- ALL INEOR ATION CONTAINED.
HEREIN IS UNCLASSIFIEDDATE 07-08-2009 BY UC 60322 LP/STP/SZ

UNCLASSIFIEDFOR OFFICIAL USE ONLY

Domestic Investigations and Operations Guide

Federal Bureau of Investigation (FBI)
December 16, 2008

This.is a privileged document that cannot be released in whole or in part to persons or agencies outside the Federal
Bureau of Investigation, nor can it be republished in whole or in part in any written form not containing thisstatement, including generaluse pamphlets, without the approval of the Director of the Federal Bureau of
Investigation.

UNCLASSIFIEDFOR OFFICIAL USE ONLYUNCLASSIFIED - FOR OFFICIAL USE ONLY
Domestic Investigations and Operations Guide
GENERAL INFORMATION: Questions or comments pertaining to the DIOG can bedirected to:
The Deputy Director's Officeor
FBIHQ, Director's Office, Resource Planning Office (RPO), Division [00]Corporate Policy Office (CPO)

Division Point of Contact:

b6

b7c

(NOTE: Document is a new publication; no previous DIOG versions are available)

PRIVILEGED INFORMATION:
Any use of this document, including direct quotes oi identifiable paraphrasing,
will bemarked with the following statement:This is a privileged document that cannot be released in whole or in part to persons
or agencies
outside the Federal Bureau of Investigation, nor can it be republished in whole or in partin anywritten form not containing this statement, including general use pamphlets,
without the approvalof the Director of the Federal Bureau of Investigation.
FOR OFFICIAL FBI INTERNAL USE ONLY-DO NOT DISSEMINATEFOR OFFICIAL USE ONLYUNCLSSIFIED-OR OFFICIALUNCLASSIFIED-FOR
OFFICIAL USE
USE ONLYONLYUNCLASSIFIED - FOR OFFICIAL USE ONLY
Domestic Investigations and Operations Guide

Table of Contents(U) Preamble....................................................

...
..........................
xi
1. (U) Scope andPurpose.....................................................................
......................
1.1.
(U) Scope ............................................... :.........................................................................
1:2.
(U) Purpose...................................................................................................................... I
2. (U) General Authorities and Principles ......................................................
2
2.1.
(U) Scope of the Attorney General's Guidelines for Domestic FBI Operations .............
2
2.2.
(U) General FBI Authorities under AGG-Dom.......................
.....................
2.3.
(U) FBI as an Intelligence Agency .........................
........
3...................
2.4. (U) FBI Lead Investigative Authorities ............... .........................
4
2.5.
(U) Status as Internal Guidance .......................................
..................................... 10
2.6. (U) Departures from the AGG-Dom ..........................--....................
10
2.7. (U) Departures from the DIOG...........................................................
2.8.
(U) Other FBI Activities Not Limited by AGG-Dom .............................
.
2.9. (U) Use of Classified Investigative Technologies .........
.................
12
2.10. (U) Application of AGG-Dom and DIOG...........................
............... 12
3. (U) Core Values, Roles, and Responsibilities................................
............... 13
3.1.
(U) The FBI's Core V alues ...........................................
. ..............................
13
3.2. (U) Deputy Director Roles and Responsibilities .........................................
3.3. (U) Special Agent/fritelligence Analyst/Task Force Officer/FBI
Contractor/Others
Roles and Responsibilities.............................
..............................
................ 14
3.4.
(U) Supervisor Roles and Responsibilities ....................................
15
3.5.
(U) Chief Division Counsel Roles and Responsibilities................. ... 18
3.6. (U) Office of the General Counsel Roles and Responsibilities .............
........
18
3.7. (U) Corporate Policy Office Roles and Responsibilities .................
...................
19
3.8. (U) Office of Integrity and Compliance Roles and Responsibilities ............
... 19
3.9.
(U) Operational Program Manager Roles and Responsibilities.............................19
3.10. (U) Division Compliance Officer Roles and Responsibilities........................
.20
3.11. (U) FBI Headquarters Approval Levels............................................... . .. . ...... 20
4. (U) Privacy and Civil Liberties, and Least Intrusive Methods.................
...............2i
4.1.
(U) Civil Liberties and Privacy................ .
...................
21
4.2. (U) Protection of First Amendment Rights.................
.
..................... 24
4.3.
(U) Equal Protection under the Law...... ........... ..........................
30
34...............................................................
4.4. .(U) Least Intrusive M ethod .....
5.

(U) Assessm ents .......................... ...................
...............................
39
5.1.
(U) Overview ............................
39
5.2. (U) Purpose and Scope......
..........
40
43*- --- ..........
5.3.
(U) Civil Liberties and Privacy ....................................
5.4.
(U) Authorized Purposes (AGG-Dom, Part II.A.2.Authorized Activities)......44
5.5. (U//FOUO) Standards for Initiating-or Approving an Assessment.....................
45
5.6. (U).Duration, Approval, Notice, Documentation, File Review
and Responsible Entity45
iii

UNCLASSIFIED-FOR OFFICIAL USE ONLYUNCLASSIFIED - FOR OFFICIAL USE ONLY
Domestic Investigations and Operations Guide
5.7.
5.8.

(U) Sensitive Investigative Matter / Academic Nexus / Buckley Amendment .............57(U//FOUO) Standards for Initiating or Approving the Use of an Authorized
Investigative M ethod ..................................................
.......................
58
5.9.
(U) Authorized.Investigative Methods.in Assessments and Predicated Investigations.58
5.10. (U) Investigative Methods Not Authorized During Assessments ............
.............. 71
5.11. (U//FOUO) FBI National Collection Requirements ................
...................... 72
5.12. (U//FOUO) FBI Field Office Collection Requirements ................................ 73
5.13. (U) Retention and.Disseminationof Privacy Act Records .....................
......... 73
5.14. (U) Assessment File Records.Management and Retention...............................74
6. (U) Preliminary Investigations.......................................................
.
........
. .................... 76
6.1.. (U) Overview ....................................... .........
............ . .
........................ 76
6.2.
(U) Purpose and Scope..................... .-.................
.
76
6.3.
(U) Civil Liberties and Privacy..
.................
..................... 76
6.4.
(U) Legal Authority..........................
.............................. 77
6.5. (U ) Predication.........................................
.............................................. 78
6.6. (U//FOUO) Standards for Initiating or Approving a Preliminary Investigation .......... 78
6.7.
(U) Duration, Approval, Notice, Documentation and File Review .........................
78
6.8.
(U//EOUO) Standards for Initiating or Approving the Use of an Authorized
Investigative Method................ ....................................
. 80
6.9. (U) Authorized Investigative Methods in Preliminary Investigations........... 81.10. (U) Sensitive Investigative Matter / Academic Nexus / Buckley Amendment ............ 83
6.11. (U) Program Specific Investigative Requirements.........................
....................84
7. (U) Full Investigations .. ......... .............
..................................................... 85
7.1.
(U) Overview .........................
.......
.85................

.................

......

............................. 85

...

7.2.

(U) Purpose and Scope.

7.3.
7.4.

(U) CiVil Liberties and Privacy ........
(U) Legal Authority .................

7.5..

(U) Predication..........................

7.6.
7.7.
7.8.

(U//FOUO) Standards for Initiating or Approving a
1Fuli
Investigation .................
(U) Duration, Approval, Notice, Documentation and File Review ...................
(U//FOUO) Standards for Initiating or Approving the Use of an Authorized

88
88

Investigative Method...............

90******...........-...........................85....- **--***......... ............................ 86...

87.................................

............

.

.

.

7.9.
(U) Authorized Investigative Methods in Full Investigations .... ...
...........
.90*7.10. (U) Sensitive !nvestigative Matter/Academic Nexus /Buckley Amendment ............. 92
7.11. (U) Program Specific Investigative Requirements .........................................
93
8. (U) Enterprise Investigations....................................................
..................... ... 94
8.1.
(U) Overview ...............................................
94.94.............
..
.
......
(U) Purpose, Scope and Definitions....................
8.2.
8.3.
(U) Civil Liberties and Privacy..............
...
...................
94
8.4.
(U) Legal Authority..........................
...
95
8.5. (U) Predication ................................................................. 95
8.6. (U) Duration, Approval, Notice, Documentation and File eview............................
9. (U) Foreign Intelligence..................................................98
9.1.
(U) Overview...................... ..............................
".
...................... 98
UNCLASSIFIED-FOR iv
OFFICIAL USE ONLYUNCLASSIFIED - FOR OFFICIAL USE ONLY
Domestic Investigations and Operations Guide
9.2.
9.3.
S9.4.
9.5.

(U) Purpose and Scope...........................................
................................99(U) Civil Liberties and Privacy......
............. ............
.
.................99(U) Legal Authority ............................................
-....
.
.
....
100
(U//FOUO) Duration, Approval, Notice, Documentation, File Review and FBIHQ
Standards for Approving the Initiation of Positive Foreign Intelligence Investigations
101
9.6. (U//FOUO).Standards for Initiating or Approving the Use of an Authorized
Investigative M ethod..................... ......................... ........................................
102
9.7. (U) Authorized Investigative Methods in Foreign Intelligence Assessments:andPredicated Investigations............................................. 102
9.8.
(U//FOUO) Investigative Methods Not Authorized During Foreign Intelligence
Investigations.......................................
................ ............................ ........... 04
9.9. (U) Sensitive Investigative Matter............................................................
........... 104
9.10. (U) Approval and Notification.................................
...................... 105
9.11. (U) Retention of Information......................................
............
........................ 107
10. (U) Sensitive Investigative Matter / Academic Nexus.........................
........
108
10.1. (U ) O verview .................................................
.....................................
.............108
10.2. (U) Purpose, Scope and Definitions.....................
..................................
8
10.3. (U//FOUO) Factorsto Consider When Initiating or Approving an Investigative
Activity Involving-a Sensitive Investigative Matter...............................
........ 09
10.4. (U) Duration, Approval, Notice and Documentation..........................
........... 110
10.5. (U//FOUO) Distinction Between Sensitive Investigative Matter and Sensitive
Circum stance....................................................................
.................................. 1111.

(U) Investigative Methods ..................................................................................

112

11.1. (U) Overview ...........................................
.-.....................
...... .........................
11.1.1.. (U) Least Intrusive M ethod................ .................................................... 112
112
11.2. (U) Authorized Investigative Methods in Assessments and PredicatedIfivestigationsI 13
11.2.1. (U) Authorized Investigative Methods in Assessments......................................
113
11.2.2. (U) Authorized Investigative Methods in Preliminary Investigations.................
113
11.2.3. (U) Authorized Investigative Methods in Full Investigations ..............
11.2.4. (U) Particular Investigative Methods.................................................................. 114
15
11.3. (U) Investigative Method: Mail Covers.........
.............................. 116
11.3.1. (U) Summary ........................................................... .... 116
11.3.2. (U) Legal Authority ....................................................... 116
11.3.3. (U) Definition of Investigative Method................... ....
.
.......
11.3.4. (U) Standard for Use and Approval Requirements for Investigative Method..... 116
117
11.3.5. (U) Duration of Approval ..................................................
. .....
11.3.6. (U) Specific Procedures ................... . ..................... .......... ................. 119
119
11.3.7. (U) Compliance and Monitoring.............
.................................... 119
11.4. (U) Investigative Method: Physical searches of personal or teal property
where awarrant or court order is not legally required because there is no reasonable
expectation of privacy (e.g., trash covers)..... .............

11.4.1.
.11.4.2.
11.4.3.

...............

. 120(U) Sum m ary ........................ . ..........................
...................... 20(U). Legal Authority ....... .......
. ........
.........................................................120(U) Definition of Investigative Method..................
...
...... 120

UNCLASSIFIED-FOR OFFICIAL USE ONLYUNCLASSIFIED - FOR OFFICIAL USE ONLY
Domestic Investigations and Operations Guide
11.4.4.

(U//FOUO) Standards for Use and Approval Requirements for Investigative
Method .............................
................ 1 121
11.5. (U) Investigative Method; Consensual Monitoring of Communications, including
consensual computer monitoring....................................................
.... .122
11.5.1. (U) Summary ..................................
...... ............................... 122
11.5.2. (U) Legal Authority ............................
.......................................122
11.5.3. (U) Definition of Investigative M ethod ............. ..............
............................ 122
11.5.4. (U) Standards for Use and Approval Requirements for Investigative Method...12311.5.5. (U) Duration of Approval ................ .......
................................... 127
11.5.6. (U//FOUO) Specific Procedures.... ..... ............
............
................... 128
11.5.7. (U//FOUO) Compliance and Monitoring....................................................
129
11.6. (U) Investigative Method: Use of closed-circuit television, direction finders, and othermonitoring devices (Not needing a Court Order).....................................................
130
11.6.1. (U) Sum m ary ............... ..............................
.................................... ... 130
11.6.2. (U) Legal Authority .....................................
......... ....................... 130
11.6.3. (U//FOUO) Definition of Investigative Method .............
......................... 130
11.6.4. (U//FOUO) Standards for Use and Approval Requirements for Investigative
Method .................................................
131
S1.6.5. (U)Duration of Approval .................................-............
...
.. 132
11.6.6. (U//FOUO) Specific Procedures........................... ...................
............. 132
11.6.7. (U//FOUO) Compliance and Monitoring.........................
........................... 133
11.7. (U) Investigative Method: Polygraph ...............
.................................... 134
11.7.1. .(U)Summary .......................... ....-...............
134
11.7.2. (U) Legal Authority .......................... .........
. .. ..............
.......
....
134
11.7.3. (U//FOUO) Definition of Investigative Method......................
.......
134
11.7.4. (U//FOUO) Standards for Use and Approval Requirements for Investigative
Method .................................................................................................................
134
11.7.5. (U) Duration of Approval ..................
.....
1........................
134
11.7.6. (U//FOUO) Specific Procedures..... ................
......................
135
11.7.7. (U//FOUO) Compliance and Monitoring.........................
............
135
11.8. (U), Investigative Method: Undercover Operations .............
............................... 136
118.1. (U) Sum m ary ...............................................................
............................. 13 6
11.8.2. (U) Legal Authority............................
. ..................................... 136
11.8.3.

(U//FOUO) Definition of Investigative Method ................

......................... 136(U//FOUO) Distinction Between Sensitive Circumstance and Sensitive Ihvestigative
Matter:137
11.8.4. (U//FOUO) Standards for Use and Approval Requirements for Investigative
Method ........................................................... .................
37
11.8.5. (U) Duration of Approval ............................................ 139
1.1.8.6. (U) Additional Guidance..............................................
.......
139
11.8.7. (U//FOUO) Compliance and Monitoring, and Reporting Requirements...........
139
11.9. (U) Investigative Method: Compulsory process as authorized
by law, including grandjury subpoenas and other subpoenas, National Security Letters ................
11.9.1. (U) Federal Grand Jury Subpoena........................................... .140
140
11.9.2. (U) Administrative Subpoena.. .....
....
........................ 152
11.9.3. (U) National Security Letter ...........
............................
158
11.9.4. (U) Business Record Under FISA.................
:....
........... 165
vi

UNCLASSIFIED-FOR OFFICIAL USE ONLYUNCLASSIFIED - FOR OFFICIAL USE ONLY
Domestic Investigations and Operations Guide
11.10. (U) Investigative Method: Accessing stored wire and electronic communications
andtransactional records in conformity with chapter 121 of title 18, UnitedStates Codel67
11.10.1. (U) Sumniary ...................................
...... ........................... 167
11.10.2. (U) Legal Authority ........................................
68................... 168....
11.10.3. (U) Definition of Investigative Method ......................
11.10.4. (U) Approval Requirements for Investigative Method ............... ...................179
11.10.5. (U) Duration of Approval................... ..................
179
179.. ..............
"
11.10.6. (U//FOUO) Specific Procedures .......................
11.10.7. (U) Notice and Reporting Requirements ............................
......
11.10.8. (U) Other Applicable Policies................................................... 80(U) Stored Communications Quick Reference Guide 5/1/2008 ............
................... 180
11.11. (U) Investigative Method: Pen Registers and Trap and Trace devices in conformity
with chapter 206 of Title 18, United States Code, and the Foreign Intelligence
Surveillance Act...........................................................
11.11.1. (U) Summary ........ ... .................
............ . . . . ......
181
11.11.2. (U)Legal Authority ................................................ ..... 181... ......... ............. 181
11.1.3. (U) Definition of Ivestigative Method.................
11.1.. (U) Standards for Use and Approval Requirements for Investigative Method ...181
1.11.5. (U)Duratio ofAppoval..................................
84
11.11.6. (U//FOUO) Specific Procedures..........
.....................
184
11.117. (U) Use and Dissemination of Information Derived from Pen Register/Trap andTrace Authorized Pursuant to FISA......................................... 185
11.11.8. (U) Notice and Reporting Requirements ..................... .....
..
.........
.
186
11.11.9. (U) Special Circumstances..............
..................... ...
.... 86
11.12. (U) Investigative Method:Electronic Surveillance under Title III and under FISA..
193
11.12.1. (U) Summary :.............................
93
11.12.2. (U) Legal Authority .........................
.........
.............. 193......... 193"...........
............
11.12.3. (U) Definition of Investigative Method ............
11.12.4. (U) Standards for Use and ApprovalRequirements for Investigative
Method ...193
11.12.5. (U) Duration of Approval...............................
196
11.12.6. (U) Specific Procedures..................................
...................
11.12.7. (U) Notice and Reporting Requirements ...
...........
...............
199
11.12.8. (U) Compliance and Monitoring... .........................
200* .................................. 200
11.12.9. (U) Special Circumstances..............
............
200
11.12.10. (U) Other Applicable Policies....
....................
11.13. (U) Investigative Method: Physical searches, including mail openings, requiring
judicial order or warrant...................................................201
11.13.1. (U) Summary .....................................
*--201
11.13.2. (U) Legal Authority...................
.............
201.......
201......
11.13.3. (U) Definition of Investigative Method ..................
11.13.4. (U) Approval Requirements for Investigative Method ............................ 04
11i.13.5. (U) Duration of Approval ........
.. .......................... 204.
..................................... 204
11.13.6. (U) Specific Procedures .........
11.14. (U) Investigative Method: Acquisition of foreign intelligence information in
conformity with Title VII of the Foreign Intelligence Surveillance
Act................ 213
11.14.1. (U)Summary....... ...................
................
..................
213

UNCLASSIFIED-FOR viiOFFICIAL USE ONLYUNCLASSIFIED - FOR OFFICIAL USE ONLY
Domestic Investigations and Operations Guide
11.14.2. (U) Legal Authority ...............................
............
213
11.14.3. (U) Definition of Investigative Method................................
.213
11.14.4. (U//FOUO) Standards for Use and Approval Requirements for Investigative
Method............................................
.213
11.14.5. (U) Duration of Approval ...................
....
.
.....
213
11.14.6. (U//FOUO) Specific Collection Procedures for Title VII ............................
213
12. (U) Assistance to Other Agencies...........................
..........
........ 216
12.1. (U) Overview.............**.................................216.
... •""°"".""°"**.,,*-*.. ,..
..
..
216...
12.2. (U) Purpose and Scope......................................
.
216
12.3. (U//FOUO) Standards for Providing and Approving Investigative Assistanceto Other
Agencies ...........................................................
....................................... 2 17............. 217
12.4. (U) Documentation andRecord Retention ............ .........
12.5. (U) Duration, Approvaland Notice for Investigative Assistance to Other Agencies..217
12.6. (U//FOUO) Standards for Providing and Approving Technical Assistanceto Foreign,State, Local and Tribal Agencies ....................................
................. ...........225
13. (U) Extraterritorial Provisions............................
..... ....
....... ..................... 227
13.1. (U) Overview ..................................................
227
13.2. (U) Purpose and Scope...........................
""....."..""""227
13.3. (U) Legal Attache Program................................ .............
... ........... .228
14. (U) Retention and Sharing of Information.............
.............................................
229
14.1. (U) Purpose and Scope ...................................................................... 229
14.2. (U) The FBI's Records Retention Plan, and Documentation ................................ 229
30...........
14.3. (U) Information Sharing .....................................
.................... 231
14.4. (U) Information Related to Ciiminal Matters ..............
............. 231
A. (U) Coordinating with Prosecutors ....................................
............ 231
B. (U) Criminal Matters Outside FBI Jurisdiction ................
...232.................
****................
C. (U) Reporting of Criminal Activity ...
14.5. (U) Information Related to National Security and Foreign Intelligence Matters....... 232(U) Department of Justice..........................................232233..............
(U) White House ......................................
14.6. (U) Special Statutory Requirements......................
235
15. (U) Intelligence Analysis and Planning...............
........
........................... 236
15.1: (U) Overview .................. .................................
236
15.2. (U) Purpose and Scope............................."""""""""..................236.......................
237
15.3. (U) Civil Liberties and Privacy""""""""".....
***-------...............................
237
15.4. (U) Legal Authority .......................
15.5. (U//FOUO) Standards for Initiating or Approving Intelligence Analysis
and Planning238
15.6. (U//FOUO) Standards for Initiating or Approving
the Use of an Authorized
Investigative Method in IntelligenceAnalysis and Planning .......
............
.238
15.7. (U) Authorized Activities in Intelligence Analysis
and Planning ..
........................ 238
16. (U) Undisclosed Participation (UDP)...................................
.................... 242
16.1. (U) O verview ...............................................................
16.2. (U) Purpose, Scope, and Definitions ......
..................
.................. 243
viii
UNCLASSIFIED-FOR OFFICIAL USE ONLYUNCLASSIFIED - FOR OFFICIAL USE ONLY
Domestic Investigations and Operations Guide
16.3. .(U) Requirements for Approval..................-................... .....
... ...........
45
16.4. (U) Supervisory Approval Not Required......................................
.248
16.5. (U//FOUO) Standards for Review and Approval ..................................
.......... 249
16.6. (U) Requests for Approval of Undisclosed Participation ...............................
250
16.7. (U ) D uration..........................................................
...... ......................................... 25
16.8. (U//FOUO) Sensitive Oversight Review Committee ....................
251
17. (U) Otherwise Illegal Activity. .......................
******................
256
17.1.. (U) Overview .....................
....................
........................... 256256....................
............. ................
17.2. (U) Purpose and Scope ..... ...............
256.......................
17.3. (U//FOUO) OIA in Undercover Activity...................
257.... ...
17.4. (U//FOUO).OIA fora Confidential Human Source .....-.............--* .
17.5. (U//FOUO) Approval of OIA by a Special Agent in Charge.... ....... ..
... 257
17.6. (U//FOUO) Standards for Review and Approval of OIA ............................
258
17.7. (U//FOUO) OIA not authorized...........................................258
17.8. (U//FOUO) Emergency Situations .......
..................................
258

ix
UNCLASSIFIED-FOR OFFICIAL USE ONLYUNCLASSIFIED - FOR OFFICIAL USE ONLY
Domestic Investigations and Operations Guide

List of Appendices
Appendix A: The Attorney General's Guidelines for Domestic
FBI Operations............... A-1
Appendix B: Executive Order 12333...........
............................................................
BAppendix C: Sensitive Operations Review Committee.........................
.................... C-1
Appendix D: Superceded Documerits and NFIP, MIOG, and MAOP
Sections................ D-1
Appendix E: Key Words, Definitions, and Links .................................
................. E-1
Appendix F: Acronyms..................
........................................................
FAppendix G: Investigations Manual - Classified Provisions.........................................

x
UNCLASSIFIED-FOR OFFICIAL USE ONLY

G-1

UNCLASSIFIED - FOR OFFICIAL USE ONLY
Domestic Investigations and Operations Guide(U) Preamble
December 1,2008(U) As the primary investigative agency of the federal government,
the FBI has the authority andresponsibility to investigate all violations of federal law that are
not exclusively assigned toanother federal agency. The FBI is'further vested by law and by Presidential
directives with theprimary role in carrying out criminal investigations and investigationsof threats to the natiohal
security of the United States. This includes the lead domestic role in investigatinginternational
terrorist threats to the United States, and in conducting counterintelligence
activities to counter
foreign entities' espionage and intelligence efforts directed against theUnited States. The FBI is
also vested with important functions in collecting
foreign intelligence as a member agency of theUnited States Intelligence Community (USIC). (AGG-Dom,
Introduction)(U) While investigating crime, terrorism, and threats to the national
foreign intelligence, the FBI must fully comply with all laws and security, and collecting
regulations, including those
designed to protect civil liberties and privacy. Through compliance,
the FBI will continue to earn
the support, confidence and respect of the people of theUnited States.
(U)To assist the FBI-inits.mission, theAttorney General signed The Attorney
General '.
Guidelines-br
Domestic FBI Operations (AGG-Dom) on September

29, 2008. The primary
purpose of the AGG-Dom and the Domestic Investigations and Operations
Guide (DIOG) is.to
standardize policy so that criminal, national security, and foreign
intelligence
investigative
activities are accomplished in a consistent manner, wheneverpossible (e.g., same approval,
notification, and reporting requirements). In addition tothe DIOG,
each FBIHQ substantive
Division has a policy implementation guide (PG) that supplements
this document. Numerous
FBI manuals, electronic communications, letterhead memoranda, andother policy documents areincorporated-into the DIOG and the substantive Division
policy implementation guides, thus,
consolidating the FBI's policy guidance. The FBIHQ Corporate
Policy Office (CPO) plays
instrumental role in this endeavor. Specifically, the CPO
maintains the most current versionanof
the DIOG on its website. As federal statutes, executive orders, Attorney
General guidelines, FBI
policies, or other relevant authorities change, CPO will electronically update
the DIOG after
appropriate coordination and required approvals.
(U) The changes implemented by the DIOG should better equip
you protect the people of theUnited States against crime and threats to the national security and totocollectforeign intelligence.
This is your document, and it requires your input
so that we can provide the best se~vice to ournation. If you discover a need for change, please.forward
your suggestion to FBIHQ CPO.
(U) Thank you for your outstanding service!
Robert S Mueller, III
Director

xi

UNCLASSIFIED-FOR OFFICIAL USE ONLYUNCLASSIFIED - FOR OFFICIAL USE ONLY
Domestic Investigations and Operations Guide

1. (U) Scope and Purpose
1.1.

(U) Scope(U) The DIOG applies to all investigative activities and intelligence collection activities
conducted by the FBI within the United States or outside the territories of all countries. This
policy document does not apply to investigative and intelligence collection activities of the.FBI
in foreign countries; those are governed by The Attorney General's Guidelinesfor
ExtraterritorialFBI Operations.
1.2.

(U) Purpose(U) The purpose of the DIOG is to standardize policy so that criminal, national security, andforeign intelligence investigative activities are consistently and uniformly accomplishedwhenever possible (e.g., same approval, notification, and reporting requirements).
(U) This policy document also stresses the importance of oversight and self-regulation to ensurethat all investigative and intelligence collection activities are conducted within Constitutionaland statutory parameters and that civil liberties and privacy are protected.
(U) In addition to this policy documeiit, each FBIHQ substantive Division-has a-PG that
supplements the DIOG. As a result, numerous FBI manuals, electronic communications,
letterhead memoranda, and other policy documents are incorporated into the DIOG and Division
PGs, thus, consolidating FBI policy guidance.

UNLASSIFED-FOR OFFCAL USE ONLYUNCLASSIFIED-FOR OFFICIAL USE ONLYUNCLASSIFIED - FOR OFFICIAL USE ONLY
Domestic Investigations and Operations Guide

2. (U) General Authorities and Principles
2.1.

(U) Scope of the Attorney General's Guidelines for Domestic FBI Operations(U) The Attorney General'sGuidelines for Domestic FBI Operations(AGG-Dom) apply toinvestigative and intelligence collection activities conducted by the FBI within the United States,in the United States territories, or outside the territories.of all countries. They do not apply toinvestigative and intelligence collection-activities of the FBI in foreign countries, which will begoverned by the Attorney General'sGuidelinesforExtraterritorialFBI Operations,whenpublished. (Reference: AGG-Dom, Part I.A.)(U) The AGG-Dom replaces the following six guidelines:*(U) The Attorney General'sGuidelines on General Crimes, Racketeering Enterprise andTerrorismEnterprise Investigations(May 30, 2002)*(U) The Attorney General'sGuidelinesfor FBINationalSecurity Investigationsand
ForeignIntelligence Collection(October 31, 2003)*(U) The Attorney General'sSupplemental Guidelinesfor Collection, Retention, andDissemiiationof ForeignIitelligence (November 29, 2006)*(U) The Attorney GeneralProcedureforReportingand Use of Information Concerning
Violations of Law andAuthorizationfor Participationin Otherwise Illegal Activity in FBI
ForeignIntelligence, Counterintelligenceor InteinationalTerrorismIntelligence
Investigations (August 8, 1988).

*(U) The Attorney General.'s Guidelinesfor Reportingon Civil Disordersand
DemonstrationsInvolving a FederalInterest (April 5, 1976)*(U) The Attorney General'sProceduresforLawful, WarrantlessMonitoring of Verbal
Communications (May 30, 2002) [only portion applicable to FBI repealed](U) The Attorney General will be issuing a separate set of new guidelines for extraterritorial
operations, the Attorney General'sGuidelinesfor ExtraterritorialFBI Operations.However,certain of the existing guidelines that are repealed by the AGG-Dom currently apply in part to
extraterritorial operations, including the Attorney General'sGuidelinesfor FBI National Security
Investigationsand ForeignIntelligence Collection, and the Attorney General Procedurefor
Reportingand Use of Information Concerning Violations ofLaw aid Authorizationfor
Participationin Otherwise Illegal Activity in FBI ForeignIntelligence, Counterintelligenceor
InternationalTerrorismIntelligence Investigations.To Insure that there is no gap in theexistence of guidelines for extraterritorial operations, these existing guidelines will remain in
effect in their application to extraterritorial operations until the Attorney General's Guidelines
for ExtraterritorialFBI Operationsare issued and take effect, notwithstanding the general repealof these existing.guidelines by the AGG-Dom.
(U) Also, the classified Attorney GeneralGuidelinesfor ExtraterritorialFBI Operation andCriminalInvestigations (1993) will continue to apply to FBI criminal investigations, pending theexecution of the new guidelines for extraterritorial operations, as discussed above. Finally, fornational security and foreign.intelligence investigations, FBI investigative activities will continue
to be processed as set forth in the classified'Memorandumof UnderstandingConcerning
2
UNCLASSIFIED-FOR OFFICIAL USE ONLYUNCLASSIFIED - FOR OFFICIAL USE ONLY
Domestic Investigations and Operations Guide
Overseas and Domestic Activities of the CentralIntelligence Agency and the FederalBureau of
Investigation (2005).
2.2. . (U) General FBI Authorities under AGG-Dom(U) The AGG-Dom recognizes four broad, general FBI authorities. (AGG-Dom, Part I.B.)
A. (U) Conduct Investigations and Collect Intelligence and Evidence(U) The FBI is authorized to collect intelligence and to conduct investigations to detect,obtain information about, and prevent and protect against federal crimes and threats to thenational security and to collect foreign intelligence, as provided in the DIOG (AGG-Dom,
Part II).
(U) By regulation, the Attorney General has directed the FBI to:investigate violations of thelaws of the United States and collect evidence in cases in which the United States is or may
be a party in interest, except in cases in which such responsibility is by statute or otherwise
specifically assigned to another investigative agency. The FBI's authority to investigate andcollect evidence involving criminal drug laws of the United States is concurrent with such
authority of the Drug Enforcement.Administration (28 C.F.R. § 0.85[a]).
B. (U) Provide Investigative Assistance(U) The FBI is authorized to provide investigative assistance to other federal, state, local, or
tribal agencies, and foreign agencies as provided in Section 12 of the DIOG (AGG-Dom, PartIII).
C. (U) Conduct Strategic Analysis and Planning(U) The FBI is authorized to conduct intelligence analysis and planning as provided in
Section 15 of the DIOG (AGG-Dom, Part IV).
D. (U) Retain and Share Information(U) The FBI is authorized to retain and share information obtained pursuant to the AGGDom, as provided in Section 14 of the DIOG (AGG-Dom, Part VI).
2.3:

(U) FBI as an Intelligence Agency(U) The FBI is an intelligence agency as well as a law enforcement agency. Its basic functions
accordingly extend beyond limited investigations of discrete matters, and include broader
analytic and planning functions. The FBI's responsibilities in this area derive from various
administrative and-statutory sources. See Executive Order 1,2333; 28 U.S.C. § 532 note
(incorporating P.L. 108-458 §§ 2001-2003) and 534 note (incorporating P.L. 109-162 § 1107).
(U) Part IV of the AGG-Dom authorizes the FBI to engage in intelligence analysis and planning,drawing on all lawful sources of information. The functions authorized under'that Part includes:(i) development of overviews and analyses concerning threats to and vulnerabilities of the UnitedStates and its interests; (ii) research and analysis to produce reports and assessments (see note
below) concerning matters relevant to investigative activities or other authorized FBI activities;and (iii) the operation of intelligence systems that facilitate and support investigations throughthe compilation and analysis of data and information on an ongoing'basis.
(U) Note: In the DIOG, the word "assessment" has two distinct meanings. The AGG-Dom
authorizes as an investigative activity an "assessment" which requires an authorized purpose as
3
UNCLASSIFIED-FOR OFFICIAL USE ONLYUNCLASSIFIED - FOR OFFICIAL USE ONLY
Domestic Investigations and Operations Guide
discussed in the DIOG Section 5. The United States Intelligence Community (USIC), however,also uses the word "assessment" to describe written intelligence products as discussed in the
DIOG Section 15.7.B.
2.4.

(U) FBI Lead Investigative Authorities

A. (U) Introduction(U//FOUO) The FBI's primary investigative authority is derived from the authority of the
Attorney General as provided in 28 U.S.C. §§ 509, 510, 533 and 534. Within this authority,
the Attorney General may appoint officials to.detect crimes against the United States and to
conduct such other investigations regarding official matters under the control of the
Department of Justice (DOJ) and the Department of State (DOS) as may be directed by the
Attorney General (28 U.S.C. § 533). The Attorney General has delegated a number of his
statutory authorities and granted other authorities to the Director of the FBI (28 C.F.R.
§ 0.85[a]). Some of these authorities apply both inside and outside the United States.
B. (U) Terrorism and Counterterrorism Investigations(U) The Attorney General has directed the FBI to exercise Lead Agency responsibility ininvestigating all crimes for which DOJ has primary or concurrent jurisdiction and which
involve terrorist activities or acts in preparation of terrorist activities within the statutory
jurisdiction of the United States. Within the United States, this includes the collection,
coordination, analysis, managemeht and dissemination of intelligence and criminal
information, as appropriate. If another federal agency identifies an individual who is engaged
in terrorist activities or in acts in preparation of terrorist activities, the other agency isrequired to promptly notify the FBI. Terrorism, in this context, includes the unlawful use offorce and violence against persons or property to intimidate or coerce a government, thecivilian population, or any segment thereof, to further political or social objectives (28 C.F.R.
§ 0.85[a]).
C. (U) "Federal Crimes of Terrorism"(U) Pursuant to the delegation in 28 C.F.R. § 0.85(a), the FBI exercises the Attorney
General's lead investigative responsibility under 18 U.S:C. § 2332b(f) for all "federal crimesof terrorism" as identified in that statute. Many of these statutes grant the FBI extraterritorial*investigative responsibility. Check the cited statute for the full particulars concerning
elements of the offense, jurisdiction, etc. Under 18 U.S.C-.§ 2332b(g)(5), the term "federal
crime of terrorism" means an offense that is: (i) calculated to influence or affect the conductof government by intimidation or coercion or to retaliate against government conduct; and (ii)
is a violation of federal statute relating to:
1. (U) Destruction of aircraft or aircraft facilities (18 U.S.C. § 32);
2. (U) Violence at international airports-(applies to offenses occuriing outside the UnitedStates ii certain situations) (18 U.S.C. § 37);
3. (U) Arson within "special maritime and territorial jurisdiction of the United States"(SMTJ is defined in 18 U.S.C. § 7) (18 U.S.C. § 81);
4. (U) Prohibitions with respect to biological weapons (extraterritorial federal jurisdiction if
offense committed by or against a United States national) (18 U.S.C. § 175);

4
UNCLASSIFIED-FOR OFFICIAL USE ONLYUNCLASSIFIED - FOR OFFICIAL USE ONLY
Domestic Investigations and Operations Guide
5. (U) Possession of biological agents or toxins by restricted persons (18 U.S.C. § 175b);
6. (U) Variola virus (includes smallpox and other derivatives of the variola major virus)(applies to offenses occurring outside the Uhited States in certain situations) (18 U.S:C.
§ 175c);7. (U) Prohibited activities regarding chemical weapons (applies to offenses occurringoutside the United States in certain situations) (18 U.S.C. § 229) (E.O. 13128 directs any
possible violation of this statute be referred to the FBI);
8. (U) Congressional, Cabinet, and Supreme Court assassination, kidnapping and assault (18
U.S.C. § 351 [a]-[d]) (18 U.S.C. § 351 [g] directs that the FBI shall investigate violationsof this statute);
9. (U) Prohibited transactions involving nuclear materials (applies to offenses occurringoutside the United States in certain situations) (18 U.S.C. § 831);
10. (U) Participation in nuclear and weapons of mass destruction threats.to the United States(extraterritorial federal jurisdiction) (18 U.S.C. § 832);
11. (U) Importation, exportation, shipping, transport, transfer, receipt, or possession.of plastic-explosives that do-not-contain a detection.agent.(I8 U.S.C. §.842[m] and [n]);12. (U) Arson or bombing of government property risking or causing death (18 U.S.C.,§ 844[f][2] or [3]) (18 U.S.C.. § 846[a] grants FBI and the Bureau.of Alcohol, Tobacco,
Firearms, and Explosives (ATF) concurrent authority to investigate violations of thisstatute);13. (U) Arson oi bombing of property used in or affecting interstate or foreign commerce (18
U.S.C..§ 844[i]) (18 U.S.C. § 846[a] grants FBI and ATF concurrent authority toinvestigate violations of this statute);
14. (U) Killing or attempted killing during an attack on a federal facility with a dangerous
weapon (18 U.S.C. § 930[c]);15. (U) Conspiracy within United States jurisdiction to murder, kidnap, or maim persons at
any place outside the United States (18 U.S.C. § 956[a][1]);16. (U) Using a computer for unauthorized access, transmission, or retention of protected
information (18 U.S.C.,§, 1030[a][1]) (18 U.S.C: § 1030[d][2] grants the FBI "primaryauthority" to investigate Section 1030[a][1] offenses involving espionage, foreigncounterintelligence, information protected against unauthorized disclosure for reasons ofnational defense or foreign relations, or Restricted Data as defined in the Atomic Energy
Act, except for offenses affecting United'States Secret Service (USSS) duties under 18
U:S.C. § 3056[a]);17. (U) Knowingly transmitting a program, information, code, or command and thereby
intentionally causing damage, without authorization, to a protected computer (18 U.S.C.
§ 1030[a][5][A][i]);18. (U) Killing or attempted killing of officers or employees of the United States, including
any member of the uniformed services (18 U.S.C. § 1114);

5
UNCLASSIFIED-FOR OFFICIAL USE ONLYUNCLASSIFIED - FOR OFFICIAL USE ONLY
Domestic Investigations and Operations Guide
19: (U) Murder or manslaughter of foreign officials, official guests, or internationallyprotected persons (applies to offenses occurring outside the United States in certain
situations) (18 U.S:C. § 1116) (Attorney General may request military assistance in thecourse of enforcement of this section);
20. (U) Hostage taking (applies to offenses occurring outside the United States in certain
situations) (18 U.S.C. § 1203);
21. (U) Willfully injuring or committing any depredation against government property orcontracts (18 U.S.C. § 1361);
22. (U) Destruction of communication lines, stations, or systems (18 U.S.C. § 1362);
23. (U) Destruction or injury to buildings or property within special.maritime and territorial
jurisdiction of the United States (18 U.S.C. § 1363);
24. (U) Destruction of $100,000 or more of an "energy facility" property as defined in thestatute (18 U.S.C. § 1366);
25. (U) Presidential and Presidential staff assassination, kidnapping, and assault (18 U.S.C.
§ 1751[a], [b], [c], or [d]) (extraterritorial jurisdiction) (Per 18 U.S.C. §.1751[i], 1751
violations must be investigated by the EBI; FBI may request assistance from any federal[including military], state, or local agency notwithstanding any statute, rule, or regulation
to the contrary);
26. (U) Terrorist attacks and other violence against railroad carriers and against masstransportation.systems on land, onwater, or through the air (includes a school bus,
charter, or sightseeing transportation; or any means of transport on land, water, or
through the air) (18 U.S.C..§ 1992);
27. (U) Destruction of national defense materials, premises, or utilities(1 8 U.S.C. § 2155);
28. (U) Production of defective national defense materials, premises, or utilities (18 U.S.C.
§ 2156);29. (U) Violence against maritime navigation(18 U.S.C. § 2280);
30. (U) Violence against maritime fixed platforms (located on the continental shelf of theUnited States or located interationally in certain situations) (18 U.S.C. § 2281);
31. (U) Certain homicides and other violence against United States nationals occurringoutside of the United States (18 U.S.C. § 2332);
32. (U) Use of weapons of mass destruction (againsta national of the United States while
outside the United States; against certain persons or property within the United States; orby a national of the United States outside the United States) (18 U.S.C. § 2332a) (WMD
defined in 18 U.S.C. § 2332a[c][2]);33. (U) Acts of terrorism transcending national boundaries (includes murder, kidnapping, andother prohibited acts occurring inside and outside the United States under specified
circumstances - including that the victim is a member of a uniform service; includes
offenses committed in the United States territorial sea and airspace above and seabedbelow; includes offenses committed in special maritime and territorial jurisdiction of theUnited States as defined in 18 U.S.C. § 7) (18 U.S.C. § 2332b);
6
UNCLASSIFIED-FOR OFFICIAL USE ONLYUNCLASSIFIED - FOR OFFICIAL USE ONLY
Domestic Investigations and Operations Guide
34. (U) Bombings of places of public use, government facilities, public transportation
systems and infrastructure facilities (applies to offenses occurring inside or outside theUnited States in certain situations; does not apply to activities of armed forces during anarmed conflict) (18 U.S.C. § 2332f);
35. (U) Missile systems designed to destroy aircraft (applies to offenses occurring outside theUnited States in certain situations) (18 U.S.C. § 2332g);
36. (U) Radiological dispersal devices (applies to offenses occurring outside the UnitedStates in certain situations) (18 U.S.C. § 2332h);
37. (U) Harboring or concealing terrorists (18 U.S.C. § 2339);
38. (U) Providing material support or resources to terrorists (18 U.S.C. § 2339A);
39. (U) Providing niaterial support or resources to designated foreign terrorist organizations(extraterritorial federal jurisdiction) (18 U.S.C. § 2339B) ("The Attorney General shallconduct any investigation of a possible violation of this section, or of any license, order,or regulation issued pursuant to this section." 18 U.S.C. § 2339B[e][1]);40. (U) Prohibitions against the financing of terrorism (applies to offenses occurring outside
the United States in certain situations including on board a vessel flying the flag ofthe
United States or an aircraft registered under the laws of the United States) (18 U.S.C.
§ 2339C) (Memorandum of Agreement between the Attorney General and theSecretaryof Homeland Security, dated May 13, 2005: FBI leads all teriorist financing
investigations and operations);
41. (U) Relating to military-type training from a foreign terrorist organization (extraterritorial
jurisdiction) (18 U.S.C. § 2339D);
42. (U) Torture applies only to torture committed outside the United States in certain
situations; torture is defined in 18 U.S.C. § 2340 (18 U.S.C. §2340A);
43. (U) Prohibitions governing atomic weapons (applies to offenses occurring outside theUnited States in certain situations) (42 U.S.C. § 2122) (FBI shall investigate alleged orsuspected violations per 42 U.S.C. § 2271 [b]);44. (U) Sabotage of nuclear facilities or fuel (42 U.S.C. § 2284) (FBI shall investigate
alleged or suspected violations per 42 U.S.C. § 2271 [b]);45. (U) Aircraft piracy (applies to offenses occurring outside the United States in certain
situations) (49 U.S.C. § 46502) (FBI shall investigate per 28 U.S.C. § 538);
46..(U) Assault on a flight crew with a dangerous weapon (applies to offenses occurring in
the "special aircraft jurisdiction of the United States" as defined in 49 U.S.C. § 4650 1[2]);(second sentence of 49 U.S.C. § 46504) (FBI shall investigate per 28 U.S.C. § 538);
47. (U) Placement of an explosive or incendiary device on an aircraft (49 U.S.C.
§46505[b][3]) (FBI shall investigate per28 U.S.C. § 538);
48. (U) Endangerment of human life on aircraft by means of weapons (49 U.S.C. § 46505[c])(FBI shall investigate per 28 U.S.C. § 538);
49. (U) Application of certain criminal laws to acts on aircraft (if homicide or attempted
homicide is involved) (applies to offenses occurring in the "special aircraft jurisdiction of
7
UNCLASSIFIED-FOR OFFICIAL USE ONLYUNCLASSIFIED - FOR OFFICIAL USE ONLY
Domestic Investigations and Operations Guide
the United States" as defined in 18 U.S.C. § 46501[2]); (49 U.S.C. § 46506) (FBI shallinvestigate per 28 U.S.C.-§ 538);
50. (U) Damage or destruction of interstate gas or hazardous liquid pipeline facility (49
U.S.C. § 60123[b]); and51. (U) Section 1010A of the Controlled Substances Import and Export Act (relating to' narco-terrorism).
D. (U) Additional offenses not defined as "Federal Crimes of Terrorism"(U) Title 18 U.S.C. § 2332b(f) expressly grants the Attorney General primary investigative
authority for additional offenses not defined as "Federal Crimes of Terrorism." These
offenses are (Note: nothing in this section of the DIOG may be construed to interfere with
the USSS under 18 U.S.C. § 3056):
1. (U) Congressional, Cabinet, and Supreme Court assaults (18 U.S.C. § 351[e]) (18 U.S.C.
§ 351 [g]) directs that the FBI investigate violations of this statute);
2. (U) Using mail, telephone, telegraph, or other instrument of interstate or foreigncommerce to threaten to kill, injure, or intimidate any individual, or unlawfully todamage or destroy any building, vehicle, or other real or personalproperty by means offire or explosive (18 U.S.C. § 844[e]); (18 U.S.C. § 846[a] grants FBI and ATF'concurrent authority to investigate violations of this statute);
3. (U) Damages or destroys by means of fire or explosive any building, vehicle, or otherpersonal or real property, possessed, owned, or leased to the United States or any agency
thereof, or any institution receivirig federal financial assistance (18 U.S.C.-§ 844[f][1])'(18 U.S.C. § 846[a] grants FBI and ATF concurrent authority to investigate violations of
this statute);
4. (U) Conspiracy within United States jurisdiction to damage or destroy property in a-foreign country and belonging to a foreign country, or to any railroad, canal, bridge,
airport, airfield, or other public utility, public conveyance, or public structure, or any
religious, educational, or cultural property so situated (18 U.S.C. § 956[b]);5. (U) Destruction of $5,000 or more of an "energy facility" property as defined in 18 U.S.C.
§ 1366(c)(18 U.S.C. § 1366[b]); and6. (U) Willful trespass upon, injury to, destruction of, or interference with fortifications,harbor defenses, or defensive sea areas (18 U.S.C. § 2152).
E. (U//FOUO) NSPD-46/HSPD-15, "U.S. Policy and Strategy in the War on Terror"(U//FOUO) Annex II (Consolidation and Updating of Outdated Presidential Counterterrorism
Documents), dated January 10, 2007, to Natioinal Security Presidential Directive (NSPD)
46/Homeland Security Presidential Directive (HSPD) 15, dated March 6, 2006, establishes
FBI lead responsibilities. as well as those ofother freral antiti;;, h "w.- -b2
b7E

8
UNCLASSIFIED-FOR OFFICIAL USE ONLYUNCLASSIFIED - FOR OFFICIAL USE ONLY
Domestic Investigations and Operations Guide(U//FOUO) Areas addressed in Annex IIIbb7E

Both NSPD4/H-L- 13 and Annex 11 thereto are classified.

F. (U) Counterintelligence and Espionage Investigations(U//FOUO) A representative list of federal statutes applicable to counterintelligence andespionage investigations appears below. For additional information, refer to theCounterintelligence Program Implementation Guide and the current list of espionage andcounterintelligence authorities.
1. (U) Espionage Investigations of Persons in United States Diplomatic Missions
Abroad(U) Section 603 of the Intelligence Authorization Act of 1990 (P.L. 101-193) states that,
subject to the authority of the Attorney General, "the FBI shall supervise the conduct of
all investigations of violations of the espionage laws of the United States by persons
employed by or assigned to United States diplomatic missions abroad. All departments
and agencies shall provide appropriate assistance to the FBI in the conduct of suchinvestigations." Consult the Attorney General's extraterritorial guidelines and otherapplicable policy or agreements.
2. (U) Investigations of Unauthorized Disclosure of Classified Information to a Foreign
Power or Agent of a Foreign Power(U) The National Security Act of 1947, as amended, establishes procedures for thecoordination of counterintelligence activities (50 U.S.C. § 402a). Part of that statuterequires that, absent extraordinary circumstances as approved by the President in writing
on a case-by-case basis, the head of each executive branch department or agency mustensure that the FBI is "advised immediately of any information, regardless of its origin,which indicates that classified information is being, or may have been, disclosed in an
unauthorized manner to a foreign power or an agent of a foreign power."
G. (U) Criminal Investigations(U//FOUO) In addition to the statutes listed above and below, refer to the Criminal
Investigative Division (CID) Program Implementation Guide (PG) for additional criminal
jurisdiction information.
1. (U) Investigations of aircraft privacy and related violations(U) The FBI shall investigate any violation of 49 U.S.C. § 46314 (Entering aircraft or
airport areas in violation of security requirements) or chapter 465 (Special aircraftjurisdiction of the United States) of Title 49, United States Code. (28 U.S.C. § 538)
2. (U) Violent crimes against foreign travelers(U) The Attorney General and Director of the FBI shall assist state and local authorities
in investigating and prosecuting a felony crime of violence in violation of the law of any
State in which the victim appears.to have been selected because he or she is a traveler
from a foreign nation. (28 U.S.C. § 540A[b])9
UNCLASSIFIED-FOR OFFICIAL USE ONLYUNCLASSIFIED - FOR OFFICIAL USE ONLY
Domestic Investigations and Operations Guide
3. (U) Felonious killings of state and local law enforcement officers (28 U.S.C. § 540); and4. (U) Investigations'of serial killings (28 U.S.C. § 540B) .
H. (U) Authority of an FBI Special Agent(U) An FBI Special Agent has the authority to:
1. (U) Investigate violations of the laws, including the criminal drug laws, of the-UnitedStates (21 U.S.C. §'871; 28 U.S.C. §§ 533, 534 and 535; 28 C.F.R. § 0.85).
2. (U) Collect evidence in cases in which the United States is or may be a party in interest(28 C.F.R. § 0.85 [a]) as redelegated through exercise of the authority contained in 28
C.F.R. § 0.138 to direct personnel in the FBI.
3.

(U) Make arrests (18 U.S.C. §§ 3052 and 3062).

4. (U) Serve and exectte.arrest warrants and seize property under warrant; issue and/or
serve administrative subpoenas; serve subpoenas issued by other proper authority; andmake civil investigative demands (18 U.S.C. §§ 3052, 3107; 21 U.S.C. § 876; 15 U.S.C.
§ 1312).
5.

(U) Carry firearms (18 U.S.G. § 3052).

6. (U) Administer oaths to witnesses attending totestify or depose in the course ofinvestigations of frauds on or attempts to defraud the United States or irregularities or
misconduct of employees or agents of the United States (5 U.S.C. § 303).
7. (U) Seize property subject to seizure under the criminal and civil forfeiture laws of theUnited States (e.g., 18 U.S.C. §§ 981 and 982).
8. (U) Perform other duties imposed&by law.
2.5.

(U) Status as Internal Guidance(U) The AGG-Dom and this DIOG are set forth solely for the purpose of internal DOJ and FBI
guidance. They are not intended to, do not, and may not be relied upon to create any rights,
substantive or procedural, enforceable by law by any party in any matter, civil or criminal,nor
do they place any limitation on otherwise lawful investigative and litigative-prerogativesof the
DOJ and the FBI. (AGG-Dom, Part I.D.2.)
2.6.

(U) Departures from the AGG-Dom

A. (U//FOUO) Departure from the AGG-Dom in Advance of an Operation: A Departurefrom the AGG-Dom must be approved by the Director of the FBI, by the Deputy Directorofthe FBI, or by an Executive Assistant Director (EAD) designatedby the Director. The
Director of the FBI has designated the'EAD National Security Branch or the EAD.Criminal
Cyber Response and Services Branch to grant departures from the AGG-Dom. Notice of thedeparture must be provided to the General Counsel (GC).
B. (U//FOUO) Emergency Exception for a Departure from the AGG-Dom: If a departurefrom the AGG-Dom is necessary withoutsuch prior approval because of the immediacyorgravity of a threat to the safety of persons or property or to the national security, the Director,
the Deputy Director, or a designated EAD, and the GC must be notified by the official
granting the emergency departure as soon thereafter as practicable. The FBI must
providetimely written notice of departures from the AGG-Dom to the.DOJ Criminal Division
or
10
UNCLASSIFIED-FOR OFFICIAL USE ONLYUNCLASSIFIED - FOR OFFICIAL USE ONLY
Domestic Investigations and Operations Guide .
National Security Division (NSD), as appropriate, and the Criminal .Division or NSD must
notify the Attorney General and the Deputy Attorney General. Notwithstanding thisparagraph, all activities'in all circumstances must be carried out in a manner consistent with
the Constitution and laws of the United States. (AGG-Dom, Part I.D.3.)
C.. (U//FOUO) Records of Departures from the AGG-Dom: The Office of the GeneralCounsel (OGC) is responsible for maintaining records of all requests and appiovals or
denials of departures from the AGG-Dom.
2.7.
(U) Departures from the DIOG
A. (U//FOUO) Departure from the DIOG in Advance of an Operation: Arequest for a"departure from"'any provision of the DIOG must be submitted to the.appropriate
substantive-program Assistant Director (AD) and to the GC for approval prior to exercising adeparture from the DIOG. The AD may designate the Deputy Assistant Director (DAD), and
the GC may designate the Deputy General Counselfor the National Security Law Branch(NSLB) or the Deputy General Counsel for the Investigative Law Branch (ILB) to approvedepartures. Notwithstanding this paragraph, all activities in all circumstances must be carriedout in a manner consistent with the Constitution and laws of the United States.
B. (U//FOUO) Emergency Exception for a Departure from the DIOG: If a departure isnecessary because of the immediacy or gravity of a threat to.the safety of persons or property
or to the.national security, the approving.authority may, at:his/her.discretion, authorize an
emergency departure from the DIOG. As soon as practicable thereafter, the Special Agent in
Charge (SAC) orFBIHQ Section Chief must provide, in writing, notice to the appropriate
AD and GC describing the circumstances ard necessity for the departure. Notwithstanding
this paragraph, all activities in all circumstances must be carried out in a manner consistent
with the Constitution and laws of the United States.
C. (U//FOUO) Records of Departures from the DIOG: The OGC is responsible formaintaining records of all requests and approvals or denials of departures from the DIOG.
2.8. (U) Other FBI Activities Not Limited by AGG-Dom(U) The AGG-Dom apply to FBI investigative activities as provided herein and do not limit
other authorized activities of the FBI, such as the FBI's responsibilities to conduct backgroundchecks and inquiries concerning applicants and employees urder federal personnel security
programs (e.g., background investigations), the FBI's maintenance and operation of national
criminal records systems and preparation of national crime statistics, and the forensic assistanceand administration functions of the FBI Laboratory. (AGG-Dom, Part I.D.4.)(U)FBI employees may incidentally obtain information relating to matters outside of the FBI's
primary irvestigative responsibility. For example, information relating to violations of state orlocal law or foreign law may be incidentally obtained in the course of investigating federal
crimes or threats to the national security or in collecting foreign intelligence. The AGG-Dom
does not bar.the acquisition of such information in the course of authorized investigative
activities, the retention of such information, or.its dissemination as appropriate to the responsible
authorities in other jurisdictions. (AGG-Dom, Part II)

11
UNCLASSIFIED-FOR OFFICIAL USE ONLYUNCLASSIFIED - FOR OFFICIAL USE ONLY
Domestic Investigations and Operations Guide
2.9.

(U) Use of Classified Investigative Technologies(U) Inappropriate use of classified investigative technologies may risk the compromise of suchtechnologies. Hence, in an investigation relating to activities in violation of federal criminal law,that does not concern a threat to the national security or foreign intelligence, the use of suchtechnologies must be in conformity with the Procedures for the Use of Classified Investigative
Technologies in Criminal Cases. (AGG-Dom, Part V.B.2)
2.10.

(U) Application of AGG-Dom and DIOG

(U//FOUO) The AGG-Dom and DIOG apply to all FBI domestic investigations and operations
conducted-by "FBI employees" such as, but not limited to, applicable support personnel,
intelligence analysts, special agents, task force officers, detailees, FBI contractors, andconfidential human sources'(CHS). All of these "FBI employees" are bound by the AGG-Domand DIOG. In the DIOG, the use of "FBI employee" implies the use of all personnel descriptions,
if not otherwise prohibited by law or policy. For example, if the DIOG states the "FBIemployee" is responsible for a particular investigative activity, the supervisor has the flexibility
to assign that responsibility to any person bound by the AGG-Dom and DIOG (i.e.,. agent,intelligence analyst, task force officer), if not otherwise prohibited by law or policy.
(U//FOUO) FBIHQ Division -Policy Implementation Guides cannot be less restrictive than the
DIOG. Additionally, FBIHQ Division Policy Implementation Guides must comply with thepolicy contained in the DIOG, unless approval for deviation from the DIOG is reviewed by theGeneral Counsel and approved by.the FBI Deputy Director.

12
UNCLASSIFIED-FOR OFFICIAL USE ONLYUNCLASSIFIED - FOR OFFICIAL USE ONLY
Domestic Investigations and Operations Guide

3. (U) Core Values, Roles, and Responsibilities
3.1.

(U) The FBI's Core Values(U) The FBI's values do not exhaust the many goals we wish to achieve, but they capsulate themas well as can be.done in a few words. The FBI's core values must be fully understood, practiced,
shared, vigorously defended, and preserved. The values are:
* (U) Rigorous obedience to the Constitution of the United States* (U) Respect for the digrity of all those we protect* (U) Compassion* (U) Fairness* (U).Uncompromising personal integrity and institutional integrity* (U) Accountability by accepting responsibility for our actions and decisions and theirconsequences°(U) Leadership, by example, bothpersonal and professional(U) By observing these core values, we achieve a high level of excellence in performing theFBI's-national security and criminal investigative functions as well as the trust of the American
people. Rigorous obedierice to constitutional principles ensures that individually andinstitutionally our adherence to constitutional guarantees is more important than the.outcome ofany single interview, search for evidence, or investigation. Respect for the dignity of all reminds
us to wield law enforcement powers with restraint. Fairness and compassion.erisure that we treat
everyone with the highest regard for constitutional, civil, and human rights. Personal andinstitutional integrity reinforce each other and are owed to our Nation in exchange for the sacredtrust and great authority conferred upon us.
(U) We who enforce the law must not merely obey it. We have an obligation to set a moral
example that those whom we protect can follow. Because the-FBI's success in accomplishing its
mission is directly related to the support and cooperation of those we protect, these core values
are the fiber that holds together the vitality of our institution.
(U) Compliance(U) All FBI personnel must fully comply with all laws, rules, and regulations governing FBI
investigations, operations, programs and activities, including those set forth in the AGG-Dom.
We cannot and do not countenance disregard for the law for the sake of expediency in anything
we do.The FBI expects its personnel to ascertain the laws and regulations that govern theactivities in which they engage, to acquire sufficient knowledge of those laws, rules, and.
regulations to understand their requirements and to conform their professional and personal
conduct accordingly. Under no circumstances will expediency justify disregard for the law.
Further, the FBI requires its employees to report to proper authority any known or suspected
failures to adhere to the law, rules or regulations by themselves or others. Information forreporting such violations is available from the Office of Integrity and Compliance (OIC).

13
UNCLASSIFIED-FOR OFFICIAL USE ONLYUNCLASSIFIED - FOR OFFICIAL USE ONLY
Domestic Investigations and Operations Guide
FBI policy must be consistent with Constitutional, legal and regulatory requirements.
Additionally, the FBI must provide sufficient training to affected personnel and ensure thatappropriate oversight monitoring mechanisms are in place.
3.2.

(U) Deputy Director Roles and Responsibilities(U//FOUO) The Deputy Director is the proponent of the DIOG, and he has oversight regarding
compliance with the DIOG and subordinate implementing procedural directives and.divisional
specific policy implementation guides (PG). The Deputy Director is also responsible for thedevelopment and the delivery of necessary training and the execution of the monitoring andauditing processes. The Deputy Director works through the Corporate Policy Office (CPO) toensure that the DIOG is updated, as necessary, to comply with changes in the law, rules, or
regulations, but not later than one year from the effective date of this DIOG, and every three
years thereafter.
3.3.

(U) Special Agent/Intelligence Analyst/Task Force Officer/FBI
Contractor/Others Roles and Responsibilities(U//FOUO) Agents, analysts, task force officers (TFO), FBI contractors and others bound by the
AGG-Dom and-DIOG must:,
A. (U//FOUO) Ensure compliance with the DIOG standards for initiating, conducting, andclosing an investigative activity; collection, activity; or use of an investigative method, as
provided in the DIOG;
B. (U//FOUO) Obtain training on the DIOG standards relevant to his/her position and perform
activities consistent with those standards;
C. (U//FOUO) Ensure all investigative activity complies with the Constitution, federal law,
executive orders, Presidential Directives, AGG-Dom, other Attorney General Guidelines,
Treaties, Memoranda of Agreement/Understanding, this policy document, and any otherapplicable legal and policy requirements (if an.agent, analyst, TFO,, or other individual isunsure of the legality of any action, he/she must consult with his/her supervisor and Chief
Division Counsel [CDC] or OGC);
D.. (U//FOUO) Ensure that civil liberties and privacy are protected throughout the assessment orinvestigative process;E. (U//FOUO) Conduct no investigative activity solely on the basis of activities that areprotected by the First Amendment or solely on the basis of the race, ethnicity, national origin
or religion of the subject;
F. (U//FOUO) Comply with the law, rules, or regulations, and report any non-complianceconcern to the proper authority, as stated in the DIOG Section 3.1; andG. (U//FOUO) Identify victims who have suffered direct physical, emotional, or financial harm.
as result of the commission of federal crimes, offer the FBI's assistance to victims of thesecrimes and provide victims' contact information to the responsible FBI Victim Specialist, andkeep them updated on the status of the investigation. The FBI's responsibility for assisting
victims is continuous as long as there is an open investigation.

14
UNCLASSIFIED-FOR OFFICIAL USE ONLYUNCLASSIFIED - FOR OFFICIAL USE ONLY
Domestic Investigations and Operations Guide
3.4.

(U) Supervisor Roles and Responsibilities

A. (U) Supervisor Defined: Supervisors include, but are not limited to, Field Office andFBIHQ personnel including: Supervisory Intelligence Analyst (SIA), Supervisory Special
Agent (SSA), Supervisory Senior Resident Agent (SSRA), Unit Chief (UC), AssistantSpecial Agent in Charge (ASAC), Assistant Section Chief (ASC), Section Chief (SC),Special Agent in Charge (SAC), Deputy Assistant Director (DAD), Assistant Director (AD),Assistant Director inCharge (ADIC), and Executive Assistant Director (EAD).
B. (U) Supervisor Responsibilities:
1. (U//FOUO) Anyone in a supervisory role that approves/reviews investigative orcollection activity must determine whether the standards for initiating, approving,
conducting, and closing an investigative activity, collection activity or investigative
method, as provided in the DIOG, are satisfied.
2. (U//FOUO) Supervisors must monitor to ensure that all investigative activity, collection
activity and the use of investigative methods comply with the Constitution, federal law,
Executive Orders, Presidential Directives, AGG-Dom, other Attorney General Guidelines,
Treaties, Memoranda of Agreement/Understandingthis policy docuiient, andany'otherapplicable legal and policy requirements.
3. (U//FOUO) Supervisors must obtain training on the DIOG standards relevant to theirposition and conform their decisions to those standards. Supervisors must also ensure thatall subordinates have received the required training on the DIOG standards andrequirements relevant to their positions.
4. (U//FOUO) All supervisors must ensure that civil liberties and privacy are protected
throughout the investigative process.
5. (U//FOUO) If encountering a practice.that does not comply with-the law, rules, or
regulations, the supervisor must report that compliance concern to the proper authority-and, when.necessary, take action to maintain compliance.
6. (U//FOUO) Supervisors must not retaliate or take adverse action against.persons whoraise compliance concerns. (See OIC non-retaliation policy in the CPO policy andguidance library)
C. (U//FOUO) Supervisory Delegation: Throughout the DIOG, any requirement imposed on asupervisor maybe performed by a designated Acting, Primary or Secondary Relief
Supervisor, unless specified otherwise by federal statute, Executive Order, Presidential
Directive, Attorney General Guidelines, FBI policy, or any other applicable regulation. All
delegations must be made in writing and retained appropriately.
(U//FOUO) A supervisor may delegate authority to a supervisor one level junior to himself or
herself, unless specified otherwise (e.g., the SAC may delegate authority to the ASAC). Thisdelegation must: (i) identify the task delegated; (ii) identify the supervisory position given
approval authority; (iii) be in writing; and (iv) be retained appropriately. This delegation
authority is not further delegable. Except as provided in the preceding paragraph, an SSA or
SIA may not delegate authority.
(U//FOUO) Any supervisor can request that a supervisor at a higher level approve a
particular activity, so long as the higher-level supervisor is in the original approval
15
UNCLASSIFIED-FOR OFFICIAL USE ONLYUNCLASSIFIED - FOR OFFICIAL USE ONLY
Domestic Investigations and Operations Guide
supervisor's "chain-of-command" (e.g., SSA approval is required to open a preliminary
investigation, but the SSA requests that his/her ASAC or SAC approve the preliminary
investigation because he/she will be on TDY). Unlike delegations of authority which require
written documentation, higher supervisory approval than required by the AGG-Dom or
DIOG does not require written authorization.
D. (U//FOUO) File Reviews: Full-time supervisors or primary relief supervisors (relief
supervisors require SAC approval) must conduct investigative file reviews with theirsubordinates, as discussed below. Investigative file-reviews must be conducted with allagents, Resident Agents, TFOs, analysts, detailees, and FBI.contractors as appropriate.
Investigative file reviews for probationary agents are recommended every 30 days but must
be conducted at least every 60 days.
1. (U//FOUO) Assessment Justification/File Reviews: Supervisors must conduct 30-day
justification.reviews for types 1 and 2 assessments and 90-day file reviews for types 3, 4
and-6 assessments, as-required in Section 5 of the DIOG. These justification/file reviews
must: (i) evaluate the progress made toward the achievement of the authorized purposeand objective; (ii) ensure activities that occurred in.the prior 30/90 days were appropriate;(iii) determine whether itis reasonably likely that,information may be obtained that isrelevant to the authorized objective, thereby warranting an extension for another 30/90
days;:(iv) determine whether adequate predication has been developed to open and/or
continues to justify a predicated investigation; and (v) determine whether the assessment
should be terminated..
a. (U//FOUO) Type 1 and 2 Assessments: Supervisory justification reviews must
be conducted for each 30 day period. Following the end of the 30-day period, theagent, analyst, TFO, detailee or FBI contractor and the supervisor have.up to 10
calendar days to complete all aspects of the review and to appropriately document
the review, as specified in this section of the DIOG.
b. (U//FOUO) Type 3, 4 and 6 Assessments: Supervisory justification/file reviews
must be conducted for each 90 day period. Following the end. of each 90 day
period, the agent, analyst, TFO, detailee or FBI contractor and the supervisor haveup to 30 days to complete all aspects of the review and to appropriately document
the review, as specified in this section of the DIOG..Investigative file reviews forprobationary FBI employees are recommended every 30 days but must be
conducted at least every 60 days.
2. (U//FOUO) Predicated Investigations: Supervisory investigative file reviews must be
conductedfor each 90 day period. Following the end of each 90 day period, the agent,
analyst, TFO, detailee or FBI contractor and the supervisor have up'to 30 days tocomplete all aspects of the review and to appropriately document the review, as specified
in this section of the DIOG. Investigative file:reviews for.probationary FBI employees
are recommended every 30 days but must be conducted at least every 60 days.
3. (U//FOUO) General Policy for Justification/File Reviews: A justification/file review
must be: (i) in person orby telephone when necessary (e.g., FBI employee is TDY); (ii)conducted in private; and (iii) noted in the Automated Case Support (ACS) Investigative
Case Management Case Review or on the FD-71 or Guardian. Justification/file review
documentation must be executed in duplicate, with the subordinate being permitted to
16
UNCLASSIFIED-FOR OFFICIAL USE ONLYUNCLASSIFIED - FOR OFFICIAL USE ONLY
Domestic Investigations and Operations Guide
retain a'copy, and the originals retained by the supervisor in each subordinate's
administrative folder until the next inspection. If the subordinate only has applicant cases
assigned and is in compliance with FBI deadlines and regulations, thein-person
conference may be waived. If the conference is waived, the. supervisor will make suitablecomments concerning the subordinate's caseload, performance, compliance with FBI
deadlines and regulations, and record the fact that no conference was held. The results ofthejustification/file reviews must be considered when.preparing mid-year progress
reviews, annual appraisals, and developmental worksheets, except this provision does not
apply to TFOs, other agency detailees, or FBI Contractors.
E. (U//FOUO) Unaddressed Work for Assessments and Full Investigations(U//FOUO)

I

b2
b7E

(U//FOUO)

.
b2
b7E

(U//FOUO)l

I

b2
b7E

I

(U//FOUO-

b2
b7E

17
UNCLASSIFIED-FOR OFFICIAL USE ONLYUNCLASSIFIED - FOR OFFICIAL USE ONLY
Domestic Investigations and Operations Guide(U//FOUO) The FD-71 provides a mechanism to assign an Assessment to an appropriate
Unaddressed Work File, if appropriate. In the FD-71, the Supervisor must select a reason for
assigning the matter to the Unaddressed Work File, and choose the appropriate classification.
Upon submitting the FD-71, a new Unaddressed Work File will be opened.
3.5. (U) Chief Division Counsel Roles and Responsibilities(U//FOUO) The Chief Division Counsel (CDC) nust review all assessments and predicatedinvestigations involving sensitive investigative matters as discussed in DIOG Section 10 as well
as review the use of particular investigative'methods as discussed in Sections 5 and' f of the
DIOG. The primary purpose of the CDC's review is to ensure the legality of the actions
proposed. Review, in this context, includes a determination that the investigative activity is: (i)not legally objectionable (i.e., that it is not based solely on the exercise of.First Amendment
rights or on the race, ethnicity, national origin or religion of the subject; and (ii) founded upon an
authorized purpose and/or adequate factual predication and meets the standard specified in the
DIOG. The CDC should also include in his or her review and recommendation, if appropriate, adetermination of the wisdom of the proposed action (e.g., the CDC may have no legal objection
but may recommend denial because the value of the proposal is outweighed by the intrusion into
legitimate privacy interests); The CDC's determination that an investigative-activity is:-(i) not
legally objectionable; and (ii) warranted from a mission standpoint is based on facts known at thetime of the review and recommendation. Often these facts are not verified or otherwise
corroborated until the investigative activity commences. As a result, the CDC may require
additional CDC reviews or provide guidance to supervisory personnel with regard to monitoring
the results of the investigative activity to ensure that the authorized purpose and/or factual
predication remains in tact after the facts are. developed.
(U//FOUO) For investigative activities involving a sensitive investigative matter, the CDC must.
also independently consider the factors articulated in the DIOG and provide the approving
authority with a recommendation as to whether, in the CDC's judgment, the investigative
activity should be approved. Activities found to be legally objectionable by the CDC may not beapproved unless and until the CDC's determination is countermanded by the FBI GeneralCounsel or a delegated designee.
(U//FOUO) Throughout the DIOG, any requirement imposed on the CDC may be performed byan Associate Division Counsel (ADC), Legal Advisor, or designated Acting CDC. All CDC
delegations must be made in writing and retained appropriately.
.3.6.
(U) Office of the General Counsel Roles and Responsibilities(U//FOUO) In coordination with the DOJ NSD, the OGC is responsible for conducting regularreviews of all aspects of FBI national security arid foreign intelligence activities. The primary
purpose of the OGC's review is to ensure the legality of the actions proposed. These reviews,
conducted at FBI Field Offices and Headquarters' Units, broadly examine such activities forcompliance with the AGG-Dom and other applicable.requirements. Review, in this context,
includes a determination that the investigative activity is: (i) not legally objectionable (i.e., that it
is not based solely on the exercise of First Amendment rights or on the race, ethnicity,.national
origin or religion of the subject; and (ii) founded upon an authorized purpose-and/or adequate
factual predication and meets the standard specified in the-DIOG. The OGC should also include
in its review and recommendation, if appropriate, a determination of the wisdom of the proposed
18
UNCLASSIFIED-FOR OFFICIAL USE ONLYUNCLASSIFIED - FOR OFFICIAL USE ONLY
Domestic Investigations and Operations Guide
action (e.g., the OGC may have no legal objection but may recommend denial because the valueof the proposal is outweighed by the intrusion into legitimate privacy interests). The OGC's
determination that an investigative activity is: (i) not legally objectionable; and (ii) warranted
from a mission standpoint is based on facts known at the time of the review and recommendation.
Often these facts are not verified or otherwise corroborated until the investigative activity
commences. As a result, the OGC may require additional OGC reviews or provide guidance tosupervisory personnel with regard to monitoring the results of the investigative activity to ensurethat the authorized purpose and/or factual predication remains in tact after the facts aredeveloped.
(U//FOUO) For those investigative activities involving a sensitive investigative matter requiring
OGC review, the OGC must independently consider the factors articulated in the DIOG andprovide the approving authority with a recommendation as to whether, in the OGC's judgment,
the investigative activity should be approved.
(U//FOUO) Throughout the DIOG, any requirement imposed on the General Counsel may bedelegated and performed by a designated OGC attorney. All delegatiors must be made in writing
and retained appropriately;
3.7.

(U) Corporifte Policy Office Roles and Responsibilities(U//FOUO) Subject to the guidance of the Deputy Director, the CPO has oversight of theimplementation of the DIOG. In the process of implementing and analyzing the DIOG, the CPO
should report any-apparent compliance risk areas directly to the OIC. Additionally, the CPO will
work directly with the OIC to ensure that the policies, training and monitoring are adequate tomeet compliance monitoring procedures.
3.8.

(U) Office of Integrity and Compliance Roles and Responsibilities(U//FOUO) OIC is responsible for reviewing the DIOG, and workirg with each FBI Divisionand the CPO, to identify compliance risk areas and ensure the adequacy of policy statements,
training and monitoring. When compliance risk areas are identified, the OIC works with theDivisions, Field Offices, and/or programs affected by the risk and develops programs to review
the adequacy of policy statements, training, and monitoring and mitigates those concerns
appropriately.
3.9.

(U) Operational Program Manager Roles and Responsibilities(U//FOUO) FBIHQ Operation Program Managers must review notices and actions received fromFBI Field Offices pursuant to procedures contained in the applicable FBIHQ substantive
Division's policy implementation guide. This responsibility includes notifying the.appropriate
DOJ entity of FBI Field Office and FBIHQ investigative activities, within the time period
specified by the AGG-Dom, when required.
(U//FOUO) FBIHQ Operational Program Managers are responsible for identifying, prioritizing,
and analyzing potential compliance risks within their programs regarding implementationof the
DIOG, and developing mitigation plans where warranted.
(U//FOUO) Operational Program Managers must proactively identify and take appropriate
actionto resolve potential compliance concerns. In identifying possible compliance concerns, Program
Managers should consider the following indicators of possible compliance issues:

19
UNCLASSIFIED-FOR OFFICIAL USEONLYUNCLASSIFIED - FOR OFFICIAL USE ONLY
Domestic Investigations and Operations Guide

A. (U//FOUO) Similar activities being handled differently from Squad-to-Squad / Unit-to-Unit /Field Office-to-Field Office;B. (U//FOUO) Unusually high need for contact with Headquarters' Division for basic
information on how to conduct an activity;
C. (U//FOUO) Apparent confusion over how to conduct a certain activity;
D. (U//FOUO) Conflicting policy;
E. (U//FOUO)Non-existent/inaccurate/wrongly targeted training;
F. (U//FOUO)'Monitoring mechanisms that do not exist or do not test the right information (e.g.
file reviews/program management); andG. (U//FOUO) Inadequate audit for compliance.
(U//FOUO) Operational Program Managers may not retaliate or take adverse action against
persons who raise compliance concerns.
3.10. (U) Division Compliance Officer Roles and Responsibilities(U//FOUO) Each FBIHQ Division and Field Office must have a Division Compliance Officer(DCO) who willproactively identify potential non-compliance risk areas concerning theimplementation of the DIOG and report them to the proper authority and the OIC. The DCO
must always be aware that the focus of a compliance program is the identification and resolutionof a compliance problem and the process must not be punitive or retaliatory.
3.11. (U) FBI Headquarters Approval Levels(U//FOUO) Ifa DIOG provision does not specifically provide, or prohibit, FBIHQ approvalauthority for conducting certain investigative activities or investigative methods, the below
Field
Office approval authorities equate to the following FBIHQ personnel and approving officials
when FBIHQ initiates, conducts, or closes an investigative activity or utilizes
an investigative
method:* (U//FOUO) Field Office Analyst or Special Agent (SA) = FBIHQ Analyst,
SA, orSupervisory Special Agent (SSA);* (U//FOUO) Field Office Supervisory Intelligence Analysts (SIA) = FBIHQ SIA;.
* (U//FOUO) Chief Division Counsel (CDC) =FBIHQ Office of the GeneralCounsel. (OGC);* (U//FOUO) Field Office SSA = FBIHQ Unit Chief (UC); and* (U//FOUO) Special Agent in.Charge (SAC) = FBIHQ Section Chief (SC).

20
UNCLASSIFIED-FOR OFFICIAL USE ONLY .

UNCLASSIFIED - FOR OFFICIAL USE ONLY
Domestic Investigations and Operations Guide

4. (U) Privacy and Civil Liberties, and Least Intrusive Methods
4.1.

(U) Civil Liberties and Privacy

A. (U) Overview(U) The FBI is responsible for protecting the American public, not only from crimeandterrorism, but also from-incursions into their constitutional rights. Accordingly, all AGGDom investigative activities must be carried out with'full adherence to the Constitution,federal laws and the principles of civil liberty and privacy.
(U) The FBI has a long-established commitment to protecting the civil liberties of Americans
as it investigates threats to national security and public safety. As discussed below,
compliance with the FBI's comprehensive infrastructure of legal limitations, oversightandself-regulation effectively ensures that this commitment is honored. Because our ability
toachieve our mission requires that we have the trust and confidence of the American
public,and because that trust and confidence can be significantly.shaken by our failure torespect thelimits of our power, special caremust be taken by all employees to comply withthese
limitations.
B. (U) Purpose of Investigative Activity(U) One of the most important-safeguards in the AGG-Dom-one that is intended
to ensurethat FBI employees respect the constitutional rights of Americans-is the thresholdrequirement that all investigative activity be conducted for an authorized purpose.
Under theAGG-Dom that authorized purpose must be an authorized national security, criminal,or
foreign intelligence collection purpose.
(U) Simply stating such a purpose is not sufficient, however, to ensure compliancewith thissafeguard. It is critical that the authorized purpose not be, or appear to be, arbitraryorcontrived; that it be well-founded and well-documented; and that the information
sought andthe investigative method used to obtain it befocused in scope, time, and manner
to achieve
the underlying purpose. Furthermore, there are constitutional provisions that set
limits onwhat that purpose may be. It may not be solely to monitor the exercise of rightsthat areprotected by the Constitution, and, equally important, the authorized purpose
may not bebased solely on race, ethnicity, national origin or religion.
(U) It is important to understand how the "authorized purpose" requirement andtheseconstitutional limitations relate to one another. For example, individuals orgroups who
communicate with each other or with members of the public in any form in pursuit.or political causes-such as opposing war or foreign policy, protesting government of social
actions,
promoting certain religious beliefs-have a fundamental constitutional rightto do so. No
investigative activity may be conducted for the sole purpose of monitoring theexercise of
these rights. If, however, there exists a well-founded basis to conduct investigative
activityfor one of the authorized purposes listed above-and that basis is not solely
the race,
ethnicity, national origin or religion of the participants-FBI employees
may assess orinvestigate these activities, subject'to other limitations in the AGG-Dom
and the DIOG.
this situation, the investigative activity would not be based solely on Constitutionally- In
protected conduct or on race, ethnicity, nationality or religion. Finally,
althoughactivity would be authorized in this situation, it is important that it be conducted investigativein a manner
21
UNCLASSIFIED-FOR OFFICIAL USE ONLYUNCLASSIFIED - FOR OFFICIAL USE ONLY
Domestic Investigations and Operations Guide
that does not materially interfere with the ability of the individuals or groups to engage intheexercise of Constitutionally-protected rights.
C. (U) Oversight and Self-Regulation(U) Provisions of the AGG-Dom, other AGG, and oversight from DOJ components aredesigned to ensure the activities of the FBI are lawful, appropriate and ethical as well as
effective in protecting the civil liberties and privacy of individuals in the United:States. DOJ
and the-FBI's Inspection Division, OIC, and OGC, along with every FBI employee, share
responsibility for ensuring that the FBI meets these goals.
(U) In the criminal investigation arena, oversight.ofFBI activities has traditionally comefrom prosecutors and district courts. Because many national security investigations do
notresult in prosecutions, other oversight mechanisms are necessary. Various features of the
AGG-Dom facilitate the DOJ NSD oversight functions in the national security and foreign*intelligence collection areas. Relevant requirements and provisions include: (i) required
notification by the FBI to the DOJ NSD concerning a full investigation that involves
foreign
intelligence collection, a full investigation of a United States person in relation to a threattothe national security; or a national security investigation involving a "sensitive investigative
matter;" (ii) an annual report.by the FBI to the DOJ NSD concerning the FBI's foreign
intelligerice collection program, including information reflecting the scope and natureofforeign intelligence collection activities in each FBI Field Office; (iii) access by the
DOJ
NSD to-information obtained by the FBI through national security or foreign intelligence
activities; and (iv) general authority for the Assistant Attorney General for National
Security
to obtain-reports from the FBI concerning these activities. (AGG-Dom, Intro.4.C)(U) The DOJ NSD's Oversight Section and the FBI's QGC are.responsible for conducting
regular reviews of all aspects of FBI national security and foreign intelligence
activities.
These reviews, conducted at FBI Field Offices and FBIHQ Divisions, broadly examine
suchactivities for compliance withthe AGG-Dom and other applicable requirements.
(U) Further examples of oversight mechanisms include the involvement of both
FBI andprosecutorial personnel in the review of undercover operations involving sensitive
circumstances; notice requirements.for investigations involving sensitive investigative
matters; and notice and oversight provisions for enterprise investigations, which
involve.a
broad examination of groups implicated in criminal and.national security threats.
These
requirements and procedures help to ensure that the rule of law is respected in the
FBI's
activities and.that public confidence is maintained in these activities. (AGG-Dom,
Intro.4.C)(U) In addition to the above-mentioned oversight entities DOJ has inplace, theFBI is subject
to a regime of oversight, legal limitations, and self-regulation designed to ensure
strictadherence to civil liberties. This regime is comprehensive and has many facets,
including thefollowing:
1. (U) The Foreign Intelligence:Surveillance Act of 1978, as amended, andTitle III of the
Omnibus and Streets Act of 1968. These laws establish the processes for obtaining
judicial approval of: electronic.surveillance ard physical searches for the purposesofcollecting foreign intelligence and electronic surveillance for the purposeof collecting
evidence of crimes.

22'UNCLASSIFIED-FOR OFFICIAL USE ONLYUNCLASSIFIED - FOR OFFICIAL USE ONLY
Domestic Investigations and Operations Guide
2. (U) The Whistleblower Protection Acts of 1989 and 1998: These laws protect
whistleblowers from retaliation.
3. (U) The Freedom of Information Act of 1966: The law provides the public with access
to FBI documents not-covered by a specific statutory exemption.
4. (U) The Privacy Act ofl 974: The purpose of the Privacy Act is to balance thegovernment's need to maintain information about United States citizens and legal
permanent resident aliens with the rights of those individuals to be protected against
unwarranted invasions of their privacy stemming from the government's collection,use,
maintenance, and dissemination, of that informhation. The Privacy Act forbids the FBI
and other federal agencies from collecting information about how individuals exercise
their First Amendment rights, unless that collection is expressly authorized by statuteorby the individual, or is pertinent to and within the scope of an authorized law
enforcement activity (5 U.S.C. § 552a[e][7]). Except for collection of foreign
intelligence, activities authorized by the AGG-Dom are authorized law enforcement
activities or activities for which there is otherwise statutory authority for purposesof
the Privacy Act. Foreign intelligencecollection is not an authorized law enforcenient
activity.
(U) Congressional Oversight is conducted by various cotimittees of the UnitedStatesCongress, but primarily by the Judiciary and -Intelligence Committees. These committees
exercise regular, vigorous oversight into all aspects of the FBI's operations. To
this end, theNational Security Act of 1947 requires the FBI to keep the intelligence committees
Senate and House of Representatives) fully and currently informed of substantial (for theintelligence
activities. This oversight has significantly increased in breadth and intensity
since the 1970's,
and it provides important additional assurance that the FBI conducts its investigations
according to the law and the Constitution.
(U) The FBI's counterintelligence and counterterrorism operations are subject.tb
significant
self-regulation and oversight beyond that conducted by Congress. The Intelligence
Oversight
Board (lOB), comprised of members from the President's Intelligence, Advisory
Board(PIAB), also conducts oversight of the FBI. Among its other responsibilities,
thereviews violations of The Constitution, national security law, E.O..or PresidentialIOB
Decision
Directive (PDD) by the FBI and the other intelligence agencies, and issues
reports thereon to
the President and the Attorney General.
(U).Intemal FBI safeguards include: (i) the OGC's Privacy and Civil Liberties
Unit (PCLU),
which reviews plans of any record system proposed within the FBI for compliancewith thePrivacy Act and related privacy protection requirements and policies; (ii)the.criminal andnatiorial'security undercover operations review committees, comprisedof senior DOJ andFBI officials, which.review all proposed undercover operations that involve
sensitive
circumstances; (iii) the Sensitive Operations Review Committee (SORC)
comnrised(iv) all FBI employees have an obligation to report violations of the DIOG
to their supervisor, other management officials, or appropriate authorities;and (v) the FBI
requirement for training of new FBI employees and periodicitraining
for all FBI employees

23
UNCLASSIFIED-FOR OFFICIAL USE ONLYUNCLASSIFIED - FOR OFFICIAL USE ONLY
Domestic'Investigations and Operations Guide
to.maintain currency on the latest guidelines, changes to laws and regulations, andjudicial
decisions related to constitutional rights and liberties.
(U) The AGG-Dom and DIOG set forth the standards and requirements under whichaninvestigative activity may be initiated and are designed to provide FBI employeeswith aframework that maintains the proper balance between the public's need for effectivelaw
Senforcement and protection of the national security and the protection of civil
liberties andprivacy. Among the provisions that specifically serve to protect civil liberties andprivacy are
the following: (i) the prohibition against initiating investigations based solely on
the exerciseof First Amendment rights or other constitutionally protected activity; (ii) the requirementthat FBI employees use the least intrusive method reasonable under the circumstancestoachieve their investigative goals; and (iii) the prohibition against engaging
in ethnic andracial profiling. Further, in the context-of collecting foreign intelligence, theFBI is further
required to operate openly and consensually with United States persons, tothe extent
practicable.
4.2.

(U) Protection of First Amendment Rights(U) A fundamental principle of the Attorney General's guidelines for FBI investigations
andoperations since the. first guidelines were issued in 1976 has been that investigative
activity may
not be based solely on the exeicise of rights guaranteed by the First Amendment
to the UnitedStates Constitution. This principle carries through to the present day in
the AGG-Dom. There is acorollary to this principle in the Privacy Act of 1974, 5 U.S.C. § 552a, which
prohibits theretention of information describing how a person exercises rights under theFirst Amendment,
unless there is a valid law enforcement purpose.
(U) The First Amendment states:(U) Congress shall make no law respecting an establishment of religion or
prohibitingthefree exercise thereof, or abridgingthe freedom of speech,
or ofthe press; or of the right of the people to peaceably assemble, and to petition
the Governmentfor redress ofgrievances.
(U) Although the amendment appears literally to apply only to Congress,
the Supreme Court
made it clear long ago that it also applies to activities of the Executive
Branch, including law
enforcement agencies. Therefore, for FBI purposes, it would be helpful to readthe introduction
to the first sentence as: "The FBI shall take no action respecting..." In addition,
the word"abridging" must be understood. "Abridging," as used
here, means "diminishing." Thus, it is notnecessary for a law enforcement action to destroy or totally undermine theexercise of First
Amendment rights for it to be unconstitutional; significantly diminishingor lessening the abilityof individuals to exercise these rights without an authorized investigative purpose
is sufficient.
(U) This is not to say that any diminishment of First Amendment rights
is unconstitutional. The
Supreme Court has never held that the exercise of these rights is absolute.
In fact, the Court has
set forth realistic interpretations of what level and kind of government
activity actually violates aFirst Amendment right. For example, taken to an extreme, one could argue
that the mere
possibility of an FBI agent being present at an open forum (or an
on-line presence) would
dimiiish the right of free speech by, for example, an anti-war protestor
because he/she would be
afraid to speak freely. The Supreme Court, however, has never foundan "abridgement" of First
Amendment rights based on such a subjective fear. Rather, it requires
an action that, from an
24
UNCLASSIFIED-FOR OFFICIAL USE ONLYUNCLASSIFIED - FOR OFFICIAL USE ONLY
Domestic Investigations and Operations Guide
objective perspective, truly diminishes-the speaker's message or his/her ability to deliver it (e.g.,pulling the plug on the sound system). For another example, requiring protestors to use a certain
parade route may diminish,in a practical sense, delivery of their message. The Court has made.it
clear, however, that for legitimate reasons (e.g., public safety), the government may impose
reasonable limitations in terms of time, place and manner to the exercise of such rights-as longas the ability to deliver the message remains.
(U) While the language of the First Amendment prohibits action that would abridge theenumerated rights, the implementation of that prohibition in the AGG-Dom reflects the Supreme
Court's opinions on the constitutionality of law enforcement action that may impact the exerciseof First Amendment rights. As stated above, the AGG-Dom prohibits investigative activity forthe sole purpose of monitoring the exercise of First Amendment rights. The import of the
distinction between this language and the actual text of the First Amendment language is twofold: (i) the line drawn by the AGG-Dom prohibits even "monitoring" the exercise of First
Amendment-rights (far short of abridging those rights) as the sole purpose of FBI activity; and(ii)
the requirement of an authorized purpose for all investigative activity provides additional
protection for the exercise of Constitutionally protected rights.
(U) The AGG-Dom classifies investigative activity that involves a religious or politicalorganization (or an individual prominent in such an organization) or a member of the news
media as a "sensitive investigative matter." That designation recognizes the sensitivity of
conduct that traditionally involves the exercise ofFirst Amendment rights-i.e., groups who
associate for political or religious purposes, and the press. The requirements for opening andpursuing a "sensitive investigative matter" are set forth in Section 10 of this policy document.
Itshould be clear, however, from the discussion belowjust howpervasive the exercise of First
Amendment rights is in American life and that not all protected First Amendment activity will
fall within the definition of a "sensitive investigative matter." Therefore, it is essential that FBI
employees recognize when investigative activity may have an impact on the exercise of thesefundamental rights and be especially sure that any such investigative activity has a valid law
enforcement or national security purpose, even if it is not a "sensitive investigative matter" as
defined in the AGG-Dom and the DIOG.
(U) Finally; it is important to note that United States persons (and organizations comprisedof
United States persons) do not forfeit their First Amendment rights simply because they
also
engage in criminal activity or in conduct that threatens national security. For example,
anorganization suspected of engaging in acts of domestic terrorism may also pursue legitimate
political goals and may also engage in lawful means to achieve those goals. The pursuitof thesegoals through constitutionally-protected conduct does not insulate them from legitimate
investigative focus for unlawful activities-but the goals and the pursuit of their goals throughlawful means remain protected from unconstitutional infringement.
(U) When allegations of First Amendment violations are brought to a court of law, it isusually inthe form of a civil suit in which a plaintiff has to prove some actual or potential harm.
Presbyterian-Church.v. United States, 870 F.2d 518 (9th Cir. 1989). In a criminal
trial, adefendant.may seek either or both of two remedies as part of a claim that his or
her First
Amendment rights were violated: suppression of evidence gathered in the alleged First
Amendment violation, a claim typically analyzed under the "reasonableness" clauseof theFourth Amendment, and dismissal of the indictment on the basis of "outrageous government
conduct" in violation of the Due Process Clause of the Fifth Amendment.
25
UNCLASSIFIED-FOR OFFICIAL USE ONLYUNCLASSIFIED - FOR OFFICIAL USE ONLY
Domestic Investigations and Operations Guide(U) The scope of each of the primary First Amendment rights and their impact on FBI
investigative activity are discussed below. The First Amendment's "establishment clause,"-theprohibition against the government establishing or sponsoring a specific religion-has little
application to the FBI and, therefore, is not discussed here.
A. (U) Free Speech(U) The exercise of free speech includes far more than simply speaking on a cortroversial
topic in the town square. It includes such activities as carrying placards in a parade, sending
letters to a newspaper editor, posting a web site on the Internet, wearing a tee-shirt with apolitical message, placing a bumper sticker critical of the President on one's car, andpublishing books or articles. The common thread in these examples is conveying a public
message or an idea through words or deeds. Law enforcement activity that diminishes aperson's ability to communicate in any of these ways may interfere with his or her freedomof speech-and thus may not be undertaken by the FBI solely for that purpose.
(U) The line between constitutionally protected speech and advocacy of violence or of
conduct that may lead to violence or other unlawful activity must be understood. In
Brandenburg v. Ohio, 395 U.S. 444 (1969), the Supreme Court established a two-part test to
determine whether such speech is constitutionally protected: the government may notprohibit advocacy offorce or violence excet when such-advocacy-(i) is intended to incite
imminent lawless action, and (ii) is likely to do so. Therefore, even heated rhetoric or
offensive provocation that could conceivably lead to a violent response in the future isusually protected. Suppose, for example, a politically active group advocates on its web sitetaking unspecified "action" against persons or entities it views as the enemy, who thereafter
suffer property damage and/or personal injury. Under the Brandenburg two-part test, themissing specificity and imminence in the message may provide it constitutional protection.
For that reason, law enforcement may take no action that, in effect, blocks the message
orpunishes its sponsors.
(U) Despite the high standard for prohibiting free speech or punishing those who engage
in it,
the law does not preclude FBI employees from observing and collecting any of theforms ofprotected speech and considering its content-as long as those activities are done fora validlaw enforcement or national security purpose and conducted in a manner that does
not unduly
infringe upon the ability of the speaker to deliverhis or her message. To be an authorizedpurpose, it must be one that is authorized'by the AGG-Dom-i.e.; to further.an FBI
assessment, predicated investigation, or other authorized function such as providing
assistance to other agencies. Furthermore, by following the "Standards for InitiatingorApproving an Assessment or Predicated Investigation" as contained in the DIOG, the FBI
will ensure that there is a rational relationship between that authorized purpose
and.theprotectedspeech such that a reasonable person with knowledge of the circumstances
could
understand why the information is being collected.
(U) Returning to the example posed above, because the group's advocacy ofaction could bedirectly related by circumstance to property damage suffered by one of the group's
known
targets, collecting the speech-although lawfully protected-can lawfully occur. Similarly,
listening to the public talks by a religious leader, who is suspected of raisingfunds for aterrorist organization, may yield clues as to his motivation, plan of action, and/or
hiddenmessages to his followers. FBI employees should not, therefore, avoid collecting
First
26

UNCLASSIFIED-FOR OFFICIAL USE ONLYUNCLASSIFIED - FOR OFFICIAL USE ONLY
Domestic Investigations and Operations Guide
Amendment protected speech if it is relevant to an authorized AGG-Dom purpose-as longas they do so in a manner that does-not inhibit the delivery of the message or the ability oftheaudience to hear it, and so long'as the method of collection is the. least intrusive means
feasible to gather the relevant information.
(U) In summary, during the course of lawful investigative activities, the FBI may lawfullycollect, retain, and consider the content of constitutionally protected speech, so long as: (i)the collectionis logically related to an authorized investigative purpose; (ii) the collection
does not actually infringe on the ability of the speaker to deliver his or her message; and (iii)the method of collection is the least intrusive alternative feasible.
B. (U) Exercise of Religion(U) Like the other First Amendment freedoms, the "free exercise of religion" clause isbroader than commonly believed. First, it covers any form of worship of a deity-even
formsthat are commonly understood to be cults or fringe sects, as well as the right not to worshipany deity. Second, protected religious exercise also extends to dress or food that is requiredby religious edict, attendance at a facility used for religious practice (no matter how unlikely
it appears to be intended for that purpose), observance of the Sabbath, raising money forevangelical or missionary purposes, and proselytizing. Even in controlled environments
likeprisons, religious exercise must be permitted-subject to reasonable restrictions as to time,
place, and manner. Another feature-of this First Amendment right is that it is a matterofheightened sensitivity to some Americans-especially to devout followers. For thisreason,itis a matter that is more likely to provoke an adverse reaction, if the right is violatedregardless of which religion is involved. Therefore, when essential investigative activity
may
impact this right, it must be conducted in a manner that avoids'the actual-and theappearance of-interference with religious practice to the maximum extent possible.
(U) While there must be an authorized purpose for any investigative activity that could
have
an impact on religious practice, this does not mean religious practitioners or religious
facilities are completely free from being examined as part of an assessment or predicatedinvestigation. If such practitioners are involved in--or such facilities are used for-activities
that are the proper subject of FBI-authorized investigative or intelligence collection
activities,
their religious affiliation does riot "immunize" them to any degree from these efforts.
It isparamount, however, that the authorized purpose of such efforts be properly documented.
Itis also important that investigative activity directed at religious leaders or atconduct
occurring within religious facilities be focused in time and manner so as not toinfringe on
legitimate religious practice by any individual but especially by those who
appearunconnected to the activities under investigation.
(U) Furthermore, FBI employees may take appropriate cognizance of the rolereligion may
play:in the membership or motivation of a criminal or terrorism enterprise.
If, for example,
affiliation with a certain religious institution or a specific religious sect isa known
requirement for inclusion in a violent organization that is the subject of an investigation,
thenwhether a person of interest is a member of that institution or sect.is a rational
andpermissible consideration. Similarly, if investigative experience and reliable
intelligence
reveal that members of a terrorist or criminal organization are known to commonly
possess
or exhibit a combination of religion-based characteristics or practices (e.g.,group leadersstate that acts of terrorism are based in religious doctrine), it is rational
and lawful to consider-27

UNCLASSIFIED-FOR OFFICIAL USE ONLYUNCLASSIFIED - FOR OFFICIAL USE ONLY
Domestic Investigations and Operations Guide
such a combination in gathering intelligence about the group-even if any one ofthese, byitself, would constitute an impermissible consideration. By contrast, solely because
prior
subjects of an investigation of a particular group were members of a certain religion andtheyclaimed a religious motivation for their acts of crime or terrorism, other members' mereaffiliation with that religion, by itself, is not a basis to assess or investigate-absent a known
and direct connection to the threat under assessment or investigation. Finally, the absence ofa particular religious affiliation can be used by analysts and investigators to eliminate certainindividuals from further investigative.consideration in those scenarios where religious
affiliation is relevant.
C. (U) Freedom of the Press(U) Contrary to what many believe, this well-known First Amendment right is not ownedbythe news media; it is a right of the American people. The drafters of the Constitution
believedthat a free press was.essential to preserving democracy. Although the news media typicallyseeks to enforce this right, freedom of the press should.not be viewed as a contest between
law enforcement or national security, on the one hand, and the interests of news
media, on
the other.
(U) Freedom of the.press includes such matters as reasonable access to news-making
events,the-making of documentaries, and the posting of"blogs;" the news gatheringfunction is the
aspect of freedom of.the press most likely to intersect with law enforcement andnational
security investigative activities. Within that category, the interest of the news media
inprotecting confidential sources and the interest of agencies like the FBI in gaining accesstothese sources who may have evidence of a crime or national security intelligenceoften clash.
The seminal case in this area is Branzburg v. Haves, 408 U.S. 665 (1977), in-which theSupreme Court held that freedom of the press does not entitle a news reporterto refuse todivulge-the identity of his source to. a federal grand jury. The Courtreasoned
that, as long as
the purpose of law enforcement is not harassment or vindictiveness against the press,any
harm to the news gathering function of the press (by revealing source identity) isoutweighedby the need of the grand jury to gather evidence of crime. "(U) Partially in response to Branzburg, the Attorney General has issued
regulations thatgovern the issuance of subpoenas for reporter's testimony and telephone tollrecords, thearrest of a reporter for a crime related to news gathering, and,the interview of a reporter
as asuspect in a crime arising froni the news gathering process. In addition, an investigationof amember of the news media in his official capacity, the use of a reporter as a source,andposing as a member of the news media are all sensitive circumstances in the AGG-Domandother applicable AG guidelines.
(U) These regulations are not intended to insulate reporters and other news media
from FBI
assessments or predicated investigations. They are intended to ensure thatinvestigative
activity that seeks information from or otherwise,involves members of the news media:
isappropriately authorized; is necessary for an important law enforcement br national security
objective; is the least intrusive means to obtain the information or achieve the goals;
and does
not unduly infringe upon the news gathering aspect of the constitutionalright to freedom of
the press.

28
UNCLASSIFIED-FOR OFFICIAL USE ONLY/UNCLASSIFIED - FOR OFFICIAL USE ONLY
Domestic Investigations and Operations Guide
D. (U),Freedom of Peaceful Assembly and to Petition the Governmentfor Redress of
Grievances(U) Freedom of peaceful assembly, often called the right to freedomof association, present
unique issues for law enforcement agencies, including the FBI. Individuals
who gather withothers to protest government action, or to rally or demonstrate in
favor
of,
or
in opposition to,a.social cause sometimes present a threat to public safety either by their
numbers, by theiractions, by the anticipated response to their message, or bycreating an opportunity forindividuals or other groups with an unlawful purpose to infiltrateand compromise thelegitimacy.of the group for their own ends. The right to peaceful assembly
includes morethan just public denionstrations-it includes, as well, the posting
of
group
web
sites on theInternet, recruiting others.to a cause, marketing a message, andfund raising. All are protected
First Amendment activities if they are conducted in support of theorganization or political,
religious or social cause.
(U) The right to petition the government for redress of grievances
assembly and association that it is included in this discussion. A is so linked to peaceful
distinction between the two
isthat an individual may exercise the right to petition the governmentby himself whereas
assembly necessarily involves others. The right to-petition thegovernment includes writing
letters to Congress, carrying a placard outside city hall thatdelivers a political message,
recruiting others to one's cause, and lobbying Congress or an
executive agency for aparticular result.
(U) Forthe FBI, covert presence or action withinassociations,also called "undisclosed
participation," has the greatestpotential to impact this Constitutionalright. The Supreme
Court addressed this issue as a result of civil litigation arisingfrom one of the many protests
against the Vietnam War. In Laird v; Tatum, 408 U.S. 1 (1972), the Court foundthat themere existence of an investigative program-consisting of covert physical surveillanceinpublic areas, infiltration of public assemblies by government
operativesorsources,andthecollection of nws articles and other publicly available information-forthepurposeofdetermining the existeince and scope of a domestic threat to national
security does not, byitself, violate the First Amendment rights of the rembers of theassemblies. The subjective"chill" to the right to assembly, based on thesuspected presence of government operatives,
did notby itself giverise to legal "standing" to'argue.thattheirconstitutional rights had been
abridged..Instead, the Court required a showing that thecomplained-of government action
would reasonably deter the exercise of that right.
(U) Since Laird v. Tatuniwas decided, the lower courts haveexamiiined.government activity
on many occasions to determine whether it gave rise to a "subjective
deterrent.' The basic standingrequirement establish by Laird remainschill" or an "objective
unchanged today. The
lower courts,.however,'have often imposed a very low threshold ofdismissal'of the case. For example, plaintiffs who have-shown a lossobjective harm to surviveof memibership in an
organization, loss of financial support, loss to reputation and status in
the community, andloss of employment by members have been granted standing
to sue.
(U) More significant for the FBI than the standing issue has been
the lower courts? evaluationof investigative activity into First Amendment protected.associations
since Laird. The courts
have held the-followinrig investigative activities to be constitutionallypermissible under First
Amendment analysis: undercover participationin group activities; physical and video
29
UNCLASSIFIED-FOR OFFICIAL USE ONLYUNCLASSIFIED - FOR OFFICIAL USE ONLY
Domestic Investigations and Operations Guidesurveillance in public areas; properly authorized electronic surveillance;
recruitment andoperation of sources; collection of information from government, public,
and private sources(with consent); and the dissemination of information for a valid law enforcement
purpose.
However, these decisions were not reached in the abstract. In every casein which the courts
have found government action to be proper, the government provedthat it was conducted foran authorized law enforcement or national security purpose and that
it was conducted in
substantial compliance with controlling regulations. In addition, in
approving.thesetechniques, the courts have often considered whether a less intrusivetechnique was available
to the agency, and the courts have balanced the degree of intrusion or
impact against theimportance of the law enforcement or national security objective.
(U) By contrast, since Laird, the courts have found these techniques
to be legallyobjectionable: initiating an investigation solely on the basis of thegroups' social or political
agenda (even if the agenda made the group susceptible to subversive
infiltration); sabotaging
or neutralizing the group's legitimate social or political agenda; disparaging
the group's
reputationor standing; leading the group into criminal activity
that otherwise probably would
not have occurred; and underinining legitimate recruiting or funding
efforts.
case, the court found the government's purpose either was not persuasive, In every such
was too remote, or
was too speculative to justify he intrusion and the potential harm to
the exercise of First
Amendment rights.
(U) Once again, the message is clear that investigative activity that involves
assemblies or
associations of United States persons exercising their First Amendment
rights must have an
authorized purpose under the AGG-Dom-and one to which theinformation sought and thetechnique to be employed are rationally related. Less intrusive techniquesshould always be
explored first and those authorizing such activity (which, as discussed
above, will almost
always constitute a sensitive investigative matter) should ensure thatthe investigative activity
is focused as narrowly'as feasible and that the purpose is thoroughly
documented.
4.3.
(U) Equal Protection under the Law
A. (U) Introduction(U) The Equal Protection Clause of the. United States Constitution
provides in part that: "NoState shall make or enforce any law which shall... deny to any
personwithin its jurisdiction
the equal protection of the laws." The Supreme Court and the lower
courts have made it clearthat it applies as well to the official acts of United States government
law enforcement
agents. Specifically, government employees are prohibited fromengaging in invidiousdiscrimination against individuals on the basis of race, ethnicity,
national origin, or religious
affiliation. This principle is further reflected and implemented forfederal law enforcement in
the United States Department of Justice's Guidance Regarding the Use ofRace by Federal
Law Enbrcemen Awgenc (hereinafter "DOJ Guidance").

(U) The DOJ Guidance statesthat investigative and intelligencecollection activities must not
be based solely on race, ethnicity, national origin, or religious
affiliation. Any such activities
that are based solely on such considerations are invidious by definition,
therefore,
See, e.g., Whren v. United States, 517 U.S. 806 (1996); see also
Chavez v. Illinois State Police 251
F.3d 612 (7th Cir. 2001).

30
UNCLASSIFIED-FOR OFFICIAL USE ONLYUNCLASSIFIED - FOR OFFICIAL USE ONLY
.Domestic Investigations and Operations Guide
unconstitutional. This standard applies to all investigative and collection activity, includingcollecting and retaining information, opening cases, disseminating information, and indicting
and prosecuting defendants. It is particularly.applicable to the retention and dissemination of
personally identifying information about an individual-as further illustrated in the examples
enumerated below.
(U) The constitutional prohibition against invidious discrriination based on race, ethnicity,
national origin or religion is.relevant to both the-national security and criminal ihvestigative
programs of the FBI. National security investigations often have ethnic aspects;, members of
a foreign terrorist organization may be primarily or exclusively from a particular country or
area of the world. Similarly, ethnic heritage is frequently the common thread running through.
violent gangs or other criminal organizations. It should be noted that this is neither a new nor
isolated phenomenon. Ethnic commonality among criminal and terrorist groups has been
relatively constant and widespread across mahy ethnicities throughout the history ofthe FBI.
B. (U) Policy Principles(U) To ensure that assessment and investigative activities and strategies consider racial,ethnic, national.origin and religious factors properly and effectively and to help assure theAmerican public that the FBI does not engage in invidious discrimination, the following
policy principles are established.
1. (U) The prohibition against investigative activity based solely on race or ethnicity is not
avoided by considering it in combination with other prohibited factors. For example, aperson of a certain race engaging in lawful public speech about his religious
convictions is not a proper subject of investigative activity based solely on any one ofthese factors-or by the combination of all three. Before collecting and using thisinformation, a well-founded and authorized investigative purpose must exist as towhich any or all of these otherwise prohibited factors is relevant:
2. (U) When race or ethnicity is a relevant factor to consider, it should not be thedominant or primary factor. Adherence to this standard will not only ensure that it is.never the sole factor-it will also preclude undue and unsound reliance on race or
ethnicity in investigative analysis. It reflects the recognition that there are thousands
and, in sorie cases, millions of law abiding people in American society of the same raceor ethnicity as those who are the subjects of FBI investigative activity, and it guards
against the risk of sweeping some of them into the net of suspicion without a soundinvestigative basis.
3. (U) The FBI will not collect or use behavior or characteristics-common to particularracial.or ethnic community as investigative factors unless they bear clear and specificrelevance to a matter under assessment or investigation. This policy is intefided toprevent the potential that collecting ethnic characteristics or behavior will inadvertently
lead to individual identification based solely on such matters, as well as to avoid theappearance that the FBI is engaged in ethnic or racial profiling.

31
UNCLASSIFIED-FOR- OFFICIAL USE ONLYUNCLASSIFIED - FOR OFFICIAL USE ONLY
Domestic Investigations and Operations Guide
C. (U) Guidance on the Use of Race and Ethnic Identity in Assessments and PredicatedInvestigations(U) Considering the reality of common ethnicity or race.among many criminal and terroristgroups, some question how the prohibition against racial or ethnic profiling is to beeffectively applied-and not violated-in FBI assessments and predicated investigations.
The question arises generally in two contexts: (i) with respect to an individual.or a group ofindividuals; and (ii) with respect to ethnic'or racial communities as a whole.
1. (U) Individual Race or Ethnicity as a Factor(U) The DOJ Guidance permits the consideration of ethnic and racial identity information
based on specific reporting-such as from an eyewitness. As a general rule, race or ethnicity as an identifying feature of a suspected perpetrator, subject, and in some cases, a.
victim, is relevant if it is based on reliable evidence:or information-not conjecture or
stereotyped assumptions. In addition, the DOJ Guidance permits consideration of race or
ethnicity in other investigative or collection scenarios if it is relevant. These examples-illustrate:a. (U) The race or ethnicity of suspected members, associates, or supporters of an
ethnic-based gang or criminal enterprise may be collected and retained whengathering information about or investigating the organization.
b. (U) Ethnicity may be considered in evaluating whether a subject is-or is not-a
possibleassociate of a criminal or terrorist group that is known to be comprised ofmembers of the same ethnic grouping-as long as it is not the dominant factor forfocusing on a.particular person. It is axiomatic that there are many members of thesame ethnic group who are not members of the group; and for that reason, there must
be other information beyond race or ethnicity that links the individual to the terrorist
or criminal group or to the other members of the group. Otherwise, racial or ethnic
identity would be the sole criterion, and that is impermissible.
2. -(U) Community Race or Ethnicity as a Factor
a. (U) Collecting and analyzing.demographics. The DOJ guidance ard FBI policy
permit the FBI to identify locations of concentrated ethnic.communities in the Field
Office's domain, if these locations will reasonably aid the analysis of potential threats
and vulnerabilities, and, overall, assist domain awareness for the purpose of
performing intelligence analysis. If, for example, intelligence reporting reveals thatmembers of certain terrorist organizations live and operate primarily within a certain
concentrated community of the same ethnicity, the location of that community isclearly valuable-and properly collectible-data. Similarly, the locations of ethnicoriented businesses- and other facilities may be collected if their locations willreasonably contribute to an awareness of threats.and. vulnerabilities, and intelligencecollection opportunities. Also, members of some communities may be potential
victims of civil rights crimes and, for this reason, cominunity location may aid
32

UNCLASSIFIED-FOR OFFICIAL USE.ONLY

UNCLASSIFIED - FOR OFFICIAL USE ONLY
Domestic Investigations and Operations Guide
enforcement of civil rights laws. Information about such communities should not becollected, however, unless the communities are sufficiently concentrated andestablished so as to provide a reasonable potential for intelligence collection thatwould support FBI mission programs (e.g., where identified terrorist subjects fromcertain countries may relocate to blend in and avoid detection).
-(U

ethnic/racial demographics. I

b2

b7E

c. (U) General ethnic/racial behavior. The authority to collect ethnic community
location information does not extend tothe collection of cultural and behavioral
information about an ethnic community that bears no rational relationship to a valid
investigative or analytical need. Every ethnic community in the Nation that has been
associated with a criminal or national security threat has a.dominant majority, of lawabiding citizens, resident aliens, and visitors who may share common ethnic behavior
but who have no connection to crime or terrorism (as either subjects or victims). For
this reason, a broad-brush collection of racial or ethniccharacteristics or behavior is
not helpful to achieve any authorized FBI purpose and may create the appearance ofimproper racial or ethnic profiling.
d. (U) Specific and relevant ethnic behavior. On the other hand, knowing the
behavioral and life style characteristics of known individuals who are criminals or
who pose a threat to national security may logically aid in the detection andprevention of crime and threats to the national security within the community andbeyond. Focused behavioral characteristics reasonably believed to be associated witha particular criminal or terrorist element of an ethnic community (not with thecommunity as a whole) may be collected and retained. For example, if it is known
through intelligence analysis or otherwise that individuals associated with an ethnicbased terrorist or criminal group conduct their finances by certain methods, travel in acertain manner, work in certain jobs, or come from a certain part of their homecountry that has established links to terrorism, those are relevant factors to consider
when investigating the group or assessing whether it may have a presence within a.
community. It is recognized that the "fit" between specific behavioral characteristics
and a terrorist or criminal group'is unlikely to be perfect-that is, there will bemembers of the group who do not exhibit the behavioral criteria as well as persons
who exhibit the behaviors who are not members of the group. Nevertheless, in orderto maximize FBI mission relevance and to minimize the appearance of racial oi
33
UNCLASSIFIED-FOR OFFICIAL USE ONLYUNCLASSIFIED - FOR OFFICIAL USE ONLY
Domestic Investigations and Operations Guide
ethnic profiling, the criteria used to identify members of the group within the larger
ethnic community to which they belong must be as focused and as narrow as
intelligence reporting and other circumstances permit. If intelligence reporting is
insufficiently exact so that it is reasonable to believe that the criteria will include an
unreasonable number of people who are not involved, then it would be inappropriate
to use the behaviors, standing alone, as the basis for FBI activity.
(U) Exploitive ethnic behavior. A related category of information that canrbe collected
is behavioral and cultural information about ethnic or racial communities that isreasonably likely to be exploited by criminal or terrorist groups who hide within thosecommunities in order to engage in illicit activities undetected. For example, the existenceof a cultural tradition of collecting funds from members within the community to'fundcharitable causes in their homeland at a certain time of the year (and how that isaccomplished) would be relevant if intelligence reporting revealed that, unknown tomany donors, the charitable causes were fronts for terrorist organizations or that terrorist
supporters within the community intended to exploit the unwitting donors for their owri
purposes.
4.4.

(U) Least Intisive Method

A. (U) Overview(U) The AGG-Dom requires that the "least intrusive".means or method be considered
and-if operationally sound and effective-used to obtain intelligence or evidence in lieu
of a more intrusive method. This principle is also reflected in Executive Order 12333,
which governs the activities of the United States intelligence community. The concept ofleast intrusive method applies to the collection of all intelligence and evidence. Regarding
the collection of foreign intelligence that is not collected as part of the FBI's traditional
national security or criminal missions, the-AGG-Dom provides that open and overt
collection activity must be used with United States persons if feasible.
(U) By emphasizing the use of the least intrusive means to obtain intelligence and evidence,
FBI employees can effectively execute their duties while mitigating potential negative
impacts on the privacy and civil liberties of all people encompassed within theinvestigation, including targets, itnesses, and victims. This principle is not intended to
discourage FBI employees from seeking relevant and necessary intelligence, information,or evidence, but rather is intended to encourage investigators to choose the least intrusivebut still effective-means from the available options,to obtain the material.
(U) This principle is embodied in statutes and DOJ policies on a variety of topics including
electronic surveillance, the use of tracking devices, the temporary detention of suspects,
and forfeiture. In addition, the concept of least intrusive method.can be found in case law
as a factor to be considered in assessing the reasonableness of an investigative method in
the face of a First Amendment or due process violation claim. See Clark v. Library ofCongress, 750 F;2d 89, 94 (D.C. Cir 1984); Alliance to End Repression v. City of Chicago,
627 F. Supp. 1044, 1055 (N.D. 11. 1985), citing Elrod v. Bums, 427 U.S. 347, 362-3(1976).

34
UNCLASSIFIED-FOR OFFICIAL USE ONLYUNCLASSIFIED - FOR OFFICIAL USE ONLY
Domestic Investigations and Operations Guide
B. (U) General Approach to Least Intrusive Method Concept(U) Applying the concept of least intrusive method to an investigative or intelligencecollection scenario is both a logical process and an exercise in judgment. It is logical in thesense that the FBI employee must first determine the relative intrusiveness of the methodthat would provide information:
1. (U) Relevant to the assessment or predicated investigation;
2. (U) Within the time frame required by the assessment or predicated investigation;
3. (U) Consistent with operational security and the protection of sensitive sources andmethods; and4. (U) In a manner that provides confidence in.the accuracy of the information.
(U) Determining the least intrusive method also requires sound judgment because it is clearthat the factors discussed above arenot fixed points on a checklist. They require carefulconsideration based on a thorough understanding of investigative objectives andcircumstances.
C. (U) Determining Intrusiveness(U) In determining intrusiveness, the primary factor should be the degree of procedural
protection that established law and the AGG-Dom provide for the use of the method. Using
this factor, search warrants, wiretaps, and undercover operations are very intrusive. By
contrast, investigative methods with limited procedural requirements, such as checks ofgovernment and commercial data bases and communication with established sources, areless intrusive.
(U) The following guidance is designed to assist FBI personnel in judging.the relativeintrusiveness of different methods:
1. (II) Nature of the information sought: Investigative objectives generally dictate thetype of information required and from whom, it should be collected. This subpart is notintended to.address the situation where the type of information needed and its location
are-clear so that consideration of alternatives would be pointless. When the option
exists, however, to seek information from any of a variety of places, it is less intrusive
to seek information from less sensitive and less protected places. Similarly, obtaining
information that is protected by-a statutory scheme (e.g., financial records)or anevidentiary privilege (e.g., attorney/client communications) is more intrusive thanobtaining information that is not so protected. In addition, if there exists a reasonable
expectation of privacy under the Fourth Amendment (i.e., private communications),
obtaining that information is more intrusive than obtaining information that is
knowingly exposed to public view as to which there is no reasonable expectation ofprivacy.
2. (U) Scope of the information sought: Collecting information regarding an isolated
event-such as a certain phone number called on a specific date or a single financialtransaction-is less intrusive or invasive of an individual's privacy than collecting acomplete communications or financial "profile." Similarly, a complete credit history isa more intrusive view into an individual's life than a few isolated credit charges. In
some cases, a complete financial and credit profile is exactly what the investigation
35
UNCLASSIFIED-FOR OFFICIAL USE ONLYUNCLASSIFIED - FOR OFFICIAL USE ONLY
Domestic Investigations and Operations Guide
requires (for example, investigations of terrorist financing or money laundering). If so,
FBI employees should not hesitate to use appropriate legal process to obtain suchinformation if thepredicate requirements are satisfied. It is also recognized that
operational security-such as source protection-may dictate seeking a wider scope of
information than is absolutely necessary for the purpose of protecting a specific target
or source. When doing so, however, the concept of least intrusive alternative still
applies. The FBI may obtain more data than strictly needed, but it should obtain no
more data than is needed to accomplish the operational security goal.
3. (U) Scope of the use of the method: Using a method in a manner that captures a
greater picture of an individual's or a group's activities is more intrusive than using thesame method or a different one that is focused in time and location to a specificobjective. For example, it.is less intrusive to use a tracking device to verify point-topoint travel than it is to use the same device to track an individual's movements over asustained period of time. Sustained tracking on public highways would be just as lawful
but more intrusive because it captures a greater portion of an individual's daily
movements. Similarly, surveillance by closed circuit television that checks a discrete
location within a discrete time frame is less intrusive than 24/7 coverage of a wider area.
For another example, a computer intrusion device that captures only host computer
identification informatioi is far less intrusive than one that capturesffile content.
4. (U).Source of the information sought: It is less intrusive to obtain information fromexisting government sources (such as state, local, tribal, international, or federal
partners) or from publicly-available data in commercial data bases, than to obtain thesame information from a third party (usually through legal process) that has aconfidential relationship with the subject-such as a financial or academic institution.
Similarly, obtaining information from a reliable confidential source who.is lawfully inpossession of the information and lawfully entitled to disclose it (such as obtaining an
address from an employee of a local utility company) is less-intrusive than obtaining
the information from an entity with a.confidential relationship with the subject. It is
recognized'in this category that the accuracy and procedural reliability of theinformation sought is an important factor in choosing the source of the information. For
example, even if the information is available from a confidential source, a grand jury
subpoena, national security letter (NSL), ex parte order, or other process may berequired in order to ensure informational integrity.
5. (U) The risk of public exposure: Seeking information about an individual or group
under circumstances that create a risk that the contact itself and the information sought
will be exposed to the individual's or group's detriment and/or embarrassmentparticularly if the method used carries no legal obligation to maintain silence-is more
intrusive than information gathering that does not carry that risk. Interviews with
employers, neighbors, and associates, for example, or the issuance of grand jury
subpoenas at a time when the investigation has not yet been publicly exposed are more
intrusive than methods that gather information covertly. Similarly, interviews of a
subjectin a discrete location would be less intrusive than an interview at, for example, aplace of employment or other location where the subject is kiown.
(U) There is a limit to the utility of this list of intrusiveness factors. Some factors may beinapplicable in a given investigation and, in many cases, the choice and scope of the36
UNCLASSIFIED-FOR OFFICIAL USE ONLYUNCLASSIFIED - FOR OFFICIAL USE ONLY
Domestic Investigations and Operations Guide
method will be dictated wholly by investigative objectives and circumstances. The
foregoing is not intended to provide a comprehensive checklist or even an overall
continuum of intrusiveness. It is intended instead to identify the factors involved in a
determination of intrusiveness and to attune FBI employees to select, within eachapplicable category, a less intrusive method if operational circumstances permit. In the end,
selecting the least intrusive method that will accomplish the objective is a matter of soundjudgment. In exercising such judgment, however, consideration of these factors should
ensure that the decision to proceed is well founded.
D. (U) Standard for Balancing Intrusion and Investigative Requirements(U) Once an appropriate method and its deployment have been.determined, reviewing andapproving authorities should balance the level of intrusion against investigativerequirements. This balancing test is particularly important when the information sought
involves clearly established constitutional, statutory, or evidentiary rights or sensitive
circumstances (such as obtaining information from religious, or academic institutions or
public fora where First Amendment rights are being exercised), but should be applied in all
circumstances to ensure that the least intrusive alternative feasible is being utilized.
(U) Balafcing the factors discussed above with the considerations discussed below will
help determine whether the method and the extent to which it intrudesinto privacy orthreatens civil liberties is proportionate to the significance of the case and the information
sought.
(U) Considerations on the investigative side of the balancing scale include the:
1. (U) Seriousness of the crime or national security threat;
2. (U) Strength and significance of the intelligence/information to be gained;.
3. (U) Amount of information already known about the subject or group underinvestigation; and4. (U).Requirements of operational security, including protection of sources and methods.
(U) If, for example, the threat is remote, the individual's involvement is speculative, and the
Sprobability of obtaining probative information is low, intrusive methods may not bejustified, i.e., they may do more harm than good. At the other end of the scale, if the threat
is significant and possibly imminent (e.g., a bomb threat), aggressive measures would beappropriate regardless of intrusiveness.
(U) In addition, with respect to the investigation of a group, if the terrorist or criminal
nature of the group and its membership is well established (e.g., al Qaeda, Ku Klux Klan,
Colombo Family of La Cosa Nostra), there is less concern that pure First Amendment
activity is at stake than there would be for a group whose true character is not yet known(e.g., an Islamic charity suspected of terrorist funding) or many of whose members appear.to be solely exercising First Amendment rights (anti-war protestors suspected of being
infiltrated by violent anarchists). This is not to suggest that investigators should be lessaggressive in determining the true nature of an unknown group, which may be engaged in
terrorism or other violent crime. Indeed, a more aggressive and timely approach may be inorder to determine whether the group is violent or to eliminate it as a threat. Nevertheless,when First Amendment rights are at stake, the choice and use of investigative methods
37
UNCLASSIFIED-FOR OFFICIAL USE ONLYUNCLASSIFIED - FOR OFFICIAL USE ONLY
Domestic Investigations and Operations Guide
should be focused in a manner that minimizes potential infringement of those rights.
Finally, as the investigation progresses and the subject's or group's involvement becomes
clear, more intrusive methods may be justified. Conversely, if reliable information emerges
refuting the individual's involvement or the group's criminal or terrorism connections, theuse of any investigative methods must be carefully evaluated.
(U) Another consideration.to be balanced is operational security. Is it likely that if a lessintrusive but feasible method were selected, the subject would detect its use and alter his
activities-including his means of communication-to thwart the success of the operation.
Operational security-particularly in national security investigations-should not be
undervalued and may, by itself, justify covert tactics which, under other circumstances,would not be the least intrusive.
E. (U) Conclusion(U) The foregoing guidance is offered to assist FBI employees in navigating the often
unclear course to select the least intrusive investigative method that effectively
accomplishes the operational objective at hand. In the final analysis, the choice of method
and balancing of the impact on privacy and civil liberties with operational needs is a matterof judgment, based on training and experience. Pursuant to the AGG-Dom, other applicablelaws aid policies, and this guidance; FBI employees may use any lawful-method allowed,
even if intrusive, where the intrusiveness is warranted by the threat to the national security
or to potential victims of crime and/or the strength of the information indicating its
existence.

38
UNCLASSIFIED-FOR OFFICIAL USE ONLYUNCLASSIFIED - FOR OFFICIAL USE ONLY
Domestic Investigations and Operations Guide

5. (U) Assessments
5.1.

(U) Overview(U//FOUO) The Attorney General'sGuidelinesfor Domestic FBI Operations(AGG-Dom)combine "threat assessments" under the former Attorney General'sGuidelinesfor FBINational
Security Investigations andForeignIntelligence Collection and the "prompt and extremely
limited checking out of initial leads" under the former Attorney General's Guidelineson General
Crimes, Racketeering Enterpriseand Terrorism EnterpriseInvestigationsinto a newinvestigative category entitled "assessments." All assessments must either be opened,in an
investigative classification as an assessment file (e.g.,b. placed in ali ae.g.,[in arnI

b2[Guardian]), or placed

b7E[ as discussed in greater detail below.

(U//FOUO) Note: In the DIOG, the word "assessment" has two distinct meanings. The AGGDom authorizes as an investigative activity an "assessment" which requires an authorizedpurpose as discussed in this section of the DIOG. The USIC, however, also uses the word
"assessment" to describe written intelligence products, as discussed in DIOG Section 15.7.B.
(U)-Assessments authorized under the-AGG-Dom do not require a particular factual-predication
but do require an authorized purpose. Assessments may be carried out to detect, obtain
information about, or prevent or protect against federal crimes or threats to the national security
or to collect foreign intelligence. (AGG-Dom, Part II and Part II.A)(U//FOUO) Although "no particular factual predication" is required, the basis of an assessment
cannot be arbitrary or groundless speculation, nor can an assessment be. based. solely on theexercise of First Amendment protected activities or on the race, ethnicity, nationalorigin or
religion of the subject. Although difficult to define, "no particular factual predication" is lessthan "information or allegation" as required for the initiation of a preliminary investigation. For
example, an assessment may be conducted when there is a basis to know: (i) whether more
information or facts are required to determine if there is a criminal or national security threat;and (ii).there is a rational' and articulable relationship between the stated authorized purpose of
the assessment on the one hand and the information sought and the proposed means to obtain that
information on the other. Regardless of whether specific approval or specific documentation isrequired, an FBI employee should be able to explain the purpose of an assessment and the reason
for the methods used to conduct the assessment. Those FBI employees who conduct assessments
are responsible for assuring that assessments are not pursued for frivolous or improper purposes
and are not based solely on First Amendment activity or on the race, ethnicity, national origin, or
religion of the subject of the assessment. (AGG-Dom, Part II)(U//FOUO) An FBI employee can search historical information already contained within: (i) FBI
data systems; (ii) United States Intelligence Community (USIC) systems to which
FB,employee has access (e;g..T;.(iii) any other United States Government database towhich an FBI employee has access; and (iv) the FBI employee can also conduct open-source
Internet searches without initiating an assessment (open-source Internet searches do not include
any paid-for-service databases such as Lexis-Nexis and Choicepoint), as further discussed in
Section 5.6.A.1 and Section 15. The use of such paid-for-service databases requires the initiation.
of an assessment or predicated investigation. This allows the FBI employee to possibly resolve a
39
UNCLASSIFIED-FOR OFFICIAL USE ONLYbab2

UNCLASSIFIED - FOR OFFICIAL USE ONLY
Domestic Investigations and Operations Guide
matter without the need to conduct new investigative activity and'open an assessment.
Additionally, through analysis of existing information, the FBI employee may produce productsthat include, but are not limited to. an Intelligence Assessment, Intelligence Bulletin andIf,'while conducting analysis, the FBI employee finds a gap
in intelligence that is relevant to an authorized FBI activity, the FBI employee can identify thegap for possible evelopment of a "collection requirement." The applicable I
I
I(or other.
las directed in the DI PG) must be used to
document this analysis. See the Directorate of Intelligence (DI) PG for file classification
guidance.
5.2.

b2
b7E

(U) Purpose and Scope(U//FOUO) The FBI cannot be content to wait for leads to come in through the actions of others;
rather, we must be vigilant in detecting criminal or national security threats to the full extent
permitted by law, with an eye towards early intervention and prevention of criminal or national
security incidents before they occur. For example, to carry out its central mission of protecting
the national security, the FBI must proactively collect information from available sources inorder to identify threats and activities and to inform appropriate intelligence analysis. Collection
required to inform such analysis will appear as FBI National Collection Requirements and FBI
Field Office-Collection-Requirements. Likewise, in the exercise of its protective-functions, theFBI is not constrained to wait until information is received indicating that a particular event,activity or facility has drawn the attention of would-be perpetrators of terrorism. The proactive
authority conveyed to the FBI is designed.for, and may be used by, the FBI in the discharge ofthese responsibilities. The FBI may also conduct assessments as part of its special events
management responsibilities. (AGG-Dom, Part II)(U) More broadly, detecting and interrupting criminal activities at their, early stages, andpreventing crimes from occurring in the first place, is preferable to allowing criminal plots tocome to fruition. Hence, assessments may also:be undertaken proactively with such objectivesas
detecting criminal activities; obtaining information on individuals, groups, or organizations ofpossible investigative interest, either because they may be involved in criminal or national
security-threatening activities or because they may be targeted for attack or victimization in suchactivities; and identifying and assessing individuals who may have value as confidential humansources. (AGG-Dom, Part.II).
(U//FOUO) As described in the below-scenarios, assessments may be used when an "allegation
or information" or an "articulable factual basis" (the predicates for predicated investigations)concerning crimes or threats to the national security is obtained and the matter can be checkedout or resolved through the relatively non-intrusive methods authorized in assessments (use ofleast intrusive means). The checking of investigative leads in this manner can avoid the need toproceed to more formal levels of investigative activity (predicated investigation), if the results ofan assessment indicate that further investigation is not-warranted. (AGG-Dom, Part II)
Hypothetical fact-patterns are discussed below:
A. (U//FOUO
b2
b7E

40
UNCLASSIFIED-FOR OFFICIAL USE ONLYUNCLASSIFIED - FOR OFFICIAL USE ONLY
Domestic Investigations and Operations Guide. (The FBI employee can analyze historical information already(U//FOUO)
contained within: (i FBI data systems; (ii) USIC systems to which FBI employees haveaccess (e.gl);.(iii) any other United States Government
database to which anFBI employee has access; and (iv) can conduct open-source Internet
searches without initiating an assessment. Open-source Internet.searches do not include any

b2
b7E

paid-for-service databases such as Lexis-Nexis and-Choicepoint.

(U//FOUO
B. (U//FOUO)

..-

b2
b7E

(U//FOUO)|

C. (U//FOUO)(U//FOOO.
bE(U//FOUO)b2b2

D. U/FOUO)

b7E

41
UNCLASSIFIED-FOR OFFICIAL USE ONLYUNCLASSIFIED - FOR OFFICIAL USE ONLY
Domestic Investigations and Operations Guideb2
b7E. (U//FOUO)(U//FOUO}
b2
b7E(U//FOUO /F(U//FO.UO)

b2
'b7E

(U//FOUO)

42

UNCLASSIFIED-FOR OFFICIAL USE ONLYUNCLASSIFIED - FOR OFFICIAL USE ONLY
Domestic Investigations and Operations Guide(U//FOUO,

G. (Uj//FOUO

.b2

b7E

(U//FOUOf(U//FOUO

H. (U//FOUO
b2_-(U//FOUO)

.

.

-b7E

(U//FOUO)

I. (U//FOUO

S'b2
b7E

(U//FOUO(U//FOUO

5.3.

.

(U) Civil Liberties and Privacy(U) The.pursuit of legitimate goals without'infringing upon the exercise of constitutional
freedoms is a challenge that the FBI meets through the application of sound judgment anddiscretion. In order to ensure that civil liberties are not undermined by the conduct ofassessments, every assessment under this subsection must have an authorized purpose and an
identified objective. The purpose and objective of the assessment mustbe documented andretained as described in this section and in DIOG Section 14.
(U) Even when an authorized purpose is present, an assessment could create the appearance that
it is directed at or activated by constitutionally protected activity, race, ethnicity, national origin
43
UNCLASSIFIED-FOR OFFICIAL USE ONLYUNCLASSIFIED -.FOR OFFICIAL USE ONLY
Domestic Investigations and Operations Guideor.religion-particularly under circumstances where the link to an authorized FBI mission is notreadily apparent. In these situations, it is vitally important that the authorized purpose and theunderlying reasons for conducting the assessment and engaging in the proposed methods are well
documented.
(U) No investigative activity, including assessments, may be taken solely on thesbasis ofactivities that are protected by the First Amendment or onthe race, ethnicity, national origin or
religion of the subject. If an assessment touches on or is partially motivated by First Amendment
activities, race, ethnicity, national origin or religion, it is particularly important to identify anddocument the basis for the assessment with clarity.
(U//FOUO) Example: Individuals or groups who communicate with eachother or with members of the public in any form in pursuit of social orpolitical causes-such as opposing war or foreign policy, protesting
government actions, promoting certain religious beliefs, championing
particular local, national, or international causes, or a change in government
through non-criminalmeans, and actively recruit others to join their causeshave a fundamental constitutional right to do so. An assessment may not be
initiated based solely on the exercise of these First Amendment rights. If,
however, a group exercising-its First Amendment rights also threatens or
advocates violence or destruction of property, an assessment would beappropriate.
(U) The AGG-Dom require that the "least intrusive" means or method be considered and-if
operationally sound and effective-used in lieu of more intrusive methods to obtain intelligence
and/or evidence. This principle is also reflected in Executive Order 12333, which governs theactivities of the USIC. Executive Order 12333 lays out the goals, directions, duties andresponsibilities of the USIC. The concept of least intrusive means applies to the collection of all.intelligence and evidence, not just that collected by those aspects of the FBI that are part of theintelligence community.
(U) By emphasizing the use of the least intrusive means to obtain intelligence and/or evidence,
FBI employees can effectively execute their duties while mitigating the potential negative impact
on the privacy and civil liberties and the damage to the reputation of all people encompassed
within the investigation or assessment, including targets, witnesses, and victims. This principle is
not intended to discourage FBI employees from seeking relevant and necessary intelligence,
information, or evidence, but rather is intended to encourage FBI employees to choose the least
intrusive-but still effective -means from the available options to obtain the information.
(AGG-Dom, Part 1.C.2)
5.4.

(U) Authorized Purposes (AGG-Dom, Part II.A.2.-Authorized Activities)

A. (U) Assessment Activities: During an assessment, the FBI may:
1. (U) Seek information, proactively or in response to investigative leads, relatirigto
activities constituting violations of federal criminal law or threats to the national security;
2. (U) Seek information, proactively or in response to investigative leads, relating to theinvolvement or role of individuals, groups, or organizations relating to activities
constituting violations of federal criminal law or threats to the national security;
44.
UNCLASSIFIED-FOR OFFICIAL USE ONLYUNCLASSIFIED - FOR OFFICIAL USE ONLY
Domestic Investigations and Operations Guide
3. (U) Identify and obtain information about potential targets of or vulnerabilities tocriminal activities in violation of federal law or threats to the national security;
4. (U) Obtain informatibn to inform or facilitate intelligence analysis and planning (AGGDom, Part IV);
5. (U) Seek information to identify potential human sources, assess the suitability,
credibility, or value of individuals as human sources, validate human sources, or maintainthe cover or credibility of human sources, who may be able to provide or obtain
information relating to criminal activities in violation of federal law, threats to thenational security, or matters of foreign intelligence interest; and6. (U) Seek. information, proactively or in response to investigative leads, relating to mattersof foreign intelligence interest responsive to'foreign intelligence requirements.
5.5.

(U//FOUO) Standards for Initiating or Approving an Assessment(U//FOUO) Before initiating or approving an assessment, an FBI employee or approving official
must determine whether:A. (U//FOUO) An authorized purpose and objective exists for the conduct of the assessment;
B. (U//FOUO) The assessment is based on factors other thaii the exercise-of-First Amendment
activities or theriace, ethnicity, national origin or religion of the subject; andC. (U//FOUO) The assessment is an appropriate use of personnel and financial resources.
5.6. (U) Duration, Approval, Notice, Documentation,File Review and.Responsible
Entity(U//FOUO) FBIHQ and FBI Field Offices have the authority to conduct all assessment activities,as authorized in Section 5.4. Field Office personnel and approving officials, as specified in the.
DIOG Section 5.6.A.1-6, equate to the following FBIHQ personnel and approving officials when
FBIHQ initiates, conducts, or closes an assessment:* (U//FOUO) Field Office Analyst or Special Agent (SA) = FBIHQ Analyst, SA, or
Supervisory Special Agent (SSA);** (U//FOUO) Field Office Supervisory Intelligence Analysts (SIA) = FBIHQ SIA;
* (U//FOUO) Chief Division Counsel (CDC) = FBIHQ Office of the General Counsel(OGC);* (U//FOUO) Field Office SSA = FBIHQ Unit Chief (UC); and* (U//FOUO) Special Agent in Charge (SAC) = FBIHQ Section Chief (SC).
A. (U//FOUO) Duration, Approval, Notice, Documentation, File Review and Responsible
Entity: An FBI employee must document on the FD-71 or in Guardian the use of or therequest and approval for the use of authorized investigative methodsin type 1 and 2
assessments (see DIOG Section 5.6.A. 1 and 2, below). By exception, certain assessment type
I and 2 situations may require the use of an electronic communication (EC) to document theuse and approval of particular investigative methods. All type 3, 4, and 6 (see DIOG Section
5.6.A.3.4. and 6, below) assessments and authorized investigative methods requiring

45
UNCLASSIFIED-FOR OFFICIAL USE ONLYUNCLASSIFIED - FOR OFFICIAL USE ONLY
Domestic Investigations and Operations Guide
supervisory approval must use an EC to document the approval of the assessment and therequest and approval for the use of an applicable investigative method.
(U//FOUO) For type 5 assessment activities, an FBI employee must follow the duration,
approval, and other requirements specified in the FBI's Confidential Human Source Policy
Manual (CHSPM), Confidential Human Source Validation Standards Manual (CHSVSM),
and The Attorney General s Guidelines Reairdinvthe Use ofFBI ConfidentialHuman
Sources (AGG-CHS), as implemented i
All type 5 assessment activities under thisprovision must be documented in[ unless otherwise directed in the DI PG or'other
FBIHQ Division PGs. If there is any inconsistency between the CHSPM or CHSVSM andthe DIOG, the DIOG controls and OGC should be immediately notified of the conflict.
(U//FOUO) Listed below are the applicable duration, documentation, justification/file review,
approval level; and responsible entity for each type of'assessment, described in'DIOG
Section 5.4 above.
1. (U//FOUO) Seek information, proactively or in response to investigative leads,
relating to activities constituting violations of federal criminal law or threats to thenational'security (e.g., the prompt checking of leads on individuals or activity).

b2

b7E

(U//FOUO) Duration: There is no time requirement for this type of assessment, but it isanticipated that such assessments will be relatively short. These assessments require
recurring 30-day justification reviews by the SSA orSIA as discussed below.
(U//FOUO) Documentation: Guardian will be used for
She electronicb2

D-1 1, as discussed below, must e used tob7E.

[D-71 or
Guardian["

S(U//FOUO) Approval: An FBI employeemay initiate an assessment under thissubsection without supervisory approvalpan FD-71 or Guardian

b2
b7E

FD-71
or Guardian. The initiation date for this type of assessment is the date the SSA or SIA

assigns an FBI employee to conduct the assessment.
(U//FOUO)As soon as practicable following the determination that this type ofassessment involves a sensitive investigative matter, the matter must be brought to the
CDC for review and to the SAC for approval to. continue the assessment. The term
"sensitive.investigative matter" is defined in Section 5.7 and Section 10!the FD-71 or GuardianI
IHigher supervisory approval, as described in Section 5.9, may be required

before using one or more of the following investigative methods: physical surveillance,
certain interviews, and tasking of confidential human sources. In addition, as specified in
the Division policy implementation guides (PG), there are agreements.(e.g., Memoranda

46
UNCLASSIFIED-FOR OFFICIAL USE ONLY

b2

.b7E

*UNCLASSIFIED - FOR OFFICIAL USE ONLY
Domestic Investigations and Operations Guide
particular coordination prior toof Agreements/Understanding, Treaties) that may require
government information.
the release/acquisition of federal, state, local, tribal, and foreign
is not concluded within 30(U//FOUO) Justification Review: If this type of assessment
reviews in accordancedays, the SSA or SIA must conduct recurring 30-day justification
with Section 3.4. This justification review must:the authorized purpose anda. (U//FOUO) Evaluate the progress made toward achieving
objective;
30 days were appropriate;b. (U//FOUO) Ensure activities that occurred during the priorinformation will bec. (U//FOUO) Determine whether it is reasonably likely thatwarranting an extension
therebyobjective,
obtained that is relevantto the authorized
for another 30-days;
developed to justifyd. (U//FOUO) Determine whether adequate predication has been
or weapons of mass
cyber,
opening a criminal, counterterrorism, counterintelligence,
destruction predicated investigation; and'e. (U//FOUO).Determine whether the assessment should be terminated.
(U//FOUO)The FBI employee must-ensure thatin the FD-71 or Guardian. The completed FD-71 or Guardianor Guardian must also
requires supervisory approval before being uploaded. The FD-71
that requires
document supervisory approval for the use of any investigative methodofor tasking confidential
approval, such as: physical surveillance; certain interviews;
Division PG, there
human sources (see DIOG Section 5.9). In addition, as specified in theare agreements (e.g., Memoranda of Agreements/Understanding, Treaties) that may
state, local,
require particular coordination prior to the release/acquisition of federal,f.;lnnqnr fhrpion iovernrinent information.F.

bE[wihine appropnareclassification as described in Section 5.14.
by the appropriate(U//FOUO) Responsible Entity: This type of assessment is conducted
substantive Field Office Squad.

ITImnn/ T

I

47
UNCLASSIFIED-FOR OFFICIAL USE ONLY'"b2

UNCLASSIFIED - FOR OFFICIAL USE ONLY
Domestic Investigations and Operations Guide
access, he/she can also review already existing data contained in any United States
Government data system and search open source information on the Internetl
1 Open-source Internet searches do not include any paid-for7|
service databases suchnas Lexis-Nexis and ChoicepointJ .
If these
database checks or open source Internet searches do not reveal' any derogatory
information, the FBI employee may terminate this activity without opening an assessment
or documenting these activities on an FD-71.
(U//FOUO)J
b2
b7E

Iand complete an FD-t-7.

,

2. (U//FOUO) Seek information, proactively or in response to investigative leads,
relating to the involvement or role of individuals, groups, or organizations in
activities constituting violations of federal criminal law or threats to the national
security (e.g.,'the prompt checkingof leads on groups or organizations).
(U//FOUO) Duration: There is no time requirement for this type of assessment, but it isanticipated that such assessments will be relatively short. These assessments require
recurring 30-day justification reviews by the'SSA or SIA as discussed below.
- T//pF

c

Documentation: Guardian
iThe electronic FD-71,1
FD-71 orb2
b7E

Guardiard(U//FOUO) Approval: An FBI employe may initiate an assessment under thisubsection without supervisory approval,

Slan
__-

__....

tU -yi or f art -u,the FD-71

or Guardian. Theinitiation date for this type of assessment is the date the SSA or SIA
assigns an FBI employee to conduct the assessment(U//FOUO) As soon as practicable following the determination that this type ofassessment involves a sensitive investigative matter, the matter must be brought to the
CDC for review and to the SAC for approval to continue the assessment. The term
"sensitive investigative matter" is defined in Section 5.7 and Section 10. Whencorhpleting the FD-71 or Guardian lead for an assessment involving a sensitive48
UNCLASSIFIED-FOR OFFICIAL USE ONLY

1

UNCLASSIFIED - FOR OFFICIAL USE ONLY
Domestic Investigations and Operations Guideb2
b7

5.9 may be required before
SHigher supervisory approval, as described in Section
surveillance, certain
physicalmethods:
using one or more of the following investigative
specified in theasaddition,In
interviews, and tasking of confidential human-sources.
Agreements/Understanding,
Division PGs, there are agreements (e.g., Memoranda ofrelease/acquisition ofTreaties) that may require particular coordination prior to theinformation.
federal, state, local, tribal and foreign government
is not concluded within 30(U//FOUO) Justification Review: If this type of assessment
justification reviews in accordancedays, the SSA or SIA must conduct recurring 30-day
with Section 3.4. This justification review must:achieving the authorized purpose anda. (U//FOUO)'Evaluate the progress made toward
objective;prior 30 days were appropriate;b. (U//FQUO) Ensure activities that occurred during thethat information will bec. (U//FOUO) Determine whether it is reasonably likely
warranting an extension
therebyobjective,
obtained that is relevant to the authorized
for another 30-days;
developed-to justifyd. (U//FOUO) Determine whether adequate pfedication has-been or weapons of mass
cyber,
opening a criminal, counterterrorism, counterintelligence,*destruction predicated investigation; andbe terminated.
e. (U//FOUO) Determine whether the assessment should(U//FOUO) The FBI employee must ehsure tha
in the FD-71 or Guardian. The completed FD-71 or uardianSI
must also
requires supervisory approval before being uploaded. The FD-71 or Guardian
requiresthat
methodinvestigative
any
of
use
the
for
document supervisory approvalor tasking of confidential
approval,such as:.physical surveillance; certain interviews;in the Division PGs, there are
specifiedasaddition,In
5.9).
Sectionhuman sources (seethat may require
agreements (e.g., Memoranda of.Agreements/Understanding, Treaties)
tribal andstate,local,
federal,particular coordination prior to the release/acquisition offoreign government information.

(U//FOUO) Responsible Entityi This type of assessment issubstantive Field Office Squad.

b2
b7E

conducted by the appropriate(TT//FPO ]
b2
Sb7E

49
UNCLASSIFIED-FOR OFFICIAL USE ONLYUNCLASSIFIED - FOR OFFICIAL USE ONLY
Domestic Investigations and Operations Guide( /FOUOI

b2
b7E-

M T//F O]_T__--_

of.or vulnerabilities to
3. (U) Identify and.obtain information about potential targets
criminal activities in violation of federal law or threats to the national security.
designed to collect(U//FOUO) Assessments in this section may include activities
of or vulnerabilities
targets
identifyingonfocusedisthat
analysis
information for domain
Domainto criminal conduct or threats to the national security. FBIHQ directed National
Management
Assessments must be coordinated in advance with the FBIHQ DI, Domain
Section (DMS).See the DI PG for details.
collecting(U//FOUO) This type of assessment may not be used for the purpose ofcollected
incidentallybemayintelligencesuch
positive foreign intelligence, althoughcollectedbeduring this type of assessment. Positive foreign intelligence can only
pursuant to Section 5.6.A.6 and Section 9.
purpose only
(U//FOUO) Duration: An FBI employee may initiate an assessment for thisdate thetheisassessment
the
of
date
effective
with prior SSA or SIA approval. The
as necessary tosupervisor approves the EC. Such an assessment may continue for as long
EC mustclosing
a
met,
been
has
objectivetheWhenachieve its purpose and objective.
file.
the
to
uploaded
be approved by the SSA or SIA andof assessment and the(U//FOUO) Documentation: The approval to initiate this type
rcqt.t fnr nn rnvl to ,se annlicable investigative methods must be documented

in an

subsection must be(U//FOUO) Approval: All assessments conducted.pursuant to thisapproved in advance by an SSA or SIAand be opened in either the appropriatel'as directed in the DI PG) or theI(or otherI
an opening
appropriate substantive investigative classification as an assessment file with
and"Assessment,"word
thecontainmust
EC. The title/case caption of the opening EC
time
the
at
If
assessment.
theofobjective
the synopsis must identify the purpose and theinvestigative
sensitiveainvolves
assessmentof the opening, or at anytime thereafter, thematter, the title/case caption must contain the words "Assessment" and "Sensitive
Investigative Matter."file reviews(U//FOUO) File Review: This type of assessment requires recurring 90-day Section 3.4.
withaccordance
in
SIA
or
ofthe assessment file and any sub-file by the SSA
50
UNCLASSIFIED-FOR OFFICIAL USE ONLY

b7E

UNCLASSIFIED - FOR OFFICIAL USE ONLY
Domestic Investigations and Operations Guide
Investigative file reviews for probationary FBI employees are recommended every
30
days but must be conducted at least every 60 days. This file review must:a. (U//FOUO) Evaluate the progress made toward achieving the authorized purpose
andobjective;b. (U//FOUO) Determine whether it is reasonably likely that information willbeobtained that is relevant to the.authorized objective, thereby warranting an extension.for another 90 days (at least every 60 days for probati6nary FBI employees);c. (U//FOUO) Determine whether adequate predication has been developed tojustify
opening a criminal, counterterrorism, counterintelligence, cyber, or weaponsof mass
destruction predicated investigation; andd. (U//FOUO) Determine whether the assessment should be terminated.
(U//FOUO) An SSA or SIA may approve an assessment under this subsectioninaccordance with the standards listed in the DIOG Section 5.5. However,if the assessment
involves a sensitive investigative matter, then the initiation requires prior CDC
reviewand SAC approval. If a sensitive investigative matter arises after the initiationof anassessment, investigative activity must-ceaseuntilCDC-review and SAC approval-isacquired. The term "sensitive investigative-matter" is defined in Section
5.7 and Section
10. Higher supervisory approval, as described in Section 5.9, may be required
prior to useof the following investigative methods: physical surveillance, certain
interviews, andtasking of confidential human sources. In addition, as specified in-the Division
PGs, there
are agreements (e.g., Memoranda of Agreements/Understanding, Treaties)
that mayrequire particular coordination prior to the release/acquisition of federal,state, local,
tribal and foreign government information.
(U//FOUO) Any collection undertaken in order to identify threats, vulnerabilities,
or
intelligence gaps identified as a result of domain analysis or in responseto an FBI
National Collection Requirement or FBI Field Office Collection Requirement
must' beaddressed
in a separate substantive

assificatinaes

cording to theinvestigative matter (e.g.
Additionally, any
time an assessment begin
u a paculariniviuaaseparate
substantive.
classification assessment file or subfile, as appropriate, according to theinvestigative
matter must be opened on the individual.
(U//FOUO) Responsible Entity: In general, the Field Intelligence Group (FIG) or
FBIHQ DI will manage this type of assessment, regardless ofwhethr

th

ncc

ntis

documented in a(orotherasdirected in the DI ru) or a substantive investigative classiication
file. This includes
substantive assessments danalysis produced and documented id(or otheras directed in the DI PG). Under the managementof the Fl, sustanive eld Oice Squads can support the collectionof information forthis type of assessment. However, substantive Field Office Squads
or FBIHQ Units will
be responsible for initiating and managing particular kinds of type3 assessments. These
assessments will be documented in the appropriate substantive investigativeclassification
file.

51
UNCLASSIFIED-FOR OFFICIAL USE ONLY

b7E

UNCLASSIFIED - FOR OFFICIAL USE ONLY
Domestic Investigationsand Operations Guide(U//FOUO

b2

b7E(U//FOUO)l

I
b2
b7E

(U//FOUQ
b2
b7E

4. (U//FOUO) Obtain information to inform or facilitate intelligence analysis andplanning. rAGG-Dom. Part IV(U//FOUO) Assessments in this section may include activities designed to collectinformation for domain analysis in order to respond to an FBI National Collection,Requirement or FBI Field.Office Collection Requirement created in response to FBI
operational needs or an intelligence gap identified.through strategic analysis that was
conducted as part of the FBI's national security or law'enforcement responsibilities, as
discussed in Sections 5.11 and 5.12. FBIHQ directed National Domain Assessmentsmust
be coordinated in advance with the FBIHQ DI, Domain Management Section (DMS).
See
the DI PG for details.
(U//FOUO) This type of assessment may not be used for the purpose of collecting
positive foreign intelligence, although such intelligence may be incidentally collectedduring this type of assessment. Positive foreign intelligence can only be collectedpursuant to Section 5.6.A.6 and Section 9.
(U//FOUO) Duration: An FBI employee may initiate an assessment for this purpose onlywith prior SSA or SIA approval. The effective date of the assessment is thedate thesupervisor approves the EC. Such an assessment may continue for as long asnecessary toachieve its purpose and objective. When the objective has.been met, a closing
EC mustbe approved by the SSA or SIA and uploaded to the file.
(U//FOUO) Documentation: The approval to initiate this type of assessment
and therequest for approval to use applicable investigative methods must be documented in an
EC. This type of assessment may be documented in either the appropriateb2Io_(korotheras directed in the DI PG) or theb7appropriatesubstantive investigative classification assessment file.

52
UNCLASSIFIED-FOR OFFICIAL USE ONLYUNCLASSIFIED - FOR OFFICIAL USE ONLY
Domestic Investigations and Operations Guide(U//FOUO) Approval: All assessments conducted pursuant to this subsection
approved in advance by an SSA or SIA and be onenep.
(or other[must ben either the appropriaten[lmdire tpr in thi DT rn\
b2
b7E(U//FOUO) File Review: This type of assessment requires recurring 90-day filereviews
ofthe assessment file and any sub-file by the SSA.or SIA in accordancewith DIOG
Section 3.4. Investigative file reviews for probationary FBI employees arerecommended
every 30 days but must be conducted at least every 60 days. This file review
must:
a. (U//FOUO) Evaluate the progress made toward achieving the authorizedpurpose andobjective;b. (U//FOUO) Determine whether it is reasonably likely that information willbeobtained that-is relevant to the authorized objective, thereby warranting an extension
for another 90 days (at least every 60 days for probationary FBI employees);c. (U//FOUO) Determine whether adequate predication has been developed
to justify
opening a criminal, counterterrorism, counterintelligence, cyber, or weaponsof mass
destruction predicated investigation;, andd. (U//FOUO) Determine whether the-assessment should be terminated.
(U//FOUO) An SSA or SIA may approve an.assessment tinder this subsectioninaccordance with the standards listed in the DIOG Section 5.5. However, if
the assessment
involves a sensitive investigative matter, then the initiation requires prior CDC
reviewand SAC approval. If a sensitiverinvestigative matter arises after the
initiation of anassessment, investigative activity must cease until CDC review and SAC
approval isacquired. The term "sensitive investigative matter" is defined in Section
5.7 and DIOG
Section. 10. Higher supervisory approval, as, described in Section 5.9, may
be required
before using the, fdllowing investigative methods: physical surveillance, certain
interviews, and tasking of confidential human sources. In addition, as specified
in theDivision PGs,.there are agreements (e.g., Memoranda of Agreements/Understanding
Treaties) that.may require particular coordination prior to the release/acquisitionoffederal, state, local, tribal and foreign government, information.
(U//FOUO) Any collection undertaken in order to identify
threats, vulnerabilities, or
intelligence gaps identified as a result of domain analysis or in responseto an FBI
National Collection Requirement or FBI Field Office Collection Requirement
must beaddressed in a separate substantive classification a.se.rnpnt
fi,
cording to theinvestigative matter v(e.g.Additionally,anyb..,*-,. n° 'eginsl______
Additionally, any
b7E
time an assessment begins
to focus on aparticular individual, a separate
classification assessment file or subfile, as.appropriate, according to the substantive
investigative
matter must be opened on the individual.

53
UNCLASSIFIED-FOR OFFICIAL USE ONLYUNCLASSIFIED - FOR OFFICIAL USE ONLY
Domestic Investigations and Operations Guide(U//FOUO) Responsible Entity: The FIG or FBIHQ DI will manage this type ofassessment, regardless of whether the assessment is-documented in an
(or
other
as directed in the DI PG) or a substantive investigativeclassification file. This includes substantive assessments derived from aalysis produced

and documented in,(or otherb2b7E

as directed in the

DI PG). Under the management of the FIG, substantive Field Office Squads can support
the collection of information in this type of assessment.

(U//FOUO)

I

b2
b7E

(U//FOUO)

|

b2

b7E

(U//FOUO)
b2*
b7E

5. (U//FOUO) Seek information to identify potential human sources, assess thesuitability, credibility, or value of particular individuals as human sources,
validatehuman sources, or maintain the cover or credibility of human sources, who
may beable to provide or obtain information relating to criminal activities in violationoffederal law, threats to the national security, or matters of foreign
intelligenceinterest.
(U//FOUO) Duration: All such activities must follow the policy requirements
established in the FBI's Confidential Human Source Policy Manual (CHSPM),
Confidential Human Source Validation Standards Manual (CHSVSM), and The
Attorney
General 's Guidelines Regardin thee ofFBI Confidential Human Sources (AGCHS), and implemented inrl
If there is any inconsistency between the CHSPM or

54
UNCLASSIFIED-FOR OFFICIAL USE ONLYb2

UNCLASSIFIED - FOR OFFICIAL USE ONLY
Domestic Investigations and Operations GuideCHSVSM and the DIOG, the DIOG controls and OGC should be immediately notifiedofthe conflict.
(U//FOUO) Documentation:I ~ must be used to document allactivities
under thisprovision, unless otherwise directed in the DI PG or other FBIHQ Division
PGs.
(U//FOUO) Approval: All approvals must follow the policy requirements established in
the FBI's CHSPM, CHSVSM, and the AGG-CHS, and as implemented in-(U//FOUO) File Review: File reviews must be conducted in accordance with.the FBI's
CHSPM.

b2'b7E(U//FOUO) Responsible Entity: A FIG or substantive squad may conduct and manage
this type of assessment.
6. (U//FOUO) Seek information, proactively or in response to investigative leads,
relating to matters of foreign intelligence interest responsive to foreign intelligencerequirements.
(U//FOUO) Foreign Intelligence is "information relating to the capabilities, intentions,oractivities of foreign governments or elements thereof, foreign organizations,orforeignpersons, or international terrorists." The FBI defines a foreign intelligencerequirement tobe a collection requirement issued by the United States Intelligence Community(US1C)
and accepted by the FBI DI. The collection of foreign intelligence pursuant
to thisdefinition extends the sphere of the FBI's information-gathering activities
beyondcrimes and threats to the national security, and permits the FBI to seek information federal
regarding a broader range of matters relating to.foreign powers, organizations,or persons
that may be of interest to the.conduct of the United States' foreign affairs. (AGG-Dom,
Introduction A.3)
(U//FOUO) Under this authorized purpose, an FBI employee may only collectinformation.that relates to matters of positive foreign intelligence. (See DIOG
Section 9
for a description of "positive foreign intelligence.") An FBI employee
should prioritizecollection .against FBI National Collection Requirements before attempting
to collectagainst a positive foreign intelligence requirement. The DI PG furnishes guidance on theprioritization of collection.

(U//FOUO) Duration: An FBI employee may initiate an assessment for thispurpose only
with-prior Field Office SSA.or SIA approval and FBIHQ Collection Management
Section(CMS) approval. The effective date of the assessment is the date FBIHQ
CMS
approves
the assessment. Such an assessment may continue for as long as necessary
to achieve its
purpose and objectives. When the objective has been met, a closing EC
must be approvedby the Field Office SSA or SIA and FBIHQ CMS and uploaded to the file.
(U//FOUO) Documentation: This type of assessment must use an EC
to document theinitiation approval of the.assessment and the request and approval
for the use of
applicable investigative methods. Foreign intelligence collectedn ,,to thissubsection must be maintained in thelor as otherwise
determined by FBIHQ CMS. The DI PG further describes this process.
(U//FOUO) Approval: Assessments to collect on matters of "foreign
intelligenceinterest" must be approved in advance by FBIHQ CMS in accordancewith the standards
55
UNCLASSIFIED-FOR OFFICIAL USE ONLY

b2

b7E

UNCLASSIFIED - FOR OFFICIAL USE ONLY
Domestic Investigations and Operations Guide
listed in Section 5.5.
b2
b7E

1in addition to the normal

equirement to use the least intrusive method to gather information during an assessment,
when conducting this type of assessment the FBI employee must be mindful of theadditional requirement to operate openly and consensually.with a United States person,tothe extent practicable.
(U//FOUO) File Review: This type of assessment requires recurring 90-day file reviewsof the assessment file and any sub-file by the SSA or SIA in accordance with Section 3.4.
Investigative file reviews for probationary FBI employees are recommended every 30
days but must be conducted at least every 60 days. This file review must:a. (U//FOUO) Evaluate the progress made toward achieving the authorized purpose
andobjective;b. (U//FOUO) Determine whether-it is reasonably likely-that information will beobtained that is relevant to the authorized objective, thereby warranting-an extension
for another 90 days (at least every. 60 days for probationary FBI employees);c. (U//FOUO) Determine whether adequate predication has been developed tojustify
opening a criminal, counterterrorism, counterintelligence, cyber, or weapons of mass
destruction predicated investigation; andd. (U//FOUO) Determine whether the assessment should be terminated.
(U//FOUO) If the initiation of the assessment involves a sensitive investigative
matter, it
must be reviewed by the CDC and approved by the SAC, prior to seeking
FBIHQ CMS
authorization. If a sensitive investigative matter arises after the initiation of an assessment,
investigative activity must cease until CDC review and SAC approval is acquired andnotice provided to FBIHQ CMS. Higher, supervisory approval, as described in
Section
5.9, may be required before using the following investigative methods: physicalsurveillance, certain interviews, and tasking of confidential human-sources.
In addition,
as.specified in the Division PGs, there are agreements (e.g., Memorandaof
Agreements/Understanding, Treaties) that may require particular coordination
prior to therelease/acquisition of certain federal, state, local, tribal and foreign government
information.
(U//FOUO) Positive foreign intelligence collected nrsuant to this subsection mustbelor as otherwise determined by
FBIHQ CMS. Ihe title/case caption of the opening EC must contain the word
"Assessment," and the synopsis must identify the purpose and the objective of theassessment. If at the time of the opening, or at anytime thereafter, theassessment
involves a sensitive investigative matter, the title/case caption must containthe"Assessment" and "Sensitive Investigative Matter." The DI PG further describeswords
thisprocess.
maintained in=

56
UNCLASSIFIED-FOR OFFICIAL USE ONLY

.b2
b7E

UNCLASSIFIED - FOR OFFICIAL USE ONLY
Domestic Investigations and Operations Guide(U/FOUO) Responsible Entity: This type of assessment is managed by the FIG andFBIHQ DI.
5.7.
(U) Sensitive Investigative Matter / Academic Nexus / Buckley
Amendment
A. (U//FOUO) Sensitive Investigative Matter: An investigative matter
involving the activities
of a domestic public official or political candidate (involving corruption
or a threat to thenational.security), religious or political organization or individual
prominentin such anorganization, or news media, or any other matter which, in the judgmentof the official
authorizing an investigation, should be brought to the attention of
FBI Headquarters andother DOJ officials. (AGG-Dom, Part VII.N.) As a matter of FBI policy,"judgment" meansthat the decision of the authorizingofficial is discretionary. DIOG Section I0
and the DIOG
classifiedAppendix G defind

|

b2

b7E

B. (U//FOUO) Academic Nexus:
b2
b7E(U//FOUO) The sensitivity related to an academic institution arises fromthe American
tradition of "academic freedom" (e.g., an atmosphere in which
students and faculty are free
to express unorthodox ideas and views and to challenge conventional
thought without fear ofrepercussion). Academic freedom does not mean, however, that academic
institutions are off
imits to FBI investigators in pursuit of information or individualsoflegitimate
investigativeinterest.

(U//FOUO)
seethe lOG class ited Appendix G.
C. (U//FOUO) Buckley Amendment: A request for "academic records"
must only be madepursuant to the provisions of the uckle Aendment(The Family
Educational
Rights andPrivacy Act of 1974, 20 U.S.C. § 12 3 2[g], as amended by Public
Law 107-56 ["USA
PATRIOT Act"]). An FBI employee is prohibited from receiving"academic records" thathave not been properly requested pursuant to the Buckley Amendment.
The definition ofacademic records" is very broad and covers almost
all records about a student other thanpublic, student directory-type information published by the institution.
The Buckley
Amendment contains a penalty provision for those institutions that improperly nrov
academicrecords to law enforcementncl

I(U//FOUO) A Buckley Amendment request for academic records cannot
be made during anassessment. In a predicated investigation, a request for academic
records must be madepursuant to the Buckley Amendment.

57
UNCLASSIFIED-FOR OFFICIAL USE ONLY

bE

b2

b7E

UNCLASSIFIED - FOR OFFICIAL USE ONLY
Domestic Investigations and Operations Guide
5.8.

(U//FOUO) Standards for Initiating or Approving the Use of an Authorized
Investigative Method(U//FOUO) Prior to initiating or approving the use of an authorized investigative method,an FBI
employee or approving official must determine whether:A. (U//FOUO) The use of the particular investigative method is likely to further an objectiveof
the assessment;
B. (U//FOUO) The investigative method selected is the least intrusive niethod, reasonable
under
the circumstances;
C. (U//FOUO) The anticipated value of the assessment justifies the use of the.selected
investigative method or methods;
D. (U//FOUO) If the purpose of the assessment is to collect positive foreign intelligence,
theinvestigative method complies with the AGG-Dom requirement that the FBI
operate openly
and consensually with a United States person, to the extent practicable; andE. (U//FOUO) The method is an appropriate use of personnel and financial resources.
5.9.
(U) Authorized Investigative Methods in Assessments and PredicatedInvestigations(U) The following investigative methods-may be used in assessments and predicatedinvestigations:
A. (U) Obtain publicly available information. (AGG-Dom, Part II.A.4.aand Part VII.L.)

1. (U) Scope: "Publicly available information" is information that is:a.. (U) Published or broadcast for public consumption;b. (U),Available on request to the public;c. (U) Accessible on-line or otherwise to the public;d. (U) Available to the public by subscription or purchase;e. (U) Made available at a meeting open to the public;f. (U) Obtained by visiting any place or attending an event that is open to

the public;.org. (U) Could'be seen or heard by any casual observer not involving unconsented
intrusion into private places.

oI(U//FOUO)

b2
b2
b7E

2. (U//FOUO) Approval: Supervisory approval is not required
for use of this method,
except as to information gathered at a religious service. Notwithstanding
any other policy,
tasking a CHS or UCE to attend a religious service during a predicatedinvestigation,
whether open to the public ornot, requires SSA approval. Tasking a
CHS toreligious service, whether open to the public or not, during an assessment attend arequires SAC
approval.
58
UNCLASSIFIED-FOR OFFICIAL USE ONLYUNCLASSIFIED - FOR OFFICIAL USE ONLY
Domestic-Investigations and Operations Guide
3. (U//FOUO) Application: This investigative method may be used inassessments, national
security investigations; criminal investigations, foreign intelligence collection
cases, andfor assistance to other agencies.
4. (U) Use/Dissemination; The use or dissemination of information
obtained by thismethod must comply with the AGG-Dom and DIOG Section 14.
B. (U) Engage in observation or surveillance riot requiring a court order.
Surveillance
includes physical, photographic and video surveillance where such'surveillancedoes
not infringe on a reasonable expectation of privacy and trespass
is not required toaccomplish the surveillance. (AGG-Dom, Part II.A.4.h)
1. (U)Scopea. (U//FOUO) Physical Surveillance Defined: Physical surveillance isthe deliberate
observation by an FBI employee of persons, places, or events, on either alimited orcontinuous basis,,in a public or a semi-public (e.g., commercial business
open to the
public) setting.
(U//FOUO

I

b2
b,7E

b. (U//FOUO) Surveillance Enhancement Devices: The use of mechanicaldevices
operated by the user (e.g., binoculars; hand-held cameras; radiation,
chemicalorbiological detectors) is authorized in physical surveillance.provided
thatthedeviceis
not used to collect information in which a person has a reasonable expectationofprivacy (e.g., equipment such as a parabolic microphone or other listening
device thatwould intercept a private conversation or thermal imaging a home is
not permitted).
2. .(U//FOUO) Approval: During an assessment, physical surveillance may be approved fora period of time not to exceedI
as explained further below.
a. (U//FOUO) Standards for Initiating or Approving Physical Surveillance
Duringan Assessment: During an assessment,,in addition to the standards
contained in
Sections 5.5 and 58, the FBI employee and supervisor must consider
the following:
59
UNCLASSIFIED-FOR OFFICIAL USE ONLYb2
b7E

UNCLASSIFIED - FOR OFFICIAL USE ONLY
DomestieJnvestigations and Operations Guide
i.
ii.
iii.

iv.

(U//FOUO) Whether the physical surveillance is rationally related to thearticulated purpose and objective of the assessment;(U//FOUO) Whether the physical surveillance is the least intrusivealternative
for acquiring needed information;(U//FOUO) If the physical surveillance is for the purpose of determiningapattern of activity, whether there.is a logical nexus between the purposeof theassessment and the pattern of activity he or she is seeking to determine;
and(U//FOUO) If being conducted in order to gather positive foreign
intelligence,
whether the surveillance is consistent with the requirement that theFBIemployee operate openly and consensually with a United States
person, to theextent practicable.

b. (U//FOUO)

b2
b7E

c.

u''mOIjb2
b7E

d.

U//UUO)
Guardian, or an EC requesting ASAC approval.

60
UNCLASSIFIED-FOR OFFICIAL USE ONLY

in an
an FD-71,
FD

UNCLASSIFIED - FOR OFFICIAL USE ONLY
Domestic Investigations and Operations Guidee. (U//FOUO) Physical Surveillance during Predicated Investigations: Physicalsurveillance undertaken during a-predicated investigation does not require
supervisory approvalJ

3. (U//FOUO) Application: This investigative method may be used in assessments, national,security investigations, criminal investigations, foreign intelligence collection cases, andfor assistance to other agencies when it is not otherwise prohibited-by AGG-Dom, Part
III.B.2-3.
4. (U) Use/Dissemination: The use or dissemination of information obtained by thismethod must comply with the AGG-Dom and DIOG Section 14.
C. (U) Access and examine FBI and other Department of Justice (DOJ) records, andobtain information from any FBI or other DOJ personnel. (AGG-Dom, Part II.A.4.b.)
1. (U//FOUO) Scope: As part of an assessment or predicated investigation, an FBI
employee may access and examine FBI and other DQJ records and may obtain
information from any FBI personnel or other DOJ personnel. Access to certain FBI
records may be restricted to designated FBI personnel because of the sensitive nature.of
the information in the record or the classification of the records. These include, but are
not limited to: FBI records concerning human source identification; espionage
investigations; code word; and other compartmented information.
2. (U//FOUO) Approval: Supervisory approval is not required to use this method, exceptthat if the use of records constitutes pattern-based data mining under the Federal.Data
Mining Reporting Act of 2007, it must be reviewed and approved according to paragraph
3 below.
3. (U//FOUO) Pattern-Based Data Mining: The vast majority of data analysis performed
during FBI assessments is based on subjects or events and does not meet the definition ofpattern-based data mining. Pattern-based data mining is the use of one or more data bases
to search for persons who fit a set of group characteristics or patterns of behavior (e.g.,
the known characteristics of a particular terrorist organization). Any such analysis based
solely on racial, ethnic, national origin or religious characteristics is strictly prohibited.
Sensitive Operations Review Committee (SORC) approval is required for any analytical,
search of FBI or other agency data bases that constitute pattern-based data mining, as
defined above. Additionally, pursuant to the Federal Data Mining Reporting Act of 2007,
the FBI must report all agency initiatives that involve the use of pattern-based data
mining to Congress.
4. (U//FOUO) Application: This investigative method may be used in assessments, national
security investigations, criminal investigations, foreign intelligence collection cases, andfor assistance to other agencies.
5. (U) Use/Dissemination: The use or dissemination of information obtained by thismethod must comply with the AGG-Dom and DIOG Section 14.

61
UNCLASSIFIED-FOR OFFICIAL USE ONLYb2
b7E

UNCLASSIFIED - FOR OFFICIAL USE ONLY
Domestic Investigations and Operations Guide
D. (U) Access and examine records maintained by, and request information from, otherfederal, state, local, or tribal, or foreign governmental entities or agencies. (AGG-Dom,
Part II.A.4.c.)
1. (U//FOUO) Scope: As part of an assessment or predicated investigation, an FBI
employee may access andexamine records maintained by, and request information from,other federal, state, local, or tribal, or foreign governmental entities or agencies: Whenrequesting information using this authority, care must'be taken to ensure the entity
concerned understands that it is not compelled to provide such information or create a
new record for the purpose of assisting the FBI.
2. (U//FOUO) Approval: Supervisory approval is not required to use this method for"routine uses," unless,such approval is required by Memoranda of Understanding (MOU)or other agreements for requesting such information. The FBI may request anotherfederal agency to disclose Privacy Act-protected records pursuant to the other agency's"routine uses" (5 U.S.C. § 522a[b][3]) or through a written request for a law enforcement
purpose (5 U.S.C. § 522a[b][7]). Such written requests (for a law enforcement purpose)
pursuant to 5 U.S.C. § 522a(b)(7) may be made by the Director or his designee, provided
that such authority may not-be delegated beldw the Section Chief level (28 C.F.R.
§ 16.40[c]; OMB Guidelines, 40 Fed. Reg. at 28,955). Requests for records orinformation from a foreign government entity or agency must be appropriately
coordinated through the applicable FBI. Legat office, Office of International Operations(OIO), INTERPOL, relevant substantive headquarters division, and/or DOJ Office ofInternational Affairs, as necessary. Direct contact is authorized in certain circumstances,such as an imminent threat situation. If the analysis of records obtained in this mannerconstitutes pattern-based data mining tinder the Federal. Data Mining Reporting Act of
2007, it must be reviewed and approved according to Section.5.9.C.3, above.

(U//FOUO)|
b2
b7E(U//FOUO) Records received from an outside entity and used during an assessment must
be maintained as part of the appropriate file (e.g.,
3. (U//FOUO) Application: This investigative method may be used in assessments, national
security investigations, criminal investigations, foreign intelligence collection cases, andfor assistance to other agencies.
4. (U) Use/Dissemination: The use and/or dissemination of information obtained by thismethod must comply with the AGG-Dom and DIOG Section 14.
E. (U) Use online services and resources (whether non-profit or commercial). (AGG-Dom,
Part II.A.4.d.)
1. (U//FOUO) Scope: As part of an assessment or predicated investigation, an FBI
employee may use any FBI-approved on-line service or resource that is available bysubscription or purchase, including services available only to law enforcement entities.

62
UNCLASSIFIED-FOR OFFICIAL USE ONLYUNCLASSIFIED - FOR OFFICIAL USE ONLY
Domestic Investigations and Operations Guide
2. (U//FOUO) Approval: Supervisory approval is not required to use this method, althoughsubscribing to or purchasing any new service or resource must be done according to FBI
contracting procedures.
(U//FOUO) Example: FBI-approved on-line services or resources include, but are notlimited to: Google, Yahoo, or similar Internet search services; data brokers such as
ChoicePoint, Westlaw, and Lexis-Nexis; and vehicle, casualty, and property insurance
claims databases such as Claim-Search.
3. (U//FOUO) Application: This investigative method'may be used in assessments, national
security investigations, criminal investigations, foreign intelligence collection cases, andfor assistance to other agencies.
4. (U) Use/Dissemination: The use.or dissemination of information obtained by thismethod must comply with the AGG-Dom and DIOG Section 14.
F. (U) Interview or request information from members of the public and private entities.
(AGG-Dom, Part II.A.4.f)
1. (U//FOUO) Scope: An interview is the questioning of an individual (to include thesubject) designed-to gather information-fromthe person being interviewed that is-accurate,
pertinent to, and within the scope of an authorized assessment or predicated investigation.
In the normal course of an interview, the FBI employee should divulge the employee's
affiliation with the FBI and the true purpose of the interview. Information requested
during an interview must be voluntarily provided. If the person who is being interviewed
expresses a desire not to provide the information, the FBI employee may riot state or
imply in any way that the interviewee is compelled to provide information or that adverse
consequences may follow if the interviewee does not provide the information. If theperson being interviewed indicates he or she wishes to consult an attorney, the interview
must immediately stop.
2. (U//FOUO) Custodial Interviews: Within the United States, Mirandawarnings are
required to be given prior to custodial'interviews if the subject is significantly restricted
in his/her freedom of action to a degree normally associated with a formal arrest. For
more information refer to the CID and CTDPGs and The FBI Legal Handbook forSpecial Agents (LHBSA), Section 7-3-2.
3. (U//FOUO) Approval: With the exceptions discussed below, interviews do not require
supervisory approval.
a. (U//FOUO) Contact With Represented Persons:(U//FOUO) CDC review is required before contact with represented persons. Suchcontact may implicate legal restrictions and affect the admissibility of resulting
evidence. Hence, if an individual is known to be represented by counsel in aparticular matter, the CDC will follow applicable law and DOJ procedure whenreviewing the request to contact the represented individual in the absence of priornotice to counsel. The SAC, CDC, or their designees, and the United States Attorney
or their designees must consult periodically on applicable law and DOJ procedure.
The Field Office may raise the following issues with the United States Attorney's
Office and request that it consult with the DOJ Professional Responsibility Advisory
Office, when the issues include, but are not limited to, the inconsistent application of:
63
UNCLASSIFIED-FOR OFFICIAL USE ONLYUNCLASSIFIED - FOR OFFICIAL USE ONLY
Domestic Investigations and Operations-Guide(i) state ethics rules; or (ii) rules for contacts with represented persons. (AGG-Dom,
Part V.B.1)
b. (U//FOUO) Members of the United States Congress and their Staffs:(U//FOUO) Generally, FBI employees maytake information received fromcongressional offices just as they would take information from other sources, andthey may act upon it accordingly.
(U//FOUO) However, prior CDC review, SAC and appropriate FBIHQ AD approvaland prior notice to the AD Office of Congressional Affairs (OCA) are reuired if aninvestigator seeks to jb2b7E

ote: The FBIHQ substantive Division policy implementation
guides may contain additional approval/notice requirements.
c. (U//FOUO) White House Personnel:(U//FOUO) CDCreview and SAC approval.is required before initiating contact with:White House personnel. Additionally, CDC review, SAC approval and appropriate
FBIHQ Section.Chief approval must be obtained prior to conducting an interview of amember oftheWhite House staff. Note: The FBIHQ substantive Division policy
implementation guides may contain additional approval/notice requirements.
d, (U) FBIHQ Substantive Division Requirements:i.

(U//FOUO) Counterintelligence Division: Interviews conducted during
counterintelligence assessments and predicated investigations must comply
with the requirements contained in the,Memorandum of Understanding
Between the Department of State and the FBI on Liaison forCounterintelligence Investigations. TheFBIHQ Courterintelligence Division
PG contains interview approval requirements.

ii.

(U//FOUO) Other FBIHQ Divisions: Each FBIHQ Division may provide
additional interview approval requirements in its policy implementation guide.

4. (U//FOUO) Requesting Information Without Revealing FBI Affiliation or the True
Purpose of a Request:a. (U//FOUO)

b2
b7 E

b. (U//FOUO)|

c. (U//FOUO)

64

UNCLASSIFIED - FOR OFFICIAL USE ONLY
Domestic Investigations and Operations-Guide
d. (U//FOUO)

b2
b7E

b2
b7E

e. (UI/FOUO(1),(U//FOUO)|
i. (U//FOUO)

ii. (U//FOUo)/FOUO1b2

iv. '(,U UU

b7

iii.

v. (U//FOUQO
vi.
vii. (U//FOUO)
b2
b7 E(2) (U//FOUO

f. (U//FOUO)
b2
b7E

b2
b7E

g. (U//FOUO)

65
UNCLASSIFIED-FOR OFFICIAL USE ONLYUNCLASSIFIED - FOR OFFICIAL USE ONLY
Domestic Investigations and Operations !Guideb2
b7E(U//FOUO

b2
b7E

(U)F=
i.

(U//FOUO)

b2ii. (U//FOUO
b2
b7E

iii. (U//FOUO)-

b7E------------- ----5"|bb2iv. (U//FOUO)

b7E

66
UNCLASSIFIED-FOR OFFICIAL USE ONLYUNCLASSIFIED - FOR OFFICIAL USE ONLY
Domestic Investigations and Operations G

b2
b7E

v.

------b2

b7E

Ai. U/FOU

b2
b7E

67
UNCLASSIFIED-FOR OFFICIAL USE ONLYUNCLASSIFIED - FOR OFFICIAL USE ONLY
Domestic Investigations and Operations Guidevii. (U//FOUO)

b2

b7E

viii.(U//FOUO)
b2

b7E

5. (U//FOUO) Application: This investigativemethod may be used in assessments, national
security investigations, criminal investigations, foreign intelligence collection cases, andfor assistance to other agencies when it is not otherwise prohibited by AGG-Dom, Part
III.B.2-3.
6. (U) Use/Dissemination: The use or dissemination of information obtained by this method
must comply with-the AGG-Dom and DIOG Section 14.
G. (U) Accept information voluntarily provided by governmental or private entities.
(AGG-Dom, Part II.A.4.g.)
1. (U//FOUO) Scope: As part of an assessment or predicated investigation, an FBI
employee may accept information voluntarily provided by'federal, state, local, or foreign
governmental or.private entities to include individuals. Voluntarily provided information
includes,'but is not limited to, oral as well as documentary and physical evidence such as:
a computer hard drive or other electronic media that contains information, paper
documents containing information, or physical objects (e.g., handgun or narcotics).
S68
UNCLASSIFIED-FOR OFFICIAL USE ONLYUNCLASSIFIED - FOR OFFICIAL USE ONLY
Domestic Investigations and Operations Guide
2. (U//FOUO) Approval: Supervisory approval is not required to accept voluntarily
provided information. Personnel may not request nor knowingly accept information
where disclosure would be prohibited by federal law. See, e.g., 18 U.S.C. § 2702
(prohibiting an entity providing electronic communications services from divulging
certain communications and other records, except in certain circumstances).
3. (U//FOUO) Application: This investigative method may be used in assessments, national
security investigations, criminal investigations, foreign intelligence collection cases, andfor assistance to other agencies when it is not otherwise prohibited by AGG-Dom, Part
III.B.2-3.
4. (U) Use/Dissemination: The use or dissemination of information obtained by thismethod must comply with the AGG-Dom and DIOG Section 14.
H. (U) Use and recruit human sources in conformity with the Attorney General's
Guidelines Regarding the Use of FBI Confidential Human Sources. (AGG-Dom, Part
II.A.4.e)
1. (U//FOUO) The FBI may use and recruit human sources in assessments and predicated'investigations in conformity with the AGG-Dom, AGG-CHS, the FBI CHSPM, and the
FBI CHSVSM. In this context, "use" means obtaining information from, tasking, orotherwise operating such sources. (AGG-Dom, Part VII.V.)
2. (U//FOUO) A CHS can be "used" in support of an assessment and a predicatedinvestigation or for the purpose of validating, vetting or determining the suitability of
another CHS as part of an assessment.
3. (U//FOUO) Religious Service-Notwithstanding any other policy, tasking a CHS toattend a religious service, whether or not open to the public, requires SSA approval in a
predicated investigation and SAC approval in an assessment.
4. (U//FOUO) All investigative methods should be evaluated to ensure compliance with theadmonition that the FBI should use the least intrusive method practicable. That
requirement should be particularly observed during an assessment when using a CHS
because the use of a CHS during an assessment maybe more intrusive than many otherinvestigative methods. Use of a CHS in an assessment should take place only after
considering whether there are effective, less intrusive means available to obtain thedesired information. The CHS must comply with all constitutional, statutory, andregulatory restrictions and limitations. In addition:a. (U//FOUO) CHS use and direction must be limited in focus and scope to what isrnecessary to accomplish the authorized pu ose and ohiectiv nf----ation
investipredicatedorb. (U//FOUO) A CHS may be directed to seek information about an individual,group or organization only to the extent that such information is necessary toachieve the specific.objective of the assessment. If such contact reveals
information or facts about an individual, group or organization that meets therequirements of a predicated investigation, a predicated investigation may be
opened, as appropriate.
69
UNCLASSIFIED-FOR OFFICIAL USE ONLY

b2

b7E

UNCLASSIFIED - FOR OFFICIAL USE ONLY
Domestic Investigations and Operations Guide

I-.----o--o------ ----I_-c. (U//FOUO
b2
b7E

d. (U/FOU O
b2

b7E

e.

U//

b2

b7 E

f.

UFOUO) If there is any conflict between the CHSPM or CHSVSM.and theDIOG, the DIOG controls and OGC should be immediately notified of theconflict.

5. (U//FOUO) Application: This investigative method may be used in assessments, national
security investigations, criminal investigations, foreign intelligence collection cases, and,for assistance to other agencies when it is not otherwise prohibited by AGG-Dom, Part '.II.B.2.
(U) Note: When collecting positive foreign intelligence, the BI must operate openly
and consensually with a United States person, to the extent practicable.
6. (U) Use/Dissemination: The use or dissemination of information obtained by thismethod must comply with the AGG-Domand DIOG Section 14.
I. (U) Grand jury subpoenas for telephone or electronic mail subscriber information.
(AGG-Dom, Part II.A.4.i)
1. (U//FOUO) Scope: During a type 1 or 2'assessment, an FBI employee imay requestfrom
an appropriate United States Attorney's Office (USAO) the issuance of a Federal Grand
Jury (FGJ) subpoena for the limited purpose of obtaining subscriber information. A FGJ
subpoena, under this provision, may not be requested for the purpose of collecting
foreign intelligence. For more informationregarding FGJ subpoenas, see DIOG Section
11.9;(U//FOUO) Note: The use of Federal Grand Jury Subpoenas; to include subpoenas fortelephone or electronic mail subscriber information, is not authorized in a type 3, 4, or 5
70
UNCLASSIFIED-FOR OFFICIAL USE ONLYUNCLASSIFIED - FOR OFFICIAL USE ONLY
Domestic Investigations and Operations Guide
assessment or in a type 6 assessment or full investigation initiated for the purpose ofcollecting positive foreign intelligence.
2. (U//FOUO) Approval: In a type 1 or 2 assessment or predicated investigation,
supervisory approval is not required prior to requesting a USAO to issue a FGJ subpoena
for telephone or electronic mail subscriber information.
3.

(U) Electronic Communications Privacy Act (ECPA) (18 U.S.C. §§ 2701-2712):
ECPA, 18 U.S.C. § 2703 states "a provider of electronic communication service orremote computing service shall disclose to a governmental entity the: (i) name; (ii)address; (iii) local and long distance telephone connection records, or records of sessions,times and durations; (iv) length of service (including start date) and types of service
utilized; (v) telephone or instrument number or other subscriber number or identity,
including any temporarily assigned network address; and (vi) means and source of
payment for such service (including any credit card or bank account number), of a
subscriber to.or customer of such service when the governmental entity uses ... a Federal
Grand Jury [subpoena]'..." (emphasis added)

4. (U//FOUO) Application: This investigative method may be used in type 1 and.2
assessments, national security investigations, criminal investigations, and for assistanceto other agencies if relevant to an already open type 1 or 2 assessment or predicatedinvestigation. This method may not be used to collect positive foreign intelligence
information.
5. (U) Use/Dissemination:b2

b7E

The use or dissemination of information obtained bythis method mustcomply with the AGG-Dom, DIOG Section 14, and the Federal Rules of Criminal
Procedure (FRPC) Rule 6.
5.10.

(U) Investigative Methods Not Authorized During Assessments(U) The following-methods may not be used in an assessment:(U//FOUO) Note: For use of lawful investigative methods during the recruitment, assessment
and validation of a CHS, refer to the AGG-CHS, CHSPM, and CHSVSM.
A. (U) Mail covers
B. (U) Physical searches of personal or real property where a warrant or court order'is notlegally required because there is no reasonable expectation of privacy (e.g., trash covers)
C. (U) Consensual monitoring of communications. including consensual computer monitoring
D. (U) Use of closed-circuit television. directionfinders, and other monitoring devices
E. (U) Polygraph examinations
F. (U) Undercover operations

71
UNCLASSIFIED-FOR OFFICIAL USE ONLYUNCLASSIFIED. - FOR OFFICIAL USE ONLY
Domestic Investigations and Operations Guide
G. (U//FOUO) Compulsory process, including grand jury subpoenas (except: subscriber
information during type I and 2 assessments). administrative and other subpoenas. andNational Security Letters
H. (U) Accessing stored wire and electronic communications and transactional records
I. (U) Use of pen registers and trap and trace devices
J. (U) Electronic surveillance
K. (U) Physical searches where there is a reasonable expectation of privacy
L. (U) Acquisition of foreign intelligence information in conformity with Title VII of theForeign Intelligence Surveillance Act (FISA)
5.11.

(U//FOUO) FBI National Collection Requirements(U//FOUO) The FBIHQ DI establishes FBI National Collection Requirements after coordination
with FBIHQ OGC, other FBIHQ substantive Divisions, and Field Offices. An FBI National
Collection Requirement describes information needed by the FBI to: (i) identify or obtain
information about potential targets of, or vulnerabilities.to, federal criminal activities or threats
to the national-security; or (ii) inform or facilitate intelligence-analysis and planningipertinent to
the FBI's law enforcement or national security missions.

(U//FOIJOf
b2
b7E(U//FOUO|(i)(U//FOUO)I(ii)(U//FOUO(U//FOUO]

72
UNCLASSIFIED-FOR OFFICIAL USE ONLY

b7E

UNCLASSIFIED - FOR OFFICIAL USE ONLY
Domestic Investigations and Operations Guideb2
b7E(U//FOUO) Before any investigative activity is initiated in order to respond to an FBLNational
Collection Requirement, an assessment must be initiated or already open. An assessment cannot
be opened solely based upon an FBI National Collection Requirement. An authorized purpose(national security or criminal threat) must exist and an objective must be clearly articulated that
identifies an authorized purpose prior to opening an assessment; During an assessment, the FBI
is authorized to collect against any FBI National Collection Requirement that isrelevant to theassessment because such requirements are issued for information necessary to identify potential
threats or vulnerabilities (e.g., type 3 assessment) or to collect information necessary for
intelligence analysis (e.g., type 4 assessment)(U//FOuOJ

.

.
b2
b7E

(U//FOUO)|

5.12.

(U//FOUO) FBI Field Office Collection Requirements(U//FOUO) An FBI Field Office Collection Requirement describes information needed by thefield to: (i) identify or obtain information about potential targets of or vulnerabilities to federal
criminal activities or threats to the national security; or (ii) inform or facilitate intelligence
analysis and planning pertinent to the FBI's law enforcement or national security missions.
(U//FOUO) Before any investigative activity may be conducted to respond to an FBI Field
Office Collection Requirement,.an assessment must be initiated boralready open. An assessmelnt
cannot be opened solely based upon an FBI Field Office Collection ReouirementJ~

b2
b7E

i ne UI tU contans detailed guidance regarding the Field Office Collection Requirements.
5.13.

(U) Retention and Dissemination of Privacy Act Records(U//FOUO) The Privacy Act restricts the maintenance of records relating to the exercise of First
Amendment rights by individuals who are United States persons. Such.records may be
73
UNCLASSIFIED-FOR OFFICIAL USE ONLYUNCLASSIFIED - FOR OFFICIAL USE ONLY
Domestic Investigations and Operations Guide
maintained if the information is pertinent to and within the scope of authorized law enforcement
activities or for which there is otherwise statutory authority for the purposes of the Privacy Act(5 U.S.C. § 522a[e][7]). Activities authorized by the AGG-Dom are authorized law enforcement
activities. Thus, information concerning the exercise of First Amendment rights by United States
persons may be retained if it is pertinent to or relevant to the.FBI's law enforcement or national
security activity. Relevancy must be determined by the circumstances. If the information is not
relevant to the law enforcement activity being conducted, then it may not be retained: For more
information see DIOG Section 4. (AGG-Dom, Part I.C.5)(U//FOUO) Even if information obtained during an assessment does not warrant opening a
predicated investigation, the FBI may retain personally identifying information for criminal andnational security purposes. In this context, the information may eventually serve a variety ofvalid analytic purposes as pieces of the overall criminal or intelligence picture are developed todetect and disrupt criminal and terrorist activities. In addition, such information may assist FBI
personnel in responding to questions that may subsequently arise as to the nature and extent of
the assessment and its results, whether positive or negative; Furthermore, retention of suchinformation about an individual collected in the course of an assessment will alert other
Divisions or Field Offices considering conducting an assessment:on the same individual that the.
particular individual is not a criminal or national security threat. As sich, retaining personallyidentifying information collected in the course of an assessment will also serve to conserve
resources and prevent the initiation of unnecessary assessments and other investigative activities.
(U) Marking Closed Assessments That Contain Personal Information: Information obtained
during an assessment that has insufficient value to justify further investigative activity may
contain personal information. As a result: (i) when records retained in an assessment.specifically
identify an individual or'group whose possible involvement in criminal or national securitythreatening activity was checked out through the assessment; and (ii) the assessment turns up no
sufficient basis to justify further investigation of the individual or group, then the records must
be clearly annotated as follows: "It is noted that the individual or group identified during theassessment does not warrant further FBI investigation at this time. It is recommended that thisassessment be closed." Extreme care should be taken when disseminating personally identifiable
information collected during an assessment that does not lead to sufficient facts to open a
predicated investigation. If personal information from the assessment is disseminated outside the
FBI according to authorized dissemination guidelines and procedures, it must be accompanied by
the required annotation that the assessment involving this individual or group did not warrant
further investigation by the FBI at the time the assessment was closed.
~
b2
b7E

IMreover, an FBI
employee, who shares information from such a closed assessment file, must ensure that the
specific.annotation (as discussed above) is included with the shared information.
5.14.

(U) Assessment File Records Management and Retention(U//FOUO)I
b2
b7E

74
UNCLASSIFIED-FOR OFFICIAL USE ONLYUNCLASSIFIED - FOR OFFICIAL USE ONLY
Domestic Investigations and Operations Guide,b2
b7E

mst oe retainea accoring to National Archives and Records Administration (NARA)-regulations.

Records'

The retention ofrecords in uuardian, or any successor information technology system, must be retained
according to NARA regulations.
(U//FOUO) Assessments that require prior supervisory annroval mwt have

I

b2
b7E

IIMust be approved by te

A orA

...

...

.

If additionalobjectives arise

during the assesment, they inustbe
approved by the SSA or SIA, andI
Assessment classification files must be retained according to NARA
regulations.

75
UNCLASSIFIED-FOR OFFICIAL USE ONLYUNCLASSIFIED - FOR OFFICIAL USE ONLY
Domestic Investigations and Operations Guide

6. (U) Preliminary Investigations
6.1.

(U) Overview(U) The AGG-Dom authorizes a second level of investigative activity-predicated investigations.
Predicated investigations that concern federal crimes or threats to the national security are
subdivided into preliminary investigations and full investigations. Preliminary investigations
may be initiated on the basis of any "allegation or information" indicative of possible.criminal
activity or threats to the national security.
6.2.
(U) Purpose and Scope(U//FOUO) Preliminary investigations may be carried out to detect, obtain information about, or
prevent or protect against federal crimes or threats to the national security. However, apreliminary investigation cannot be initiated or used solely for the purpose of collecting against
Positive Foreign Intelligence Requirements, or for conducting enterprise investigations.
Intelligence responsive to Positive Foreign Intelligence Requirements, FBI National Collection.
Requirements and FBI Field Office Collection Requirements may be collected incidental to apreliminary investigation concerning another person, organization, or entity. If Positive ForeignIntelligence Requirement, FBI National Collection Requirement or'FBI Field Office Collection
Requirement information is incidentally collected-in a preliminary investigation, it should be
forwarded to the FIG for evaluation and potential dissemination against collection requirements.
(U) In preliminary investigations, the immediate objectives include such matters as: determining
whether a federal crime has occurred or is occurring, or if planning'or preparation for such acrime is taking place; identifying, locating, and appiehendingthe perpetrators; obtaining
evidence needed for prosecution; or identifying threats to the national security.
(U) The investigation of threats to the national security may constitute an exercise of the FBI's
criminal investigation-authority as well as its authority to investigate threats to the national
security. As with criminal investigations, detecting and solving crimes and arresting andprosecuting the perpetrators are likely objectives of investigations relating to threats to thenational security. These investigations, however, serve important purposes outside the ambit of
normal criminal investigations, by providing the basis for decisions concerning other measuresneeded to protect,the national security.
6.3.
(U) Civil Liberties and Privacy(U) The pursuit of legitimate investigative goals without infringing upon the exercise of
constitutional freedoms is a challenge that the FBI meets through the application of soundjudgment and discretion. In order to further ensure that civil liberties are not undermined by the
conduct of criminal and national security investigations, every preliminary investigation under
this subsection must have an identified authorized puipose and adequate predication.
(U) No investigative activity, including preliminary investigations, may be taken solely on thebasis of activities that are protected by the First Amendment or on the race, ethnicity, national
origin or religion of the subject. Preliminary investigations of individuals, groups ororganizations must focus on activities related to the threats and or crimes being investigated, notsolely on First Amendment activities or on the race, ethnicity, national origin or religion of the76
UNCLASSIFIED-FOR OFFICIAL USE ONLYUNCLASSIFIED - FOR OFFICIAL USE ONLY
Domestic Investigations and Operations Guide
subject. In this context, it is particularly important clearly to identify and document the law
enforcement or national security basis of the preliminary investigation.
(U) Example: Individuals or groups who communicate with each other orwith members of the public in any form in pursuit of social or politicalcauses-such as opposing war or foreign policy, protesting government
actions, promoting certain religious beliefs, championing particular local,
national, or international causes, or a change in government through noncriminal means, and actively recruit others to join their causes-have afundamental constitutional right to do so. A preliminary investigation may not
be initiated based solely on the exercise of these First Amendment rights.
(U) The AGG-Dom present investigators with a number of authorized investigative methods inthe conduct of a preliminary investigation. Considering the effect on the privacy and civil
liberties of individuals and the potential to damage the reputation of individuals, some of theseinvestigative methods are more intrusive than others. The least intrusive method feasible is to be
used, but the FBI must not hesitate to use any lawful method consistent with the AGG-Dom. A
more intrusive method may be warranted in'light of the seriousness of a criminal or national
security threat.
(U) By emphasizing the use of the least intrusive means to obtain intelligence ard/or evidence,
FBI employees can effectively execute their duties while mitigating the potential negative impact
on the privacy and civil liberties of'all people encompassed within the investigation, including
targets, witnesses, and victims. This principle is not intended to discourage FBI employees fromseeking relevant and necessary intelligence, information, or evidence, but rather is intended toencourage FBI employees to-choose the least intrusive-but still effective means-from theavailable options to obtain the-material.
6.4.
(U) Legal Authority
A. (U) Criminal Investigations(U) The FBI has statutory authority to investigate all federal crime not assigned exclusively
to another federal agency. (See.28 U.S.C.,§ 533; 18 U.S.C. § 3052; 28 C.F.R. § 0.85 [1])(U) The FBI also has special investigativejurisdiction to investigate violations of state law inlimited circumstances. Specifically,, the FBI has jurisdiction to investigate felony killings ofstate law enforcement officers (28 U.S.C. § 540), violent crimes against interstate travelers(28 U.S.C. § 540A), and serial killers (28 U.S.C.. § 540B). Authority to investigate thesematters is contingent on receiving a request by ah appropriate state official.
B. (U) Threats to the National Security(U) The FBI has authority to investigate threats to the national security pursuant to executive
orders, Attorney General authorities, and various statutory sources. (See E.O. 12333; 50
U.S.C. §§ 401 et seq.; 50 U.S.C. §§ 1801 et seq.)
S(U) "Threats to the national security" are specifically defined to mean: international terrorism;
espionage and other intelligence activities, sabotage, and assassination, conducted by, for, oron behalf of foreign powers, organizationis, or persons; foreign computer intrusion; and othermatters determined by the Attorney General, consistent with Executive Order 12333 or any
successor order. (AGG-Dom, Part VII.S)
77
UNCLASSIFIED-FOR OFFICIAL USE ONLYUNCLASSIFIED - FOR OFFICIAL USE.ONLY
Domestic Investigations and Operations Guide
6.5.
(U) Predication(U) A preliminary investigation may be initiated on the basis of"information or an allegation"
indicating the existence ofa circumstance described as follows:
A. (U) An activity constituting a federal crime or a threat to the national security has or may
have occurred, is or may be occurring, or will or may occur and the investigation may
obtain information relating to the activity or the involvement or role of an individual, group,or organization in.such activity. (AGG-Dom, Part II.B.3)
B. (U) An individual, group, organization, entity, information, property, or activity is or may
be a target of attack, victimization, acquisition, infiltration, or recruitment in connection
with criminal activity in violation of federal law or a threat to the national security and theinvestigation may obtain information'that would help to protect against such'activity or
threat. (AGG-Dom, Part II.B,3)(U//FOUO)l(i) (U//FOUO)
b2b7E(ii) (U//FOUO)

6.6.

(U//FOUO) Standards for Initiating or Approving a Preliminary Investigation(U) Before initiating or approving the conduct of a preliminary investigation, an FBI employee
or approving official must determine whether:A. (U//FOUO) An authorized purpose and adequate predication exist for initiating apreliminary investigation;
B. (U//FOUO) The preliminary investigation is not based solely on the exercise of Fiist
Amendment activities or on the race, ethnicity, national origin or religion of the subject;andC. (U//FOUO) The preliminary investigation is an appropriate use of personnel arid financial
resources.
6.7.

(U) Duration, Approval, Notice, Documentation and File Review

A. (U//FOUO) Initiation: The purpose. of and predication for a preliminary investigation must
be documented-in the initiating EC. The effective date of the preliminary investigation isthe date the final approval authority (e.g., SSA or SAC) approves the EC.,
I. (U//FOUO) The initiation of a preliminary investigatiorinby the Field Office reciuires
prior approval of the SSA. FBIHQ Division policy implementation guides may require
written notification to the appropriate FBIHQ Unit and Section. The initiation of apreliminary investigation does not require FBIHQ and DOJ notification unless thepreliminary investigation involves a sensitive investigative matter as discussed inparagraph 3, below.
78
UNCLASSIFIED-FOR OFFICIAL USE ONLYUNCLASSIFIED - FOR OFFICIAL USE ONLY
Domestic Investigations and Operations Guide
2. (U//FOUO) The initiation of a preliminary investigation by FBIHQ requires priorapproval of the Unit Chief with written notification to the applicable Field Office. The
initiation of a preliminary investigation does:not require DOJ notificatidn unless thepreliminary investigation involves a sensitive investigative matter as discussed inparagraph 3, below.
3. (U//FOUO) Sensitive Investigative Matter: The initiation of a preliminary
investigation involving a sensitive investigative matter:a. (U//FOUO) Initiated by a Field Office: requires CDC review, SAC approval,
and written-notification to the appropriate FBIHQ Unit Chief andSection Chief.
Additionally, written notification must be made by the Field Office to the UnitedStates Attorney or by the appropriate.FBIHQ Section to the DOJ Criminal
Division or NSD as soon as practicable but in all events no later than 30 calendar
days after the initiation of such an invetioatinn I

b7E

cease until CUD review and SAC approval is acquired and notice is furnished as
specified above.
b. (U//FOUO) Initiated by FBIHQ: requiies OGC review, Section Chief approyal,
and written notification to the United States Attorney and the appropriate Field
Office or the DOJ Criminal Division or NSD as soon as practicable but in all
events no later than 30 calendar days after the initiation of such.an investigation.

must cease until OGC review and Section
Chief approval is acquired and notice is furnished as specified above.,(AGG-Dom,
Part II.B.5.a)4. (U//FOUO) The Executive Assistant Director (EAD) for the National Security Branchmust notify the Deputy Attorney General if FBI Headquarters disapproves a Field
Office's initiation of a preliminary investigation relating to, a threat to the national
security on the ground that the predication for the investigation is insufficient, and theEAD for the National Security Branch is responsible for establishing a system that willallow for the prompt retrieval of such denials. (AGG-Dom, Part II.B.5.d)
B. (U//FOUO) Extension: A preliminary investigation must be concluded within six monthsof its initiation but may be extended for up to six months by the SAC. This extension
authority may not be delegated by the SAC to the ASAC. Extensions of preliminary
investigations beyond a year are discouraged and may only be approved by the approriate
FBIHQ Unit and Section for "good cause." (AGG-Dom. Part flR.4.a i Nnt -(U//FOUO) The following factors must be used to determine if"'good cause" exists toextend the preliminary investigation beyond one year:
79
UNCLASSIFIED-FOR OFFICIAL USE ONLYb2
b7E

UNCLASSIFIED - FOR OFFICIAL USE ONLY
Domestic Investigations and Operations Guide*(U//FOUO) Whether logical investigative steps have yielded information thattends to inculpate or exculpate the subject;*(U//FOUO) The progress that has been made toward'determining whether
a fullinvestigation should be opened or the preliminary investigation should be closed;*(U//FOUO) Whether, based on the planned course of investigation for thefollowing six months, it is reasonably likely that information will be obtained thatwill lead to predication for a full investigation, thereby warranting
an extension
for another six months, or will lead to exculpatory information, thereby
warranting closing the preliminary investigation; and* (U//FOUO) Whether adequate predication has been developed to justify openingafull investigation or whether sufficient information has been developed that justify
closing the preliminary investigation.
C. (U//FOUO) Closing: When closing a preliminary investigation, theField Office or FBIHQ
will provide the reason for closing the.investigation. When closing a preliminary
investigation, the SSA or Unit Chief must ensure that all pending investigative methods
have been completed/terminated (e.g., mail covers and pen register/trap and trace).
1. (U//FOUO) Closing a preliminary investigationinitiated hby Fi.-Id Ofl ron,;approval from the SSA._

IZ

I

2. (U//FOUO) Closing a preliminary investigation initiated by FBIHQ requires
approvalfrom the Unit Chief and notification to the appropriate Field Office.
3, (U//FOUO) Closing a preliminary investigation initiated by a Field Office
involving asensitive investigative matter requires approval from the SAC
4. (U//FOUO) Closing a preliminary investigation.initiated by FBIHQ involving asensitive investigative matter requires approval from the Section Chief||

D. (U//FOUO) Conversion: When converting a preliminary investigation toa fullinvestigation, see Section 7 for approval and notification requirements.
E. (U//FOUO) File Review: Supervisory file reviews must be conducted at least
once every
90 days in accordance with Section 3.4. File reviews for probationary FBI employees
must
be conducted at least every 60 days.
6.8.
(U//FOUO) Standards for Initiating or Approving the Use of an Authorized
Investigative Method(U//FOUO) Prior to initiating or approving the use of an investigative method,an FBI employee
or approving official must determine whether:A. -(U//FOUO) The use of the particular investigative method is likely
to further the purpose of
the preliminary investigation;
B. (U//FOUO) The investigative method selected is the, least intrusive method,
reasonable under
the circumstances; and80
UNCLASSIFIED-FOR OFFICIAL USE ONLYb2

UNCLASSIFIED - FOR OFFICIAL USE ONLY
Domestic Investigations and Operations Guide
C. (U//FOUO) The method to be used is an appropriate use of personnel and financial resources.
6.9., (U) Authorized Investigative Methods in Preliminary Investigations
A. (U) All lawful methods may be used in a preliminary investigation, except for mail opening,
physical search requiring a Federal Rules of Criminal Procedure (FCRP) Rule 41 search
warrant or a FISA order, electronic surveillance requiring a judicial order or warrant, or Title
VII FISA requests. Authorized methods include, but are not limited to, those listed below.
Some of the methods listed are subject to special restrictions or review or approval.
requirements. (AGG-Dom, Part V.4.A)
B. (U//FOUO) A complete discussion of the investigative methods, including approvalrequirements, is contained in Sections 5 and 1I. The use or dissemination of information
obtained by the use of the below methods must comply-with the AGG-Dom and DIOG
Section 14.
1. (U) Obtain publicly available information.
2. (U) Access and examine FBI and other DOJ records, and obtain information from any
FBI or other DOJ personnel.
3. (U)IAccess and examine records maintained by. and request information from, otherfederal, state. loal. or tribal, or foreign, overnmental entities or agencies.
4. (U) Use online services and resources (whether non-profit or commercial).
5. (U) Use and recruit human sources in conformity with the AGG-CHS.
6. (U) Interview or request information from members of the public and private entities.
7. (U) Accept information voluntarily provided by governmental or private entities.
8.

(U) Engage in observation or surveillance not requiring a court order.

9. (U) Grand Jury Subpoenas for telephone or electronic mail subscriber information (seealso number 16, below).
10. (U) Mail covers. (AGG-Dom, Part V.A.2)
11. (U) Physical searches of personal or real-property where a warrant or court order is notlegally required because there is no reasonable expectation, of privacy (e.g., open
fields,trash covers).. (AGG-Dom, Part V.A.3)
12. (U) Consensual monitoring of communications, including consensual computer
monitoring, subject to legal review by the CDC or the FBI OGC. When a sensitive
monitoring circumstance is involved, the-monitoring must be approved by the
DOJ
Criminal Division or, if the investigation concerns a threat to the national security,by theDOJ NSD. (AGG-Dom, Part V.A.4) Sensitive monitoring circumstances include:a. (U) Investigation of a member of Congress, a federal judge, a member oftheExecutive Branch at Executive Level IV or above, or a person who has servedin suchcapacity within.the previous two years (Executive Level I through IV aredefined in 5
U.S.C. §§ 5312-5315);b. (U) Investigation of the Governor, Lieutenant Governor, or Attorney Generalof anystate or territory, or a judge or justice of the highest court of any stateor territory,81
UNCLASSIFIED-FOR OFFICIAL USE ONLYUNCLASSIFIED - FOR OFFICIAL USE ONLY
Domestic Investigations and Operations Guide
concerning an offense involving bribery, conflict of interest, or extortion related tothe performance of official duties;c. (U) A party to the communication is in the custody of the Bureau of Prisons oi the
United States Marshal Service or is being or has been afforded protection in the
Witness Security Program; ord. (U) The Attorney General, the Deputy Attorney General, or an Assistant Attorney
General has requested that the FBI obtain prior approval for the use of consenisualmonitoring in a specific investigation. (AGG-Dom, Part VII.A and 0)(U//FOUO) Note: See classified appendix for additional information.
(U//FOUO)I
1
b2

b7E

13. (U) Use of closed-circuit television, direction finders, and other monitoring devices,
subject to legal review by the CDC or the FBI OGC. (The methods described in thisparagraph usually do not require a court order or warrant unless they involve an intrusion
into an area where there is a reasonable expectation of privacy or non-consensual
monitoring of communications, but.legal review is iecessary to ensure compliance withall applicable legal requirements.) (AGG-Dom, Part.V.A.5)
14. (U) Polygraph examinations. (AGG-Dom, Part V.A.6)
15. (U) Undercover operations. In investigations relating to activities in violation of federal
criminal law that do not concern threats to the national security or foreign intelligence,
undercover operations must be carried out in conformity with The Attorney General's
Guidelines on FederalBureau ofI'nvestigation Undercover Operations.Investigations

that are not subject to the preceding sentence because they concern threats to the national
security or foreign intelligence undercover operations involving religious or politicalorganizations must be reviewed and approved by FBI Headquarters, with participation by
the DOJ NSD in the review process. (AGG-Dom, Part V.A.7)
16. (U) Compulsory process as authorized by law. including grand iurv subpoenas and othersubpoenas. National Security Letters (15 U.S.C. §§ 1681u, 1681v; 18 U.S.C. § 2709; 12
U.S.C. § 3414[a][5][A]; 50 U.S.C. § 436), and FISA orders for the production of tangible
things. (50 U.S.C. §§ 1861-63). (AGG-Dom, Part V.A.8)
17. (U) Accessing stored wire and electronic communications and transactional records inconformity with chapter 121 of title 18, United States Code (18 U.S.C. §§ 2701-2712).
(AGG-Dom, Part V.A.9)
18. (U) Use of pen registers and trap and trace devices in conformity with chapter 206 of title
18, United States Code (18 U.S.C. §§ 3121-3127) or FISA (50 U.S.C. § 1841-1846).
(AGG-Dom; Part V.A. 10)

82
UNCLASSIFIED-FOR OFFICIAL USE ONLYUNCLASSIFIED - FOR OFFICIAL USE ONLY
Domestic Investigations and Operations Guide
6.10. (U) Sensitive Investigative Matter / Academic Nexus / Buckley Amendment(U//FOUO) The title/case caption of the opening or subsequent EC for a preliminary
investigation involving a sensitive investigative matter must contain the words "Sensitive
Investigative*Matter." DIOG Section 10 contains the required approval authority and factors forconsideration when determining whether to initiate or approve a predicated investigation
involving a sensitive investigative matter.
A. (U//FOUO) Sensitive Investigative Matter: An investigative matter involving the activities
of a domestic public official or political candidate (involving corruption or a threat to thenational security), religious or political organization or individiral prominent in such anorganization, or news media, or any other matter which, in the judgment of the official'authorizing an investigation, should be brought to the attention of FBI Headquarters andotherDOJ officials. (AGG-Dom, Part VII.N.) As a matter of FBI policy, "judgment"
meansthat the decision.of.the.authorizing official is discretionary. DIOG Section 10 and/or the
DIOG classified Appendix G definelb27

B. (U//FOUO) AcademicNexus:1
b2
b7E(U//FOUO) The sensitivity related to an academic institution arises from the American,
tradition of "academic freedom" (e.g., ah atmosphere in which students and faculty are free
to express unorthodox ideas and views and to challenge conventional thought without
fear ofrepercussion). Academic freedom does not mean, however, that academic institutions
are off
limits to FBI investigators in pursuit of information or individuals of legitimate investigativeinterest.

(U//FOUO)|
I

b2

b7E
Isee the D10G classified Appendix.-.

C. (U//FOUO) Buckley Amendment: Although not a sensitive investigative
matter, a request
for "academic records" must only be made.pursuant to the provisions of the Buckley
Amendment (The Family Educational Rights and Privacy Act of 1974, 20 U.S.C. §1232[g],as amended by Public Law 107-56 ["USA PATRIOT Act"]). An FBI employee is prohibitedfrom receiving "academic records" that have not been properly requested pursuant
to theBuckley Amendment. The definition of "academic records" is very broad and covers almost
all records about a student other than public, student directory-type information
published
the institution. The Buckley Amendment contains a penalty provision for those institutionsby
that improperly provide academic records tolaw enforcement n.innie
b2*b7E

A Buckley Amendment request for academic records cannot be made during
an assessment.
In a predicated investigation, a request for academic records must be made pursuant to the
Buckley Amendment.
83
UNCLASSIFIED-FOR OFFICIAL USE ONLYUNCLASSIFIED - FOR OFFICIAL USE ONLY
Domestic Investigations and Operations Guide
6.11. (U) Program Specific Investigative Requirements(U//FOUO) Because of the, many investigative programs within the FBI, a single universal
requirement will not adequately address every program. To facilitate compliance within anexisting program, the FBI employee should consult the relevant program policy guidance.

84
UNCLASSIFIED-FOR OFFICIAL USE ONLYUNCLASSIIED,-FOR OFFICIAL USE ONLY
Domestic Investigations and Operations Guide

7.

(U) Full Investigations

7.1. (U) Overview(U//FOUO) The AGG-Dom authorizes a second level of investigative activity-predicatedinvestigations. Predicated investigations that concern federal crimes or threats to the national
security are subdivided into.preliminary investigations and full investigations. Full investigations
may be initiated if there is an "articulable factual basis" of possible criminal or national threat
activity, as discussed in greater detail in Section 7.5, below. There are three types of fullinvestigations" (i) single and multi-subject; (ii) enterprise; and (iii) positive foreign intelligencecollection.
7.2. (U) Purpose and Scope(U) Full investigations may be initiated to detect, obtain information about, or prevent or protect
against federal crimes or threats to the national security or to collect foreign intelligence.
(U) The objective of a full investigation.includes: determining whether a federal crime is being
planned, prepared for, occurring or occurred; identifying, locating, and apprehending theperpetrators; obtaining evidence for prosecution; identifying threats to the national security;
investigating an-enterprise (as defined in DIOG Section 8); or collecting positive foreign
intelligence.
(U) The investigation of threats to the national security.can be investigated under both the FBI's
criminal investigation authority and its authority to investigate threats to the national security. As
with criminal investigations, detecting and solving crimes, gathering evidence and arresting andprosecuting the perpetrators are frequently the objectives of investigations relating to threats tothe national security. These investigations also serve important purposes outside the ambit of
normal criminal investigations, however, by providing the basis for decisions concerning othermeasures needed to protect the national security.
(U//FOUO)
b2

b7E(U//FOUO) A full investigation solely for the collection of positive foreign, intelligence extends
the sphere of the FBI's information gathering activities beyond federal crimes and threats to thenational security and permits the FBI to seek information regarding a broader.range of mattersrelating to foreign powers, organizations, or persons that may be of interest to the conduct of theUnited States' foreign affairs. (See DIOG Section 9)
7.3.
(U) Civil Liberties and Privacy(U) The pursuit of legitimate investigative goals without infringing upon the exercise of
constitutional freedoms is a challenge that the FBI meets through the application of soundjudgment and discretion. In order to further ensure that civil liberties are not undermined by the
conduct of criminal and national security investigations, every full investigation under thissubsection must have an identified authorized purpose and adequate predication.

85
UNCLASSIFIED-FOR OFFICIAL USE ONLYUNCLASSIFIED.- FOR OFFICIAL USE ONLY
Domestic Investigations and Operations Guide(U) No investigative activity, including full investigations, may be taken solely on the basis ofactivities that are protected by the First Amendment or on the race, ethnicity, national origin or
religion of the subject. Full investigations of individuals, groups or organizations must focus on
activities related to the threats or crimes being investigated, not solely on First Amendment
activities or'on the race, ethnicity, national origin or religion of the subject. In this context, it is.particularly important clearly to identify and document the law enforcement.or national security
basis of the full investigation:(U) Example: Individuals or groups who communicate with each other orwith members, of the public in any form in pursuit of social or politicalcauses-such as opposing -war or foreign policy, protesting government
actions, promoting certain- religious beliefs, championing particular local,
national, or international causes, or a change in government through noncriminal means, and actively recruit others to join their causes-have afundamental constitutional right to do so. A full investigation may not be
initiated based.solely on the exercise of these First Amendment rights.
(U) The AGG-Dom authorize all lawful investigative methods in the conduct of a fullinvestigation. Coisidering the effect-on-the privacy and civil libertiesof individuals and thepotential to damage the reputation of individuals, some of these investigative methods are more
intrusive than others. The least intrusive method feasible is to be used, but the FBI must nothesitate to use any lawful method consistent with the AGG-Dom. A more intrusive method may
be warranted in light of the seriousness of a criminal or national security threat or.the importanceof a foreign intelligence requirement.
(U) By emphasizing the use of the least intrusive means to obtain intelligence or evidence, FBI
employees can effectively execute their duties while mitigating the potential negative impact on.
the privacy and civil liberties of all people encompassed within the investigation,
includingtargets, witnesses, and victims. This principle is not intended to discourage FBI employees fromseeking relevant and necessary intelligence, information, or evidence, but rather is intended toencourage-FBI employees to choose the least intrusive-but-still effective means-from theavailable options to obtain the material.
(U) Because the authority to collect positive foreign intelligence enables the FBI to obtain'information pertinent to the United States' conduct of its foreign affairs, even if that information
is not related to criminal activity or threats to the national security, the information gathered may
concern lawful activities. The FBI must accordingly operate openly and consensually with a
United States person to the extent practicable when collecting positive foreign intelligence that
does not concern criminal activities or threats to the national security.
7.4. (U) Legal Authority
A. (U) Criminal Investigations(U). The FBI has statutory authority to investigate all federal'crime not assigned exclusively
to another federal agency. (See 28 U.S.C. § 533; 18 U.S.C. § 3052; 28 C.F.R. § 0.85 [1].)(U) The FBI also has special investigative jurisdiction to investigate violations of state law inlimited circumstances. Specifically, the FBI has jurisdiction to investigate felony killings ofstate law enforcement officers (28 U.S.C. § 540), violent crimes against interstate travelers
86
UNCLASSIFIED-FOR OFFICIAL USE ONLYUNCLASSIFIED - FOR OFFICIAL USE ONLY
Domestic Investigations and Operations Guide(28 U.S.C. § 540A), and serial killers (28 U.S.C. § 540B). Authority to investigate thesematters is contingent on receiving a request by an appropriate state official.
B. (U) Threats to the National Security(U) The FBI has authority to investigate threats to the national security pursuant to executive
orders, Attorney General authoiities, and various statutory sources. (See E.O. 12333; 50
U.S.C. §§ 401 et seq.; 50 U.S.C. §§ 1801 et seq.)(U) "Threats to the national security" are specifically defined to mean: international
terrorism;
espionage and other intelligence activities, sabotage, and assassination, conducted by, for,oron behalf of foreign powers, organizations, or persons; foreign computer intrusion; and othermatters determined by the Attorney General, consistent with Executive Order 12333 orany
successor order. (AGG-Dom, Part VII.S)
C. (U) Foreign Intelligence Collection(U) The FBI authority to collect foreign intelligence derives from a mixture of administrativeand statutory sources. (See E.O. 12333; 50 U.S.C. §§ 401 et seq.; 50 U.S.C. §§ 1801et sec.;28 U.S.C. § 532 note (incorporates the Intelligence Reform and Terrorism Protection Act,
P.L. 108-458 §§ 2001-2003).
(U) "Foreign Intelligence"is defined as information relating to the capabilities, intentions,oractivities of foreign governments or elements thereof, foreign organizations or foreign
persons, or international terrorists. (AGG-Dom, Part VII.E)
7.5. (U) Predication(U) A full investigation may be initiated if there is an "articulable factual basis" that reasonably
indicates one of the following circumstances exists:
A. (U) An activity constituting a federal crime or a threat to the national security-has
or.mayhave occurred, is or may be occurring, or will or may occur and the investigation
may obtain
information relating to the activity or the involvement or role of an individual, group,ororganization in such activity.
B. (U) An individual, group, organization, entity, information, property, or activity
is or maybe
a target of attack, victimization, acquisition, infiltration, or recruitment in connection
withcriminal activity in violation of federal law or a threat to the national security andtheinvestigationinay obtain information that would help to protect against suchactivity or threat.
C. (U) The investigation may obtain foreign intelligence that is responsive to a
Positive Foreign.Intelligence Requirement, as defined in DIOG Section 7.4.C.
(U//FOUO)

I(i)(U//FOUO

I

b2
b7E

(ii)

(U//FOUO

87
UNCLASSIFIED-FOR OFFICIAL USE ONLYUNCLASSIFIED - FOR OFFICIAL USE ONLY
Domestic Investigations and Operations Guide(iii)(U//FOUO)

b2
b7E

7.6. (U//FOUO) Standards for Initiatinig or Approving a Full Investigation(U//FOUO) Before initiating or approving the conduct of a full investigation, an FBI employee
or approving official must determine whether:A. (U//FOUO) An authorized purpose.and adequate predication exist for initiating aifull
investigation;
B. (U//FOUO) The full investigation is based on factors other than the exercise of First
Amendment activities or the race, ethnicity, national origin or religion of the subject; arid
C. (U//FOUO) The full investigation is an appropriate use ofpersonnel-and financial resources.
7.7. (U) Duration, Approval, Notice, Documentation and File Review
A. (U//FOUO) Initiation: The purpose of and predication for a full-investigation must be
documented in the initiating EC. The effective date of the full investigation is the date thefinal approval authority (e.g., SSA or SAC) approves the EC.
1. (U//FOUO) By a Field Office: The initiation of a full investigation for circumstances
described in Sections7.5.A aid 7.5.Bby a Field Office requires prior approval of the
SSA with written notification to the appropriate FBIHQ substantive Unit. The.initiationof a full investigation of a United States person relating to a threat to the nationalsecurity for circumstances described in Sections 7.5.A and 7.5.B requires the approvalof the Field Office SSA with written notification to the appropriate FBIHQ substantive
Unit. The FBIHQ substantive Unit must notify DOJ NSD as soon as practicable but inall events within 30 calendar days after the initiation of the investigation.
2. (U//FOUO) By FBIHQ: The initiation of a full investigation for circumstances
described in Sections. 7.5.A and 7.5.B by FBIHQ requires prior approval of the Unit
Chief with written notification to the appropriate Field Office. The initiation of a fullinvestigation by FBIHQ of a United States person relating to a threat to the national
security for circumstances described in Sections 7.5.A and 7.5.B requires the approvalof the Unit Chief with written notification to the appropriate-Field Office and notice to
DOJ NSD as soon as practicable but in all events within 30 days after initiation of theinvestigation.
3. (U//FOUO) Sensitive Investigative Matter: The initiation of.a full investigation
involving a sensitive investigative matter:a. (U//FOUO) By a Field Office: requires CDC review, SAC approval, and written
notification to the appropriate FBIHQ substantive Unit Chief and Section Chief.
Additionally, the Field Office must notify, in writing, the United States Attorney,
if required. The appropriate FBIHQ Section must notify, in writing, the DOJ
Criminal Division or NSD as soon as practicable, but no later than 30 calendar
days after the initiation of the investigation. The notice must identify all known
sensitive investigative matters involved in.the investigation (see classified
appendix for additional notice requirements). If a sensitive investigative matter
arises after the initiation of a full investigation, investigative activity must cease
88
UNCLASSIFIED-FOR OFFICIAL USE ONLYUNCLASSIFIED - FOR OFFICIAL USE ONLY
Domestic Investigations and Operations Guide
until CDC review and SAC approval are acquired and notice is furnishedasspecified above.
b. (U//FOUO) By FBIHQ: requires OGC review, Section Chief approval,
andwritten notification to the United States Attorney and the appropriate
Field Officeor the.DOJ Criminal Division orNSD as soon as practicable, but no later
than 30
calendar days after the initiation of such an investigation. The noticemust identify'
all known sensitive investigative matters involved in the investigation(seeclassified appendix for additional notice requirements). If a sensitive-investigative
matter arises after theinitiation of a full investigation, investigative
activity mustcease until OGC review and Section Chief approval are acquired andnotice is.
fumished as specified above. (AGG-Dom, Part II.B.5.a)4. (U//FOUO) The initiation of a full investigation in order to collectpositive foreign
intelligence must be approved as provided in Section 9. Additionally,
writtennotification to FBIHQ CMS and DOJ NSD is required as soon aspracticable
but nolater than 30 calendar days after the initiation of the investigation.
5. (U//FOUO) The.EAD for the National Security Branch must notify
the Deputy
AttdrneyGeneral if FBI Headquarters disapproves a Field Office's
initiation of a fullinvestigation relating to a threat to the national security on-the ground that thepredication for the investigation ,isinsufficient, and the EAD for the
National Security
Branch is responsible for establishing a system that will allow for
the prompt retrievalof such denials. (AGG-Dom, Part II.B.5.d)
B. (U//FOUO) Closing: When closing the full investigation, theField Office or FBIHQ will
provide the reason for closing the investigation. When closing a fullinvestigation, the SSA or
Unit Chief must ensurethat all pending investigative methods
have been, completed/terminated (e.g., mail covers and penregister/trap and trace). Although
there is no duration
requirement for a full:investigation, the investigation must be closed upon allinvestigative
activity being exhausted.
1. (U//FOUO) Closing a full investigation initiated by a Field Officerequires approval
from the SSA. Notification to the substantive FBIHQ Unit may
berequired by program
policy.
2. (UI/FOUO) Closing a full investigation initiated by FBIHQ requires
approval from theUnit Chief and notification to the appropriate Field Office.
3. (U//FOUO) Closing a full investigation initiated by a Field
Officeinvestigative matter requires approval from the SAC andwritten involving a sensitive
notification to the
FBIHQ substantive. Unit and Section.
4. (U//FOUO) Closing a full investigation initiated by FBIHQ involving
a sensitive.
investigative matter requires approval from the Section Chief
and written notification to
the appropriate Field Office.
5. (U//FOUO) Closing a full investigation for the purposeof positive foreign intelligencecollection requires the approval of FBIHQ CMS.

89
UNCLASSIFIED-FOR OFFICIAL USE ONLYUNCLASSIFIED - FOR OFFICIAL USE ONLY
Domestic Investigations and Operations Guide
C. (U//FOUO) File Review: Supervisory file reviews must be conducted at least once every
90
days in accordance with Section 3.4. File reviews for probationary FBI employees mustbeconducted at least every 60 days.
D. (U//FOUO) Annual Letterhead Memorandum: Annual letterhead memoranda regardin
the status of full investigations are not required bv the AG(i-Dnm- hnxrr I
I

b2
b7E

7.8. (U//FOUO) Standards for Initiating or Approving the Use of an Authorized
Investigative Method(U//FOUO) Prior to initiating or approving the use of an investigative method, an FBI.employee
or approving official must determine whether:A. (U//FOUO) The use of the particular investigative method is likely to further the purposeofthe full investigation;
B. (U//FOUO) The investigative method selected is the least intrusive method, reasonable
under
the circumstances;
C. (U//FOUO) If the full investigation is for collecting positive foreign intelligence,
theFBI
mustoperate openly and consensually with aUhitedStates person, to the extent
practicable;'andD. (U//FOUO) The method to be used is an appropriate use of personnel and financial

resources.
7.9. (U) Authorized Investigative Methods in Full Investigations(U) Al lawful methods may be used in a full investigation, unless the investigation
is to collectforeign intelligence. The use or dissemination of information obtained by the useof these
methods must comply with the AGG-Dom and DIOG Section 14..See foreign intelligencecollection Section 9 for more information regarding use of authorized investigative methods..
A. (U) Obtain publicly available infornnation.
B. (U) Access and examine FBI and other DOJ records, and obtain informationfrom any FBI orother DOJ personnel.
C; (U) Access and examine records maintained by. and reuest information from.
other federal,state, local, or tribal, or foreign governmental entities or agencies.
D. (U) Use online services and resources (whether non-profit or commercial).
E. (U) Use and recruit human sources in conformity With the AGG-CHS.
F. (U) Interview or request information from members of the public and private
entities.
G. (U) Accept information voluntarily provided by governmental or private entities.
H. (U) Engage in observation or surveillance not requiring a court order.
I. (U) Grand Jury Subpoenas for telephone or electronic mail subscriber information (see also
'P' below).
J. (U) Mail covers. (AGG-Dom, Part V.A.2)

90
UNCLASSIFIED-FOR OFFICIAL USE ONLYUNCLASSIFIED - FOR OFFICIAL USE ONLY
Domestic Investigations and Operations Guide
K. (U) Physical searches ofpersonal or real property where a warrant
or court order is notlegally required because there is no reasonable expectation of privacy(e.g., trash covers).
(AGG-Dom, Part V.A.3)
L. (U) Consensual monitorin of communications, including consensualcomputer monitoring,
subject to legal review by the CDC or the FBI OGC. When asensitiye monitoring
circumstance is involved, the monitoring must be approvedby the DOJ Criminal Division or,if the investigation concerns a threat to the national security,by the DOJ NSD. (AGG-Dom,
Part V.A.4)(U) Sensitive monitoring circumstances include:
1. (U) Investigation of a member of Congress, a federal judge,
a member of the
Executive Branch at Executive Level IV or above, or a person
who has served in suchcapacity within the previous two years (Executive Level I
through IV are defined in 5
U.S.C. §§ 5312-5315);
2. (U) Investigation of the Governor, Lieutenant Governor,
or Attorney General of any
state or territory, or a judge or justice of the highest courtof any state or territory,
conceming an offense involving bribery, conflict of interest,
or extortion related tothe performance of official duties;
3. (U) A party to the communication is in the custody of
the Bureau of Prisons or theUnited States Marshal Service or is being or has been afforded
protection in the
Witness Security Program; or
4. (U) The Attorney General, the Deputy Attorney General,or an Assistant Attorney
General has requested that the FBI obtain prior approval forthe use of consensual *monitoring in a specific .iivestigation. (AGG-Dom, Part
VII.A'and 0)(U//FOUO) Note: See classified appendix for additional information.
(U//FOUO) Note: For those state, local and tribal governmentsthat do not sanction orprovide a law enforcement exception available to the FBI
for one-party consensual recording
ofcommunications with persons within their jurisdiction, the SAC must approve
theconsensual monitoring of communications as an OIA, as
discussed in Section 17. Prior to the
SAC.authorizing.the OIA, one-party consent must be.acquired.
The SAC may delegate thisOIA approval authority to an ASAC or SSA.
M. (U) Use of closed-circuit television direction finders, andother monitoring devices, subject
to legal review by the CDC or the FBI OGC. (The methods
usually do not require a court order or warrant unless they described in this paragraphinvolve an intrusion into an area
where there is a reasonable expectation of privacy or
non-consensual monitoring ofcommunications- but legal review is necessary to ensure compliancewith all applicable legal
requirements.) (AGG-Dom, Part V.A.5)
N. (U) Polygraph examinations. (AGG-Dom, Part V.A.6)
O. (U) Undercover operations. In investigations relating
activities in violation of federal
criminal law that do not concern.threats to the nationaltosecurity
undercover operations must be carried out in conformity with or foreign intelligence,
The Attorney General's
Guidelines on Federal
Bureau of Investigation UndercoverOperations.Investigations

are not subject to the preceding sentence because they concern

thatthreats to the national security

91
UNCLASSIFIED-FOR OFFICIAL USE ONLYUNCLASSIFIED - FOR OFFICIAL USE ONLY
Domestic Investigations and Operations Guideor foreign intelligence undercover operations involving religious or political organizations
must be reviewed and approved by FBI Headquarters, with participation by the DOJ NSD in
the review process. (AGG-Dom, Part V.A.7)
P. (U) Compulsory process as authorized by law. including grand iurv subpoenas and othersubpoenas. National Security Letters (15 U.S.C. §§ 1681u, 1681v; 18 U.S.C. § 2709; 12
U.S.C. § 3414[a][5][A]; 50 U.S.C. § 436), and FISA orders for the production of tangible
things. (50 U.S.C. §§ 1861-63). (AGG-Dom, Part V.A.8)
Q. (U) Accessing stored wire and electronic communications and transactional records inconformity with chapter 121 of title 18, United States Code (18 U.S.C. §§ 2701-2712).
(AGG-Dom, Part V.A.9)-R. (U) Use of pen registers and trap and trace devices in conformity with chapter 206 of title 18,
United States Code (18 U.S.C. §§ 3121-3127) or FISA (50 U.S.C. §§ 1841-1846). (AGGDom, Part V.A.10)(U) The following investigative methods can only be used in full investigations:S. (U) Electronic surveillance in conformity with chapter 119 of Title 18, United States Code
(18 U.S:C. §§ 2510-2522), FISA, or Executive'Order 12333 § 2.5. (AGG-Dom, Part V.A. 1.)
T. (U) Physical searches, including mail openings, in conformity with Rule 41 of the Federal
Rules of Criminal Procedure, FISA, or Executive Order 12333 § 2.5. The classified appendix
to the DIOG, Appendix G, provides additional information regarding certain searches.
(AGG-Dom, Part V.A.12)
U. (U) Acquisition of foreign intelligence information in conformity with Title VII of FISA.
,(AGG-Dom, Part V.A.13)
7.10. (U) Sensitive Investigative Matter / Academic Nexus / Buckley Amendment(U//FOUO) The title/case caption of the opening or subsequent EC for a full investigation
involving a sensitive investigative matter must contain the words "Sensitive Investigative
Matter." DIOG Section 10 contains the required approval authority and factors to be consideredwhen determining,whether to conduct or to approve a predicated investigation involving asensitive-investigative matter. The AGG-Dom defines sensitive investigative matter as follows:
A. (U//FOUO) Sensitive Investigative Matter: An'investigative matter involving the activities
of a domestic public official or political candidate.(involving corruption or a threat to thenational security), religious or political organization or individual prominent in such anorganization, or news media, or any other matter which, in the judgment of the official
authorizing an investigation, should.be brought to the.attention of FBI Headquarters andother DOJ officials. (AGG-Dom, Part VII.N). As a matter of FBI policy, "judgment" meansthat the decision of the authorizing official is discretionary. DIOG Section 10 and/or the
DIOG classified Appendix G-define domestic public official, political candidate, religious orpolitical organization or individual prominent in such an organization, and news media.
B. (U//FOUO) Academic Nexus:|

92
UNCLASSIFIED-FOR OFFICIAL USE ONLYb2
b7E

UNCLASSIFIED - FOR OFFICIAL USE ONLY
Domestic Investigations and Operations Guide(U//FOUO) The sensitivity related to an academic institution arises from the American
tradition of "academic freedom" (e.g., an atmosphere in which students and faculty are free
to express unorthodox ideas and views and to challenge conventional thought without fear ofrepercussion). Academic freedom does not mean,.however, that academic institutions are off.limits to FBI investigators in pursuit of information or individuals of legitimate investigativeinterest.
I(U//FOUO) For matters not considered a sensitive investigative matter
I see the DIOG classified Appendix G.

b2

b7 E

I

C. (U//FOUO) Buckley Amendment: Although not a sensitive investigative matter, a request
for "academic records" must only be made pursuant to the provisions of the Buckley
Amendment (The Family Educational Rights and Privacy Act of 1974,20 U.S.C. § 1232[g],as amended by Public Law 107-56 ["USA PATRIOT Act"]). An FBI employee is prohibitedfrom receiving "academic records" that have not been properly requested pursuant to the
Buckley Amendment. The definition of "academic records" is very broad and covers almost
all records about a student other than public, student directory-type information published by
the institution. The Buckley Amendment contains a penalty provision for those institutions
that improperly provide academic records to law enforcement agencies .
I

b2
b7E

(U//FOUO) A Buckley Amendment request for academic records cannot be made during anassessment. In a predicated investigation, a request for academic records must be madepursuant to the Buckley Amendment.
7.11. (U) Program Specific Investigative Requirements(U//FOUO) Because of the many investigative programs within the FBI, a single universal
requirement will not adequately address every program. To facilitate compliance within anexisting program, the FBI employee should consult the relevant proram policy guidance.

93
UNCLASSIFIED-FOR OFFICIAL USE ONLYUNCLASSIFIED - FOR OFFICIAL USE ONLY
Domestic Investigations and Operations Guide

8.

(U) Enterprise Investigations

8.1. (U) Overview(U).Enterprise investigations may only be opened and operated as full investigations and are
subject to the same requirements that apply to full investigations described in Section 7.
Enterprise investigations focus on groups or organizations that may be involved in the mostserious criminal or national security threats to the public, as described in Section 8.5 below.
Enterprise investigations cannot be conducted as preliminary investigations or assessments, nor
may they be conducted for the sole purpose of collecting positive foreign intelligence. See
Section 8.2, below, regarding preliminary investigations and assessments.
8.2. (U) Purpose, Scope and Definitions(U) The term "enterprise" iticludes any partnership, corporation, association, or other legal entity,
and any union or group of individuals associated in fact, although not-a legal entity. The purposeof an enterprise investigation is to examine the structure, scope,.and nature of the group ororganization including: its relationship, if any, to a foreign power; the.identity and relationship of
its members, employees, or other persons who may be acting in furtherance of its objectives; its
finances and resources;-its geographical dimensions;its past and future-activities and goals; andits capacity for harm. (AGG-Dom, Part II.C.2)(U//FOUO) Although an enterprise investigation may not be conducted as a preliminary
investigation, a preliminary investigation may be used to determine whether a group'ororganization is a criminal or terrorist enterprise if the FBI has "information or an allegation" thatan activity constituting a federal crime or a threat to the national security has or may haveoccurred, is or may be occurring, or will or may occur, and the investigation may obtain
information relating to the activity of the group or organization in such activity. An assessment
may also be initiated to determine whether a group or organization is involved in activities
constituting violations offederal.criminal law or threats to the national security.
8.3. (U) Civil Liberties and Privacy(U) The pursuit of legitimate investigative goals without infringing upon the exercise of
constitutional freedoms is a challenge that the FBI meets through the application of soundjudgment and discretion. In order to further ensure that civil liberties are not undermined by the
conduct of criminal and national security investigations, every full investigation, including anenterprise investigation under this subsection, must have an identified authorized purpose andadequate predication.
(U) No investigative activity, including enterprise investigations, may be taken solely on thebasis of activities that areprotected by the First Amendment or on the race, ethnicity, national
origin or religion of the subject. Enterprise investigations of groups and organizations must focus
on activities related to the threats or crimes being investigated, not solely on First Amendment
activities or on the race, ethnicity, national origin or religion of the members of the group ororganization: In this context, it is particularly important clearly to identify and document the law
enforcement or national security basis of the enterprise investigation.
(U//FOUO) Example: Groups who communicate with each other or withmembers of the public in any form in pursuit of social or political causes94
UNCLASSIFIED-FOR OFFICIAL USE ONLYUNCLASSIFIED - FOR OFFICIAL USE ONLY
Domestic Investigations and Operations Guide
such as opposing war or foreign policy, protesting government actions,promoting certain religious beliefs, championing particular local; national, orinternational' causes, or a change in government through non-criminal means,'and actively recruit others, to join their causes-have .a fundamental
constitutional right to do so. An enterprise investigation may not be initiatedbased solely on the exercise of these First Amendment rights.
(U) The AGG-Dom authorize all lawful investigative iethods in the conduct of an enterpriseinvestigation. Considering the effect on the privacy and.civil liberties of individuals and thepotential to damage the reputation of individuals, some of these investigative methods are more
intrusive than others. The least intrusive method feasible is to be used, but the FBI must nothesitate to use any lawful method consistent with the AGG-Dom. A more intrusive method may
be-warranted in light of the.seriousness of a criminal or national security threat.
(U) By emphasizing the use of the least intrusive means to obtain intelligence and/or evidence,
FBI employees can effectively execute their duties while mitigating the potential negative impact
on the privacy and civil.liberties of all people encompassed within the investigation, including
targets, witnesses, and victims. This principle is not intended to discourage FBI employees fromseeking relevant and necessary intelligence, information, or evidence, but rather is intended toencourage FBI.employees to choose the.least:intrusive-but still effective means-from theavailable options to obtain the material.
8.4. (U) Legal Authority(U) A full investigation of a group or organization may be initiated as an enterprise investigation
if there is an articulable factual basis for the investigation that.reasonably indicates the group ororganization may-have engaged,.or may be engaged in, or may have or may be engaged inplanning.or preparation or provision of support for: (AGG-Dom, Part II.C. 1)
A. (U) A pattern of racketeering activity as defined in 18 U.S.C. § 1961(5),B. (U) International terrorism, as defined in the AGG-Dom, Part VII.J, or other threat to thenational security;
C. (U) Domestic terrorism as defined in 18 U.S.C. S 2331(5) involving a violation of federal
criminal law;
D. .(U) Furthering political or social goals wholly or in part through activities that involve force
or violence and a violation of federal criminal law; or
E. (U) An offense.described in 18 U.S.C. § 2332b(g)(5)(B) or 18 U.S.C.
§ 43.
8.5. (U) Predication(U).An enterprise investigation is predicated when there is an articulable factual basis for theinvestigation that reasonably indicates the group or organization may have engaged or may
beengaged in, or may have or may be engaged in, planning.or preparation-or provision of support
for the matters identified in Section 8.4, above.
(U) The."articulable factual basis" for opening an enterprise investigation is met with theidentification of a group whose statements made in furtherance of its objectives, or its conduct,
demonstrate t purpose of committing crimes or securing the commission of crimes by others.
The group's activities and statements of its members may be considered in combination-to95
UNCLASSIFIED-FOR OFFICIAL USE ONLYUNCLASSIFIED - FOR OFFICIAL USE ONLY
Domestic Investigations and Operations Guide
comprise the "articulable factual basis," even-if the statements alone or activities alone would not
warrant such a determination.
(U//FOUO) Examples of situations in which an enterprise investigation may
be opened:

8.6.

i.

(U//FOUO)

ii.

(U//FOUO)

iii.

(U//FOUO)

b2
b7E(U) Duration, Approval, Notice, Documentation and File Review

A. (U) Initiation:
1. (U//FOUO).By a Field Office: The initiation of an enterprise investigation by an FBI
Field Office requires the prior approval of the Field Office SSA with written notification
to the appropriate FBIHQ substantive Unit and DOJ (as discussed in greater detail below).
FBIHQ Divisions may require specific facts to be included in this notificatibn.FI. b2
b7E
bnterprise investigations involving sensitive investigative matters require CDC review,
SAC approval, and written notification to the appropriate FBIHQ substantive Unit and
DOJ.
(U//FOUO) The responsible FBIHQ entity must notify the DOJ NSD or the Organized
Crime and Racketeering Section (OCRS) of the initiation of an enterprise investigation;
by a Field Office or by FBIHQ, as soon as practicable but no later than 30 days-after the
initiation of the investigation. The FBI Field Office must also notify any relevant USAO,
except in.counterintelligence investigations. See the DOJ NSD policy that governs
notification to the USAO for counterintelligence investigations.
2. (U//FOUO) By FBIHQ: The initiation of an enterprise investigation by an FBIHQ
Division requires the prior approval of the appropriate Section Chief with written
notification to the appropriate Field Offices and DOJ (as discussed in greater detailbelow). Enterprise investigations involving sensitive investigative matters require OGC
review, appropriate Assistant Director approval, and written notification to DOJ.
(U//FOUO) The responsible FBIHQ entity must provide notification of an enterpriseinvestigation initiation to the appropriate DOJ component (NSD or OCRS) as soon aspracticable, butno later than 30 days after the initiation of the investigation. FBIHQ must
notify any relevant USAO of the initiation of all enterprise investigations, except incounterintelligence investigations.
96
UNCLASSIFIED-FOR OFFICIAL USE ONLYUNCLASSIFIED - FOR OFFICIAL USE ONLY
Domestic Investigations and Operations Guide(U//FOUO) Note: For enterprise investigations that involve allegations that pertain tonational security matters, the responsible DOJ component for the purpose of notification
and reports is the NSD. For enterprise investigations .relating to a pattern of racketeering
activity that does not involve terrorism offenses, see 18 U.S.C. § 2332b(g)(5)(B), theresponsible DOJ component is the Organized Crime and Racketeering Section of the
Criminal Division. (AGG-Dom, Part II.C.3)(U) The Assistant Attorney General for National Security or the Chief of the Organized
Crime and Racketeering Section, as appropriate, may at any time request the FBI to provide areport on the status of an enterprise investigation and the FBI willprovide such reports asrequested. (AGG-Dom, Part II C.3.d)
B. (U//FOUO) Closing: When closing the enterprise investigation, the Field Office or FBIHQ
will provide the reason for closing the investigation. When closing an enterprise investigation,
the SSA or Unit Chief must ensure that all, pending investigative methods have been
completed/terminated (e.g., mail covers and pen register/trap and trace). Although there is, noduration requirement for an enterprise investigation, the investigation must be closed upon allinvestigative activity being exhausted.
1. (U//FOUO) Closing an enterprise investigation initiated by a Field Office requires
approval from the SSA with written notification to the appropriate FBIHQ substantive
Unit. Unless advised contrary by the FBIHQ (UACB) substantive desk, the enterpriseinvestigation can be. closed 30 days after the date of notification to FBIHQ.
2. (U//FOUO) Closing an enterprise investigation initiated by FBIHQ requires approval
fromthe Unit Chief and notification to the appropriate Field Office.
3. (U//FOUO) Closing an enterprise investigation initiated by a Field Office involving a,sensitive investigative matter requires approval from the SAC, with written notification
to the appropriate FBIHQ substantive Unit. The enterprise investigation can be closed
30 days after the notification to FBIHQ, UACB.
4. (U//FOUO) Closing an enterprise investigation initiated by FBIHQ involving asensitive investigative matter requires approval from the Section Chief, and written
notification to the appropriate Field Office.
C. (U//FOUO) File Review:(U//FOUO) Supervisory file reviews must be conducted at least once every 90 days inaccordance with Section 3.4. File reviews for probationary agents must be conducted at.least
once every 60 days.

97
TTrTl'A QQ TT 'T

VT,r"TieT
'Tr
•T

TCI

..

".1

UNCLASSIFIED - FOR OFFICIAL USE ONLY
Domestic Investigations and Operations Guide

9. (U) Foreign Intelligence9.1. (U) Overview(U) Foreign intelligence is "information relating to the capabilities, intentions, or activitiesofforeign governments or elements thereof, foreign organizations, or foreign persons, orinternational terrorists." A "Foreign Intelligence Requirement" is a collection requirement
issuedunder the authority of the DNI and accepted by the FBIDI. Additionally, the President,
a USIC
office designated by the President, the Attorney General, Deputy Attorney General, orotherdesignated DOJ official may levi a Foreign Intelligence Requirement on the FBI.
Foreign
intelligence collection by the FBI is based upon requirements. .
(U//FOUO) Foreign Intelligence Requirements issued by one of the parties listed abovearid
accepted by the FBI DI will fall into one of two categories: (i) those that address national
security issues that are within the FBI's core national security mission; and (ii) information
relating to the capabilities, intentions, or activities of foreign governments or elements
thereof,foreign organizations, foreign persons, or international terrorists which are not within
the FBI's
core national security mission.
S(U//FOUO) Requirements which fall-into the first.categoy may correspondto FBI National
Collection Requirements as defined in Section:5.11. FBI National Collection Requirements
will
only be addressed in properly authorized assessments or incidental to predicatedinvestigations.
(See the DI PG for specific requirements.)(U//FOUO) Requirements which fall into the second category are known as Positive
ForeignIntelligenceRequirements and may only be addressed under the authorities describedin thissection. Assessments and full investigations intended to result in the collection of
positive
foreign intelligence must be.based upon established requirements and approved
by FBIHQ
Preliminary, investigations for the sole purpose of collectin positive foreign intelligence areDI.
not b2authorized.
b7E
SAssessments and full investigations initiated for the
purpose of positive foreign intelligence colection must be opened by FBIHQ
CMS. Forassessments, the authorized purpose and identified objective must be documented
in theassessment file.
(U//FOUO) "The general guidance of the FBI's foreign intelligence collection
activities by DNIauthorized requirements does not limit the FBI's authority to conduct investigations
supportableon the basis of its other authorities-to investigate federal crimes and threats to thenational
security-in areas in which the information sought also falls under the definition offoreign
intelligence." (AGG-Dom, Introduction A.3) Accordingly, the AGG-Dom
authorizes thecollection of foreign intelligence incidental to predicated criminal, counterintelligence,
couhterterrorism, cyber, and weapons of mass destruction investigations.
(U//FOUO) FBI National Collection Requirements which address national security
issues thatare within the FBI's core national security mission will be worked under FBI substantivecase
classifications (e.g., 200, 105, 315) as assessments. An assessment.cannot
be opened solely
based upon an FBI National Collection Requirement. An authorized purpose(national security or
criminal threat) must exist and.the objective of the assessment must be
clearly articulated when98
UNCLASSIFIED-FOR OFFICIAL USE ONLYUNCLASSIFIED - FOR OFFICIAL USE ONLY
Domestic Investigations and Operations Guide
opening an authorized assessment. The authorized purpose and identified objective for allassessments mustbe documented in the assessment file.
(U//FOUO) Example:(i) (U//FOUO)
b2
b7E
b7A

(ii) (U//FOUO)I

b2
b7E(U//FOUO)

b2
b7E(U//FOUO) Note: FBIHQ DI provides specific guidance in its policy implementation guideregarding FBI National Collection Requirements, FBI Field Office Collection Requirements,
and Positive Foreign Intelligence Requirements.
9.2. (U) Purpose and Scope(U//FOUO) As stated above, foreign intelligence is "information relating to the capabilities,
intentions, or activities of foreign governments or elements thereof, foreign organizations, or
foreign persons, or international terrorists." The collection of.positive foreign intelligenceextends the sphere of the FBI's information-gathering activities beyond federal crimes andthreats to the national security and permits the FBI to seek information regarding abroader range.
of matters relating to foreign powers, organizations, or persons that may be of interest to the
conduct of the United States' foreign affairs. (AGG-Dom, Introduction A.3)
9.3. (U) Civil Liberties and Privacy(U) Because the authority to collect positive foreign intelligence enables the FBI to obtain
information pertinent to the United States' conduct of its foreign affairs, even if that information
99
UNCLASSIFIED-FOR OFFICIAL USE ONLYUNCLASSIFIED - FOR OFFICIAL USE ONLY
Domestic Investigations and Operations Guide
is not related to criminal activity or threats to the national security,
the information so gathered'may concern lawful activities. Accordingly, the FBI must
operate openly and consensually witha United States person to the extent practicable when collecting
positive foreign intelligence.
(AGG-Dom, IntroductionA.3)(U) The pursuit of legitimate investigative goals without infringing
constitutional freedoms is a challenge that the FBI meets through upon the exercise of
the application of soundjudgment and discretion. In order to further ensure.that civil liberties
are not undermined, every
assessment or full investigation involving the collection of positive
foreign intelligence under
this section must have an authorized purpose and an identified objective.
Additionally, theauthorized purpose and objective of any assessment conductedmust
be documented and retained
as prescribed in Sections 5 and 14.
(U) No investigative activity, including the collection of
positivetaken solely onthe basis of activities that are, protected by the foreign intelligence, may beFirst Amendment or on the race,
ethnicity, national origin or religion of the subject. Collectionof positive foreign intelligencerequires: (i) an assessment relating to a matter of foreign
intelligence
Positive Foreign Intelligence Requirement;.or (ii) a full investigation interest responsive to athat is predicated on a
Positive Foreign Intelligence Requirement.
(U) The.AGG-Dom present investigators with a number ofauthorized
investigative methods inthe conduct of an assessment or full investigationto collectpositive foreign intelligence..
Considering the effect on the privacy and civil liberties
of individuals and the potential todamage the reputation of individuals, some of theseinvestigative
methods are more intrusive
than others. The least intrusive method feasible is to be
used, but the FBI must not hesitate to use
any lawful method Consistentwith the AGG-Dom. For further
explanation of the least intrusive
method refer to Section 4.
(U) Moreover, when collecting positive foreign intelligenceeither as part of an assessment
related to a matter offoreign,intelligence interest or as
part of a full investigation predicated on a
Positive Foreign Intelligence Requirement, the FBI
must operate-openly and consensually with a
United States person, to the extent.practicable.
(U) By emphasizing the use of the least intrusive means
to collectand by emphasizing the need to operate openly and consensually positive foreign intelligencewith a United States person,, tothe extent practicable, FBI employees can effectively
execute their duties while mitigating thepotential negative impact on the privacy and civil libertiesofthe collection. This principle is not intended to discourage-FBIall people encountered as part of
employees from seeking relevant
and necessary positive foreign intelligence or evidence,but ratheris intended to make sure FBI
employees choose the least intrusive-but still effective-meansfrom the available options to
obtain.the information.
9.4. (U) Legal Authority(U) The FBI's legal authbrity, to collect positive
foreignadministrative and statutory sources.-(SeeE.O. 12333; intelligence derives from a mixture- of
50 U.S.C. §§ 401 et seq.; 50 U.S.C.
§§ 1801 et seq.; 28 U.S. C. § 532 note [incorporates
the Intelligence Reform and Terrorism
Protection Act, P.L. 108-458 §§ '2001-2003]).
In collecting positive foreign intelligence, theFBIwill be guided by Collection Requirements issued
under the authority of the DNI, including the100
UNCLASSIFIED-FOR OFFICIAL USE ONLYUNCLASSIFIED - FOR OFFICIAL USE ONLY
Domestic Investigations and Operations Guide
National Intelligence Priorities Framework and the National
HUMINT Collection Directives, or
any successor directives issues under the authority of the DNI and accepted by FBIHQDI.
A. (U) Assessment Activities(U//FOUO) As discussed in Section 5 of the DIOG,-the AGG-Dom authorize six
types ofassessments, one of which specifically applies to collection of positive foreign
intelligence asfollows: "seeking information, proactively or in response to investigative leads
onmatters of
foreign intelligence interest responsive to foreign-intelligence.requirements." Positive
ForeignIntelligence Requirements can be found on the DI's Collection Management Section
website.
Further instructions on the collection of positive foreign intelligence are containedin the DI PG.
B. (U) Full Investigation Activities(U//FOUO) As discussed in Section 7 of the DIOG, the AGG-Dom cites three,predication
circumstances warranting a full investigation, one of which specifically applies
to collection of
positive foreign intelligence: "The full investigation may obtain foreign intelligencethat isresponsive to a foreign intelligence requirement."(U//FOUO) Predicated positive foreign intelligence collection originates when
the Office of the:DN1 levies a foreign-intelligence collection requiremient on the FBI and'the DI accepts
therequirement as one to which the FBI will endeavor to respond to as part of its
Positive ForeignIntelligence Program.
(U//FOUO) A full investigation to collect positive foreign intelligence is appropriate
only When a
DNI-authorized requiirement exists for a particular issue and that requirement
has
been
accepted
by FBIHQ DI.
9.5.

(U//FOUO) Duration, Approval, Notice, Documentation, File Review
and FBIHQ
Standards for Approving the Initiation of Positive Foreign Intelligence
Investigations

A. (U//FOUO) Positive Foreign Intelligence Collection Authorities(U//FOUO) The FBIHQ CMS is responsible for promulgating FBI policy and oversightofthe Foreign Intelligence Collection Program (FICP). FBIHQ CMS will provide
notice to the
DOJ NSD upon the initiation of a positive foreign intelligence investigation. To
ensure'that
all, positive foreign intelligence collection is focused on authorized Positive'ForeignIntelligence Requirements, only FBIHQ CMS may approve the initiationof a positive
foreign intelligence assessment or full investigation.
nr therwise
determined.by DI).

Field offices must request, by EC, FBIHQ CMS approval

to open such assessments and full investigations.

B. (U//FOUO).Standards to be Considered When Initiating an Assessment
or Full ForeignIntelligence Investigation to Collect Positive Foreign Intelligence(U//FOUO) Before initiating or approving an-assessment or full investigation
for the purposeof collecting positive foreign intelligence, the approving official must
determine whether:
1. (U//FOUO) An authorized purpose and objective exists for the conduct
or an authorized purpose and adequate predication exists for initiating of the assessmenta full investigation;

101:UNCLASSIFIED-FOR OFFICIALUSE ONLYb2
b7E

UNCLASSIFIED - FOR OFFICIAL USE ONLY
Domestic Investigations and Operations Guide
2. (U//FOUO) The assessment or full investigation is not based solely on the exercise ofFirstAmendment activities or on the race, ethnicity, national origin or religion of thesubject; and3. (U//FOUO) The assessment or full investigation is an appropriate use of.personnel andfinancial resources.
9.6.

(U//FOUO) Standards for Initiating or Approving the Use of an Authorized
Investigative Method(U//FOUO) Before initiating or approving the use of an investigative method in an assessment orfull investigation for the purpose of collecting positive foreign. intelligence, an FBI employee orapproving official must determine whether:A. (U//FOUO) The use of the particular investigative method is likely to further the purpose of
the assessment or full investigation;
B. (U//FOUO) The investigative method selected is the least intrusive method, reasonable under.
the circumstances and, if taken relative-t6 a United States person,.the method involves open
Sand consensual activities, to the extent practicable;
C. (U//FOUO) If open and consensual activity would likely be successful, then covert nonconsensual contact with a United States person may not be approved.
D. (U//FOUO) In the case of an assessment, the anticipated value of the assessment justifies theuse of the selected investigative method or methods; andE. (U//FOUO) The investigative method is an appropriate use of personnel and financial
resources.
9.7.

(U) Authorized Investigative Methods in Foreign Intelligence Assessments andPredicated Investigations(U//FOUO) Prior to initiating or approving the use of a method, an FBI employee and approving
official will apply the standards as provided in Section 9.6. With the exceptions noted below, alllawful assessment methods may be used during positive foreign intelligence assessments. With
the exceptions noted below, all lawful methods may be used during a full investigation to collectpositive foreign intelligence. If actions are to be taken with respect to a United States person,
the method used must include open and consensual activities, to the extent practicable.
A. (U) Assessments (see DIOG Section 5.9 for a complete description of the following methods
that may be used in assessments)1. (U) Obtain publicly available information.
2. (U) Engage in observation or surveillance not requiring a court order.
3. (U) Access and examine FBI and other DOJ records, and obtain information from any
FBI or other DOJ personnel.
4. (U) Access and examine records maintained by. and request information from. otherfederal, state. local, or tribal. or foreign governmental entities or agencies.

5. (U) Use online services and resources (whether non-profit or commercial).
6. (U) Interview or request information from members of the public and private entities.

102
UNCLASSIFIED-FOR OFFICIAL USE ONLYUNCLASSIFIED - FOR OFFICIAL USE ONLY
Domestic Investigations and Operations Guide
7. (U) Accept information voluntarily provided by governmental or private

entities.

8. (U) Use and recruit human sources in conformity with the AGG-CHS.
(U//FOUO) Note: The use of Federal Grand Jury Subpoenas, toinclude subpoenas fortelephone or electronic mail subscriber information, is not authorized
in a positive foreign
intelligence assessment.
B. (U) FullInvestigations:(U) In addition to the authorized methods listed in Section 9.7.A,
above, the following lawful
methods may also be used in full investigations opened for the purposeof collecting positive
foreign intelligence:
1. (U) Physical searches of personal or real property where a warrant or
court order is not,legally required because there is no reasonable expectation ofprivacy (e.g., trashcovers). (AGG-Dom, Part V.A.3)
2. (U) Consensual monitoring of communications. including consensualcomputermonitoring. subject to legal review b vthe CDC or the FBI OGC.
Where a sensitive
monitoring circumstance is involved, the monitoring-must be
approved by the-DOJ
Criminal Division or, if the investigation concerns a threat to thenational security, by
the DOJ NSD. (AGG-Dom, Part V.A.4)(U//FOUO) Note: See the classified appendix for additional
information.
(U//FOUO) Note: For those state, local'and tribal goverhmentsthat do not sanction orprovide a law enforcement exception available to the FBI for
one-party consent
recording of communications with persons within their jurisdiction,
the SAC must
approve the consensual monitoring of communications as
an OIA. Prior to the SAC
authorizing the OIA, one-party consent must be acquired.
The SAC may delegate the
OIA approval authority to an ASAC or SSA.
3. (U) Use of closed-circuit television, direction finders, and othermonitoring devices.
subiect to legal review by the CDC or the FBI OGC. (Themethods described in thisparagraph-usually do not require court orders or warrants unlessthey involve an
intrusion into an area where there is a reasonable expectation ofprivacy or nonconsensual monitoring of communications, but legal review
is necessary to ensurecompliance with all applicable legal requirements.) (AGG-Dom,
Part V.A.5)
4. (U) Polygraph examinations (AGG-Dom, Part V.A:6)
5. (U) Undercover operations. Undercover operations involving
religious or politicalorganizations conducted for the purpose of collecting positive
foreign intelligence must
be reiiewed and approved by FBIHQ, with participationby the DOJ NSD in the review
process. (AGG-Dom, Part V.A.7)
6. (UI/FOUO) Use of penregisters and trap and trace devices in conformity
with FISA(50 U.S.C. §§ 1841-1846), for non-United States persons only. (AGG-Dom,
Part

V.A.10)7. (U) Electronic surveillance in conformity with EISA or E.O: 12333§ 2.5. (AGG-Dom,
Pait V.A.I 1)

103
UNCLASSIFIED-FOR OFFICIAL USE ONLY.

UNCLASSIFIED - FOR OFFICIAL USE ONLY
Domestic Investigations and Operations Guide
8. (U//FOUO) Physical searches, including mail openings, in conformity withFISA orE.O. 12333 § 2.5. The classified appendix to the DIOG provides additional
information
regarding certain searches. (AGG-Dom, Part V.A.12)
9. (U) Acquisition of positive foreign intelligence information in conformity
with Title
VII of FISA. (AGG-Dom, Part V.A.1 3)
10. (U//FOUO) Obtaining a business records order pursuant to FISA,
50 U.S.C. §§ 1861-83,
for records relating to a non-United States person only.
9.8. (U//FOUO) Investigative Methods Not Authorized During
Foreign Intelligence
Investigations(U//FOUO) The following investigative methods are not.permitted for the
purpose of collecting
positive foreign intelligence:
A. (U//FOUO) National Security Letters (15 U.S.C. §§ 1681u,
1681v; 18 U.S.C. § 2709; 12
U.S.C. § 341[a][5][A]; 50 U.S.C. § 436);
B. (U//FOUO) Obtaining a business records order pursuant to FISA,
50 U.S.C. §§ 1861-1863,
for records relating to a United States person;
C. (U//FOUO) Use of pen registersand trap and trace devices in conformity
with FISA (50
U.S.C. §§ 1841-1846) on a United States person;
D. (U//FOUO) Use of pen reisters'and trap and trace devices inconformity with chapter 206 of
18 U.S.C. §§ 3121-3127;
E. (U//FOUO) Mail covers;
F. (U//FOUO) Compulsoryprocess as authorized by law,.including grandjury subpoenas andother subpoenas (e.g., Administrative Subpoena); andG. (U//FOUO) Accessing stored wire and electronic communications.andtransactional records
in conformity with chapter 121 of title 18,.United States Code (18
U.S.C. §§ 2701-2712).
(AGG-Dom, Part V.A.9)
9.9. (U) Sensitive Investigative Matter(U//FOUO) The title/case caption of the opening or subsequent
EC for a positive foreign
intelligence assessment involving a sensitive investigative matter"Assessment" and "Sensitive Investigative Matter." The title/case must contain the words
subsequent EC for a full investigation for the collection of positivecaption of the opening or
foreign intelligence involving
a sensitive investigative matter must contain the words "Sensitive
Investigative
Matter." DIOG
Section 10 contains the required approval authorities and factors
to be considered relative to anassessment or a predicated investigation involving a sensitive investigative
matter. The AGGDom defines sensitive investigative matter as follows:
A. (U//FOUO) Sensitive Investigative Matter: An investigative
matter involving the activities
of a domestic public official or political candidate (involving
corruption or a threat to thenational security), religious or political organization or individual
prominent in such anorganization, or news media, or any other matter which, in the
judgment of the official
authorizing an investigation, should be brought to the attentionof FBI Headquarters andother DOJ officials. (AGG-Dom, Part VII.N.) As a matter ofFBI.policy,"judgment" means
104
UNCLASSIFIED-FOR OFFICIAL USE ONLYUNCLASSIFIED - FOR OFFICIAL USE ONLY
Domestic Investigations and Operations Guide
that the decision of the authorizing official is discretionary.
DIOG Section 10 and/or the
DIOG classified Appendix G define domestic public official, politicalcandidate, religious orpolitical organization or individual prominent in such an organization,and news media.
All positive foreign intelligence assessments or full investigations
involving a sensitive
investigative matter must be reviewed by the CDC, approved by the
SAC, and approved by
the appropriate FBIHQ DI Section Chief. (see DIOG Section 9.10
below)
B. (U/FOUO) Academic Nexusb2
b7E(U//FOUO) The sensitivity related to an academic institution arises
from the American
tradition of "academic freedom" (e.g., an atmosphere in which
students and faculty are free
to express unorthodox ideas and views and to challenge conventional
thought without fear ofrepercussion). Academic freedom does not mean, however, that academic
institutions areoff
limits to FBI investigators in pursuit of information or individuals of legitimate investigativeinterest.
(U//FOUO)t-

see the DIOG classified Appendix G.
9.i0. (U) Approval and Notification
A. (U) Initiation(U//FOUO) The authorized purpose of an assessment or full investigationmust bedocumented in the initiating EC.
1. (U//FOUO) Approval to Initiate an Assessment to Collect
Positive
Intelligence: No assessment for the purpose of seeking information Foreign
relating to mattersof positive foreign intelligence interest responsive to a Positive
Foreign Intelligence
Requirement may be initiated without prior approval from FBI O CM Af
obtaining FBIHQ CMS approval|Ll

Si e u e/case capton ot
opening EC must contain theora Assessment," and the synopsis must identify thetheauthorizedpurpose and theobjective of the assessment.
2. (U//FOUO) Approval to Initiate a Full Investigation: FBIHQ
CMS will direct theinitiation of full investigations based on Positive ForeignIntelligence Requirements.
3. (U//FOUO) Approval to Initiate an Assessment or Full Investigation
Involving a
Sensitive Investigative Matter: The initiation of either
ah assessment or fullinvestigation to collect positive foreign intelligence involving a sensitive
investiative
matter must have prior CDC review, SAC approval and the appropriate
FBIHQ DI
Section Chief approval.

105
UNCLASSIFIED-FOR OFFICIAL USE ONLY

b2

b7E

UNCLASSIFIED -FOR OFFICIAL USE ONLY
Domestic Investigations and Operations Guide
B. (U) Notice
1. (U//FOUO) Notification to DOJ is not required when an assessment to collectinformation relating to a matter of foreign intelligence interest responsive to a positive
foreign intelligence requirement is initiated.
2. (U//FOUO) Notification to DOJ is required when a full investigation to collectinformation responsive to a foreign intelligence requirement is initiated. Notice must be
forwarded fromaFBIHQ CMS to the DOJ NSD as soon as.practicable but no later than
30 calendar days after the initiation of the itivestigation. (AGG-Dom, Part II.B.5)
C. (U) Duration(U//FOUO) A foreign intelligence assessment and full investigation may continue
for as longas necessary to achieve its purpose and objective if an assessment, or until the requirementis
met in a full investigation.
D. (U) File Review
1. (U//FOUO).Assessments: Foreign intelligence assessments require recurring
90 day filereviews of the assessment file and any sub-file by the SSA/SIA. Filereviewsforprobationary agents must be conducted at least every 60-days. The file review must:a. (U//FOUO) Evaluate the progress made toward the achievement of the authorizedpurpose and objective;b. (U//FOUO) Determine whether it is reasonably likely that information
may beobtained that is relevant to the authorized objective, thereby warranting a continuationof the assessment;c. (U//FOUO)'Determine whether the Field Office has appropriate
acce'ss and ability tocollect positive foreign intelligence in response to a requirement that has been
accepted by FBIHQ DI; andd. (U//FOUO) Determine whether the assessment should be terminated.
2. (U//FOUO) Full Investigations: Supervisory file reviews nust be conducted
at least
every 90 days in accordance with Section 3.4. File reviews for probationary
agents must
be conducted.at least every 60-days.
E. (U) Closing(U//FOUO) Upon its determination or at the request of the Field Office, only FBIHQCMS
may close an assessment or full investigation.
F. (U) Annual Letterhead Memorandum
1. (U//FOUO) Field Office Responsibility: All FIGs must submit an annual
report oneach positive foreign intelligence full investigation that was open forany period of time
during the past calendar year. This reportis due to FBIHQ CMS no later
than January
30th of the calendar year following each year during which a full investigation
is openand must consist of the following:a. (U//FOUO) The Positive Foreign Intelligence Requirement to whichtheinvestigation was responding;

106
UNCLASSIFIED-FOR OFFICIAL USE ONLYUNCLASSIFIED - FOR OFFICIAL USE ONLY
Domestic Investigations and Operations Guideb. (U//FOUO) All methods of collection used;c. (U//FOUO) All sensitive matters encountered;d, (U//FOUO) A list of all IIRs by number issued based on informationcollected
during the investigation;e. (U//FOUO) A summary of the positive foreign intelligencecollected; andf. (U//FOUO) The date the full. investigation was opened and,if applicable, the dateclosed.
(U//FOUO) These reports should be submitted by electronic communication.
The EC
must be uploaded into ACS in a file number and in the applicable
Foreign Intelligence
Collection Program-(FICP) case files as designated in the DI PG.
2. (U//FOUO) FBIHQ Responsibility: FBIHQ CMS must compile
Office regarding the scope and nature of the prior year's.positive data from each Field
foreign intelligencecollection program. The FBIHQ CMS must submit an annualcomprehensive report of.
all activity described above to. DOJ NSD no later than April Istof each year. The reportmust include the following information:a. (U//FOUO) The Positive Foreign -Intelligence Requireinent
to which-the.
investigation was responding;b. (U//FOUO) All sensitive matters; andc. (U//FOUO) The date the full investigation was opened
and closed (if applicable).
9J1.(U) Retention of Information(U//FOUO),FBIHQ CMS must maintain a database or records systems
that permits the prompt
retrieval of the status of each positive foreign intelligencecollection
full investigation (open or
closed), the dates of opening and closing, arid the basis
for the full investigation.

107
UNCLASSIFIED-FOR OFFICIAL USE ONLYUNCLASSIFIED - FOR OFFICIAL USE ONLY
Domestic Investigations and Operations Guide

10. (U) Sensitive Investigative Matter / Academic Nexus
10.1. (U) Overview(U) Certain investigative matters should be brought-to the attention of FBI management and DOJ
officials because of the possibility of public notoriety and sensitivity. Accordingly, assessments
and predicated investigations involving'"sensitive investigative matters" have special:approval
and reporting requirements.
10.2. (U) Purpose, Scope and Definitions(U//FOUO) A sensitive investigative matter is defined as an investigative matter irvolving theactivities of a domestic public official or political candidate (involving corruption or a threat tothe national security), religious or political organization or individual prominent in such anorganization, or news media, or any other matter which, in the judgment of the official
authorizing an investigation, should be brought to the attention of FBI Headquarters and other
DOJ officials. (AGG-Dom, Part VII.N.) As a matter of FBI policy, "judgment" means that thedecision of the authorizing official is discretionary. Descriptions for each of the officials andentities contained in the sensitive investigative matter definition are as follows:.
A. (U//FOUO) Domestic Public Official-A-domestic public official is an individual elected or
appointed to a position of trust in a federal, state, local or tribal governmental entity orpolitical subdivision thereof. A matter involving a domestic public official is a "sensitive
investigative matter" if the assessment or predicated investigation involves corruption or athreat to the national security.
B. (U//FOUO) Political candidate-A political candidate is an individual who is seeking
election to, or nomination for election to, or who has authorized others to explore on his or'her behalf the possibility of election to, an office in a federal, state, local or tribal!
governmental entity or political subdivision theredf. As with domestic public officials, amatter involving a political candidate is a sensitive investigative matter if the assessment orpredicated investigation involves corruption or a threat to the national security.
C. (U//FOUO) Political organization or individual prominent in such an organization-

C. (U//FOUO) Religious organization or individual prominent in such an organization-

108
UNCLASSIFIED-FOR OFFICIAL USE ONLYb2
b7E

UNCLASSIFIED - FOR OFFICIAL USE ONLY
Domestic Investigations and Operations Guide
E. (U//FOUO) Member of the media or a news organization-

F. (U//FOUO) Academic Nexus-

b2
b7E-

(U//FOUO) The sensitivity related to an academic institution arises from the American
tradition of "academic freedom" (e.g., an atmosphere in which students and faculty are free
to express unorthodox ideas and views and to challenge conventional thought without fear ofrepercussion). Academic freedom does not mean, however, that academic institutions are off
limits to FBI investigators in pursuit of information or individuals of legitimate investigativeinterest.
(U//FOUO)
|

0

.
_

.

..

|IU_
see the classified appendix.

G. (U//FOUO) Other Matters-Any matter that in the.judgment of the official authorizing an
investigation that should be brought to the attention of FBIHQ and other Department of.
Justice officials. As a matter of FBI policy, "judgment" means that the decision of theauthorizing official is discretionary.
10.3.

(U//FOUO) Factors to Consider When Initiating or Approving an Investigative
Activity Involving a Sensitive Investigative Matter(U//FOUO) In addition to the standards for approving investigative activity in Sections 5, 6, 7
and 9, the following factors should be considered by the: (i) FBI employee who seeks to initiate
an assessment or predicated investigation involving a sensitive investigative matter; (ii) CDC or
OGC when reviewing such matters; and (iii) approving official in determining whether theassessment or predicated investigation involving a sensitive investigative, matter should be
authorized:
A. (U//FOUO) Seriousness/severity of the.violation/threat;
B. (U//FOUO) Significance of the information sought to the violation/threat;
C. (U//FOUO) Probability that the pr6posed course of action will be successful;
D. (U//FOUO) Risk of public exposure, and if there is such a risk, the adverse impact or theperception of the adverse impact on civil liberties and public confidence; andE. (U//FOUO) Risk to the national security or the public welfare if the proposed course ofaction is not approved (i.e., risk.of doing nothing).
(U//FOUO) In the context of a sensitive investigative matter, particular care should be taken
when, considering whether the planned course of action is the least intrusive method feasible.

109
UNCLASSIFIED-FOR OFFICIAL USE ONLYUNCLASSIFIED - FOR OFFICIAL USE ONLY
Domestic Investigations and Operations Guide
10.4. (U) Duration, Approval, Notice and Documentation(U//FOUO) The following are required approval and notification levels for investigative
activities involving sensitive investigative matters:A. (U//FOUO) Initiated by a Field Office:(U//FOUO) Assessment: An FBI employee may initiate assessment type one and two
activities, as described in Section 5.6.A.1 and 2 (prompt checking of leads), without priorsupervisory approval: However, because assessments involving sensitive investigative
matters must be brought to the attention of FBI Field Office management, CDC review and
SAC approval to continue the assessment must be acquired as soon as practicable. For
assessment types 3, 4 and 6 assessments (see DIOG Section 5.6.A.3. 4 and 6) involving asensitive investigative matter, prior CDC review and SAC approval is required. For
assessment types 3, 4, and 6, as described in Section 5.6.A.3. 4 and 6, if a sensitive
investigative matter arises after the initiation of an assessment, investigative activity mustcease until CDC review and SAC approval is acquired.
(U//FOUO) Assessments involving a sensitive investigative matter do not require notification
to DOJ or the United States Attorney. (AGG-Dom, Part II.B.5.a) All positive foreign
intelligence collection assessments, regardless of whether they involve a sensitive
investigative matter, require prior FBIHQ CMS approval. If a sensitive investigative matter
arises after the initiation of a positive foreign intelligence collection assessment, notice must
be provided to FBIHQ CMS.
(U//FOUO) Predicated Investigation: For all predicated investigations involving a sensitive
investigative matter, prior CDC review and SAC approval is required, and the Field Officemust provide written notification to the appropriate FBIHQ Unit Chief and, Section Chief.
Additionally, the Field Office must provide written notification to-the United'States Attorney
or the appropriate-EBIHQ Section must provide written notification to the DOJ Criminal
Division or NSD, as soon as practicable, but no later than 30 calendar dav ftr
j of
the predicated investgatn Th
ce must identify
see classified appenix or(U//FOUO) If.a sensitive investigative matter arises after the initiation-of a predicatedinvestigation, investigative.activity must cease until CDC review and SAC approval isacquired and notice is furnished to the FBIHQ Unit and Section as specified,above.
B. (U//FOUO) Initiated by FBIHQ:(U//FOUO)Assessment: For assessment types 3, 4 and 6, as described in Section 5.6.A.3. 4
and 6, involving a sensitive investigative matter, OGC review and Section Chief approval isrequired. If a sensitive investigative matter arises after the initiation of an assessment,
investigative activity must cease until OGC review and Section Chief approval is acquired.
(U//FOUO) Assessments involving a sensitive investigative matter do not require notification
to DOJ or the United States Attorney. (AGG-Dom, Part II.B.5.a) All positive foreign
intelligence collection assessments, regardless of whether they involve a sensitive
investigative matter, require prior FBIHQ CMS approval. If a sensitive investigative matter
arises after the initiation of a positive foreign intelligence collection assessment, notice must
be provided to FBIHQ CMS.
110
UNCLASSIFIED-FOR OFFICIAL USE ONLYb2
b7E

UNCLASSIFIED - FOR OFFICIAL USE ONLY
Domestic Investigations and Operations Guide(U//FOUO) Predicated Investigation:-For predicated investigations involving a sensitive
investigative matter, OGC review, Section Chief approval, and written notification to theUnited States Attorney, DOJ Criminal Division or DOJ NSD is required, as soon aspracticable, but no later than 30 calendar days after the initiation of such an investigation.
eo"ibstidentify

b2
b7E

ff
__Jj(jsee classified appendix[.
(U//FOUO) If a sensitive investigative matter arises after the initiation of a predicatedinvestigation, investigative activity must cease until OGC review and Section Chief approvalis acquired and notice is furnished as specified above.
10.5. (U//FOUO) Distinction Between Sensitive Investigative Matter and Sensitive
Circumstance(U//FOUO) The term "sensitive investigative matter" should not be confused with the term
"sensitive circumstance" as that term is used in undercover operations. A "sensitive
circumstance" relates to an undercover operation requiring FBIHQ approval. A comprehensive
list of sensitive circumstances for criminal activities is contained in the Attorney General's
Guidelines on FBI Undercover Operations and in Section 11 of the DIOG for national security
iew Committee (CUORC) andmatters. The Crimi| .
iuit review and approve undercoverpraions mat involve sensitive circumstances. The detailed policy for undercover operations is
described in DIOG. Section 11.8, the Field Guide for Undercover and Sensitive Operations(FGUSO), and the FBIHQ substantive Division program implementation guides.
10.6. (U//FOUO) Sensitive Operations.Review Committee(U//FOUO.

UNCLASS111ED-FOR OFFICIAL USE ONLYUNCLASSIFIED-FOR OFFICIAL USE ONLY

b2
b7E

ALL INFORHATION CONTAINEDHEREIN IS UNCLASSIFIEDDATE 07-08-2009 BY UC 60322 LP/STP/SZ

UNCLASSIFIED - FOR OFFICIAL USE ONLY
Domestic Investigations and Operations Guide

11.

(U) Investigative Methods

11.1. (U) Overview(U//FOUO) The conduct of assessments, predicated investigations and other activities authorized
bythe AGG-Dom may present choices between the use of different investigative methods(formerly investigative "techniques") that are each operationally sound and effective, but that are
more or less intrusive, considering such factors as the effect on the privacy and ciyil-liberties ofindividuals and the potential damage to reputation. The least intrusive method feasible is to be
used in such situations. However, the choice of methods is a matter of judgment. The FBI isauthorized to use any lawful method consistent with the AGG-Dom, even if'intrusive, wherecthe
degree of intrusiveness is warranted:in light of the seriousness of a criminal or-national security
threat or the strength of the information indicating its existence, or in light of the importance of
foreign intelligence sought to the United States' interests. (AGG-Dom, Part I.C.2.)(U) The availability of a particular investigative method in a particular case may depend upon
the level of investigative activity (assessment, preliminary investigation, full investigation,
assistance to other agencies).
11.1.1.
(U) Least Intrusive Method(U) The AGG-Dom requires that the "least intrusive" means or method be considered and-if
operationally sound'and effective-used to obtain intelligence or evidence in lieu of more
intrusive methods. This principle is also reflected in Executive Order 12333, which governs theactivities of the United States intelligence.community., The concept of least intrusive method
applies to the collection of intelligence and evidence.
(U) Selection of the.least intrusive means is a balancing test as to which FBI employees must use
common sense and sound judgment to effectively execute their duties while mitigating thepotential negative impact on the privacy and civil liberties of all people encompassed within theassessment or predicated investigation, including targets, witnesses, and victims. This principle
is not intended to discourage investigators from seeking relevant and necessary intelligence,
information, or evidence, but rather is intended to encourage investigators to choose the least
intrusive-yet still effective-means from the available options to obtain the material.
Additionally, FBI employees should operate openly and consensually with United States persons
to the extent practicable when collecting foreign intelligence.that does not concern criminal
activities or threats to the national.security.
(U) Section 4.4 describes the least intrusive methods concept and the standards to be applied by

SFBI employees.

112
UNCLASSIFIED-FOR OFFICIAL USE ONLYUNCLASSIFIED - FOR OFFICIAL USE ONLY
SDomestic Investigations and Operations Guide

11.2. (U) Authorized Investigative Methods in Assessments and Predicated Investigations(U) The below listed investigative methods may be used in assessments and predicatedinvestigations. The use and/or dissemination of information obtained by the use of all authorized
investigative methods must comply with the AGG-Dom and DIOG Section 14.
11.2.1.

(U) Authorized Investigative Methods in Assessments(AGG-Dom, Part II.A.4.)(U//FOUO) Ah FBI employee must document on the FD-71, or in Guardian, the use of or therequest and approval for the use of authorized investigative methods in type 1 and 2 assessments(see DIOG Section 5.6.A.1 and 2). By exception, certain assessment type 1 and:2 situations may
require the use of an EC to document the use and approval of certain investigative methods. All
authorized investigative methods'in type 3, 4, and 6 assessments.(see DIOG Section 5.6:A.3, 4
and 6) must use an EC to document the use of or the request and approval for the use of theapplicable investigative method. For a detailed description of these methods see DIOG Section

5.9.
A. (U) Obtain publicly available information.
B. (U) Access and examine FBI and other Department of Justice records. and obtain informationfrom any FBI or other Department of Justice personnel.
C. (U) Access and examine records maintained by. and request information from. other federal.
state. local, or tribal, or foreign governmental entities or agencies.
D. (U) Use online services and resources (whether non-profit or commercial).
E. (U) Use and recruit human sources in cbfiformity with the AttorneyGeneral's Guidelines
Regarding the Use of FBI Corifidential Human Sources.
F. (U) Interview or request information'from members of the public and private entities.
G. (U) Accept information voluntarily provided by governmental or private entities.
H. (U) Engage in observation and conduct physical surveillance not requiring a court order.
I.

(U//FOUO) Grand iury subpoenas for telephone or electronic mail subscriber information
during type I and 2 assessments..

(U//FOUO) Note: In assessments, supervisory approval is required prior to use of the following
investigative methods: certain interviews, tasking of a CHS, and physical surveillance notrequiring a court order. During predicated investigations the supervisory approval requirements
for these investigative methods may not apply.
11.2.2.

(U) Authorized Investigative Methods inPreliminary Investigations(AGG-Dom, Part V.A.1-10)(U) In preliminary investigations the authorized methods include the following: fAGG-Dom.
Part II.B. and Part V.A.1
A. (U) The investigative methods approved for assessments.
B. (U) Mail covers.
113
UNCLASSIFIED-FOR OFFICIAL USE ONLYUNCLASSIFIED - FOR OFFICIAL USE ONLY
Domestic Investigations and Operations Guide
C. (U) Physical searches of personal or real property where a warrant or court order is notlegally required because there is no reasonable expectation of privacy (e.,.. trash covers).
D. (U) Consensual monitoring of communications. including consensual computer monitoring.
subject to legal review by the CDC or the OGC. When a sensitive monitoring circumstance isinvolved, the monitoringmust be approved by the DOJ Criminal Division or, if theinvestigation concerns a threat to the national security or foreign intelligence, by the;DOJ
National Security Division.
(U//FOUO) Note: For additional information, see the classified appendix.
(U//FOUO) Note: For those state, local and tribal governments that do not sanction orprovide a law enforcement, exception available to the FBI for one-party consent recording ofcommunications with persons within their jurisdiction, the SAC must approve the consensual
monitoring of communications as an OIA. Prior to the SAC authorizing the OIA, one-party
consent must be acquired. The SAC may delegate the,OIA approval authority to an ASAC or
SSA.
E. (U) Use of closed-circuit television, direction finders. and other monitoring devices, subject
to legal review by the CDC or the OGC. (The methods described in this paragraph usually do
not-require court orders-or warrants unless they involve an intrusioninto an area where there
is a reasonable expectation of privacy or non-consensual monitoring of communications, butlegal review is necessary to ensure compliance with all applicable legal requirements.)
F. (U) Polygraph examinations.
G. (U) Undercover operations. In investigations relating to activities in violation offederal
criminal law that do not concern threats to the national security or foreign intelligence,
undercover operations must be carried out in conformity with the Attorney General's
Guidelines on Federal Bureau of Investigation Undercover Operations. In investigations thatconcern threats to the national security or foreign intelligence, undercover operations
involving religious or political organizations must be reviewed and approved by FBI
Headquarters, with participation by the DOJ National Security Division in the review process.
H. (U) Compulsory process as authorized.by law. including grand jury subpoenasand othersubpoenas. National Security Letters (15 U.S.C. §§ 1681u, 1681v; i8 U.S.C. § 2709; 12
U.S.C. § 3414[a][5][A];50 U.S.C. § 436, and FISA orders [50 U.S.C. §§ 1861-63]).
1. (U) Accessing stored wire and electronic communications and transactional records inconformity with chapter 121 of title 18. United States Code (18 U.S.C. §§ 2701-2712).
.J. (U) Use of pen registers and trap and trace devices in conformity with chapter 206 of title 18.
United States Code (18 U.S.C. §§ 3121-3127) or FISA (50 U.S.C. §§ 1841-1846).
11.2.3. (U) Authorized Investigative Methods in Full Investigations(AGG-Dom, Part V.A. 11-13)(U) In full investigations, to include enterprise investigations, all investigative methods approved
for assessments and preliminary investigations may be.used. In addition, the three investigative
methods listed below may only be used in full investigations:

114
UNCLASSIFIED-FOR OFFICIAL USE ONLYUNCLASSIFIED - FOR OFFICIAL USE ONLY
Domestic Investigations and Operations Guide
A. (U) Electronic surveillance in conformity with chanter 119 of title 18. United States Code (18
U.S.C. 4§2510-2522). or the Foreign Intelligence Surveillance Act. or Executive Order12333 ' 2.5.
B. (U//FOUO) Physical searches, including mail openings. in conformity with Rule 41 of theFederal Rules of Criniinal Procedure. the Foreign Intelligence Surveillance Act. or Executive
Order 12333 § 2.5. Note: For additional information regarding.certain searches, see theclassified appendix.
C. (U) Acquisition of foreign intelligence information in conformity with Title VII of the FISA.
(U//FOUO) Note: Not all investigative methods are.authorized while collecting'foreign
intelligence as part of a full investigation. See DIOG Section 9 for more information:
1.1.2.4.

(U) Particular Investigative Methods(U//FOUO) All lawful investigative methods may be used in activities under the AGG-Dom as
authorized by the AGG-Dom. Authorized methods include, but are not limited to, those
identified in the rest ofthis.section. In some instances they are subject to special restrictions orreview or approval requirements. (AGG-Dom, Part V.A.)

115
UNCLASSIFIED-FOR OFFICIAL USE ONLYUNCLASSIFIED - FOR OFFICIAL USE ONLY
Domestic Investigations and Operations Guide
11.3. (U) Investigative Method: Mail Covers
11.3.1.

(U) Summary(U) A mail cover may be sought only in a predicated investigation when there exists reasonablegrounds to demonstrate that the mail cover is necessary to: (i) protect the national security; (ii)locate a fugitive; (iii) obtain evidence of the conimission or attempted commission of a federal
crime; or (iv) assist in the identification of property, proceeds or assets forfeitable because of aviolation of criminal law. 39 C.F.R. § 233.3(e)(2).
(U//FOUO)

b2
b7E

(U)
b2
b7E

r
Asa
general rule, a mail cover in the APO/FPO system overseas may only be ordered by a military
authority competent to order searches aiid seizures for law enforcement purposes, usually acommanding officer. See DoD 4525.6-M, the DoD Postal Manual;(U//FOUO) Application:

b2
b7E

11.3.2.

(U) Legal Authority

A. (U) Postal Service Regulation 39 C.F.R. § 233.3 is the sole authority and procedure for
initiating a mail cover and for processing, using and disclosing information obtained from amail cover;'B. (U) There is no Fourth Amendment protection for information on the outside of a piece ofmail. See, e.g., U.S. v. Choate, 576 F.2d 165,. 174 ( 9 th Cir., 1978); and U.S. v. Huie, 593 F.2d
14 (5th Cir., 1979); andC. (U) AGG-Dom, Part V.A.2.
11.3.3.

(U) Definition of Investigative Method(U) A mail cover is the non-consensual recording of any data appearing on the outside cover ofany sealed or unsealed mail matter to obtain information in order to:A. (U) Protect the national security;
B. (U) Locate a fugitive;
C. (U) Obtain evidence of commission or attempted commission of a federal crime;
D. (U) Obtain evidence of a violation or attempted violation of a postal statute; or
E. (U) Assist in the identification of property, proceeds or assets forfeitable under law.
39 C.F.R. § 233.3(c) (1).
116
UNCLASSIFIED-FOR OFFICIAL USE ONLYUNCLASSIFIED - FOR OFFICIAL USE ONLY
Domestic Investigations and Operations Guide(U) In this context, a "recording" means the transcription, photograph, photocopy, or otherfacsimile of the image of the outside cover, envelope, or wrappers of mailed matter. A warrant or
court order is almost always required to obtain the contents of any class of mail, sealed or
unsealed.
11.3.4.

(U) Standard for Use and Approval Requirements for Investigative Method(U) The stahdard to obtain a mail cover is.established by the Postal Service regulation.. The Chief
Postal Inspector may order a mail cover "[w]hen a written request is received from any law
enforcement agency in which the requesting authority specifies the reasonable grounds todemonstrate the mail cover is necessary'to:* (U) Protect the national security;* (U) Locate a fugitive;* (U) Obtain information regarding the commission or attempted commission of a crime; or* (U) Assist in the identification of property, proceeds or assets forfeitable because of aviolation of criminal law." 29 C.F.R. § 233.3(e)(2).
(U/FOUO)-National=Security Mail.Cover: A national security mail cover request must be
approved by the Director or designee, currently only the EAD of the National Security Branch.
All requests for national security mail covers must be reviewed by the Field Office SSA
according to the below-criteria. A national security mail cover sought "to protect the national
security" includes protectingthe United States from actual or threatened attack or other grave,
hostile act; sabotage; ihternational terrorism; or clandestine intelligence activities, includingcommercial [economic] espionage by foreign powers or their agents.
(U//FOUO) After being approved by the SSA, the Field Office must.transmit the mail cover
letter request by EC, with the draft letter as an attachment, to the National Security Law Branch(NSLB) for legal review and concurrence. Upon review and concurrence, the NSLB must
transmit the letter request for signature approval to the EAD, National Security Branch, or, in his
or her absence, td the Director.
(U//FOUO) Criminal-Mail Cover: A criminal mail cover request may be approved by the Field
Office SSA. The SSA may approve a request for a mail cover if there are reasonable grounds.to
demonstrate that the mail cover is necessary to assist in efforts to: (i) locate a fugitive; (ii) obtain
information regarding the commission or attempted commission of a federal crime; or (iii) toassist in the identification of property, proceeds or assets forfeitable because of a violation of
criminal law.
(U//FOUO) SSA review and or approval of a national security or criminalmail cover
request: Approval of any mail cover request or an extension is conditioned on the' following
criteria being met:A. (U//FOUO
b2

b7E

117
UNCLASSIFIED-FOR OFFICIAL USE ONLYUNCLASSIFIED - FOR OFFICIAL USE ONLY
Domestic Investigations and Operations Guide

B. (U//FOUO)
b2
b7E

C. (U//FOUO)
b2
b7E

D. (U//FOUO)
b2

b7E

E.- (U//FOUO)
b2

b7E,

F. (U//FOUO1

b2,
b7E

Note:

Under postal regulations, a mail cover must not include matter mailed between the mailcover subject and the subject's attorey,.unless the attorney is also a subject under theinvestigation.)b
G. (U//FOUO)

I

b2

b7E

H. (U//FOUO)I

b2
b7E,

I. (U//FOUO)
b2
b7E(U) Emergency Requests: When time is of the essence, the Chief Postal Inspector, or.designee, may act upon an oral request to be confirmed by the requesting authority, inwriting, within three calendar days. Information may be released prior to receipt of the118
UNCLASSIFIED-FOR OFFICIAL USE ONLYUNCLASSIFIED - FOR OFFICIAL USE ONLY
Domestic Investigations and Operations Guide
written request only when the releasing official is satisfied that ai emergency situation exists.
39 C.F.R. § 233.3(e)(3).
(U) An "emergency situation" exists when the immediate release of information is required
to prevent the loss of evidence or when there is a potential for immediate physical harm topersons or.property. 39 C.F.R. § 233.3(c)(10).
11.3.5.
(U) Duration of Approval
A. (U) National Security: A national security mail cover is limited to 120 days from the datethe mail'cover is initiated. Extensions can only be authorized by the Chief Postal Ihspector or
his designee at the National Headquarters of the Office of the Chief Postal Inspector. 39
C.F.R. § 233.3(g)(6).
B. (U) Criminal mail covers except fugitives: A mail cover in a criminal case is limited to no
more than 30 days, unless adequate justification is provided by the requesting authority. 39
C.F.R. § 233.3(g)(5). Renewals may be granted for additional 30-day periods under the same
conditions and procedures applicable to the original request. The requesting authority must
provide a statement of the investigative benefit of the mail cover and anticipated benefits to
be derived.from the extension.
C. (U) Fugitives: No mail cover instituted to locate a fugitive may remain in force forlonger
than 120 continuous days unless personally approved for further extension by the Chief
Postal Inspector or his/her designees at National Headquarters. 39 C.F.R. § 233.3(g)(6).
D. (U) Exception for Indictments: Except for fugitive cases, no mail cover mayremain inforce when an information has been filed or the subject has been indicted for the matter forwhich the mail cover has been requested. If the subject is under investigation for further
criminal violations, or a-mail cover is required to assist in the identification of property,
proceeds or assets forfeitable because of a violation of criminal law, a new mail cover ordermust be requested. 39 C.F.R. § 233.3(g)(7).
11.3.6.
(U) SpecificProcedures(U//FOUO) The Postal Regulation requires that physical storage of all reports issuedpursuant toa mail cover request to be at the discretion of the Chief Postal Inspector. 39 C.F.R. § 233.3(h)(1).
Accordingly, FBI employees-must conduct a timely review of mail covei documents received'from the USPS. A copy of the signed mail cover request and the signed transmittal letter must be
maintained in the investigative case file.
(U//FOUOf

11.3.7.

(U) Compliance and Monitoring(U//FOUO) FBI employees must conduct a timely review of mail cover information received
from the USPS for any potential production of data beyond the scope of the requested mail cover("overproduction") and either destroy or return the overproductionr to the assigned USPS
representative noting the reason for the return.

119
UNCLASSIFIED-FOR OFFICIAL USE ONLY

b2
'b7E

UNCLASSIFIED - FOR OFFICIAL USE ONLY
Domestic Investigations and Operations Guide

11.4.

(U) Investigative Method: Physical searches of personal or real property where awarrant or court order is not legally required because there is no reasonable
expectation of privacy (e.g.J

11.4.1.

(U) Summary(U//FQUO) Application: In predicated investigations, the FBI mayconduct physical searchesof personal or real property where a warrant or court order is not legally required because there is
no reasonable expectation of privacy I
not otherwise prohibited by AGG-Dom, PartI

III.B.2-3.
11.4.2.

(U) Legal Authority

A. (U) AGG-Dom, Part V.A.3,
B. (U) Fourth Amendment to the United States Constitution
11.4.3.

b2
b7E(U) Definition of Investigative Method(U) The Fourth Amendment to the United States Constitution prevents the FBI from conducting
unreasonable searches and seizures. It also generally requires a warrant be obtained if the search
will intrude on a reasonable expectation of privacy. To qualify as a "reasonable expectation ofprivacy," the individual must have an actual subjective expectation of privacy and-society must
be prepared to recognize that expectation as objectively reasonable. See Katz v. United States,
389 U.S. at 361. If an individual has a reasonable expectation of privacy, a warrant or orderissued by a court of competent jurisdiction or an exception to the requirement for such a warrant
or order is required before a search may be conducted. Physical searches of personal or real
property may be conducted without a search warrant or court order if there is no reasonable
expectation of privacy in the property or area. As a general matter, there is no reasonable
expectation of privacy in areas that are exposed to public view or that are otherwise available tothe public. A reasonable expectation of privacy may be terminated by an individual abandoning
property, setting trash at the edge of the cuitilage or beyond for collection, or when a private
party reveals the. contents of a package.
(U) Examples of Searches not Requiring a Warrant because there is no Reasonable
Expectation of Privacy: (i) Vehicle identification numbers or personal property that is exposed
to public view and may be seen when looking through the window of a car that is parked in anarea that is open to and accessible by members of thepublic; (ii) neither the examination ofbooks and magazines in.a book store nor thepurchase of such.items is a search or seizure under
the Fourth Amendment. See Maryland v. Macon, 472 U.S. 463 (1985); and (iii) a deliberate
overflight in navigable air space to photograph marijuana plants is not a search, despite thelandowners subjective expectation of privacy. See California v. Ciraolo, 476 U.S.,207 (1986).
(U) Whether an area is curtilage is determined by reference to four factors: (i) proximity of thearea in question to the home; (ii) whether the area is within an enclosure surrounding the home;(iii) nature of the use to which the area is put; and (iv) steps taken to protect the area fromobservation by passers-by.

120
UNCLASSIFIED-FOR OFFICIAL USE ONLYb2
b7E

UNCLASSIFIED - FOR OFFICIAL USE ONLY
Domestic Investigations and Operations Guide(U) An area is curtilage if it "is so intimately tied to the home itself that
if should be placed under
the home's 'umbrella' Of Fourth Amendment protection."
11.4.4.

(U//FOUO) Standards for Use and Approval Requirements
for Investigative
Method(U/FOUO) No supervisory approval is required for the useof this method. However, if there is a
doubt as to whether a person has a reasonable expectation of privacyin the area to be searched,consult with the CDC orFBI Office of the General Counsel
to determine whether a search
warrant is required. Use of this method must be documented
in the case file.

121
UNCLASSIFIED-FOR OFFICIAL USE ONLYUNCLASSIFIED - FOR OFFICIAL USE ONLY
Domestic Investigations and Operations GuidS.
11.5.

(U) Investigative Method: Consensual Monitoring of Communications, including
consensual computer monitoring

11.5.1.

(U) Summary(U) Consensual monitoring of communications may be used in predicated investigations. Its use,
including consensual computer monitoring, requires review by the CDC or the OGC:.(AGGDom, Part V.A.4)(U//FOUO) Application: This investigative method may be used in national security
investigations, criminal investigations and positive foreign intelligence collection cases, and forassistance to other agencies when it is not otherwise prohibited by AGG-Dom, Part III.B.2-3.
This method cannot be used during an assessment(U//FOUO) Note: For those state, local and tribal governments that do not sanction or provide alaw enforcement exception available to the FBI for one-party consensual recording ofcommunications with persons within their jurisdiction; the SAC must approve the consensual
monitoring of communications as an OIA. Prior to the SAC authorizing the OIA, one-party
consent must be acquired. The SAC may delegate the OIA approval authority to an ASAC or
SSA.
11.5.2.'(U) Legal Authority

A. (U) The Fourth Amendment to the United States Constitution and case law interpreting thesame;
B. (U) 18 U.S.C. § 2511(2)(b)& (c);C. (U) The Foreign Intelligence Surveillance Act of 1978 (FISA), 50 U.S.C. §§ 1801 et seq.,
defines "electronic surveillance"'to include only those communications "in which a person
has a reasonable expectation of privacy and a warrant would be required for law
enforcement purposes." 50 U.S.C. § 1801(f). If a party to the communication has consented
to monitoring, a Title III or FISA court order is not required to monitor those consensualcommunications; andD. (U) Computer Trespasser Exception - 18 U.S.C. § 2511(2)(i).
11.5.3.

(U) Definition of Investigative Method(U) Consensual monitoring is: "monitoring of communications for which a court order orwarrant is not legally required because of the consent of a party to the communication." (AGGDom, Part VII.A.) Consensual monitoring includes the interception of the content ofcommunications that typically fall into one of three general categories:
A. (U) Conventional telephone communications or other means of transmitting the human voicethrough cable, wire, radio frequency (RF), or other similar connections;
B. (U) Oral communications, typically intercepted through the use of devices that monitor andrecord oral conversations (e.g., where a body transmitter or recorder or a fixed locationtransmitter or recorder is used during a face-to-face communication in which a person would
have a reasonable expectation of privacy but for the consent of the other party); and122
UNCLASSIFIED-FOR OFFICIAL USE ONLYUNCLASSIFIED - FOR OFFICIAL USE ONLY
Domestic Investigations and Operations Guide
C. (U) Conmunicatiofis transmitted between parties using computer protocols, such as e-mail,instant message, chat sessions, text messaging, peer-to-peer communications, or other"electronic communications," as that term is defined in 18 U.S.C. § 2510(12).
(U) The consensual monitoring of communications, including consensual computer monitoring,is subject to legal review by the CDC or.the OGC. (AGG-Dom, Part V.A.4)(U) The computer trespasser exception to the wiretap statute, 18 U.S.C. § 2511(2)(i),.relies on
the corisent of the computer owner-operator and limits the monitoring to only the communications of the trespasser. The statute includes additional limitations on the use of thisprovision
11.5.4.

(U) Standards for Use and Approval Requirements for Investigative Method

A. (U) General Approval Requirements(U//FOUO) Except as provided below in Section 11.5.4.B, an SSA may approve theconsensual monitoring of communications, including consensual computer monitoring ofcommunications, if the information likely to be obtained is relevant to an ongoinginvestigation. SSA approval is conditioned on the following criteria being met anddocumented using the.FD-759:
1. (U//FOUO) Reasons for Monitoring: There is sufficient factual information
supporting the need for the monitoring and that the monitoring is related to theinvestigative purpose, including, if applicable, a citation to the principal criminal statuteinvolved;
2. (U//FOUO) Legal Review: Prior to the. initiation of the consensual monitoring, theCDC or the OGC concurred that consensual monitoring under the facts of theinvestigation is legal. Whenever the monitoring circumstances change substantially, a
new FD-759 must be executed and the CDC or OGC must be recontacted to obtain a
new concurrence. (AGG-Dom, Part V.A.4.) The following are examples of substantialchanges in monitoring circumstances which require a new FD-759: a different
consenting party, new interceptees, or a change in the location of a fixed monitoring
device;3. (U) Consent' A party to the communication has consented to the monitoring and thatconsent has been documented according to the below-procedures. Consent may be
express or implied. In consensual computer monitoring, for example, implied consent
to monitor may exist if users are given notice through a sigh-on banner that all users
must actively acknowledge (by clicking through) or through other means of obvious
notice of possible monitoring. Consent to monitor pursuant to the computer trespasser
exception isnot provided by a party to the communicationper se, but is instead,provided by the owner, operator, or systems administrator of the computer to, bemonitored.
4. (U//FOUO) Subject: The monitoring will not intentionally include a third-party who is
not of interestto the investigation, except for unavoidable or inadvertent overhears.
5. (U//FOUO) Location of device: Appropriate safeguards exist to ensure that theconsenting party remains a party to the comnimunication throughout the course ofmonitoring. Ifa fixed-location monitoring device is being used, the consenting party
123
UNCLASSIFIED-FOR OFFICIAL USE ONLY__________------------- ----UNCLASSIFIED - FOR OFFICIAL USE ONLY
Domestic Investigations and Operations Guide
has been admonished and agrees to be present during the duration of themonitoring
and, if practicable, technical means are being used to activate monitoring only when theconsenting party is present.
6. (U//FOUO) Location of monitoring: If monitoring will occur outside
a Field Office's
territory, notice has been provided to the SAC or ASAC of each Field
Office where themonitoring is to occur, and that notice has been documented
in the.case file.
7. (U//FOUO) Duration: The request states the length of time needed
for monitoring.
Unless otherwise warranted, approval may be granted-for the.duration
ofthe:investigation subject to a substantial change of circumstances,as described Section
11.5.4.A.2, above. When a "sensitive monitoring circumstance" is involved,inDOJ
may
limit its appioval to a shorter duration.
B. (U//FOUO) Exceptions Requiring Additional Approval
I. (U//FOUO) Party Located Outside the United States:"(U//FOUO)-2

b2'
b7E

a. (U//FOUO------b2
b7E

b. (U//FOUO

b2
b7E

c. (U//FOUO)
-

iL

124
UNCLASSIFIED-FOR OFFICIAL USE ONLYb2

UNCLASSIFIED - FOR OFFICIAL USE ONLY
Domestic Investigations and Operations Guide
2. (U) Consent of More than One Party Required:(U//FOUO) For those states or tribes that do not sanction orprovide a law enforcement
exception available to the FBI for one-party consent recordingof communications withpersons within theirjurisdiction, the SAC must approve-thecommunications as an OIA. Prior to the SAC authorizing theconsensual monitoring of
OIA, one-party consent
must be acquired. The SAC may delegate the OIA
approval authority to an ASAC or
SSA.
3. (U) Sensitive Monitoring Circumstance:(U) Requests to consensually monitor communications whena sensitive monitoring
circumstance isinvolved must be approved by the DOJ Criminal
Division, or if theinvestigation concerns a threat to the national security or
foreign intelligence collection,by the DOJ NSD. (AGG-Dom, Part V.A.4) A "sensitive monitoring
circumstance" isdefined in the AGG-Domi, Part VII.O, to include the following:.a. (U) Investigation of a member of Congress, a federal judge,
a-member of the
Executive Branch at Executive Level IV or above, or a personsuch capacity within the previous tivo years (Note: Executive who has served in
Levels I through IV
are definedin 5-U.S.C. -§§5312-5315);b. (U) Investigation of the Governor, Lieutenant Governor,
or Attorney General ofany state or territory, or a judge orjustice of the highest
court of any state or
territory, concerning an offense involving bribery, conflictof interest, or extortion
related to the performance of official duties;c. (U) The Attorney General, the Deputy Attorney
General, or an Assistant Attorney
General has requested that the FBI obtain prior approval forthe-use of consensual,monitoring in a specific investigation;d. (U) A party to the communication is in the custody of
the Bureau of Prisons or theUnited States Marshal Service or is being or.has been afforded protection in the
Witness Security Program.

b2'
b7E

(2)

(U//FUO

125
UNCLASSIFIED.FOR OFFICIAL USE ONLY

b2b7E

UNCLASSIFIED - FOR OFFICIAL USE ONLY
Domestic Investigations and Operations Guide(3) (U//FQUO)(4) (U//FOUO(5) (U//FOUO(6) (U//FOUO)(7)

I(U//FOUO)(8) (U//FOUO)(9)(U//FOUOI
b2
b7E(10) (U//Ouot(11) (U//FOUO(12) (U//FOUO(13) (U//FOUO(15) (U//FOUO(16) (U//FOUO(17) (U//FOUO)

I

I

II

r1'"

(//FO UO
(u//Fouoi

b
b27E

b7E.

(!) (U//FOUOI-,[(2) (U//FOUO)I

I

----

I I

126
UNCLASSIFIED-FOR OFFICIAL USE ONLY

I

b2 E

b2
b7E

UNCLASSIFIED - FOR OFFICIAL USE ONLY
Domestic Investigations and Operations Guide(U//FOUO) Note: See classified Appendix G for additional information regarding
consensual monitoring.
e. (U//FOUO) Procedure for Obtaining DOJ Approval For a Sensitive
Monitorin Circstance.ni-------

IE

b2

b7jE
b

Sb2
b7E

b2
b7E

(1)

b

(U//FOUOi

b2
b7E(U//FOUO(2)b2..........

b7E(U//FOUO
b2

b7E

11.5.5.

(U) Dration of Approval
U

H

F2

127
UNCLASSIFIED-FOR OFFICIAL USE ONLY

E
b7E

UNCLASSIFIED - FOR OFFICIAL USE ONLY
Domestic Investigations and Operations Guideb2
b7E

11.5.6.

(U//FOUO) Specific Procedures(U//FOUO) The following procedures apply whenobtaining consent.

A. (U//FOUO) Documenting consent

SI

I

b2
b7E

B. (U//FOUO) Retention of the consent form

b7E

C. (U//FOUO) Documenting review and approva

IIi'----- I'-----i---b7E

D. (U//FOUO) Multiple communications:b2
b7E

E. (U//FOUO) Case specific ap roval
b2
b7E

128
UNCLASSIFIED-FOR OFFICIAL USE ONLYUNCLASSIFIED - FOR OFFICIAL USE ONLY
Domestic Investigations and Operations Guide
11.5.7.

(U//FOUO) Compliance and Monitoring(U//FQUO) ELSUR program personnel must conduct regularly scheduled reviews of the FD759s approved within the Field Office to determine whether approval was obtained prior toinitiation-of consensual monitoring and to ensure that the monitoring occurred in compliancewith the approvals. The ELSUR Program is also responsible for indexing all individuals or
identifiers of persons-intercepted during consensual monitoring and cross-referencing theirnames or identifiers to the approved FD-759 in the investigative case file.

129
UNCLASSIFIED-FOR OFFICIAL USE ONLYUNCLASSIFIED - FOR OFFICIAL USE ONLY
Domestic Investigations and Operations Guide
11.6.

(U) Investigative Method: Use of closed-circuit television, direction finders, andother monitoring devices (Not needing a Court Order)(U) Note: Use of this method is subject to legal review by the CDC or OGC.
11.6.1.

(U) Summary

i"'

,

|

(U//FOUOIr

"

I
,2

b7E

(U//FOUO) Application:

7

I

b2
b7E

ot othe11.6.2.

prohibited

AGG-Dom, Part III:B.2-3.

(U) Legal Authority

A. (U) AGG-Dom, Part'V
B. (U) Tracking devices use (18 U.S.C. §2510[12] [C])C. (U) Rule 41 Federal Rules of Criminal Procedure
D. (U) Fourth Amendment to the United States.Constitution
11.6.3.

(U//FOUO) Definition of Investigative Method

A. (U//FOUO) Closed Circuit Television (CCTV): a fixed-location'video camera that is
typically concealed from view or that is placed on or operated by a consenting party.
B. (U//FOUO) Electronic Tracking Device
b2
b7E

Electronic tracking devices are specifically

excluded from Title III requirements (18 U.S.C. § 2510112] [C]).In circumstances where acourt order is required (pursuant to FRCP Rule 41[e][2][B]), a judge or magistrate may
authorize the use of an electronic tracking device within the jurisdiction of the court andoutside thatjurisdiction, if the device is installed in that jurisdiction. (FRCP Rule 41 b[4];18
U.S.C. § 3117._
C. (U//FOUO)
b2
b7E

130
UNCLASSIFIED-FOR OFFICIAL USE ONLYUNCLASSIFIED - FOR OFFICIAL USE ONLY
Domestic Investigations and Operations Guide(U//FOUO

b2
b7E

IAn example would be using thermal-imaging to detect heat emanating fromwithin a home to make inferences about the use of high-powered marijuana-growing
lamps
inside the home (Kvllo v. United States, 533 U.S.27 (2001)).
(U) Whether an area is curtilage is determined by reference to four factors:
the area in question to the home; (ii) whether the area is within an enclosure(i) proximity ofsurrounding thehome; (iii) nature of the use to which the area is put; and (iv) steps taken
to protect the areafrom.observation by passers-by.
11.6.4.
(U//F UO )) Standards for Use and Approval-Requirements for Investigative
Method(U//FOUO) When a video camera is physically operated as a hand-heldvideo and is being usedin an area in which no one has a reasonable expectation of privacy, its use
is equivalent to using
a still camera and does not require supervisory approval.
(U//FOUO) For those situations that require SSA approval for the use of
CCTV, tracking devices,and other monitoring devices, SSA approval, which should be documented
using the FD-759,
may be granted if the following criteria have been-met:
A. (U/FOUO) Legal review and concurrence from the CDC or OGC thatarequired for installation or use of the device because there has been lawfulcourt order is notconsent, noreasonable expectation of privacy exists, or no physical trespass
necessarytoinstall thedevice. Note: Whenever circumstances change in either installation ormonitoring, a newlegal review should be obtained to determine whether a separate authorizationis necessary.
B. (U//FOUO) Use of the method is reasonably likely to achieve investigative
nhie.te.
C. (U//FOUO)
b2
b7E

D. (U//FOUO)

b2|

i. (U//FOUO)

b7E

b2

b7E
b2

2. (U//FOUO

b7E

131
UNCLASSIFIED-FOR OFFICIAL USE ONLYUNCLASSIFIED - FOR OFFICIAL USE ONLY
Domestic Investigations and Operations Guide
3.

(U//FOUO)-----

b27

b7E

4. (U//FOUO

-

b2
b7E

11.6.5.

(U) Duration of Approval(U//FOUO
b2
b7E

11.6.6.

(U//FOUO) Specific Procedures(U//FOUO) To use the method, the case agent must:
A. (U//FOUO)|
--

--

I- --

--

.

b2

__

b7E
b2
b7E

B. (U//FOUO)

C. (U//FOUO1
b7E

D. (U//FOUO)

*I

I

b

I

E. (U//FOUO)
SI(U//FOU'
2.. (u//Fouo

.

I

I

2. (U//FOUO

3. (U//FOUO)

b2
b7E

b2
b2

b7E

b2

~--

' -'--I
b7E
b!E

132
UNCLASSIFIED-FOR OFFICIAL USE ONLYI-(U//FOUO
11.6.7.

UNCLASSIFIED - FOR OFFICIAL USE ONLY
Domestic Investigations and Operations Guide

I, '

---

I

"b2

I

b7
b7E

(U//FOUO) Compliance and Monitoring(U//FOUO) Authorization documents regarding the use of the CCTV, electronic tracking
devicesmust be documented in the substantive investigative ELSUR fileand will be available for compliance and monitoring review.

133
UNCLASSIFIED-FOR OFFICIAL USE ONLYb2
b7E

UNCLASSIFIED - FOR OFFICIAL USE ONLY
Domestic Investigations and Operations Guide
11.7. (U) Investigative Method: Polygraph11.7.1.

(U) Summary(U//FOUO) Application

I

b2
S

b 7E

not otherwi e prohibited by AGG-Dom, Part III.B.2-3.
11.7.2.

(U) Legal Authority(U) AGG-Dom, Part V.A.6.
11.7.3.

(U//FOUO) Definition of Investigative Method(U/FOUO) The polygraph is used to: (i)aid in determining
whether a person has pertinent
knowledge of a particular matter under investigation or inquiry;(ii) aid in determining thetruthfulness of statements made or information furnishedbyasubject,
an individual making allegations; (iii) obtain information leading to thevictim, witness, CHS, or
location of evidence,individuals or sites of offense; and (iv) assist in verifying theaccuracy
and thoroughness of-information furnished-by-applicants and employees.
(U//FOUO)

I

b2
b7E

(U//FOUO) Note: This policy does not limit other authorized
activities of the FBI, such as theFBI's responsibilities to conduct background checks
employees under federal personnel security programs.and inquiries concerning applicants and11.7.4. (U//FOUO) Standards for Use and Approval
Requirements for Investigative
Method(U//FOUO) An SSA may approve the use of a-polygraphif:
A. (U//FOUO)
B. (U//FOUO)

b2

b7E

C. (U//FOUO)

11.7.5.

(U) Duration of Approval(U//FOUO)r

I'i,-

-"

134
UNCLASSIFIED-FOR OFFICIAL USE ONLYb2
b7E

UNCLASSIFIED - FOR OFFICIAL USE ONLY
Domestic Investigations and Operations Guide
11.7.6.
(U//FOUO) Specific Procedures(U//FOUO) An EC must be prepared requesting SSA.approval forthe polygraph. If an AUSA is
assigned to the case, an FBI employee must confer with the USAO
to discuss any prosecutorial
issues prior to the administration of a polygraph.
11.7.7.
(U//FOUO) Compliance-and Monitoring(U//FOUO) Except for polygraphs administered as part of a backgroundcheck or as part of afederalpersonnel security program, all polygraphs must be conductedunder and documented to a
substantive case file.

135
UNCLASSIFIED-FOR OFFICIAL USE ONLYUNCLASSIFIED - FOR OFFICIAL USE ONLY
Domestic Investigations and Operations Guide
11.8. (U) Investigative Method: Undercover Operations
11.8.1.

(U) Summary(U//FOUO
ib2
b7E(U//FOUO) Undercover operations must be conducted in conformity
with The Attorney
GeneralsGuidelines on FederalBureau of nvestiationUndercoverOperations(AGG-UCO)
in. investigations relating to activities in violation of federal
criminal law that do not concern
threats to the national security or foreign intelligence. In
investigations that concern threats to thenational security or foreign intelligence,, undercover operations
involving religious or politicalorganizations must be reviewed and approved by FBI Headquarters,with participation by the
NSD in the-review process. (AGG-Dom, Part V.A.7) Other
undercover operatiofis involving
threats to thenatiohalsecurity or foreign intelligence are reviewed
and approved pursuarit to FBI
policy as described herein.
(U//FOUO) Application: 1'

---

b2

S.

11.8.2.

(U) Legal Authority

A. (U) AGG-Dom, Part V.A.7
B. (U) AGG-UCO
11.8.3.

(U//FOUO) Definitioi of Investigative Method

A. (U//FOUO) An "undercover activity" is any investigative
activity involving the use of anassumed identity by an undercover employee for an official
purpose, investigative activity, orfunction. An "undercover employee"is an employee of theFBI, another federal, state, or
local law enforcement agency, another entity of the UnitedStates Intelligence.Comnunity, or
another foreign intelligence agency working under.the.direction
and control of the FBI whose
relationship with theFBI is concealed from thirdparties by
the maintenance of a cover oralias identity for an official purpose, investigative activity,or function.
B. (U//FOUO).An "undercover operation" is an operationthat involves a series of related"undercover activities" over a period of time by an "undercoveremployee." A series ofrelated undercover activities consists of more than five
separate substantive contacts by anundercover employee with the individuals under investigation.
In investigations relating toactivitiesin violation of federal criminal law that do
not concern threats to the national
security or foreign intelligence, undercover activity involving
are listed in the AGG-UCO and the FGUSO, donstitutesan sensitive circumstances, which
undercover operation regardlessof the humber of contacts involved. A substantive contact
is a communication, whether by
136
UNCLASSIFIED-FOR OFFICIAL USE ONLY

b7E

UNCLASSIFIED - FOR OFFICIAL USE ONLY
Domestic Investigations and Operations Guideoral, written, wire, or electronic means, that includes informationof investigative interest.
Mere incidental contact (e.g., a conversation that establishes
an agreed time and location foranother meeting) is not a substantive contact within the meaningof this policy.
(U//FOUO) Distinction Between Sensitive Circumstance andSensitive Investigative
Matter:(U//FOUO) The term "sensitive investigative matter" as usedin the AGG-Dom should not be
confused with the term "sensitive circumstance" as that term
is used in undercover operations
or ELSUR matters. The term sensitive circumstance relates
to a circumstance that arises in anundercover operation that requires the UCO to obtain FBIHQ
approval. A comprehensive listof sensitive circumstances for criminal activities is containedin the AGG-UCO and fornational security matters in Section 28 of the NFIPM. The Criminal
Undercover Operations
Review Committee (CUORC) and the national security Undercover
Review Committee(UCRC) must review and approve undercover operations thatinvolve sensitive
circumstances. The detailed policy for undercover operations
is described in this section of
the DIOG, the Field Guide for Undercover and Sensitive Operations(FGUSO), and theFBIHQ substantive Division program implementation guides..
11.8.4.
(U//FOUO) Standards for Use and Approval Requirements
for Investigative
MethodA. (U//FOUO) An official considering approval or authorizationof a proposed undercoverapplication must weigh the risks and benefits of the operation,
giving careful consideration to
the following:
1. (U//FOU) The risks of personal.injury to. individuals,
property damage, financial loss topersons or business, damage to reputation, orother harmto persons;
2. (U//FOUO) The risk of civil liability or other loss to thegovernment;
3.

(U//FOUO) The risk of invasion of privacy or interferencewith privileged or confidential
relationships and any potential constitutional concerns
or other legal concerns;
4. (U//FOUO) The risk that individuals engaged in undercover
operations may become
involved in illegal conduct;
5. (U//FOUO) The suitability of government participationin the type of activity that is
expected to occur during the operation. (AGG-UCO,
Part IV.A.)
B. (U//FOUO) The following approval and authorization
requirements apply to undercover
operations relating to activities in violation of federal criminal
law that do not concern threats
to the national security or foreign intelligence:
1. (U//FOUO) An "undercover activity" in which an unidercoveremployee plans to meetwith a subject requires the approval of the SSA.
2. (U//FOUO) An "undercover operation" must be approvedby the SAC (or an ASAC withdelegated approval authority). The CDC must review allundercover operations before
approval and provide advice to the SAC regarding predicationof subjects, entrapment
issues, and whether the proposal meets the requirementsof the AGG-UCO or other DOJ
and FBI policy guidance.

137
UNCLASSIFIED-FOR OFFICIAL USE ONLYUNCLASSIFIED - FOR OFFICIAL USE ONLY
Domestic Investigations and Operations Guide
3. (U//FOUO) In addition to SAC approval, authorization from theresponsible FBIHQ
Assistant Director or Executive Assistant Director must be obtained
if the undercover'
operation involves a sensitive circumstance or certain fiscal circumstances,
as those terms
are defined in the AGG-UCO or other FBI guidance.
4. (U//FOUO) Undercover operations that involve a sensitive circumstance(Group I
undercover operations) require review by the CUORC as part oftheauthorization
process:
This requirement applies to both new and renewal proposals.
5. (U//FOUO) Undercover operations that do not involve a sensitive
circumstance (Group II
undercover operations) require notice to the appropriate FBIHQ substantive
Unit andto
the Undercover and Sensitive Operations Unit following SAC approval.
A renewal thatwould extend the operation beyondone year requires authorizationfrom the responsible
Assistant Director.
6. (U//FOUO) All Innocent Images National Initiative (IINI) undercover
operations deemedGroup I and Group II operations require initiation and renewal approvals
fromCyber Division. Group I IINI undercover operations will also be reviewedby thFBIHQ,
CUORC.
7. (U//FOUO) Requirements forinterim approval and emergency
approval for undercover
operations are contained in the FGUSO.
C. (U//FOUO) The following approval requirements apply to undercover
operations thatconcern threats to the national securityor foreign intelligence:
1. (U//FOUO) An "undercover operation" must be approved by
the SACdelegated approval authority): The CDC must review all undercover (or an ASAC with
operations before
approval and provide advice to the SAC regarding predication of subjects,
entrapment
issues, and whether the proposal meets the requirements of'Section 28
of the NFIPM, or
its successor, or other DOJ and FBI policy guidance.
2. (U//FOUO) In addition to SAC approval, authorization fromthe responsible FBIHQ
Assistant Director or Executive Assistant Director must be obtained
if the undercover
operation involves a sensitive circumstance, as defined in
Section 28 of the-NFIPM, or its
successor.
"
3. (U//FOUO) Undercover operations that involve a sensitive circumstancemust bereviewed and authorized by the responsible Assistant Director(Group
Review by the UCRC must precede such authorization. If the matter I operations).
involves religious orpolitical organizations, the review must include participation byarepresentative of the
DOJ NSD. (AGG-Dom, Section V; Section 28 of the NFIPM,
or its successor)
4. (U//FOUO) Undercover operations that do hot involve a sensitive
circumstance (Group II
undercover operations) must be forwarded to the appropriate substantive
Unit at FBIHQ
for review on a UACB basis prior to initiation of the operation.
A renewal that-would
extend the operation beyond 12 months requires authorizationfrom the responsible
Deputy Assistant Director or Assistant Director.
5. (U//FOUO) Requirements for interim approval and emergency
approval
operations are contained in Section 28 of the NFIPM, or its successor. for undercover

138
UNCLASSIFIED-FOR OFFICIAL USE ONLYUNCLASSIFIED - FOR OFFICIAL USE ONLY
Domestic Investigations and Operations Guide
11.8.5.

(U) Duration of Approval(U//FOU)

11.8.6.

(U) Additional Guidance.

A. (U//FOUO)

b2
b7E

b2

'B. (U/FOUO

b2
b7E

B. (U//FOUO)bc. (u/Fouo

C. (U//FOUO)|l~

--

----

b2
b2-----b7E

11.8.7.

(U//FOUO) Compliance and Monitoring, and Reporting(/FOUO) All UCOs must provide" to apprpriato.
ar- ..

iajRequirementssummary using.theusing the-summary

139
UNCLASSIFIED-FOR OFFICIAL USE ONLY

b2
b

b7EE

UNCLASSIFIED - FOR OFFICIAL USE ONLY
Domestic Investigations and Operations Guide
11.9.

(U) Investigative Method: Compulsory process as authorized by law, including
grand jury subpoenas and other subpoenas, National Security Letters

15 U.S.C. §§ 1681u, 1681v; 18 U.S.C. § 2709; 12 U.S.C. § 3414(a)(5)(A); 50 U.S.C. § 436, and
FISA orders (50 U.S.C. §§ 1861-63).
(U) Summary(U//FOUOj
b2
b7E

U//FOUO) Applicationi
b2
b7E

IWhen collecting positive foreign intelligence, if thesubject is a non-United States person, a request for business records pursuant to 50 U.S.C.
§§ 1861-63 is'lawful.
11.9.1.

(U) Federal Grand Jury Subpoena

A. (U) Legal Authorities(U) A Federal Grand Jury is an independent panel charged with determining whether there is
probable cause to believe one or more persons committed a particular federal offense within
the venue of the district court. If the FGJ believes probable cause exists, it will vote a "truebill" and the person will be indicted. An FGJ indictment is the most typical way persons arecharged with felonies in federal court. A FGJ can collect evidence through the use of an FGJ
subpoena, which is governed by Rule 6 of the FRCP. FRCP 6(e) controls the release of
information obtained by the prosecutor as part of the FGJ proceeding. FRCP 6(e) allows
federal prosecutors to share valuable.foreign intelligence, counterintelligence, and terrorismrelated threat information, and it is the DOJ's policy that such information should be shared
tothefullest extent permissible by law and in a manner consistent with the rule. The
Attorney General has issued revised Guidelines for the Disclosure and Use of Grand Jury
Information under Rule 6(e)(3)(D) (hereinafter "FGJ-Guidelines"). A memorandum issued
by the Deputy Attorney General on May 15. 2008, provides amplifying guidance.

140
UNCLASSIFIED-FOR OFFICIAL USE ONLYUNCLASSIFIED - FOR OFFICIAL USE ONLY
Domestic Investigations and Operations Guide
B. (U//FOUO) Definition of Method(U//FOUO) FGJ subpoenas aredemands for documents, records, testimonyof witnesses, or
any other evidence deemed relevant by a sitting grandjury. The FBI canrequest the issuanceof an FGJ subpoena in coordination with the responsible United States Attorne's
Offie inall criminal investigative matters

b2
b7E

.FGJ
are limited to use prior to
the indictment of the individual to whom the subpoenasubpoenas
relates.
C. (U) Approval Requirements(U) Thereare no-FBI-supervisory-approval requirements,:but allFGJ
subpoenas must be
issued by the United States Attorney's Office that is handlihg
the assessment or investigation
to which the subpoenaed materials or witnesses are relevant.
D. (U) Duration of Approval(U) FGJ subpoenas include a "return date," which is the date on which
the subpoenaed
materials or testimony is due to the grand jury.
E. (U) Specific Procedures(U) FGJ subpoenas are governed by Rule 6(e) of the Federal Rules
for Criminal Procedureand can orily be obtained in coordination with the responsible
United States Attorney's
Office or the appropriate DOJ Division.
(U) Note: 28 C.F.R. § 50.10 requires the approval'of the Attorney General
before a trial or
FGJ subpoena may be issued to a.third party to obtain the telephone
toll
records
of a memberof the news media. Specific justification is required. Coordination
with the Assistant UnitedStates Attorney handling the grand jury presentation or trial
is necessary. Before proposing
such a subpoena, an agent should review 28 C.F.R. § 50.10.
F. (U) Notice and Reporting Requirements(U) There are no FBI notice or reporting requirements for

FGJ subpoenas.

G. (U) Grand Jury Proceedings--Generally
1. (U) Procedural Issues and Handling of FGJ Materials

141
UNCLASSIFIED-FOR OFFICIAL USE ONLYUNCLASSIFIED - FOR OFFICIAL USE ONLY
Domestic Investigations and Operations Guide(U) The FGJ makes its determination whether-to return a "truebill of indictment" based.
on evidence presented by the prosecuting attorney in an ex parte proceeding.
The grand
jury operates under the direction and guidance of the UnitedStates District Court.
Generally, only witnesses for the prosecution testify before
the grand jury.
(U) Only the United States Attorney or an assistant, other DOJ
attorneys prosecuting thematter, the witness under examination, an interpreter (as needed),
and the stenographer or
operator of a recording device may be present while the grandjury is in session. No judge
is present during the presentation of evidence although the court
will sometime rile onevidentiary issues-and will provide initial instructions to the FGJ.
No
'the grand jurors may be present while the grand jury is deliberating person other thanor voting.
2. (U) Restrictions on Disclosure(U) As a general, rule, no one other than a grand jury witness
may disclose mattersoccurring before the grand jury. Government agents, even if
called as witnesses, may notdisclose, matters occurring before the grand jury.
3. (U) Exceptions.Permitting Disclosurea. (U) Disclosures by the government without the court's
permission. The
government; through its attorney, may disclose grand jury mattersunder thefollowing conditions:i.

(U).Under Rule 6(e)(3)(A), the government may disclose a
grand jury matter tothe following persons and.in the following situations provided
the government
does not disclose the grand jury's deliberations or any grandjuror's vote and thegovernment provides the court that impaneled the grand.jury
all persons to whom disclosure was made and certifies that with the names of
the government has
advised the receiving partyof the obligation of secrecy under
this rule.
(U) Persons eligible toreceive material under this subsection
are: 1) an attorney
for the government for ise in performing that attorney's duty;2) anygovernment personnel, including state, local, Indian tribe,or foreign
government personnel that an attorney for the government considers necessary
to assist in performing.that attorney's duty to enforce federal
law; and 3) aperson authorized under 18 U.S.C. § 3322.
(U) Note: FBI OGC attorneys and CDCs are not "attorneys
for thegovernment." Under this Rule, FRCP 1 defines "attorney
for the government"
as "the Attorney General, an authorized assistant of the Attorney
General, aUnited States Attorney, [and] an authorized assistant of
the United States
Attorney."ii..

(U) An attorney for the government may disclose any grandjury matter toanother Federal Grand Jury.
142
UNCLASSIFIED-FOR OFFICIAL USE ONLYUNCLASSIFIED - FOR OFFICIAL USE ONLY
Domestic Investigations and Operations Guide
iii.

(U) An attorney forthe government may disclose any grand jury matter
involving foreign intelligence, counterintelligence, or foreign intelligence
information to any federal law enforcement, intelligence, protective,
immigration, national defense, or national security official to assist theofficial
receiving the information in the performance of that official's duties.
The
government attorney must file, under seal, with the court that impaneled
grand jury, a notice that such information was disclosed and the agenciestheordepartments that received the information. As used in Rule 6(e), foreign
intelligence information is information that relates to the ability of theUnitedStates to protect against actual or potential attack or grave hostile acts
by aforeign power or its agents; sabotage or international terrorism by a foreign
power or its agents or clandestine intelligence activities by an intelligence
service or network of a foreign power or its agents, or information withrespect
to a foreign power or foreign territory that relates tothe national
defense or
security of the United States or the United States conduct of foreign
affairs.

iv.

(U) An attorney for the government may disclose any grand jury
matterinvolving; either in the United States or elsewhere, a threat of-attackorgrave hostile acts of a foreign power or its agent, athreat of domestic otherorinternational sabotage, or clandestine intelligence gathering activities
by anintelligence service or network of a foreign power or by its agent toanyappropriate federal, state, local, Indian tribal, or foreign government
official forthe purpose of preventing or responding to such threat or activities.
The
government attorney must file, under seal, with the court that impaneled
grand jury, a notice that such information was disclosed and the-agencies theordepartments that received the information.

b. (U) Disclosures by the government requiring the Court's
permission. The
government, through its attorney, may disclose grand jury matters
following conditions only with permission of the court. Petitions under thedisclosures are generally, but notalways, filed with the court that to make these
impaneled the
grand jury. Unless the hearing on the government's petition
is to be ex parte, thepetition must be served on all parties to the proceedings andthe parties must beafforded a reasonable period of time to respond.
i.

(U) An attorney for the.government may petition for disclosure toa foreign
court or prosecutor for use in an official criminal investigation.

ii.

(U) An attorney for the government may petition for disclosure
to a state,
Indian tribal, or foreign government official, if the government attorney local,
canshow that the matter may disclose a violation of state, Indian
tribal, or foreign
criminal law, and the purpose of the disclosure is to enforce
that law.

iii.

(U) An attorney for the government may petition for disclosure
to anappropriate military official if the government attorney-can show
the matter
143
UNCLASSIFIED-FOR OFFICIAL USE ONLYr

UNCLASSIFIED - FOR OFFICIAL USE ONLY
Domestic Investigations and Operations Guide
may disclose a violation of military criminal law under the Uniform Codeof
Military Justice, and the purpose of the disclosure is to enforce that law.
c. (U//FOUO) FBI's Conduit Rule
(U//FOUO) Only the federal prosecutor is authorized to make an initial disclosureofRule 6(e)(3)(D) foreign intelligence information. As a practical matter,such-disclosures are ordinarily accomplished through the FBI, which may haveexisting
information-sharing mechanisms with authorized receiving officials. If
the prosecutor
intends to share information directly with another, official, consultation
with the FBI
is required to ensure that disclosures will be consistent with the existing
policy ofintelligence community agencies and to ensure appropriate handling of sensitiveorclassified information.
I(U//FOUO) If, in cases of emergency, the prosecutor must disclose
information
before consulting with the FBI, the.prosecutor must.notify the FBI
as soon aspracticable.
d. (U) Other Limitations(U) Rule 6(e)(3)(D) does not eliminate certain other information protection
requirements, such as restrictions on disclosures of tax returns,
on certain financial
information under the Right to Financial Privacy Act, and on classified
information,
to name only a few examples. Specific statutes may impose additional burdensof
disclosures.
e. (U) Disclosurei.

(U) An FBI employee may become a "Receiving Official," theperson to whom
grand jury.information has been:disclosed, if the FBI receives grand jury
information developed during investigations conducted by otheragencies. A
Receiving Official is any federal, state, local, Indian tribal, or
foreigngovernment official receiving grand jury information, disclosed
by an attorney
for the government, under any provision of Rule 6(e)(3)(D). A Receiving
Official may only use the disclosed material as.necessary in the
conduct of
his/her official duties. The Receiving.Official ordinarily must consult withthe.
federal prosecutor before disseminating the information publicly,
including inopen court proceedings.

ii. (U//FOUO) Receiving Officials may only use grand jury
information in amanner consistent with the FGJ-Guidelines and any additional conditions
placedon the use or handling of grand jury information by the attorney
for thegovernment.
144
UNCLASSTf IflIw

nD iorr'TAr

rm
TTQ1i

T rT,

b2
b7E

UNCLASSIFIED - FOR OFFICIAL USE ONLY
Domestic Investigations and Operations Guideiii. (U//FOUO) if dissemination is necessary to the performance of his or her
official duties, a Receiving Official may disseminate Rule 6(e)(3)(D)
information outside of that official's agency to other government officials.
iv. (U) A Receiving Official, other than a foreign government official, must consult
with the attorney for the government before disseminating Rule 6(e)(3)(D)
information publicly (including through its use in a court proceeding that isopen to or accessible to the public), unless prior dissemination is necessary to
prevent harm to life or property. In such instances, the Receiving Official shallnotify.the attorney for the government of the dissemination as soon aspracticable.
v. (U) A foreign government Receiving Official must obtain the prior consent
from the disclosing official where possible, or if the disclosing is unavailable,from the agency that disseminated the information to that foreign official before
dissemination of the information to a third government or publicly. Publicdissemination includes using the information in a court proceeding.that is open
to or accessible by the public.
vi. (U) A.Receiving Official shall handle Rule 6(e)(3)(D) information in a mannerconsistent with its sensitivity and shall take appropriate measures to restrict
access to this information to individuals who require access for the performanceof official duties.
vii. (U) A Receiving Official shall immediately report to the disclosing attorneyforthe government: any unauthorized dissemination of Rule 6(e)(3)(D) information;or any loss, compromise, or suspected compromise of Rule 6(e)(3)(D)
information.
f.

(U) Violations
i. (U) A Receiving Official who knowingly violates Rule 6(e)(3)(D) by using thedisclosed information outside the conduct of his or her official duties, or by
failing to adhere to any limitations on the dissemination of such information,
may be subject to contempt of court proceedings and to restriction on future
receipt of Rule 6(e)(3)(D) information.
ii. (U) A state, local, Indian tribal, or foreign government official who receives
Rule 6(e)(3)(D) information, and who knowingly violates these guidelines, may
be subject to contempt of court proceedings.
iii. (U) An attorney for the government who knowingly violates Rule6(e)(3)(D)
may be subject to contempt of court proceedings.

145
UNCLASSIFIED-FOR OFFICIAL USE ONLYUNCLASSIFIED -FOR OFFICIAL USE ONLY
Domestic Investigations and Operations Guideg. (U) Limitation on Unauthorized Disclosures.
(U) Rule 6(e)(3)(D)(i) provides that Receiving Officials
may use disclosed
information only to conduct their "official duties
subject to any limitation on theunauthorized disclosure of such information." This "limitation on unauthorized
disclosures" is understood to encompass applicablestatutory, regulatory, andguideline restrictions regarding classification, privacy,
or other information
protection, as well as any additional restrictions
imposed by the federal prosecutor.
(U//FOUO) Note: The FGJ-Guidelines do not requirethat the Receiving Official
notify the federal prosecutor of subsequent disclosures,
except for consultation for
public disclosures and consent for certain disclosures
by foreign officials. The
Receiving Official is bound by whatever restrictions
govern his or her use anddisclosure of the information as part of his official duties.
dated 5/15/08,
Guidelines for the Disclosure and Use of FGJ Information (Memounder Rule 6[e]r3]rDJ).
h. (U//FOUO) Limitation of Usei. (U//FOUO) Because of the restrictions involved
in handling information that is
obtained by theuse ofa grandjury suboena, whenever ossible,
alternatives to
the grand jury subpoena, such as|i
I sIshould be considered as an alternative method of obtainingii. (U) A grand jury subpoena may only be used
for purposes of gathering
information that is relevant to the grand jury's investigation.
Grand jury secrecy
continues indefinitely, regardless of whether there
is an indictment, unless thematerial becomes a matter of public record, suchas by being introduced at trial.
iii. (U) Rule 6(e)(3)(D) does not require noticeto the court ofdissemination of the information by Receiving Officials. subsequentiv. (U//FOUO) Disclosure of grand jury material
cannot be made within the FBI for
unrelated investigations unless a government attorney
has determined that suchdisclosure to a particular investigator is needed
to assist that attorney in a
specific criminal investigation. The ability of government
attorneys to freely
share grand jury material with other government
attorneys for related or
unrelated criminal investigations does not extend
to investigators without casespecific authorization from the government
attorney and notice to the court.
Therefore, grand jury material must be restricted
when placed
system of records that is freely accessible to FBI-employees into a generaland others withaccess (e.g., ACS).
v. (U//FOUO) If a government attorney authorizes
the disclosure.of grand jury
material in the possession of the FBI for use in an
unrelated federal criminal
146
UNCLASSIFIED-FOR OFFICIAL USE ONLYb2
b7E

UNCLASSIFIED - FOR OFFICIAL USE ONLY
Domestic Investigations and Operations Guide
matter, such approval should be documented inthe grandjury
subfile of boththe initiated case file and the subsequent case file. That
documentation will bein addition to any necessary supplementation to the government
attorney's
FRCP Rule 6(e) disclosure letter and/or to the internal
disclosure list.
vi. (U//FOUO) The USAO should be consulted immediately
for precautionary
instructions if grand jury material will have application
to civil law enforcement
functions (e.g., civil RICO or civil forfeiture). There arevery limitedexceptions
that allow government attorneys to use grand jury material
or information in
civil matters (e.g., civil penalty proceedings concerningbankinglaw violations).
These exceptions do not automatically apply to investigative
personnel.
Therefore, any similar use of grand jury information by
the FBI must be
approved in advance by the government attorney.
vii. (U//FOUO) Disclosure cannot be made without acourt ordercriminal investigations, such as background investigations for use in nonor name checks.
viii. (U//FOUO) Government personnel who are preparing
a response to a Freedomof Information Act-or:PriVcy Act request-may properly-accessgrandjury
material underthe Rule because they are considered
to be,assisting the grandjury attorney by ensuring against any improper disclosure.
i. (U) Matters Occurring Before the Grand

Juryi. (U).Core Grand Jury Material: There can be
no dissemination of mattersoccurring before the grand jury unless such dissemination
comes within one of
the exceptions discussed above. Thereis no uniform
legal definition of what
constitutes matters occurring before the grand jury except
for what is generally
referred to as "core" grand jury material. "Core grandjury material" includes
the following: (i) names of targets and witnesses;(ii) grand jury testimony' (iii)
grand jury subpoenas; (iv) documents with references(including summaries and analyses); (v) documents to grand jury testimony
that
intentions or direction of the grand jury investigation; clearly reveal theand (vi) other material
that reveals the strategy, direction, testimony, or otherproceedings of a grandjury.
ii. (U) Documents Created Independent of Grand
Jury but Obtained byGrand Jury Subpoena: Rule 6(e) generally prohibitsdisclosing"matters
occurring before the grand jury." The rule, however,does
notdefinethat phrase.
The issue of whether pre-existing documents fall withinthat prohibition has
neverbeen settled conclusively by the Supreme Court,
although many lower
courts have discussed it at length. Courts generally
agree that this prohibitiondoes not cover all information developed in the courseof a grand jury
investigation; rather, the secrecy rule applies only
to information that would
reveal the existence, strategy or direction of the grandjury investigation, thenature of the evidence produced before the grandjury,
the views expressed by
147
UNCLASSIFIED-FOR OFFICIAL USE ONLYUNCLASSIIED - FOR OFFICIAL USE ONLY
Domestic Investigations and Operations Guide
members of the grand jury, or anything else that actually occurred
before thegrand jury. In addition, courts-have frequently held that
Rule 6(e) does notprotect documents subpoenaed from the government thatare sought by third-parties only for the information contained within the document
rather than todetermine the direction or strategy of the grand jury investigation.
Due todeveloping law on this issue, FBI personnel should consult
with the AUSA
responsible to determine how to best handle these documents.
iii. (U//FOUO) Data Extracted from Records ObtainedbySubpoena: Information extracted from business records Grand Jurythat was obtained by
grand jury subpoena is often used to facilitate investigations.
Some of that typeof data is, by statute or case law, subject to "the Rule."Inothercases,
determination of whether data must be considered subject
to "the Rule" depends
on the case law and local practice in the federal district.
Information extracted
from grand jury subpoenaed financial records subject to
the Right to Financial
Privacy Act of 1978 (12 U.S.C. § 3 4 20) must be treatedas grand jury material
unless such record has been used in the prosecutionof a crime for which thegrand jury issued an indictment or presentment...." Withof the
USAO, information-from subpoenaed telephone records theayapproval
be-disclosed foruse in unrelated federal criminal investigations in those
districts where suchmaterial isnot considereda "matter occurring before
a grand jury." If the
USAO approves generally of this procedure, such information
may be used inunrelated criminal investigations without authorizationfrom a government
attorney in each instance.
j.

(U) Federal Grand Jury Physical Evidence and Statementsof Witnessesi. (U) Physical evidence provided to the government
in respoise
subpoena is subject to the secrecy rule regardless of whether to a grandljury
such evidence ispresented to thegrand jury. Physical evidence provided
voluntarily
or obtainedby means other than grand jury process (such as bya search warrant) is not a
grand jury matter regardless of whether such evidence
was previously or isthereafter presentedto the grand jury.
ii. (U) Statements ofwitnesses obtained as a resultof grand
grand jury subpoena, such as a statement.given in lieu jury process. includingof grand jury testimony,are matters occurring before the grand jury irrespectiveof whether such
witnesses testified before the grand jury or are not required.to
testify. Voluntarystatements of witnesses made outside of the grandjury context(not pursuant toany grand jury processiricluding a grand jury subpoena),
including statements
made outside the-grandjury by a witness who is
being prepared for grand jury
testimony, are not grand jury matters irrespectiveof whether the witness
previously testified or will thereafter testify before
the grand jury.
iii. (U) Rule 6(e)(3)(B) requires a federal prosecutor
whomaterial to government investigators and other personsdiscloses grand jury
supporting the grand148
UNCLASSIFIED-FOR OFFICIAL USE ONLYUNCLASSIFIED - FOR OFFICIAL USE ONLY
Domestic Investigations and Operations Guide
jury investigation to promptly provide thecourt that
impaneled the grand jury
the names of the personsto whom such disclosure has
been made and to certifythat he/she has advised such persons of their obligationof secrecy under theRule. In order to document the certification requiredby the Rule, government
attorneys often execute and deliver to the court a form,
normally referred to as a
"Certification" or "Rule 6(e) letter." A copy of this document
should be
maintained with the grand jury material held in the FBI'scustody.
iv. (U//FOUO) Documentation of Internal Disclosuresof Grand Jury Material:
Grand jury material should be kept in such as fashion
as to maintain the
integrity of the evidence. Upon taking custody of grandjury material, the FBI
employee should categorize it in a manner to identify its
production source andhow it was obtained, to include the identity ofa custodianof record for
documentary evidence. Practical considerations often
require agents assisting
government attorneys to seek assistance in the same investigationfrom others
within the FBI. In many districts, support personnel
and supervisors of caseagents need not be routinely included in the list providedlto
the court. In:lieu-of
a Rule 6(e) letter from the USAO containing an exhaustive
list of names of FBI
personnel, an FBI record of additional internal disclosures
must be maintainedby the case agent in order to establish accountability.
Use of this "internal
certification" procedure should be authorized by theappropriate USAO. Theinternal form.should record the date of disclosure aswell as the identity andposition of the recipient. Such internal disclosures
may be made only in supportof the same investigation in which a federal prosecutor
has previously issued aRule 6(e) letter. In addition, the internal record shouldreflect that all recipientsof grand jury materials were advised of the secrecy
requirements of Rule 6(e).
Whenever practicable, recipients should be listed on
this internal certification
prior to disclosure. Local Rule 6(e) customs should govern
the internal
certification process used.
v. (U//FOUO) Storage of Grand Jury Material:
The FBI cannot make or allow
unauthorized disclosure of grand jury material. Material
arid records obtained
pursuant to the grand jury process are frequently
stored in FBI space. FBI
personnel should report any unauthorized disclosure
to the appropriate
government attorney Who, in turn, must notify the
court. In order to protect
against unauthorized disclosure, grand jury material must
be secured in thefollowing manner:
I. (U//FOUO) The cover, envelope, or container
containing grand jury
materials must be marked with the warning: "GRANDJURY MATERIAL DISSEMINATE ONLY PURSUANT TO RULE 6(e)."No Grand Jurystamp or mark should be affixed to the original material.
Agents, analysts
and other authorized parties should work from copies
of grand jury material
whenever possible to ensuie the original material retains
its integrity.

149
UNCT,ARm
CanVDo

m

r

A rTm

- ...

UNCLASSIFIED - FOR OFFICIAL USE ONLY
Domestic Investigations and Operations Guide
limited to authorized
2. (U//FOUO) Access to grand jury material must be
in a specificgovernment
theforattorneyanpersons (e.g., those assisting
to protect
criminal investigation). All necessary precautions should be taken
in a secure location
grand jury material, to include maintaining the material
when not in use. The material must be appropriately segregated, secured,and safegudrded. Absent chain-of-custody considerations, grand jury
jury material material may be maintained in the IA section of the file. Grand
entrusted
need not be kept in ar evidence or bulky exhibit room and may be(ECT).
technician
controlevidenceor(SST)
to a support services technician
data
database,.thecomputeraintoenteredbematerial
Shouldgrand jury
in amust be marked with the 6(e) warning and maintained within the system
restricted manner.
as Federal
3. (U//FOUO) Registered mail or other traceable courier (suchbe used to
must
(CSO)
Officer
Security
Chiefthe
Express) approved by
mail or transmit to other Field Offices any documents containing grand jury
notmaterial. Couriers and other personnel employed in these services will
be aware of the contents of the material transmitted because of the wrappinga backgroundprocedures specified below, and therefore, then do not require
investigation for this purpose. The names of persons who transport themustmaterial need not be placed on a disclosure list, but-the receiving officepersonnelofprovide the case agent in the originating office with the namesin the receiving office to whom disclosure is made.
4. (U//FOUO) Grand jury material that is to be mailed or transmitted byandtraceable courier outside a facility must be enclosed in opaque innerouter covers. The inner cover must be a sealed wrapper or envelope that
contains the addresses of the sender and the addressee, who must be
authorized to have access to the grand jury material. The inner cover must
be conspicuously marked "Grand Jury Information To Be Opened By
Addressee Only." The outer cover must be sealed, addressed, return
addressed, and bear no indication that the envelope contains grand jury
material. When the size, weight, or nature of the grand jury material
used forprecludes the use of envelopes or standard packaging, the material
packaging or covering must be of sufficient strength and durability to
exposure.
protect the information from unauthorized disclosure or accidentalof, or5. (U//FOUO) If the government attorney determines that the sensitivity
transmission
securemoreathreats to, grand jury material necessitates
method, the material may be transmitted by an express mail service
be handapproved for the transmission of national security information ordesignated
her
or
his
or
carried by the assigned government attorney
representative.
6. (U//FOUO) Grand jury material containing classified national security
information must be handled, processed, and stored.according to 28 C.F.R.
150
UNCLASSIFIED-FOR OFFICIAL USE ONLYUNCLASSIFIED - FOR OFFICIAL USE ONLY
Domestic Investigations and Operations Guide
Part 17. Grand jury material containing other types of sensitive information,such as federal tax return information, witness security information, andother types of highly sensitive information that have more stringent security
requirements than that usually required for grand jury material must be
stored and protected pursuant to the security regulations governing suchinformation and any special security instructions provided by theorganization that originated the information.
7. (U//FOUO) Original documents that are obtained through the grand jury
process should be returned to the attorney for the government or, with thegovernment attorney's permission, to the owner if there is no indictment or
the prosecution has concluded.
k. (U) Requests for Subpoenas in Fugitive Investigations(U//FOUO) It is generally a misuse of the grand jury to use the grand jury as aninvestigative aid in the search for a fugitive. Therefore, with the exceptions
discussed below, grand jury subpoenas for testimony or records related to thefugitive's whereabouts may not be requested in FBI fugitive investigations.
i. (U//FOUO) Grand jury process may be used to locate a fugitive if the grandjury
is interested in hearing the fugitive's testimony. Thus, if the grand jury seeks
thetestimony of the fugitive in an investigation that the grand jury is indicting,thegrand jury may subpoena other witnesses and records in an effort to locate
thefugitive witness. However, interest in the fugitive's testimony must not be apretext. The sole motive for inquiring into the fugitive's location must be thepotential value of fugitive's testimony to the grand jury's investigation. A
subpoena for the fugitive witness must be approved by the grand jury before
seeking to subpoena witnesses or records to locate the fugitive. Further, it is notproper to seek to obtain grand jury testimony from any witness, including a
fugitive, concerning an already-returned indictment. Thus, it would not beproperto seek to locate a fugitive for the purpose of having the fugitive testify about
matters for which an indictment has already been returned, unless there are
additional'unindicted defendants to be discovered or additional criminal acts tobeinvestigated through the testimony of the fugitive. Current.policy on "target"
witnesses must be observed. Grand jury subpoenas for witnesses and records
aimed at locating a fugitive witness who is atarget of the grand jury investigatioh
should be sought only where a target subpoena for the fugitive has alreadybeen
approved by the responsible Assistant Attorney General.
ii. (U//FOiJO) Use of the grand jury to learn the present location of afugitive is also
proper when the present location is an element of the offense
under investigation.
On adequate facts, the present.location of a fugitive might tend to establishthat
another person is harboring the fugitive, or has committed misprision,or is anaccessory after the fact in the present concealment of the fugitive. However,thisjustification would likely be viewed as a subterfuge if the suspected harborer
or
151
UNCLASSIFIED-FOR OFFICIAL USE ONLYUNCLASSIFIED - FOR OFFICIAL USE ONLY
Domestic Investigations and Operations Guide
the person potentially guilty of misprision or as an accessory were given
immunity in the grand jury in order to compel his/her testimony about
the locationof the fugitive. With regard to escaped federal prisoner and bond default matters,
the present location of a fugitive is not relevant evidence in a grandjury
investigation-because these offenses address the circumstances of a priordeparture from a known location. The fugitive's present location is not a relevant
factor as it is in harboring or as it may be in a misprision investigation.
Inasmuch
as unlawful flight to avoid prosecution cases are, as a rule, not prosecutedandcannot be prosecuted without written authorization from the Attorney Generaloran Assistant Attorney General, any effort to use the grand jury in theinvestigationof such cases must be preceded by consultation with the DOJ and by
writtenauthorization to prosecute from the Assistant Attorney General in chargeof theCriminal Division.
11.9.2. (U) Administrative Subpoena
A. (U) Summary(U) The Attorney General of the United States is vested with the authority
to issueadministrative subpoenas under two provisions of the UnitedStates Codethat have-relevanceto FBI criminal investigations, 21 U.S.C. § 876 and 18 U.S.C. § 3486.
The FBI has noinherent authority to issue administrative subpoenas but relies on.
delegated authority fromthe Attorney General. The use of administrative subpoenas.is limited
to three categories ofinvestigations-drug program investigations, child sexual exploitation
investigations, and health-care fraud investigations-and may not be and abuseused for any otherpurpose. The delegated authority varies depending on the federal violation
being investigated.
The type of information that can be obtained using.an administrative
subpoena is also limitedby law or by policy of the Attorney General.
(U//FOUO) Note: Within the FBI, the authority to issue administrative
subpoenas is limited
to those positions holding the delegated authority from the Attorney
General; that authority
may not be redelegated.b2
b7E

B. (U) Legal Authority and Delegation
I. (U) Investigations involving the sale, transfer, manufacture
or importation of
unlawful drugs(U) Authority: 21 U.S:C. § 876 and DOJ. Regulation at 28 C.F.R.
App to Pt. 0, Subpt. R§ 4.
(U) May be issued to: Any individual or business holding records relevantto the.drug
investigation.
(U) Records to be obtained: Any records relevant to the investigation.
(U//FOUO) Delegated authority to issue: By DOJ regulation,
the Attorney General'sdelegation includes SACs, ASACs, SSRAs and "those FBI Special
Agent Squad
152
UNCLASSIFIED-FOR OFFICIAL USE ONLYUNCLASSIFIED - FOR OFFICIAL USE ONLY
Domestic Investigations and Operations Guide
Supervisors who have management responsibilities over Organized Crime/Drug
Programinvestigations."(U//FOUOi

b2
b7E(U//FOUO) Limitafionsj

7.
IThe Right to Financial Privacy Act limitations
described in paragraph D of this section apply. If addressed to a providerof "electronic
communication service"o6r a "reimote computing service," provisions in the Electronic
Communication Privacy Act (ECPA) govern, as discussed in paragraph D of thissection.
2. (U) Investigations involving the sexual exploitation or abuseof children

b7E(U) Authority: 18 U.S.C. § 3486(a) and Attorney General Order 2718-2004.
(U) May be issued to: A "provider of an electronic communication
service" or a "remotecomputer service" (both terms defined in Section 11.9.2.D.2.b, below)
and only for the
production of basic subscriber or customer information. The subpoena
may require
production as soon as possible but in no event less than 24 hours
after service of the
subpoena.
(U) Records to be obtained:b2
b7E(U//FOUO) Delegated authority to issue:
b2
b7E(U//FOUO) Limitations:. By law, these administrative subpoenas
may onlycases that involve a violation of 18 U.S.C. §§ 1201, 2 241(c), 2242, 2243, be issued in
2251, 2251A
2252, 2252A, 2260, 2421, 2422, or 2423. in which the victim
has not attained the age of18 years. Under the Attorney General's delegation, an administrative
subpoena in theseinvestigations may be issued-only to "providers of electronic
communication services" or
to "remote computing services" to obtain the information
listed above. These
153
UNCLASSTFt F.injrn no TArrr AT TTr /i0, Tr

UNCLASSIFIED - FOR OFFICIAL USE ONLY
Domestic Investigations and Operations Guideadministrative subpoenas may not be issued to any other person or entity or to-obtain any
other information, including the content of communications.l

b2

b7E

3. (U) Investigations involving Federal Health Care Fraud Offenses(U) Authority: 18 U.S.C. § 3486(a)(U) Records to be obtained: Records relevant to an.investigation relating to a."federal
health care offense." Federal health care offense is defined in 18 U.S.C. § 24(U) May be issued to: Any public or private entity or individual with records relevant to
the federal health care offense. (Note: These are referred to in guidance issued by the
Attorney General as "investigative demands:")(U//FOUO) Delegated authority to issue: There is no delegation to the FBI. Delegatedto personnel within DOJ's Criminal Division and to United States Attorneys, who may
redelegate the authority to Assistant United States Attorneys.
(U) Limitations: The Right to Financial Privacy Act (RFPA) limitations described inparagraph D of this section apply. The provisions in ECPA govern, as discussed inparagraph D of this sectiorn, if.the feqtiest for rec6rds is addressedto a "provider ofelectronic communication service" or a "remotecomputing service." The subpoena may
not requirethe production of records at a place more than 500 miles from the nlace thesubpoena is.served.

b2
b7E(U) Restriction oh individual health care information: Pursuant to 18 U.S.C. § 3486,
health information about an individual acquired through.an authorized investigative
demand.may not be used in, or disclosed to any person for use in, any administrative,
civil, or criminal action against that individual unless the action or investigation arises.from and is directly related to receipt of health care, payment for health care, or action
involving a fraudulent claim related to. health care.

(U//FOUOl

b7 E

C. (U) Approval Requirements(U//FOUO) Use ofan administrative subpoena-requires SSA approval. The SSA may issue
the administrative subpoena if the authority has been so delegated. Further review andapproval may be required depending on the delegation. Review by the CDC is appropriate if
legal questions arise in preparing and issuing the subpoena.
(U//FOUO) Note: An individual designated by proper authority to serve in. an "acting" status
in one of the positions with delegated authority may sign and issue an administrative
subpoena. The "acting" status should be documented in an appropriate Field Officeadministrative-file and noted in the case file. For example, if the ASAC with authority to sign
is away on.leave or temporary duty and another individual has been designated by the SAC
to serve as-"acting" ASAC, that individual has authority to issue the administrative subpoena.
154
UNCLASSIFIED-FOR OFFICIAL USE ONLYUNCLASSIFIED - FOR OFFICIAL USE ONLY
Domestic Investigations and Operations Guide
A relief supervisor is not considered to be in an "acting" status for purposes of issuing an
administrative subpoena.
D. (U) Limitations on Use of Administrative Subpoenas
1. (U) Financial Privacy Limitations
a. (U) Obtaining records from a financial institution. "Financial records" are thoserecords that pertain to a customer's relationship with a financial institution. The
term "financial institution" is broadly defined as a bank, savings bank, card issuer,industrial loan company, trust company, savings association, building and loan orhomestead association, credit union, or consumer finance institution, located in any
state, territory, or the District of Columbia. See 12 U.S.C. § 3401. [Note: The scopeof the RFPA's.definition offinancial institution for this purpose, which limits the
restrictions the RFPA places on federal law enforcement in using an administrative
subpoena, is narrower than the definition of financial institution that is used inconnection with NSLs. For that purpose, the RFPA refers to the broader definition
found in the Bank Secrecy Act (BSA). Among the entities included in the BSA
definition are money transmitting businesses, car dealers, travel agencies, andpersons involved in real estate closings. See 12 U.S.C. § 3414(d) and 31 U.S.C.
§5312 (a)(2).aid (c)(l).].When seeking financial records from a financial
institution,,the FBI must send a certificate of compliance required by 12 U.S.C.
§ 3403 to the financial institution. The certificate must indicate, among other things,
that notice has been provided by the FBI to the individual customer whose financial
records are to be obtained. The content of the notice is set out in 12 U.S.C. § 3405.
A court order may be obtained that allows for delayed notice pursuant to 12 U.S.C.
§ 3409. Notice is not required if the administrative subpoena is issued to obtain thefinancial records of a corporation or for records not pertaining to a customer. Noticeis also not required if the administrative subpoena seeks only basic accountinformation, defined as name, address, type of account, and account number. See 12,
U.S.C. § 3413(g).
b. (U) Obtaining records from a Credit Bureau. A credit bureau or consumer
reporting agency may only provide name, address, former addresses, place of
employment and former place of employment in response to an administrative
subpoena. 15 U.S.C. § 1681f. A credit bureau or consumer reportingagency may
not release financial information in a credit report or consumer.report, or the names
and locations of financial institutions at which the consumer has accounts pursuant
to an administrative subpoena. A court order, a grand jury subpoena, or, in an
appropriate case, a national security letter may be used to obtain this information.
15 U.S.C. § 1681b. Notice of disclosure will be provided by the credit bureau or
consumer reporting agency to the consumer if the consumer requests thisinformation.
2. (U) Electronic Communication Privacy Act
a. (U) Use of an Administrative Subpoena. The ability to gather subscriber
information and the content of electronic communications using an administrative
subpoena is governed by ECPA. In cases involving the sexual exploitation or abuseof children, only basic subscriber or customer information may be obtained with an
155
UNCLASSIFIED-FOR OFFICIAL USE ONLYUNCLASSIFIED - FOR OFFICIAL USE ONLY
Domestic Investigationsand Operations Guideadministrative subpoena under the terms of the Attorney General's delegation, as
described above. No content information may be obtained. In drug and health carefraud investigations, an administrative subpoena may be used to obtain basic
subscriber or customer information and certain stored communications, underlimited circumstances, from entities that provide electronic communication services
Sto the public.
b. (U) Definitions. ECPA applies to two types of entities that provide electronic
communications to the public. The term "provider of electronic communication
services" is defined in 18 U.S.C. § 2510(1'5) as "any service that provides the user
thereof the ability to send or receive wire or electronic communications." The term
"remote computing services" is defined in 18 U.S.C. § 2711(12)as the "provision
to the public of computer storage oriprocessing services by means of an electronic
communication system."c. (U) Subscriber information.1
b2
b7E

d. (U) Records or other information pertaining to a subscriber.
b2b7E

e. (U) Content. Content is the actual substance of files stored in an account, including
the subject line of an e-mail.
(1) (U) Unopened e-mail held in storage for 180 days or less may not be obtainedusing an administrative subpoena. A search-warrant is required.
(2)(U) Unopened e-mail that has been held in electronic storage for more than 180
days may be obtained with an administrative subpoena. (In the Ninth Circuit,the opened e-mail and un-opened e-mail must have been in storage for
180 days
before it can be obtained with an administrative subpoena. See Theofel v.
Farev-Jones, 359 F.3d 1066.) The government must provide notice to thesubscriber or customer prior to obtaining such content. A limited exception to
the notice requirement is provided in 18 U.S.C. § 2705.
(3) (U) E-mail that has been opened and the content of other electronically stored
files held in storage by an entity that provides storage services to the public(i.e.,
a remote computing service, as defined in 18 U.S.C. § 2711), may be obtainedusing an administrative subpoena with notice to the customer or subscriber,
unless notice.is delayed in accordance with 18 U.S.C. § 2705.

156
TINCT.A.SQ-Ti1'nt-'rVnD f(It'Vr

itTCfrr-TTT-r

UNCLASSIFIED - FOR OFFICIAL USE ONLY
Domestic Investigations and Operations Guide(4)(U) E-mail that has been opened and the content of other electronically stored
files held in storage by an entity that does not provide electronic communication
services to the public, such as that on the internal network of a business, may beobtained using an administrative subpoena. Notice to the individual is not
required because this demand is not restricted by ECPA.

3. (U//FOUO) Members of the Media(U//FOUO) An administrative subpoena directed to a provider of electronic
communication services or any other entity seeking to obtain local and long distanceconnection records, or records of session times of calls, made by a member of the news
media may only be issued with the specific approval of the Attorney General. Requests
for this approval should be reviewed by the CDC and coordinated withan AssistantUnited States Attorney (AUSA). The request must provide justification for issuance ofthe subpoena consistent with the Department of Justice policies set forth in 28 C.F.R.
§ 50.10. Guidance on this policy may be obtained from the Investigative Law Unit and/or
the Privacy and Civil Liberties Unit, OGC.
E. (U//FOUO) Compliance/Monitoring

1. ;(U) Limits oh use.
b2
b7E

2. (U//FOUO) Overproduction]
b2
b7E

3. (U//FOUO) Factors for compliance. The following factors should be considered toensure compliance with applicable laws and regulations that govern the FBI's use ofadministrative subpoenas:a. (U//FOUO) The administrative subpoena must relate to a type of investigation forwhich the subpoena is authorized;b. (U//FOUO) The administrative subpoenamust be directed to a recipient to whom
an administrative subpoena is authorized;c. (U//FOUO) The administrative subpoena may request only records that are
authorized under the pertinent law;
157
UNCLASSIFIED-FOR OFFICIAL USE ONLYUNCLASSIFIED - FOR OFFICIAL USE ONLY
Domestic Investigations and Operations Guide
d. (U//FOUO) The administrative subpoena must be approved by an authorized
official;e. (U//FOUO) The administrative subpoena must be uploaded into the AutomatedCase Support (ACS) system to the Subpoena ("SBP") subfile of the substantive
case file for record purposes;f. (U//FOUO) The return of service information must be completed on the back of
the original administrative subpoena;g. (U//FOUO) The original administrative subpoena and completed return of service
must be maintained in a "SBP" subfile of the substantive investigation; and11.9.3.

h. (U//FOUO) The records provided in response to the.administrative subpoena must
be reviewed to ensure that the FBI is authorized to collect the records provided. If
an over-production has occurred, steps must be taken to correct the error.
(U),National Security Letter

A. (U) Legal Authority(U) 15 U.S.C. §§ 1681u, 1681.v; 18 U.S.C. § 2709;-(U) 12 US.C. § 3414(a) (5) (A); 50 U;S.C. § 436;
(U) AGG-Dom, Part V(U) A National Security Letter (NSL) may be used only to request:
1. (U) Financial Records: The Right to Financial Privacy Act(RFPA), 12 U.S.C.
§ 3414(a)(5);
2. (U) Identity of Financial Institutions: Fair Credit Reporting Act (FCRA), 15 U.S.C.
§ 1681u(a);3. (U) Consumer Identifying Information: FCRA, 15 U.S.C. § 1681u(b);4. (U) Identity of Financial Institutions and Consumer Identifying Information:
FCRA,
15 U.S.C. §§ 1681u(a) & (b);5.

(U) Full Credit Reports in International Terrorism Investigations: FCRA,
15 U.S.C.
§ 1681v; and6. (U) Telephone Subscriber Information, Toll Billing Records, Electronic
Communication Subscriber Information, and Electronic Communication
Transactional Records: Electronic Communications Privacy Act (ECPA),
18 U.S.C.
§ 2709.
B. (U) Definition of Method(U) A National Security Letter is an administrative demand for documents-or
records that canbe made by the FBI during a predicated investigation relevant to a threat
to the national
security.'Sample NSLs are available.
C. (U//FOUO) Approval Requirements(U//FOUO) A request for an NSL has two parts. One is the NSL itself,
and one is the EC
approving the issuance of the NSL. The authority to sign NSLs has
been delegated to the158
UNCLASSIFIED-FOR OFFICIAL USE ONLYUNCLASSIFIED - FOR OFFICIAL USE ONLY
Domestic Investigations and Operations Guide
Deputy Director, Executive Assistant Director and Assistant EAD for the National Security
Branch; Assistant Directors and all DADs for CT/CD/Cyber; General Counsel; Deputy
General Counsel for the National Security Law Branch; Assistant Directors in Charge in NY,
DC, and LA; and all SACs.
(U//FOUO) In addition to being signed by a the statutorily-required approver, every NSL
must be reviewed and approved by a CDC, ADC or attorney acting in that capacity, or an
NSLB attorney.

b2
b7E(U//FOUO)I
b2
b7E(U//FOUO]

..
b2

b2
b7E

(U//FOUo)

b2
b7E

159
UNCLASSIFIED-FOR OFFICIAL USE ONLYUNCLASSIFIED - FOR OFFICIAL USE ONLY
Domestic Investigations and Operations Guide
.

b2

b7E

D. (U) Duration of Approval-------------- :------ |b2b7 E

E. (U//FOUO) Specific Procedures.(U//FOUO)|
b2
b7E(U//FOUo)

b7E
b2
b7E

(vU/FoUo)*• (U//FOUO)

b2

b2

b7E

* (U//FOUO)
'b2
b7E

"

(U//FOoO

62
b7E

*

(U//FOUO)
I

b2

'b7E

(U//FOUO

b2
b7E

160
UNCLASSIFIED-FOR OFFICIAL USE ONLYUNCLASSIFIED - FOR OFFICIAL USE ONLY
Domestic Investigations and Operations Guideb2
b7E(U//FOUO)

b2
b7E

-

1. (U//FOUO) Cover EC(U//FOUO

I
b2
b.E

a. (U//FOUO)

b. (U//FOUO

c. (U//FOUO)

b2d. (U//FOUO

e. (U//FOUO)

f. (U//FOUOt

g. (U//FOUO)
h. (U//FOUO

i. (U//FOUO)
j.

(U//FOUO)

161
UNCLASSIFIED-FOR OFFICIAL USE ONLYI

b7E

UNCLASSIFIED - FOR OFFICIAL USE ONLY
Domestic Investigations and Operations Guide
k. (U//FOUO

.

b2
b7E

1. (U//FOUO(U//FOUOI

b2
b7E

2. (U) Copy of NSL(U//FOUO) A copy of the signed NSL must be retained in the investigative case file anduploaded under the.appropriate NSL document type in ACS. Documented proof ofservice ofNSL letters must be maintained in the case file.
3. (U//FOUO) Second Generation Information(U//FOUOI

b2
b7E

4. (U//FOUO) Emergency Circimstances(U//FOUO) ECPA protects subscriber or transactional information regarding
communications from disclosure by providers of telephone or other electronic
communication services. Generally, an NSL, grand jury subpoena, or other forms.of legal
process must be used to compel the communication service provider to disclose
subscriber or transactional information. In emergency circumstances, however, if theprovider in good faith believes that a delay in disclosure could pose a danger of death orserious bodily irjury, the provider may voluntarily disclose information to the FBI. As amatter of FBI policy, when there is a danger of death or serious bodily injury that does
not permit the proper processing of an NSL, if approved by an ASAC, a letter to theprovider citing 18 U.S.C. § 2702 may be used to request emergency disclosure. If time
does not permit the issuance of an emergency letter citing 18 U.S.C. § 2702, an.oral
request to.the provider may be made, but the oral request must be followed-up with aletter as described herein.
(U//FOUO)
b2
b7E

162
UNCLASSIFIED-FOR OFFICIAL USE ONLYUNCLASSIFIED - FOR OFFICIAL USE ONLY
Domestic Investigations and Operations Guideb2
b7E(U//FOUO)rb2
b7E(U//FOUO
b2

b7E

F. (U//FOUO) Notice and Reporting Requirements-(U//FOUO) The National Security Law Branch at FBIHQ is required to report information
about NSL usage to Congress. The data necessary for Congressional reporting is-automatically recorded if the NSL is created in the NSL Subsyste.m (FISAMS). If the NSL iscreated outside the system, the EC must include all information necessary for NSLB
accurately to report NSL statistics. The EC must break down the number of targeted phone
numbers/e-mail accounts/financial accounts that are addressed toeach and every NSL
recipient. Therefore, if there are three targets, ten accounts, and six recipients of an NSL, theEC must state how many accounts are the subject of the NSL as to Recipient 1, Recipient 2,
etc. It is not sufficient to only indicate that there are ten accounts and six recipients.
(U//FOUO) In addition, the FBI must report the United States person status of the subjec of
all NSL requests (as opposed to the target of the investigation to which the NSL is relevant),
other than those seeking subscriber information. While the subject is often the target oftheihvestigation, that is not always the case. The EC must reflect the Uniited States person status,of the subject of the request - the person whose information the FBI is seeking. If the NSL.isseeking information about more than one person, the EC must reflect the United States
person status of each of those persons. (See the form ECs, which make clear that the UnitedStates person status applies to the target of the request for information.)(U//FOUO) Finally, to ensure accurate reporting, the EC must accurately state the type of
information that is.being sought. NSLs for toll billing records or transactional records will
include subscriber information. The EC need only state that the request is for toll billing records or.transactional records, and the reporting paragraph should state that toll billing ortransactional records are being sought for x number of accounts, and, if multiple recipients,
froineach of recipients #1, #2, etc.
G. (U//FOUO) Receipt of NSL Information(U//FOUO
b2

b7E

163
UNCLASSIFIED-FOR OFFICIAL USE ONLYUNCLASSIFIED - FOR OFFICIAL USE ONLY
Domestic Investigations and Operations Guideb2
b7E(U//FOUO
b2

b7E(U//FoQu)

"

b2
b7E

(U//FOUO)
b2
b7E

H. (U//FOUO) Dissemination of NSL material(U//FOUO) Subject to certain statutory limitations, information obtained through the use of
an NSL may be disseminated according to general dissemination standards in the AGG-Dom.
ECPA (telephone and electronic communications records) and theRFPA (financial records)
permit dissemination if consistent with the AGG-Dom and if the information is clearly
relevant to the responsibilities of the recipient agency. FCRA, 15 U.S.C. § 1681u, permits
dissemination to other federal agencies as may be necessary for the approval or conduct of aforeign counterintelligence investigation. FCRA imposes no special rules for disseminationof full credit reports.
(U//FOUO)l
the NSLs themselves are not classified nor isthe material received in return.i

b2
b7E

164
TINrT.ARTR~'lni'trtTrr'TATrTTrir r

kTir'UNCLASSIFIED - FOR OFFICIAL USE ONLY
Domestic Investigations and Operations Guideb2

I. (U) Payment for NSL-Derived Information(U//FOUO) Because there is no legal obligation.for the FBI to compensate
recipients of
NSLs issued pursuant to ECPA, 18 U.S.C. § 2709 (toll billing records
information,
subscriber, electronic communication transactional records) or FCRA,
15 U.S.C.§ 1681v,(full credit reports in international terrorism cases), there should not be
payment inconnection with those NSLs. See EC, 319X-HO-A 1487720-OGC.
serial 222 fora form
letter to be sent in response to demands for payment for these types
of NSLs.
.(U) Compensation is legally required for NSLs served to obtain financial
pursuant to RFPA, 12 U.S.C. § 3414(a)(5), and credit information pursuantinformation
to FCRA, 15
U.S.C. § 1681u. Under 12 C.F.R. § 219.3, Appendix A, a feeschedule has been adopted
under which photocopying is reimbursable at $.25 per page andsearching is reimbursable at$11 per hour for clerical staff. Regulations governing a payment schedule
for FCRA, 15
U.S.C. § 1681u, NSLs has not been promulgated.
11.9.4. (U) Business Record Under FISA
A. (U) Legal Authority(U) 50 U.S.C. §§ 1861-63
B. (U) Definition of Method(U) A FISA order for business records is an order for a third party to
produce documents,
records and other tangible information relevant to a predicated national
security investigation.
FISA Business Record Orders may not be used to obtain information
during a positive
foreign intelligence case if the material sought relates to a UnitedStates person. There is no"FISA-derived" impediment to the use of documents obtained pursuantto
such orders.
C. (U/FOUO) Approval Requirements

b2

b7E

D. (U) Duration of Approval(U) Duration is established by the court order.
'E. (U) Ndtice and Reporting Requirements(U) There are.no special notice or reporting requirements.

165
UNCLASSIFIED-FOR OFFICIAL USE ONLYUNCLASSIFIED - FOR OFFICIAL USE ONLY
Domestic Investigations and Operations Guide
F. (U) Compliance Requirements(U) The case agent who receives production of documents pursuant
to a FISA business records-order must do the following:
1. (U//FOUO) Handle the production as required by the Standard
Minimization
Procedures Adopted for Business Record Orders
2. (U) Whether or not required by paragraph 1, prior to uploading the documents or data
received into FBI databases, review the documents produced
to determine whether they
are responsive to the order.
a. (U//FOUO) If the producing party has mistakenly provided
material that is
entirely non-responsive,(e.g., the producing party inverted
numbers on an accountand produced entirely irrelevant and non-responsive material),
the case agent
must sequester the material and discuss with the CDC or NSLB
the appropriate
way to return the unresponsiv, material to the producing
party and obtain the
responsive material.
b. (U//FOUO) If the producing party has produced responsive
material andmaterial that is beyond the parameters of the order issued
by the FISC (e.g., the
FISC ordered production of one month's records and theparty-produced records
for 6 weeks), the case agent must determine whether thematerial produced that is
outside the parameters of the FISC order is subject to statutory
protection (e.g.,recordsthat are subject to the Right to Financial Privacy
Act, the Buckley
Amendments, the Electronic Communications Privacy
Act; Fair Credit ReportingAct).
i. (U//FOUO) If the overproduced material is subject tostatutory
protection, then the overproduced material must be treatedlikeoverproduction is treated in the context of a national security
letter.
ii. (U//FOUO) If the overproduced material is not subject-to
statutory
protection, then it may be uploaded. In determining
whether to upload the-overproduced material, the case agent should consider
the extent to which
the overproduction includes non-public.informatiori regarding
UnitedStates persons who are not the subject of a national, security
investigation;
the sensitivity of the information contained within the overproduction;andthe burdensomeness of separating the overproduced material
from theresponsive material.

166
UNCLASSIFIED-FOR OFFICIAL USE ONLYb2
b7E

UNCLASSIFIED -FOR OFFICIAL USE ONLY
Domestic Investigations and Operations Guide
11.10. (U) Investigative Method: Accessing stored wireand electronic communications andtransactional records in conformity with chapter
121 of title 18, United States Code11.10.1. (U) Summary(U//FOUO) FBI employees may acquire the contents ofstored wire or electronic
communications and associated transactional records-including
basic subscriber informationas.provided in 18 U.S.C. §§ 2701-2712. Requests for Voluntary
disclosure under the,emergency
authority of 18 U.S.C. § 2702 require prior approval from the Field Office ASAC or FBIHQ
Section Chief when appropriate.
(U//FOUO) Application: This investigative method may
be used during national security
investigations and criminal investigations as authorized
by statute. This method may not be used
for assistance-to otheragencies, unless relevant to an alreadyopen predicated investigation. Thismethod cannot be used to collect positive foreign intelligence.
Additionally, this method cannot
be used during an assessment.
A. (U) Stored Data: The Electronic Communications
Privacy Act (ECPA)-18 U.S.C.
§§ 2 7 0 1-2 7 12-governs the disclosure of two broad categories
of information: (i) the
contents of wire orelectronic comtmunications held in"electronicstorage" by providers ofelectronic communication service" or contents
held by those who provide "remotecomputing service" to the public; and (ii) records orother information pertaining to a
subscriber to or customer of such services. The categoryof "records or other information"
can be subdivided further into subscriber records (listed
in 18 U.S.C. § 2703[c][2]) andstored traffic data or other records.
(U) Records covered by ECPA include all records thatare related to the subscriber, including
buddy lists, "friend" lists (MySpace), and virtual property
owned (Second Life). These othersortsof records are not subscriber records and cannot
be obtained by a.subpoena under 18
2
U.S.C. § 703(c)(2) or an NSL under 18 U.S.C. § 2709.
B. (U) Legal Process: The legal process for obtaining
disclosure will vary depending on thetypeof information sought and whether the information
is being voluntarily provided under
18 U.S.C. § 2702 (e.g., with consent or when emergency
circumstances require disclosure) or
the provider is being compelled to provide the information under 18 U.S.C. § 2703, as'outlined below.
C. (U) Contents held in "electronic storage" bya provider of"electronic communication
service" for 180 days or less can only. be obtainedwith a search warrant based on probablecause. Accordingly, such records may only be obtained
during a full investigation.
(U) Contents held by those who provide "remote computing
service" to the public andcontents held in "electronic storage" for more than
180 days by an "electronic:
communication service" provider can be obtained with:a warrant;,a subpoena; or an orderissued by a court under 18 U.S.C. § 2703(d) whenprior notice has been provided to thecustomer or subscriber (unless the court has authorized delayed
notice).
(U) Title 18 United States Code Sectioh 2705 establishes
the standard to delay notice for an
initial period of up to 90 days. Records or other information
pertaining to a subscriber to or

167
UNCLASSIFIED-FOR OFFICIAL USE ONLYUNCLASSIFIED - FOR OFFICIAL USE ONLY
Domestic Investigations and Operations Guide
customer of such services, including basic subscriber information
can be obtained with asearch warrant or an 18 U.S.C. § 2703(d) order without
notice.
D. (U) Basic subscriber information, as described in 18 U.S.C. 2§ 703(c)(2), can be compelled
by a grand ury or administrative subpoena without notice.
E. (U) Preservation of Stored Data: The government is authorizedunder 18 U.S.C. § 2703(f)to direct a provider to preserve records orother informatioh(stored records orcommunications) in its possession for. 90 days (which may be
extended for an additional 90days) ending issuance of applicable legal process for disclosure.
To make a preservation
request, the FBI must believe that the records will subsequently
be sought by appropriate
legal process.
F. (U) Cost reimbursement: Title 18 United States
Code Section 2706 requires thegovernment to reimburse for costs incurred in providing thecontents of communications,records, or other information obtained under 18 U.S.C. §§ 2702,
2703, or 2704, except thatreimbursement is not required for records or other information maintainedby acommunications common carrier that relate to telephone tollrecords and telephone listings
obtained under 18 U.S.C. §.2703. In essence, the government
does not have to reimburse forthe cost of producing records that the provider maintains in the ordinary course of its
business..
11.10.2.

(U) Legal Authority(U) 18 U.S.C..§§ 2701-2712
S(U) AGG-Dom, Part V.9(U) ECPA-18 U.S.C. §§ 2701-2712- creates statutory
privacy rights for the contents ofcommunications in "electronic.storage" and records or other information
ertaining to a
subscriber to or customerof an "electronic communication service"and"remote computing
service." The statutory protections protect the privacy of an individual's aelectronic
data
contained in a networked account-that may otherwise
falloutsidethe scope of the protections
afforded by the Fourth Amendment--when suchaccount or its service is ownedor
managed by athird-party provider.
(U) ECPA generally: (i) prohibits access to the contents ofwire or electronic communications
while in "electronic storage" unless authorized (18
U.S.C. § 2701); (ii) prohibits a provider ofservice to the public from disclosing the contentsof wire or-electronic communications while-held in "electronic storage," and divulging to the government
subscriber to or customer of such service unless authorized any information pertaining to a
(18 U.S.C.. § 2702); and (iii)
authorizes thegoyernment to compel disclosure
fromaproviderof stored contents of a wire orelectronic- communication and records or other information
pertaining to a subscriber to or
customer (18 U.S.C. 2703). ECPA provides
for reimbursement of costs incurred inproviding.
the information acquired.
11.10.3. (U) Definition of Investigative Method
A. .(U) Definitions:(U) Electronic Storage: is "any temporary,rintermediate
communication incidental to the electronic transmission storage of a wire or electronic
thereof," or "any storage of such
communication by an electronic cofimunication service
for purposes of backup protection
168
UNCLASSIFIED-FOR OFFICIAL USE ONLYof

UNCLASSIFIED - FOR OFFICIAL USE ONLY
Domestic.Investigations and Operations Guide
such communication." 18 U.S.C. § 2510(17). In short, "electronicstorage" refers only totemporary storage, made in the course of transmission, by a providerof an electronic
communication service.
(U) Remote Computing Service (RCS): is the "provision to the
public of computer storage
or processing services by means of an electronic communications system."
18 U.S.C.
§ 2711(2). In essence, a remote computing service is an off-sitecomputer that stores orprocesses data-for a customer.
(U) Electronic Communications System: is "any wire,or photoelectronic facilities for the transmission of wire radio, electromagnetic; photoopticalor electronic. communications, andany computer facilities or related electronic equipment for theelectronic storage of such
communications." 18 U.SC. § 2510(14).
(U) Electronic Communication Service (ECS): is "anyservice that provides to users
thereof the ability to send or receive wife or electronic communications."
18 U.S.C.
§ 2510(15). For example, telephone companies and electronic
mailcompanies
generally act
as providers of electronic communication services.
(U) ECPA authorities can be divided into two categories: (i)compelled disclosure-legal
process to compel providers to disclose the contents of.stored wire r.electtonici
communications (including e-mail and voice mail--opened
and unopened) and otherinformation such as account-records and basic. subscriber
information; and (ii) voluntary
disclosure of such informatin from service providers
Each of these authorities is discussed
below.
B. (U) Compelled Disclosure:
1. (U) Title, 18 United States Code Section 2703 lists
five types of legal process that the
government can use to compel a provider to disclose
certain kinds of information. The
five mechanisms, in descending order of required thresholdshowing are as f6llows:* (U) Search warrant;* (U) 18 U.S.C. § 2703(d) court order withprior notice to the subscriber or customer;* (U) 18 U.S.C. § 2703(d) court order without priornotice to the subscriber orcustomer;* (U) Subpoena with prior notice to the subscriber
or customer;and* (U) Subpoena without prior notice to the subscriber
or customer,

b2
b7E

169
UNCLASSIFIED-FOR OFFICIAL USE ONLYUNCLASSIFIED - FOR OFFICIAL USE ONLY
Domestic Investigations and Operations Guideb2
b7E

2. (U//FOUO) Notice--Orders Not to Disclose the Existenceof a Warrant, Subpoena,
or Court Order: FBI employees may obtain a court orderdirecting network service
providers not to disclose the existence of compelled process
if the government has nolegal duty to notify the customer or subscriber'ofthe process.
If af 18 U.S.C. § 2703(d)order or 18 U.S.C. § 2 703(a) warrant is being used, a request fora non-disclosure ordercan be included in the application and proposed order or warrant.
Ifa subpoena is being
used to obtain the information, a separate application to a
court for a non-disclosure
order must be made.
3. (U) Legal Standard: A court may order an electronic
communications service provider
or remote computing service not to disclose the existenceof-a warrant, subpoena, or
court order for such period as the court deems appropriate.
The court
an order if it determines that there is reason to believe that notificationmust enter suchof the existenceof the warrant, subpoena, or court order will result in:* (U) Endangering the life or physical safety ofanindividual;* (U) Flight from prosecution;* (U) Destruction of or tampering with evidence;* (U) Intimidation of potential witnesses; or* (U)'Otherwise seriously jeopardizing an, investigation or unduly
delaying a trial. 18
U.S.C. § 2705(b).
4. (U) Search Warrant: Investigators can obtain the full contents
of a network accountwith a search warrant. ECPA does not require the government to notify
the customer orsubscriber when it obtains information from a provider using
a search warrant.
Warrants issued under 18 U.S.C. § 2703 must comply
with either FRCP Rule 41 or anequivalent state warrant. However, all warrants issued
pursuant to 18 U.S.C. § 2703 do
not require personal service; those warrants issued byafederal-court have nationwide
jurisdiction (see below); and the warrants may only be servedon an electronic
communication service or a remote computing service. FRCP
Rule 41 also poses the
additional requirement on these warrants that a
copy of the warrant be left with theprovider, and a return and inventory be made.
(U) Under 18 U.S.C. § 2 703(a), with a search warrant issued
on probable cause
pursuant to FRCP Rule 41 or an equivalent state warrant, the based
government may obtain:a. (U) "The contents ofa wire or electronic communication,that is in electronicstorageinanelectronic
communications
systemfor one hundred and eighty daysor less," andb. (U)Everything that can be obtained using a 18 U.S.C.
§ 2703(d) court order with
notice.
(U) In other words, every record and all of the stored contentsofopened and unopened e-mail/voice mail- can be compelled by an account--including
a search warrant basedon probable cause pursuant to FRCP Rule 41. Moreover,because the warrant is issued
170
UNCLASSIFIED-FOR OFFICIAL USE ONLYUNCLASSIFIED - FOR OFFICIAL USE ONLY
Domestic Investigations and Operations Guide
by a neutral magistrate based on probable cause, obtaining a search warrant effectively
insulates the process from'challenge under the Fourth Amendment.
(U) Nationwide.Scope: Search warrants under 18 U.S.C. § 2703(a) may be issued by afederal "court with jurisdiction over the offense under.investigation," and maybe
executed outside the district of the issuing court for niaterial responsive.to the warrant.
State courts may also issue warrants under 18 U.S.C. § 2703(a), but the statute does notgive these warrants effect outside the issuing court's territorial jurisdiction. As with atypical FRCP Rule 41 warrant, investigators must draft an affidavit and a proposed
warrant that complies with FRCP Rule 41.
(U) Service of Process: Title 18 United States Code Section 2703(a) search warrants
are obtained just like any other FRCP Rule 41 search warrant but are typically servedon the provider and compel the provider to find and produce the information describedin the warrant. ECPA expressly states that the presence of an officer is not required forservice or execution of a search warrant issued pursuant to 18 U.S.C. § 2703(a).
5. (U) Court Order with Prior Notice to the Subscriber or Customer: Investigators
can obtain everything in a network account except for unopered e-mail or voice-mailstored with a provider for 180 days or less using a 18 U.S.C. § 2703(d) court order withprior notice to the subscriber unless they have obtained authority for delayed noticepursuant to 18 U:S.C. § 2705. ECPA distinguishes between the contents ofcommunications that are in "Electronic storage" (e.g., unopened e-mail) for less than
180 days, and those that-have been in "Electronic storage" for longer or that are nolonger in "Electronic storage" (e.g., opened e-mail).
(U) FBI.employees who.obtain a court order under 18 U.S.C. § 2703(d),and either giveprior notice to the subscriber or comply with the delayed notice provisions of 18 U.S.C.
§ 2705(a), may obtain:a. (U) "The contents of a wire or electronic communication that has been inelectronic storage in an electronic communications system for more than one
hundred ard eighty days." 18 U.S.C. § 2703(a).
b. (U) "The contents of any wire or electronic communication" held by a provider ofremote computing.service "on behalf of... a subscriber or customer of such
remote computing service," 18U.S.C. §§ 2703(b)(1)(B)(ii), 2703 (b)(2); andc. (U) everything that can be obtained using a 18 U.S.C. § 2703(d) court orderwithout notice.
b2

b7E

b2

b7E

171
UNCLASSIFIED-FOR OFFICIAL USE ONLYUNCLASSIFIED - FOR OFFICIAL USE ONLY
Domestic Investigations and Operations Guideb2
b7E(U) Legal Standard: To order delayed notice, the court must find that "there is reason
to believe that notification of the existence of the court order may. . endanger[] thelife or physical safety of an individual; [lead to] flight from prosecution; [lead to]destruction of or tampering with evidence; [lead to] intimidation of potential witnesses;
or... otherwise seriously jeopardiz[e] an investigation or unduly delay[] ati'ial." 18
U.S.C. §§ 2705(a)(1)(A) and 2705(a)(2). The applicant must satisfy this standard anew
each time an extension of the delayed notice is sought.
(U) Nationwide Scope: Federal court orders under 18 U.S.C. § 2703(d) have effectoutside the district of the issuing court. Title 18 United States Code Section 2703(d)orders may compel providers to disclose information even if the information is stored
outside.the district of the issuing court. See 18 U.S.C. § 2703(d) ("any court that.is acourt of competent jurisdiction" may issue a 18 U.S.C. § 2703[d] order); 18 U.S.C.
§ 2711(3) (court of competentjurisdiction-includes any federal court having jurisdiction
over the offense being investigated without geographic limitation).
(U) Title 18 United States Code Section 2703(d) orders may also be issued by state
courts. See 18 U.S.C. §§ 2711(3), 3127(2)(B). Title 18 United States Code Section
2703(d) orders issued by state courts, however, do not have effect outside thejurisdiction of the issuing state. See 18 U.S.C. §§ 2711(3).
6. (U) Court Order without Prior Notice to the Subscriber or Customer: FBI
employees need an 18 U.S.C. § 2703(d) courtorder to obtain most account logs andmost transactional records.
(U) A court order under 18 U.S.C. § 2703(d) may compel disclosure of:a. (U) All "record(s) or other information pertaining to a subscriber to or customerof such service (not including the contents of communications [held by providersof electronic communications service and remote computing service])," andb. (U) Basic subscriber information that can be obtained using a subpoena without
notice. 18 U.S.C. § 2703(c)(1);(U) Types of Transactional Records: The broad category of transactional records
includes all records held by a service provider that pertain to the subscriber beyond thespecific records listed in 2703(c)()

b7E(U//FOUO)
b2b7E

c. .(U) Cell site.and Sector information: Cell site and sector information isconsidered "a record or other information pertaining to a subscriber" andtherefore, production of historical and prospective cell site and sector information
may be compelled by a court order under 18 U.S.C. § 2703(d). Requests madepursuant.to 18 U.S.C. § 2703(d)'for disclosure of prospective cell site and sector
172
UNCLASSIFIED-FOR OFFICIAL USE ONLYUNCLASSIFIED - FOR OFFICIAL USE ONLY
Domestic Investigations and Operations Guide
information-which is delivered to law enforcement under Communications
Assistance for Law Enforcement Act (CALEA) at the beginning and end ofcalls- must be combined with an application for pen register/trap and trace
device. Some judicial districts will require a showing of probable cause before
authorizing the disclosure of prospective cell site and sector information.
d.

b2
b7E

(U//FOUOI
b2
b7E

(U
b2
b7E

(U
b2
b7E

TITNCT.Aq.QTTinT173
1D AVwTnT

AT TTtrfhnrr ET

UNCLASSIFIED - FOR OFFICIAL USE ONLY
Domestic Investigations and Operations Guide(U) Legal Standard: A court order under 18 U.S.C. § 2703(d) is known as an"articulable facts" court order or simply a "d" order. "This section imposes anintermediate standard to protect on-line transactional records. It is a standard higher
than a subpoena, but not a probable cause warrant. The intent of raising the standard foraccess to transactional datais to guard against "fishing expeditions" by law
enforcement." (See H.R. Rep. No. 102-827, at 31 (1994), reprinted in 1994
U.S.C.C.A.N. 3489.)(U) The FBI must state sufficient specific and articulable facts for the court to find that
there are reasonable grounds to believe that the contents of a wire or electronic
communication, or the records or other information sought, are relevant and material toan ongoing criminal investigationi

.'

'

b2
b7E

7. (U) Subpoena with Prior Notice to the Subscriber or Customer: Investigators can
subpoena,opened e-mail from a provider if they either give prior notice to thesubscriber or comply with the delayed notice provisions of 18 U.S.C. § 2705(a)--which
requires a written certification by the SAC or ASAC.tharthere is reason to believe that
notification ofthe existence of the subpoena may have an adverse result.
(U) FBI employees who obtain a subpoena and either give prior notice to the subscriber
or comply with the delayed notice provisions of 18 U.S.C. § 2705(a), may obtain:a. (U) "The contents of any wire or electronic communication" held by a provider ofremote computing service'"on behalf of... a subscriber or'customer of such
remote computing service." 18 U.S.C. §.2703(b)(1)(B)(i), § 2703(b)(2);b. (U) "The contents of a wire or electronic communication that has been inelectronic storage in an electronic communications system for more than one
hundred and eighty days." 18 U.S.C. § 2703(a); andc. (U) Basic subscriber information listed, in 18 U.S.C. § 2703(c)(2).

(U)l

.

[

b2
b7E

(U) Notice:jb2
b7E(U) Legal standards for delaying notice. The supervisory official must certify inwriting that "there. is reason to believe that notification of the existence of the court
order may ... endanger[] the life or physical safety of an individual; [lead to] flight174

UNCLASSIFIED-FOR OFFICIAL USE ONLYUNCLASSIFIED - FOR OFFICIAL USE ONLY
Domestic Investigations and Operations Guide
from prosecution; [lead to] destruction of or tampering with evidence; [lead to]
intimidation of potential witnesses; or... otherwise seriously jeopardiz[e] an
investigation or unduly delay[] a trial." 18 U.S.C. §§ 2705(a)(l)(A), 2705(a)(2).
Importantly, this standard must be satisfied anew every time an extension of thedelayed notice is sought.
8. (U) Subpoena without Prior Notice to the Subscriber or Customer: Investigators
can subpoena basic subscriber information listed in 18 U.S.C. §'2703(c)(2).
(U) The government may use an administrative subpoena authorized by a federal orstate statute or a federal or state grand jury or trial subpoena to compel a provider todisclose basic subscriber information listed in 18 U.S.C. § 2703(c)(2): "name; address;
local and long distance telephone connection records, or records of session times anddurations; length of service (including start date),and types of service used; telephoneor instrument number or other subscriber number or identity, including any temporarily
assigned network address; and means and source of payment for such service(including any credit card'or bank account number)[.]"b2
b7E

See PATRIOT Act § 210, 1.15 Stat. 272, 283 (2001).
(U) Legal Standard: The legal threshold for issuing a subpoena is low. In UnitedStates v. Morton Salt Co., 338 U.S. 632, 6 4 2 - 4 3 (19 50 ), the Court articulated thedeferential standard for judicial review of administrative enforcement actions is a fourfactor evaluation of "good faith" issuance requiring that: (i) the investigation isconducted pursuant to a legitimate purpose; (ii) the information requested under the
subpoena is relevant to that purpose; (iii) the agency does not already have theinformation it is seeking with.the subpoena; and (iv) the agency has followed thenecessary administrative steps in issuing the subpoena.
(U//FOUO) In the event that a federal grand jury subpoena is used, however,appropriate protections against.disclosure must be followed in compliance with FRCP
Rule 6(e).j

b2

b2
b7E

Where thetelephone billingrecords being sought are those of a member o the news media,
approval of the Attorney General is required. (See DIOG Section 11.9.1.E)

175
UNCLASSIFIED-FOR OFFICIAL USE ONLYUNCLASSIFIED - FOR OFFICIAL USE ONLY
Domestic Investigations and Operations Guide
C. (U) Voluntary Disclosure

b2

b7E

1. (U) Service NOT Available to the Public: Providers of services not available "to the
public" are not prohibited from disclosure under ECPA, and so the provider may freely
disclose both contents and other records relating to stored cominiuhications. Andersen
Consulting v. UOP, 991 F. Supp. 1041 (N.D. I11.1998) (giving hired consulting firm
employees access to UOP's e-mail system is hot equivalent to providing e-mail to the
public). Only providers of services to the public are prohibited from disclosing storedcontents and records, unless statutorily authorized.
2. (U) Services That ARE Available to the Public: If the services offered by theprovider are available to the public, then ECPA precludes both the disclosure ofcontents to any third party, including the government, and the disclosure of otherrecords to any governmental entity unless a statutory exception applies. The statutory
exceptions permit disclosure by a provider to the public, in essence when the needs ofpublic safety and service providers outweigh privacy interests.
(U) If the provider is authorized to disclose the information to the government under 18
U.S.C. § 2702 and is willing to do so voluntarily, law enforcement does not need toobtain a legal order to compel the disclosure.
(U) If a provider voluntarily discloses under the statute, there is-no follow-up legal
process required or available. If the provider, on the other hand, either may not or will
not disclose the information, FBI employees must rely on compelled disclosure
provisions and obtain the appropriate legal orders.
i.

(U) Voluntary disclosure of Stored Contents(U) ECPA authorizes the voluntary disclosure of stored contents when:(a) (U) The disclosure is with the consent (express or implied) of the originator,
addressee, intended recipient, or the subscriber in the case of opened e-mail,18 U.S.C. § 2702(b)(3);(b) (U) The disclosure "may be necessarily incident to the rendition of the service
or to the protection of the rights or property of the provider of that service," .18
U.S.C. § 2702(b)(5);(c) (U) The provider "in good faith, believes that an emergency involving dangerof death or serious physical injury to any person requires disclosure without
delay of information relating to the emergency," 18 U.S.C. § 2702(b)(8);(d) (U) To the National Center foi Missing and Exploited Children, in connection
with a report submitted thereto under Section 227 of the Victims of Child
Abuse Act of 1990. (42 U.S.C. § 13032 and 18 U.S.C. § 2702[b][6]); or(e) (U) The contents are inadvertently obtained by the service provider andappear to pertain to the commission of a crime. Such disclosures can only bemade to a law enforcement agency. 18 U.S.C. § 2702(b)(7)176
UNCLASSIFIED-FOR OFFICIAL USE ONLYUNCLASSIFIED - FOR OFFICIAL USE ONLY
Domestic Investigations and Operations Guideii.

(U) Voluntary disclosure of Non-content Customer Records(U) ECPA provides for the voluntary disclosure of non-content customer
records by a provider to a governmental entity when:S(a) (U) The disclosureis with the consent (express or implied) of the customer orsubscriber or 18 U.S.C; § 2702(c)(2);(b) (U) The disclosure "may be necessarily incident to the rendition of the service
or to the protection of the rights or property of the provider of that service," 18
U.S.C. § 2702(c)(3);(c) (U) The provider "in good faith, believes that an emergency involving dangerof death or serious physical injury to any person requires disclosure without
delay of information relating to the emergency," 18 U.S.C. § 2702(c)(4); or(U//FOUO) Note: an emergency disclosure under this statutory exception isjustified when the circumstances demand immediate action on the part of thegovernment to prevent death or serious bodily injury, and does not depend on
the immediacy of the risk of danger itself. For example, an e-mail that
discusses a planned terrorist attack but ndotthe timing for the attack would
constitute an emergency that threatens life or limb, even though'the timing of
the attack is unknown. It is the need for immediate action to prevent theserious harm threatened.bythese circumstances rather than the immediacy of
the threat itself that is the reason Congress authorized voluntary disclosures
under this exception. H.Rpt. No. 107-497 p 13-14 (June' 11, 2002)
accompanying H.R. 3482, The Cyber Security Erhancement Act of 2002,
which passed as part of the comprehensive Homeland Security Act, See P.L.
107-296 § 225.

(d) (U) To the National Center for Missing and Exploited Children, in connection
with a report submitted thereto under Section 227 of the Victims of Child
Abuse Act of 1990. (42 U.S.C. § 13032 and 18 U.S.C. § 2702[c][5])iii. (U) Preservation of Evidence under 18 U.S.C. § 2703(f):

b2
.b7E

(U) A governmental entity is authorized to direct providers to preserve stored
records-and communications pursuant to 18 U.S.C. § 2703(f).[b2
b7E

Once a preservatibn request is made, ECPA

requires that the provider must retain the records for 90 days, renewable foranother 90-day period upon a government request. See 18 U.S.C. § 2703 (f)(2).
(U) Specifically, 18 U.S.C. § 2703(f)(1) states:(a) (U) A provider of wire or electronic communication service or a remotecomputing service, upon the request of a governmental entity, must take all
177
UNCLASSIFIED-FOR OFFICIAL USE ONLYUNCLASSIFIED - FOR:OFFICIAL USE-ONLY

Domestic Investigations and Operations Guide
necessary steps to preserve records arid other evidence in its possession
pending the issuance of a court order or other process.
(b) (U) There is no legally prescribed format for 18 U.S.C. § 2703(f) requests.

b7E(U) FBI'employees who.send 18 U.S.C. § 2703(f) letters to network service
providers should be aware of two limitations. First, the authority to direct
providers to preserve records and other evidence is not prospective. That is, 18
U.S.C. § 2703(f) letters can order a provider to preserve records that havealready been created but cannot order providers to preserve records not yet
made. If FBI employees want providers to record information about future
electronic communications, they must comply with the electronic surveillance
statutes. A second limitation of 18 U.S.C. § 2703(f) is that some providers
may be unable to comply effectively with 18 U.S.C. § 2703(0 requests
b2
b7E

iv.

(U) Video Tape Rental or Sales Records(U) Title 1.8 United States Code Section 2710 makes.the unauthorized
disclosure of records by any person engaged in the rental, sale, or delivery of
prerecorded video cassette tapes or similar audiovisual materials unlawful andprovides an exclusionary rule to prohibit personally identifiable.information
otherwise obtained from being admissible as evidence in any court proceeding.
Personally identifiable.information is defined as "information that identifies a
person as having requested or obtained specific video material or services ....
(a) (U) The disclosure to law enforcement of "personally identifiable
information" is permitted only whenthe law enforcement agency:(1) (U) Has the written consent of the customer;(2) (U) Obtains a warrant issued underthe FRCP or equivalent state warrant;or(3) (U) A grand jury subpoena;
b2

(b

b7E

(U):This type of information was specifically not included in the definition of"personally identifiable information" to allow law enforcement to obtain
information about individuals during routine investigations such asneighborhood investigations.
178
UNCLASSIFIED-FOR OFFICIAL USE ONLYUNCLASSIFIED - FOR OFFICIAL USE ONLY
Domestic Investigations and Operations Guide(U//FOUO) The disclosure of "personally identifiable information" in anational security case may be compelled through use of the above legal
processes or pursuant to a business records order issued under 50 U.S.C.

§1861.
11.10.4. (U) Approval Requirements for Investigative Method
A. (U) Voluntary Emergency Disclosure(U//FOUO) ECPA protects subscriber and transactional information regarding
communications from disclosure by providers of telephone or other electronic
communication services. Generally, an NSL, grand jury subpoena, or other form of legal
process must be used to compel the communication service provider to disclose suchinformation.[b2

b7E(U//FOUOf
b2
b7E(U//FOUO)
b2
b7E(U//FOUO)
b2
b7E

11.10.5.

(U) Duration of Approval(U) As authorized by statute (e.g., for as long as the emergency necessitating usage exists andonly in those circumstances when it is impracticable to obtain legal process) and applicable court
order or warrant.
11.10.6.

(U//FOUO) SpecificProcedures
A. (U//FOUO) Filing requirements:]

179
UNCLASSIFIED-FOR OFFICIAL USE ONLY

b2
b7.E

UNCLASSIFIED - FOR OFFICIAL USE ONLY
Domestic Investigations and Operations Guideb2
b7E

B (U//FOUO) Contact with Providers:b2b7E

C. (U) Cost Reimbursement:(U) Policy and procedures regarding cost reimbursement are de'scribed in the following:(U) Consistent payment proceduresb
b7E(U) 5/25/2005 Cost Reimbursement Guidance (18 U.S.C. § 2706 - ECPA)
11.10.7. (U) Notice and Reporting Requirements
A. (U) Voluntary disclosures: Title 18 United States Code Section 2702(d) requires the
Attorney General to report annually to Congress information petaining to the receipt ofvoluntary disclosures of the contents of stored wire or electronic communications in an
emergency under 18 U.S.C. § 2702(b)(8), specifically:
1. (U) The number of accounts from which DOJ received voluntary disclosures undersubsection (b)(8); and2. (U) Summary of the basis for disclosure in those instances where the investigation
pertaining to those disclosures was closed without the filing of criminal charges.
B. (U)-Roles/Responsibilities: OGC/ILB is assigned the administrative responsibility to, by
December 31' of each year:
1'. (U) Tabulate the number of voluntary disclosures of stored contents received under theauthority of 18 U.S.C. § 2702(b)(8) for the calendar year;
2. (U) Prepare the report summarizing the basis for disclosure in those instances where theinvestigation pertaining to those disclosures was closed without the filing of criminal
charges; and3. (U) Submit the report to OGC for reviewand submission to DOJ according to thestatutory requirement for annual report by the Attorney General.
11.10.8. (U) Other Applicable Policies

b2
b7E

180

UNCLASSIFIED-FOR OFFICIAL USE ONLYUNCLASSIFIED - FOR OFFICIAL USE ONLY
Domestic Investigations and Operations Guide
11.11. (U) Investigative Method: Pen Registers and Trap
and Trace devices in conformity
with chapter 266 of Title 18, United States Code, and theForeign Intelligence
Surveillance Act
11.11.1. (U) Summary(U) Pen register and trap and trace (PR/TT) devices enable
the Prospective collection of noncontent traffic information associated with wire and electronic
communications, such as: thephone numbers dialed from or to a particular telephone, including.electronic
communications;messages sent from or to a particular telephone; or the Internet
provider (IP) address ofcommunications on the Internet and other computer networks.
(U//FOUO) Application: The PR/TT may be used in preliminary
and full national security andcriminal investigations. This method may not-be used for:(i) targeting a United States person
when providing assistance to other agencies, unlessis already an open FBI preliminary or
full investigation related to the request for assistancethereor the predicate exists to open a preliminary
or full investigation; (ii) targeting a United States person
when collecting against a foreign
intelligence requirement; or (iii) during an assessment.
11.11.2. (U) Legal Authority(U) 18 U.S.C. §§ 3 121 et seq. and 50 U.S.C. §§ 1842 etseq.
regulate the use of PR/TT devices.
PR/TT orders can collect IP addresses, port numbers andthe "To" and "From" information frome-mail; they cannot intercept the content of a communication,such.as words in the "siubject line"or the body of an e-mail.
11.11.3.

(U) Definition of Investigative Method(U) A pen register device records or decodes dialing, routiig
addressing or signaling informationtransmitted by an instrument or facility from which
a wire or electronic communication istransmitted, provided that such information must not include
the contents of any communication.
18 U.S.C. § 3127(3).
(U) A trap and trace device captures the incoming electronicor other impulses that identify theoriginating number or other dialing, routing, addressing
or signaling
likely to identify the source of a wire or electronic communication, information reasonably
information does not include the contents of any communication. provided that such
18 U.S.C. § 3127(4).
11.11.4. (U)Standards for Use and Approval Requirements
for Investigative Method
A. (U) Pen Register/Trap and Trace under FISA: Applications
for authority to use a PR/TT
device can be made to the FISC in national security investigations.
1. (U) Legal Standard: Applications to the FISC are
to be under oath and must include:a. (U) The identity of the federal officer making theapplication; andb. (U) A certification by the applicant that the information
likely to be obtained isforeign intelligence information not concerning a UnitedStates person or, if
concerning a United States person, is information thatis relevant to an ongoinginvestigation to protect the United States against international terrorism orclandestine intelligenceactivities; and that such investigation,
if of a United States
S181
UNCLASSIFIED-FOR OFFICIAL USE ONLYUNCLASSIFIED - FOR OFFICIAL USE ONLY
Domestic Investigations and Operations Guide
person, is not conducted solely upon the basis of activities protectedby the First
Amendment to the Constitution.
2. (UFOU0 ) rocedures: Reuests for initiation or renewal
ofFISA PR/TT must be madeb2
b7E

route the request to appropriate parties for theirreview and approval of the request
signatures is not required.

Routing a paper copy for

3. (U) Emergency Authority-FISA: 50 U.S.C. § 1843
(U//FOUO) Under the provisions of FISA, the Attorney General
may grant Emergency
Authority (EA) for PR/TT. Requests for Emergency Authority must
be referred to theappropriate FBIHQ Division.
-(U//FOUO)jb2
b7E

a. ,(U) The Attorney General may authorize the installation
and use of a PR/TT upona determination that an emergency exists and that the factual
basis exists for acourt order. The FISC must be informed at the time of the authorization
and anapplication for a court order must be made to the court no morethan seven (7)days after the authorization. Emergency-authorized PR/TT use
must terminate
when the information sought is obtained, when the
FISC denies the application, orseven (7) days after the Attorney General authorization
is given.
b. (U) If the FISC denies the application after an emergency
PR/TT device has been
installed, no information collected as,a result may be used inany manner, except
with the approval of the Attorney General upon a showingthat the information
indicates a threat of death or serious bodily harm to any person.
(U) Notwithstanding the foregoing, the President, acting
through
Attorney
General, may authorize the use of a PR/TT, without a court order,thefor a period not toexceed 15 calendar days, following a declarationof war by Congress.
(U//FO1IO) If an emergency situation.arises after

reular business hours.

Iemergency.

a t any time during an

B. (U) Criminal Pen Register/Trap and Traceunder 18 U.S.C. §§ 3121 et seq.:
Applications
for-the installation and use of a PR/TT device may be made to a "court of competent
182
UNCLASSIFIED-FOR OFFICIAL USE ONLY

b2

b7E

UNCLASSIFIED - FOR OFFICIAL USE ONLY
Domestic Investigations and Operations Guide
jurisdiction"--i.e., "any district court of the United States(including a magistrate judge ofsuch a court) or any United States court of appeals having jurisdiction
over the offense being
investigated, or any court of general criminaljurisdictionof a State authorized by the law ofthat State to enter orders authorizing the use of a pen registeror trap and trace device." 18
U.S.C. § 3127(2).
I. (U) Legal Standard: Applications for authorization to
install and use a PR/TT device
must include:a. (U) The identity of the attorney for the government or the state law
enforcement
or investigative officer making the application and the identityof the law
enforcement agency conducting the investigation; andb. (U) A certification by the applicant that the information
likely to be obtained isrelevant to an ongoing criminal investigation being conductedby that agency.
2. (U//FOUO) Procedures: An SSA must approve a request for initiation
or renewal of
PR/TT use prior to submission of the request to an attorney
for the government.Before
approving such a request, the SSA should consider of the following:a. (U//FOUO).Theuseof resources based on the investigative
purpose set forth;b. (U//FOUO) Whether there is sufficient factual basis
for the certification to bemade in the application (i.e., is the information likely
to be obtained relevant to an
ongoing criminal investigation);c. (U/FOUO) Whether the customer or subscriber has consented
to the use of a
PR/TT, see 18 U.S.C. § 3121(b)(3); ord. (U//FOUO) Whether the use of a PR/TT is the least intrusive
method feasible
under the circumstances.
(U//FOtUO)A copy of the approving EC must be maintainedin the investigative case file
and/or sub file and in the ELSUR Administrative Subfile
to the corresponding case file.
(U//FOUO) A PR/TT order is executable anywhere within
the United States and, upon
service, the order applies to any person or entity providing wire-or electronic
communication service in the United Stateswhose assistance
may facilitate the executionof the order. Whenever such an order is served on any personor entity not specifically
named in the order, upon request of such person or entity,
the attorney for thegovernment or law enforcement or investigative officer thatis serving the order must
proVide written or electronic certification that theorderappliesto the person or entity
being served.
3. (U) Emergency Authority-Criminal:(U) The Attorney General, the Deputy Attorney
General, theAssociate Attorney General,
any Assistant Attorney General, any acting Assistant
Assistant Attorney General may specially designate Attorney General, or any Deputy
officer to determine whether an emergency situation any investigative or law enforcementthat requires the installation and use
ofaPR/TT device before an order authorizing such installation
and usecan, with due
diligence, be obtained.
(U) An emergency situation as defined in this section
involves:.183
UNCLASSIFIED-FOR OFFICIAL USE ONLYUNCLASSIFIED - FOR OFFICIAL USE ONLY
Domestic Investigations and Operations Guidea. (U) Immediate danger of death or serious bodily injury to any
person;"b. (U) Conspiratorial activities characteristic of organized crime;c. (U) An immediate threat to a national security interest;,ord. (U) An ongoing attack on a protected computer (as definedin 18 U.S.C. § 1030)
that constitutes a crime punishable by a term of imprisonment
greater than one
year.
(U) If the DOJ authorizes the emergency installation of a PR/TT, thegovernment has 48
hours after the installation to apply for a court order according to18 U.S.C. § 3123. It is aviolation of law to fail to apply for a court order within this 48 hour
period. Use of the
PR/TT shall immediately terminate when the information sought
is obtained, when the.application for a court order is denied, or if no court order has beenobtained 48 hours
after the installation of the PR/TT device.
(U//FOUO) As with-requesting authorization for an emergency

Title 1b2
b7E

that approval has, beenobtained, the DOJ attorney will advise the AUSA.that Oncethe emergency use has been
approved and that the law enforcement agency may proceed with
the installation and useof the PR/TT. The DOJ attorney will send a verification
memorandum, signed by theauthorizing official, to the AUSA. The AUSA will include an authorization
memorandumwith the application for the court order approving the emergency
use.
(U//FOUO) If an emergency situation arises after regularbusiness hours,b2_During regular business hours,..

b7E

11.11.5. (U) Duration of Approval(U) National Security: The use of a PR/TT device may'be authorized
by the FISC for a periodof time not to exceed 90 days in cases targeting a United States
person. Extensions may be
granted for periods not to exceed 90 days upon re-application to
the court. In cases targeting a
non-United Statesoperson, an order or extension may
befora
periodof time not to exceed one
year.
(J) Criminal: Theinstallation and use ofaPR/TT
device maybe authorized by court orderunder 18 U.S.C. § 3123 for a period not to exceed sixty days,
which may be extended for
additional sixtyj-day peridds.
11.11.6. (U//FOUO) Specific Procedures
A. (U//FOUO) Prior to installing and using a PR/TT device(whether issued in a criminal or
national security matter), the case agent should:
1. (U//FOUO

.b2
b7E

184
UNCLASSIFIED-FOR OFFICIAL USE ONLYUNCLASSIFIED - FOR OFFICIAL USE ONLY
Domestic Investigations and Operations Guideb2
b7E

2. (U//FOUOI

b2
b7E

3. (U//FOUO-

--

b2
b7E

4. (U//FOUO)
b2
b7E

5. (U//FOUO

b2
J

11.11.7. (U) Use and Dissemination of Information Derived
from Pen Register/Trap andTrace Authorized Pursuant to FISA(U) 50 U.S.C. § 1845
A. (U) No information acquired from a PR/TT device installed andused pursuant to FISA may
be used or disclosed by federal officers or employees except for lawful
purposes.
B. (U) No information acquired pursuant to a FISA authorized
PR/TT may be disclosed for law
enforcement purposes unless such disclosure is accompanied by astatementthat suchinformation, or any information derived therefrom, may only be
used in a criminal
proceeding with the advance authorization of the Attorney General.
C. (U) Whenever the United States intends to enter into evidenceor otherwise use or disclose in
any trial, hearing, or other proceeding in or before any court, department,
officer, agency,
regulatory body, or other authority of the United States against an
aggrieved person.any
information obtained or derived from the use of a PR/TT device acquired
to FISA,the United States must, before the trial,, hearing, or other proceeding or at pursuanta reasonable-time
before an effort to so disclose or so use that information or submit
it into evidence, notify the
aggrieved person, and the court or other authority in which the information.is
to be disclosed
or used, that the United States intends to so disclose or so use suchinformation.
(U) Note: 50 U.S.C. § 1801(k) defines aggrieved person as: "a person
who is the target of anelectronic surveillance or any other person whose communicationsor
activities
were subject
to electronic surveillance."

185
UNCLASSIFIED-FOR OFFICIAL USE ONLY

b7E

UNCLASSIFIED - FOR OFFICIAL USE ONLY
Domestic Investigations.and Operations Guide
11.11.8.

(U) Notice and Reporting Requirements

A. (U) Annual Report for-Criminal.Pen Register/Trap and Trace: The Attorney General isrequired to make an annual report to Congress on the number of criminal PR/TT orders
applied for by DOJ law enforcement agencies. 18 U.S.C. § 3126. The report is to include thefollowing information:
1. (U) The period of interceptions authorized by the order, and the numberarid duration ofany extensions;
2. (U) The offense specified in the order or application, or extension;
3. (U) The number of investigations involved;
4. (U) The number.and nature of the facilities affected; and5. (U) The identity, including the district, of the applying agency making the applicationand the person authorizing the order.
(U//FOUO) DOJ, Criminal-Division, Office of Enforcement Operations requires that the FBI
provide quarterly reports on pen.register usage. To satisfy DOJ data requirements andstandardize and simplify field rep6rting, Court-ordered pen register usage must be reported to1within five workdays of the
FBIHQlexpiration date of an original order or extensions, or denial of an application for ah order. For all
criminal PR/TT orders or extensions issued on or after January 1, 20091
S]Thesereporting requirements.do not apply to PR/TT
authorized pursuant to consent or under the provisions of FISA.
B. (U) Semi-Annual Report for National Security,Pen Registers and Trap and Trace: The
Attorney General must inform the House Permanent Select Committee on Intelligence,
Senate Select Committee on Intelligence, Committee of the Judiciary of the House
Representatives, and Committee.of the Judiciary of the Senate concerning all uses of PR/TT
devices pursuant to 50 U.S.C. § 1846. This-report is coordinated through DOJ NSD. A semiannual report must be submitted that contains the following information:
1. (U) The total number of applications made for orders approving the use of PR/TT devices;
2. (U) The total number of such-orders either granted, modified, or denied, and3. (U) The total number of PR/TT devices whose installation and use was authorized by the
Attorney General on an emergency basis and the total number of subsequent orders
approving or denying the installation and use of such PR/TT devices.
11.11.9,(U) Special Circumstances

A. (U//FOUO) Avoiding Collection and Investigative Use of "Content" in the Operation of
Pen Registers and Trap and Trace Devices
1. (U//FQUO) Overview: Telecommunication networks provide users the ability to engage
in extended dialing and/or signaling; (also known as "post cut-through dialed digits" or
PCTDD), which in some circumstances are simply call-routing information and, in others,
are call content. For example, PCTDD occur when a party places a calling card, credit
card, or collect call by first dialing a long-distance carrier access number and then, after
the initial call is "cut through," dials the telephone number of the'destination party. In
186
UNCLASSIFFID)-F)A1P

I A
VYtn

,1
orrr.

'

b2
b7E

UNCLASSIFIED - FOR OFFICIAL USE ONLY
Domestic Investigations and Operations Guide
other instances, PCTDD may represent call content, such as when aparty calls an
automated banking service and enters an account number, calls a pharmacy's automatedprescription refill service and enters prescription information, or enters a call-backnumber when.prompted by a voice mail service. See United States Telecom Assn v.
Federal Communications Commission. 227 F.3d 450. 462 (D.C.Cir.20001
b2

b7E(U//FOUO) The definition of both a pen register device and a trap and trace device
provides that the information collected by these devices "shall not include.the contents ofany communication." 18 U.S.C. § 3127. In addition, 18 U.S.C. § 3121(c) makes explicit
the requirement to "use technology reasonably available" that restricts the collection of
information "so as not to include the contents of any wire or electronic communications.""Content" includes any information concerning the substance, purpose, or meaning of acommunication. 18 U.S.C. § 2510(8). When the pen register definition is read in
conjunction with the limitation provision, however, it suggests that although a PR/TT
device may not be used for the express purpose-of collecting-content, the incidental
collection of content may occur despite the use of "reasonably available" technology tominimize, to the extent feasible, any possible over collection of content while stillallowing the device to collect all of the dialing and signaling information authorized.
DOJ Policy: In addition to this statutory obligation, DOJ has issued a directive to all DOJ
agencies requiring that no affirmative investigative use may be made of PCTDD
incidentally collected that constitutes content, except in cases of emergency-to prevent
an immediate danger of death, serious physical injury, or harm to the national security.

(U//FOUO)
b2
b7E

2. (U//FOUO) Collection:I

{

b2
b7E

a. (U//FOUO)
b2
b7E

187

UNCLASSIFIED-FOR. OFFICIAL USE ONLYUNCLASSIFIED - FOR OFFICIAL USE ONLY
Domestic Investigations and Operations Guideb2
b7E

b. . r/FOUO
b2

b7E

3. (U//FOUO) Use ofPCTDD:
b2
b7E

a.

iU//FOUO)
b7E

i. (U//FOUO)
b2
b7E

ii.

IJ//FOUO
b2
b7E(]//FOUOTl
b2
b7E

iii. (U//FOUO

b2
b7E

188
UNCLASSIFIED-FOR OFFICIAL USE ONLYUNCLASSIFIED - FOR OFFICIAL USE ONLY
Domestic Investigations and Operations Guideiv. (U//FOUO)
b2
b7E

b. (U/FOUO
b2

b7E

i. (U/FOUO
b2
b7E

ii.

0/FO
b2
b7E

4. (U//FOUO) What constitutes PCTDD content: In applying the above, the term
"content" is interpreted to mean."any information concerning the substance, purpose, ormeaning of a communication" as defined in 18 U.S.C. § 2510. Questions concerningwhether specific PCTDD are content as opposed to dialing, routing or signaling
information should be addressed to the CDC or OGC for coordination with DOJ as
necessary.
U//FOUO

b2

b2

b7E

B. (U//FOUO) Use of cell site simulators/digital analyzers/wireless intercept tracking
technology. A PR/TT order or consent is required for the FBI to use equipmentto capture
any "signaling information"-including the Mobile Station Identification Number (MSIN)
and Electronic Serial Number (ESN) or other registration-type data-emitted from awireless phone into the public airspace--even though this can be accomplished without theassistance of the service,provider. Because 18 U.S.C. § 3127 defines PR/TT devices interms of recording, decoding or capturing dialing, routing, addressing, or signaling
189
UNCLASSIFIED-FOR OFFICIAL USE ONLYUNCLASSIFIED - FOR OFFICIAL USE ONLY
Domestic Investigations and Operations Guidesignaling datainformation,the government's use of its own device to capture suchuse of a "penthewhether passively monitoring or actively interrogating-constitutes
the statute.
violating
avoid
toexception
register" device and requires an order or statutory
used:
is(WITT)
technology
tracking
The following discusses how wireless intercept
L (U//FOUO) To Locate a Known Phone:
to authorize the use ofa. (U//FOUO) Authority: A standard PR/TT'order is adequate
phone,,provided thattargeted
this technology to determine the location of a known
installed and use a
be
to
cause
or
the language authorizes FBI employees to installor night
pen register device, without geographical limitation, at any time of day
dialing,
decodewithin (X) days from the date the order is signed, to record or
routing, addressing, or signaling information transmitted by the "Subject
toTelephone." The application and order shoild generally also request authority
U.S.C,
18
under
basis
compel disclosure of cell site location data on an ongoing
district court-as§ 2703(d)-or probable cause, if such is required by the particulartargeted
theoflocation
generalsuch information may.assist in determining thephone.
b.

iI/FOTiOnb2

b7E

c. (U//FOUOI

b2

b7E

not inUnder Kvllo v. United States, 533 U.S. 27 (2001), the use of equipment
emanatesthat
detectable
otherwise
not
is
that
general, public use to acquire data
frm a nriate nremise implicates the Fourth Amendment.'

b2

b7E

190
UNCLASSIFIED-FOR OFFICIAL USE ONLYUNCLASSIFIED - FOR OFFICIAL USE ONLY
Domestic Investigations and Operations

-

b2
b7E

2. (U//FOUO) To Identify an Unknown Target Phone Number:(U//FOUO) Authority:

b2
b7E(U//FOUO)T

b2
b7E

a. (U//FOUO)

b2
b7E

b. (U//FOUO)l
b2
b7E

191
UNCLASSIFIED-FOR OFFICIAL USE ONLYUNCLASSIFIED - FOR OFFICIAL USE ONLY
Domestic Investigations and Operations Guideb2
b7E

C. (U) PR/TT Order Language: The language in the ordershouldwill be implemented unobtrusively and with minimum interferencestate that "the pen registerwith the services
accorded to customers of such service."

192
UNCLASSIFIED-FOR OFFICIAL USE ONLYUNCLASSIFIED - FOR OFFICIAL USE ONLY
Domestic Investigations and Operations Guide
11.12.

(U) Investigative Method; Electronic Surveillance under
Title III and under
FISA

11.12.1. (U) Summary(U//FOUO) Electronic Surveillance (ELSUR) is a valuable investigative
method. It is, also, avery intrusive means of acquiring information relevant to the effective-executionof the FBl's
law enforcement, national security and intelligence missions.
To ensure that due consideration is
given to the competing interests between law enforcement and the effectliberties, this section contains various administrative and management on privacy and civil
controls beyond those
imposed by statute and DOJ guidelines. Unless otherwise noted, itis the responsibility of thecase agent and his/her supervisor to ensure compliance with these
instructions. ELSUR is only
aiuthorizedas an investigative method in the conduct of full investigations.
ELSUR requires: (i)administrative or judicial authorization p rior to its use;(ii) contact with the Field Office ELSUR
Technician to coordinte all necessary recordkeeping; andAdvisor (TA) or a designated TTA to determine feasibility,(iii) consultation with'the Technicalapplicability, and use of theappropriate equipment.
(U//FOUO) Appliction:

b2

b7E

11.12.2. (U) Legal Authority(U) ELSUR is authorized by chapter 119, 18 U.S.C. §§2510-2522 (Title II of the
Omnibus andSafe Streets Act of 1968); 50 U.S.C. §§ 1801-1811 (FISA);
and E.O. 12333 § 2.5.
11.12.3. (U) Definition of Investigative Method(U) ELSUR is the non-consensual electronic collection of information(usually communications)
under circumstances in which the parties have areasonable expectation of privacy and court
orders or warrantsaie required.
11.12.4. (U) Standards for Use and Approval
Requirements for Investigative Method
A. (U//FOUO) FISA
I. (U//FOUO) FBIHQ and Field Office requests for'FISC ELSUR
orders must use the
FISA &Reqesto.'Field Office requests for FISA orders are submitted
and tracked
through FISAMS. The FISA request forms, in aquestion and answer format, have been
designed to ensure thatall information needed for the preparationof a FISC application
is provided to FBIHQ and to the DOJ.
2. (U) A Certification by the Director of the FBIor oneof nine other individuals
authorized by Congress or the President to provide suchcertifications that the
information being sought is foreign intelligenceinformation;that a significant purposeof the electronicsurveillace
is to obtain foreign intelligence information;that such
193
UNCLASSIFIED-FOR OFFICIAL USE ONLYUNCLASSIFIED - FOR OFFICIAL USE ONLY
Domestic Investigations and Operations Guide
information cannot reasonably be obtained by normal
investigative techniques; that the
information sought is "foreign intelligence information"asincludes a statement explaining the certifier's basis for the defined by FISA; andcertification.
(U) Note: Title 50 of the United States Code Section 1804 specifies
the Assistant to the
President for National Security Affairs; E.O. 12139 as amended
by E.O. 13383
specifies the Director of the FBI, Deputy Director of the FBI,the Director of National
Intelligence, the Principal Deputy Director of National
Intelligence,
the Director of theCentfil Intelligence Agency, the Secretary of State; theDeputy Secretary of State, theSecretary of Defense, and the Deputy Secretary of Defense
as appropriate officials to
make certifications required by FISA.
3. (U) Emergency FISA Authority (50,U.S.C. § 1805[fJ)(U) The Attorney General, on request from the Director-of
the FBI or his/her designee,
may authorize an emergency FISA for electronic surveillance
determined that an emergency situation exists that precludes when it is reasonably
advance FISC review andapproval and that a factual predication for the issuance ofa FISA Order exists. A FISC
judge must be informed by DOJ at the time of the emergency authorization
and anapplication must be-submitted to that judge as soon as is practicable
but not more thanseven (7) days afterithe emergency authorityhas-beenapproved

General. If a court order is denied after an emergency.surveillanceby the Attorneyhas been initiated,no information gathered as a result of the surveillance
may be used as evidence ordisclosed in any trial or other proceeding, and noinformation-States person acquired from such surveillance may be-used or concerning any United
disclosed in any manner,except with the approval of the Attorney General if the information
indicates a threat ofdeath or serious bodily harm to any person.
(U//FOUO) For an emergency FISA for electronic sueillance
B. (U) Title IIIIt any time.

(U//FOUO) An SAC (or designee) has the authority to approve
requests for "non-sensitive"
Title III orders. An Acting SAC may approve such
requests in the absence of the SAC. The
authority to approve Title III applications may not bedelegated
The SAC, with the recommendation of the CDC, must determinelower than the ASAC level.
whether the request
involves sensitive circumstances.
(U//FOUO) ifa Title III involves one of the seven "sensitive
circumstances," it must be
approved by FBIHQ.
(U//FOUO) The following five sensitive circumstances
Assistant Director (DAD) or higher from the Criminal require the approval of a Deputy
Investigative Division (CID),Counterintelligence Division (CD), or Counterterrorism
Division (CTD), as appropriate:
I. (U//FOUO) Significant privilege issues.or First Amendment
concerns (e.g., attorneyclient privilege or-other privileged'conversations
or interception of news media
representatives);

194
UNCLASSIFIED-FOR OFFICIAL USE ONLY

F

b2
b

7E

UNCLASSIFIED - FOR OFFICIAL USE ONLY
Domestic Investigations and Operations Guide
2. (U//FOUO) Significant privacy concerns (e.g., interceptions of conversations in a
bedroom or bathroom);
3. (U//FOUO) Applications based on "relaxed specificity" (i.e., "roving" interception)
under 18 U.S.C. § 2518(11)(a) and (b);4. (U//FOUO) Applications concerning Domestic Terrorism, International Terrorism, or'Espionage investigations; or
5. (U//FOUO) Any situation deemed appropriate by the AD of CID or OGC.
(U//FOUO) The following two sensitive circumstances require the approval of the Director,
the Acting Director, Deputy Director, or the EAD for the Criminal Cyber Response andServices Branch, or the EAD for the National Security Branch, or the respective Assistant
Director for-Counterterrorism or Counterintelligence:
6. (U//FOUO) "Emergency" Title III interceptions (i.e., interceptions conducted prior to
judicial approval under 18 U.S.C. § 2518[7]); or
7. (U//FOUO) The interception of communications of members of Congress, federal
judges, high-level federal.officials, high-level state executives, or members of a state
judiciary or legislature is anticipated.
(U//FOUO) All requests for electronic surveillance that involve one of the above "sensitive
circumstances" must be reviewed by the OGC prior to approval.
(U//FOUO) With the prior approval of the Attorney General, or Attorney General's designee,
the United States Attorney or the Strike Force Attorney must apply to a federal judge for acourt order authorizing the interception of communications relating to one or more of theoffenses listed in Title III (18 U.S.C. § 2516). Judicial oversight continues into theoperational phase of the electronic surveillance-installation, monitoring, transcribing and'handling of recording media.
(U//FOUO) An extension order may be sought to continue monitoring beyond the initial 30day period without a lapse in time. When a break in coverage has occurred, a renewal order
may be sought to continue monitoring the same interceptees or facilities identified in theoriginal authorization. The affidavit and application in support of an extension or renewal
must comply with all of the Title III requirements, including-approval of the Attorney
General or designee. Excelpt as explained below, extensions that occur within 30 days of theoriginal Title III order do not require review by the SAC or designee. After a lapse of morethan 30 days, the SAC-or designee must review and request renewed electronic surveillance.
(U//FOUO) There may be situations or unusual circumstances that require the FBI to adopt
an already existing Title III from another federal law enforcement agency. This will beapproved on a case-by-case basis, only in exceptional circumstances.
(U//FOUO) Before the FBI begins or adopts the administration of a Title III, the Field Officemust obtain SAC or designee approval. Thereafter, extensions and renewals within 30 days
do not require SAC or designee approval.
(U//FOUO) Emergency Title III interceptions (e.g., interceptions conducted prior to judicial
approval under 18 U.S.C. § 2518[7]) - [Hyperlink to Memo dated May 22. 2008 Standard
and Process Authorization]
195
UNCLASSIFIED-FOR OFFICIAL USE ONLYUNCLASSIFIED - FOR OFFICIAL USE ONLY
Domestic Investigations and Operations Guide(U//FOUO)Ifan emergency situation arises after regular business hours-

b2
b7E

.-

IDuringeegular business hours[may be reached(U//FOUO) Dispute Resolution for both FISA and Title III Applications(U//FOUo)

11.12.5.

b2
b7E(U) Duration of Approval

A. (U) FISA
(U//FOUO) FISC orders for ELSUR surveillance are provided
for the period time
specified in the order that will not exceed: 90 days for Unithd States persons; of
120 days for
hon-United States persons; and one year for a foreign power,asdefinedin 50 U.S.C.
§ 18 01(a) (1)(2) or (3). For United States persons, renewals of FISA
Orders may berequestedfoi the same period of time originallyauthorized:based upona continued showing
ofprobaile cause. For non-United States persons, renewals can befor a period notto exceed
one year. All renewal requests should be submitted
to DOJNSD by the requeSting Field
Office atleast 45 days prior to the expiration of theexisting order. These requests are to besubmitted using the FISA Request Form process in FISAMS.
B. (U) Title III(U) Title III ELSUR orders are for a period not to exceed 30 days,
with subsequent 30 day
extensions as authorized by thecotirt.
11.12.6.

(U) Specific Procedures

A. (U) FISA
(U//FOUO

b7E

1. (U//FOUO) FISA Verification of Accuracy Procedures(u//FOUOb

*

"b2
b7E

a. (U//FOUO"
b2
b7E

i. (U//FOUo)
S_

b2
b7E

196
UNCLASSIFIED-FOR OFFICIAL USE ONLYUNCLASSIFIED - FOR OFFICIAL USE ONLY
Domestic Investigations and Operations GuidebVE
b7E

ii. (U//FOUO

iii. (U//FOUO
b2
b7E

b2

b. (UFOUO

b7.E

2. (U//FOUO) FISA Electronic Surveillance Administrative Sub-fileCl.(//F.OuO--"

~

I

b2-

-b2

b7E

b2

b7E

a.. (U//FOUO

b2

b7E

b. (U//FOUO
3. (U//FOUO) FISA Review Board for FISA Renewals(U//FOUO)

b2
b7E

a. (U//FOUO)

b2
b7E

b. (U//FOUO.

197
UNCLASSIFIED-FOR OFFICIAL USE ONLY

b2

b2
b7E

UNCLASSIFIED - FOR OFFICIAL USE ONLY
Domestic Investigations and Operations Guideb2
b7E(U//FOUO^
c. (U/FOUOM
c.
b2

b7E

d. (U//FOUO
b2
b7E(U//FOUO
b2
b7E

B. (U Title III
I. (U//FOUO) The requirements in 18 U.S.C. § 2518 must be followed meticulously
in thepreparation of a Title III application. In addition,
the following points must be covered:a. (U//FOUO) Probable cause must be current;b. (U//FOUO) There must be a factual basis for concludingthat normal investigative
procedures have been tried and failed or a demonstration why these procedures
appear to be unlikely to succeed or would be too dangerous if tried("boilerplate"statements in this respect are unacceptable);c. (U//FOUO) If the subscriber of the telephone on which
coverage is sought is not* one of the principals, attempts to identify thesubscriber.must be made;d. (U//FOUO) Minimization will be occur, as statutorily
required, if the coverage
involves a public telephone booth, a restaurant table, or the like;e. (U//FOUO) The facility or premises to be covered is'described
fully

f.

b2
b7E

_and
(U/FOUO) Atleast 10 days prior to submitting the Title III request toDOJ OEO,
the Field Office must forward an electronic communication to FBIHQ
b2
b7E

198
UNCLASSIFIED-FOR OFFICIAL USE ONLYUNCLASSIFIED - FOR OFFICIAL USE ONLY
Domestic Investigations and Operations Guide
b2
b7E

b2

b7E

2. (U//FOUO

3.

(U//FOUO) For details on when, how, and where to conduct pre-Title III ELSUR
searches, refer to CID PG.

4. (U//FOUO) Case agents must use theb2b7E

5. .(U//FOUO) For additional guidance, see ELSUR Manual.
11.12.7.

(U) Notice and Reporting Requirements

A. (U) FISA
(U//FOUO

b2

B. (U) Title III
1. (U//FOUO) The anticipated interception of conversations related to a "Sensitive
Investigative.Matter" as defined in the AGG-Dom, Part VI.N, requires-notice to theappropriate FBIHQ Unit Chief and Section Chief, and DOJCriminal Division.
2.. (U//FOUO)
b2
b7E

a.

(U//OUObE

b. (U//FOUO)
b2
b7E

b. (U//FOUO'

199
UNCLASSIFIED-FOR OFFICIAL USE ONLYb2
b7E

UNCLASSIFIED - FOR OFFICIAL USE ONLY
Domestic Investigations and Operations Guideb2
b7E

3. (U//FOUO)

4. (U//FOUQ

b2
b7E

5. (U//FOUO) Upon completion of a Title III ELSUR activity, the Form.2 report isrequired to be submitted per 18 U.S.C. § 2519. For details on the completion andsubmission of the Form 2 report, see the CID PG.
11.12.8.

(U) Compliance and Monitoring

A. (U) FISA

b2
b7E

(U//FOUO)fB. (U) Title III(U//FOUO) Upon completion of Title III ELSUR activity, the Form 2 report is required to besubmitted per 18 U.S:C. § 2519. For details on the completion and submission of the Form 2
report, see.the CID PG.
11.12.9.

(U) Special Circumstances(U) FISA(U) Under 50 U.S.C. § 1802, the President, through the Attorney General, may authorize
electronic surveillance under-FISA without a court order for periods of up to one year, if the
Attorney General certifies in writing under oath that the surveillance will be. solely directed atacquiring communications that are transmitted by means that are exclusively between or among
foreign powers and there is no substantial likelihood of the surveillance acquiring the contents ofcommunications to which United States Persons are parties.
11.12.10. (U) OtherApplicable Policies
A. (U) FISA
1. (U//FOUO) CD Policy Guide
2. (U//FOUO) CTD Policy Guide
3. (U//FOUO) Investigative Law Unit Library
4. (U//FOUO) Foreign Intelligence Surveillance Act (FISA) Unit
B. (U//FOUO) OTD PG
1. (U//FOUO) Title III
2. (U//FOUO) Memo dated May 22, 2008 Standard and Process Authorization
3. (U//FOUO) ELSUR Manual
4. (U//FOUO) CID PG
5. (U//FOUO) OTD PG

200
UNCLASSIFIED-FOR OFFICIAL USE ONLYUNCLASSIFIED - FOR OFFICIAL USE ONLY
Domestic Investigations and Operations Guide
11.13. (U) Investigative Method: Physical searches, including mail openings, requiring
judicial order or warrant(U) AGG-Dom, Part V.A.12.
11.13.1. (U) Summary(U) The Fourth Amendment to the United States Constitution governs all searches and seizures
by government agents. The Fourth Amendment contains two clauses. The first establishes theprohibition against unreasonable searches and seizures. The second provides that no warrant(authorizing a search or seizure) will be issued unless based on probable cause. An unlawful
search does not preclude a prosecution. The remedy to the defendant for an unlawful search issuppression of the evidence resulting from the illegal seizure.
(U//FOUO) Application:
b2
b7E(U) A search is a government invasion of a person's privacy. To qualify as reasonable
expectation of privacy, the individual must have an actual subjective expectation of privacy andsociety must be prepared.to recognize that expectation as objectively reasonable. See Katz
v.
United States, 389 U.S. at 361. The ability to conduct a physical search in an area or situation
where an individual has a reasonable expectation of privacy requires a warrant.or order issued bya court of competent jurisdiction or an exception to the requirement for such a warrant ororder.
The warrant or order must be based on probable cause. The Urited States Supreme Court defines
probable cause to search as a "fair probability that contraband or evidence of a crime willbefound in a particular place." Illinois v. Gates, 462 U.S. 213, 238 (1983). A government
agent
may conduct a search without a warrant based on an individual's voluntary consent. A searchbased on exigent circumstances may also be conducted without a warrant, but the requirement
for probable cause remains.
11.13.2. (U) Legal Authority(U) Searches conducted by the FBI must be in conformity with FRCPRule 41: FISA, 50U.S.C.
§§ 1821-1829; or E.O. 12333 § 2.5.
11.13.3.

(U) Definition of Investigative Method(U) A physical search constitutes.any physical-intrusion within the United States into premises
property (including examination of the interior of property by technical means) that is intended or
to result in the seizure, reproduction, inspection,.or alteration of information, material,orproperty, under circumstances in which a person has a reasonable expectation of privacy.
(U) A physical search requiring a warrant does not include: (i) electronic surveillance as definedin FISA-or Title-III; or (ii) the acquisition by the United States Government offoreign
intelligence information from international foreign communications, or foreign
intelligence
201
UNCLASSIFIED-FOR OFFICIAL USE ONLYUNCLASSIFIED - FOR OFFICIAL USE ONLY
Domestic Investigations and:Operations Guide
activities conducted according to otherwise applicable federal law involving a foreign
electronic
communications system, using a means other than electronic surveillance as definedin FISA.
A. (U) Requirement for Reasonableness. By the terms of the Fourth Amendment, a searchmust bereasonable.at its inception and reasonable in its exetLnn

B. (U) Reasonable.Expectation of Privacy. The right of privacy is a personal right, not a
property concept. It safeguards whatever an individual reasonably expects to be
piivate. The
prptection.normally includes persons, residences, vehicles, other personal property,
privateconversations, private papers and records. The Supreme Court has determinedthat there is no
reasonable expectation of privacy in certain areas or information. As a result,government
intrusions into those areas do not constitute a search and, thus, do not haveto meet therequirements of the Fourth Amendment. These areas include: (i) open fields; (ii) prison
cells;(iii) public access areas; and (iv) vehicle identification numbers. The Supreme Court
has also
determined that certain governmental practices do not involve an intrusion
into a reasonableekpectation of privacy and, theref6re, do not amount to a search. These practices
include:(i) aerial surveillance conducted-frof navigable.airspace; (ii) fieldtest of suspected
controlled substance; and (iii) odor detection. A reasonable expectationof privacy
terminated by an individual taking.steps to voluntarily relinquish the expectation maybe
of privacy,
such as abandoning property or setting trash at the edge of the curtilage
or beyond forcollection.
C. (U) Issuance of search warrant
1. (U) Under FRCP Rule 41, upon the request of a federal law enforcement
officer or an
attorney for the government, a search warrant may be issued by:a. (U) a federal magistrate judge, or ifnone is reasonably available, ajudgeof astate court of record within the-federal.district, for a search of property or forapersoriwithin the district;b. (U) a federal magistrate judge for a search of property or for a person either
within or outside the district if the property or person is within the district when
the warrant is sought but might move outside the district before thewarrant is
executed;c. (U) a federal magistrate judge in any-district in which activities related
to theterrorism may have. occurred, for a search of property:or for a person
within or
outside the district, in an investigation of domestic terrorism or international
terrorism (as defined in 18 U.S.C. § 2331);.andd. (U) a magistrate with authority in the district to issue.a warrant toinstall a
tracking device. The warrant may authorize use of the device to track
the
Smovement of a person or property located within the district, outside,or both.
2. (U) Physical searches related to a national security purpose may be authorized
by theFISC. (50 U.S.C. §§ 1821-1829)

202
UNCLASSIFIED-FOR OFFICIAL USE ONLYb2
b7E

UNCLASSIFIED - FOR OFFICIAL USE ONLY
Domestic Investigations and Operations Guide
D. (U) Property or Persons That May be Seized with a Warrant.
(U) A warrant may be issued to search for and seize any: (i) property that constitutes
evidence of the commission of a criminal offense; (ii) contraband, the fruits ofcrime, orthings otherwise criminally possessed; or (iii) property designed or intended
for use or that isor has been used as the means of committing a criminal offense. In addition toa conventional
search conducted following issuance of a warrant, examples of search warrants
include:1. (U) Anticipatory Warrants(U) As the name suggests, an anticipatory warrant differs from other search warrants
inthat it is not supported by probable cause to believe that contraband exists at
the premises
to be searched at the time the warrant is issued. Instead, an anticipatory search
warrant isvalidly issued where there is probable cause to believe that a crime has been oris being
committed, and that evidence of such crime will be found at the described location
attime of the search, but only after certain specified events transpire. These conditions theprecedent to the execution of an anticipatory warrant, sometimes referred
to as"triggering events," are integral to its validity. Because probable cause foran anticipatory
warrant is contingent on the occurrence of certain expected or "triggering" events,
typically.the future delivery, sale, or purchase of contraband, the judge making-theprobable cause determination must take into-account the likelihood that the triggering
event will occur on schedule and as predicted. Should these triggeringevents.failtomaterialize, the anticipatory warrant is void.
2. (U) Sneak and peek search warrants(U) A sneak and peek search warrant allows law enforcement agents to surreptitiously
enter a location such as a building, an apartment, garage, storage shed,etc., for the
purpose of looking for and documenting evidence of criminal activity.
The purpose ofthis type of warrant is to search for and seize property (either tangible or intangible)
without immediately providing notice of the search and aretur on
the warrant to theowner of the property searched or seized. See FRCP 41(f)(3). A sneak andpeek warrant
is used to gather additional evidence of criminal activity without prematurely
exposing an
on-going investigation. The evidence discovered during a sneak and peek
search may be
used to support a request for a conventional search warrant.
3. (U) Mail Openings(U) Mail in United States postal channels may be searched only pursuant
to court order
or presidential authorization. United States Postal Service regulations governing
such
activities must be followed. A search of items that are being handled
by individual
couriers, or commercial courier companies, under circumstances in which
there is areasonable expectation of privacy, or have been sealed for deposit
into postal channels,
and that are discovered within properties or premises being searched, must
be carried out
according to unconsented FISA or FRCP Rule 41 physical search
procedures.
4. (U) Compelled Disclosure of the Contents of Stored Wire orElectronic
Communications(U) Contents in "electronic storage" (e.g., unopened e-mail/voice mail)require a search
warrant. See 18 U.S.C. § 2 703(a). A distinction is made between
the contents ofcommunications that are in electronic storage (e.g., unopened e-mail) forless than 180
203
UNCLASSIFIED-FOR OFFICIAL USE ONLYUNCLASSIFIED - FOR OFFICIAL USE ONLY
Domestic Investigations and Operations Guide
days andthose in "electronic storage" for longer than 180 days, or those that are nolonger in "electronic storage" (e.g., opened e-mail). In enacting the ECPA, Congressconcluded that customers may not retain a "reasonable expectation of privacy" ininformation sent to network providers. However, the contents of an e-mail message thatis unopened should nonetheless be protected by Fourth Amendment standards, similar tothe contents of a regularly mailed letter. On the other hand, if the contents of an unopened
message are kept beyond six months or stored on behalf of the customer after these-mailhas been received or opened, it should be treated the same as a business record in-thehands of a third party, such as an accountant or attorney. In that case, the government
may subpoena the records from the third party without running afoul of either the Fourthor Fifth Amendment. If a search warrant is used, it may be served on the provider without
notice to the customer or subscriber.
11.13.4. (U) Approval Requirements forInvestigative Method
A. (U//FOUO) Search warrants issued under authority of FRCP Rule 41: A warrant tosearch is issued by a federal magistrate (or a state court judge if a federal magistrate is notreasonably available). Coordination with the USAO or DOJ is required to obtain the warrant.
B. -(U//FOUO) FISA: In national security investigations, Field:Office requests for FISA
authorized.physical searches must be submitted to FBIHQ using the FBI FISA Request Form.
Field Office requests for FISA approval are tracked through FISAMS. This form should becompleted by the case agent.
C. (U//FOUO) Sensitive Investigative Matter: Notice to the appropriate FBIHQ substantive
Unit Chief and Section Chief is required if the matter under investigation is a sensitive
investigative matter. Notice to DOJ is also required, as described in DIOG Section 10.
11.13.5. (U)'Duration of Approval(U) The duration for the execution of a warrant is established by the.court order or warrant.
11.13.6. (U) Specific Procedures
A. (U) Obtaining a Warrant under FRCP Rule 41(U) Probable Cause. After receiving an affidavit or other information, a magistrate judge ora judge of a state court of record must-issue the warrant if there is probable cause to search
for and seize a person or property under FRCP Rule 41(c). Probable cause exists where "thefacts and circumstances within the FBI employee's knowledge, and of which they hadreasonably trustworthy information are sufficient in themselves to warrant a person ofreasonable caution in the belief that..." a crime has been or is being committed, and thatseizable property can be found at the place or on the person to be searched. Probable cause isa reasonable belief grounded on facts. In judging whether a reasonable belief exists, the test
is whether.such a belief would be engendered in a prudent person with the officer's training
and.experience. To establish probable cause, the affiant must demonstrate a basis forknowledge and belief that-the facts are true and that.there is probable cause to believe theitems listed in the affidavit will be found at the.place to be searched.
1. (U) Requesting a Warrant in the Presence of a Judge.
a. (U) Wariant on an Affidavit: When a federal law enforcement officer or an
attorney for the government presents an affidavit in support ofa warrant, the204
UNCLASSIFIED-FOR OFFICIAL USE ONLYUNCLASSIFIED - FOR OFFICIAL USE ONLY
Domestic Investigations and Operations Guide
judge may require the affiant to appear personally and may examine-

the affiant and any witness the affiant produces.

under oathb. (U) Warrant on Sworn Testimony: The judge may whollyor partially dispensewith a written affidavit and base a warrant on sworn testimony
if doing so isreasonable under the circumstances.
c. (U) Recording Testimony; Testimony taken in support
of a warrant must be
Srecorded by a court reporter or by a suitable recording device,and th judge mustfile the transcript or recording with the clerk, along withany affidavit.
2. (U) Requesting a Warrant by Telephonic or Other Means,a. (U) In General: A magistrate judge may issue a warrant
based on information
communicated by telephone or other appropriate means, including
facsimiletransmission.
b. (U) Recording Testimony: Upon, learning that an applicant
is requesting awarrant, a magistrate judge must: (i) place under oath theapplicant and any
person on whose testimony the application is based; and(ii) make a verbatim
record of the conversation with a suitable recording device,
if available, or by acourt reporter, or in writing.
c. (U) Certifying Testimony: The magistrate judge musthave any recording or
court reporter's notes transcribed, certify the transcription's
accuracy, and file acopy of the record and the transcription with the clerk. Any
record must be signed by the magistrate judge and filed withwritten verbatim
the clerk.
d. (U) Suppression Limited: Absent a finding of bad faith,evidence obtained froma warrant issued under FRCP Rule 41(d)(3)(A) is not subject
to suppression on
the ground that issuing the wairant in that manner was unreasonable
under thecircumstances.
3. (U).Issuing the Warrant*(U) In general, the magistrate judge or a judge of a state courtof record must issue thewarrant to an officer authorized to execute it. The warrant
must identify the person orproperty to be searched, identify any person or property
tomagistrate judge to whom it must be returned. The warrant be seized, and designate the(i) execute the warrant within a specified time no longer thanmust command the officer to:
10 days;(ii) execute thewarrant during the daytime, unless the judge for good cause
expressly authorizes
execution at another time; and (iii) return the warrant to
the magistrate judge designatedin the warrant.
4. (U) Warrant by Telephonic or Other Means(U) If a magistratejudge decides to proceed under FRCP
Rule 41(d)(3)(A), the following
additional procedures apply:
a. (U) Preparing a Proposed Duplicate Original
Warrant: The applicant must
prepare a "proposed duplicate original warrant" andmust read or otherwisetransmit the contents.of that document verbatim to themagistrate judge.

205
UNCLASSIFIED-FOR OFFICIAL USE ONLYUNCLASSIFIED - FOR OFFICIAL USE ONLY
Domestic Investigations and Operations Guideb. (U) Preparing an Original Warrant: The magistrate judge must enter thecontents of the proposed duplicate original warrant into an original warrant.
c. (U) Modifications: The magistrate judge may direct the applicant to modify the
proposed duplicate original warrant. In that case, the judge must also modify theoriginal warrant.
d. (U) Signing the Original Warrant and the Duplicate Original Warrant: Upon
determining to issue the warrant, the magistrate judge must immediately sign theoriginal warrant, enter on its face the exact time it is issued, and direct theapplicant tosign the judge's name on the duplicate original warrant.
5. (U) Executing and Returning the Warranta. (U) Noting the Time: The officer executing the warrant must enter on its face theexact date and time it is executed.
b. (U) Inventory: An officer present during the execution of the warrant must
prepare and verify an inventory of any property seized. The officer must do so inthe presence-of another officerand the.person from whom,-or from whose
premises, the property was taken. If either one is not present, the officer must
prepare and verify the inventory in the presence of at least one other credible
person.
c. (U) Receipt; The officer executing the warrant must: (i) give a copy of thewarrant and a receipt for theproperty taken to the person from whom, or from
whose premises, the property was taken; or (ii) leave a copy of the warrant andreceipt at the place where.the officer took the property.
d. (U) Return: The officer executing the warrant must promptly return it - together
with a copy of the inventory - to the magistrate judge designated on the warrant.
The judge must, on request, give a copy of the inventory to the person from whom,or from whose premises, the property was.taken and to the applicant for the
warrant.
6. (U) Forwarding Papers to the Clerk(U) The magistrate judge to whom the warrant is returned must attach to the warrant a
copy of the return, the inventory, and all other related papers and must deliver them to theclerk in the district where the property was seized. (FRCP Rule 41)
7. (U) Warrant for a Tracking Devicea. (U) Noting the time: The officer executing a tracking device warrant must enteron it the exact date and time the device was installed and the period during which
it was used.
b. (U) Return: Within 10 calendar days after the use of the tracking device has
ended, the officer executing the warrant must return it to the judge designated in
the warrant.
c. (U) Service: Within 10 calendar days after use of the tracking device has ended,
the.officer executing the warrant must.serve a copy of the warrant on the person
who was tracked. Service may be accomplished by delivering a copy to the person
206
TJNCTLASRTFn1iV.D.X

noirITATTTQi

hkATr v

UNCLASSIFIED - FOR OFFICIAL USE ONLY
Domestic Investigations and Operations Guide
who, or whose property was tracked; or by leaving a copy at the person's
residence or usual place of abode with an individual of suitable age and discretion
who resides at that location and by mailing a copy to the person's last known
address. Upon request of the,government, the judge may delay notice as provided
in FRCP Rule 41(f)(3).
8. (U) Delayed Notice(U) Upon the government's request, a magistratejudge-or if authorized.by FRCP Rule41(b), ajudge of a state court of record-may delay any notice required by FRCP Rule
41 if the delay is authorized by statute.
B., (U) Obtaining a FISA Warrant(U) Applications for court-authorized physical search pursuant to FISA must be made by afederal officer in writing upon oath or affirmation and with the specific approval of the
Attorney General. (See 50 U.S.C. § 1823) Each application must include:
1. (U) The identity of-the federal' officer making the application;
2. (U) The authority conferred on the Attorney General by the President and the approval of
the Attorney General to make the application;
3. (U) The identity, if known, or description of the target of the physical search and adetailed description of the premises or property to be searched and of the information,material, or property to be seized, reproduced, or altered;
4. (U) A statementofthe facts and-circumstances relied upon and submitted by theapplicant that there is probable cause to believe that:a. (U) The target is a foreign power or an agent of a foreign power, provided that no
United States person may be considered a foreign power or an agent of a foreign
power solely on the basis of activities protected by the First Amendment to theConstitution of the United States; andb. (U) Each of the facilities or places at which theFISA order isdirected is being
used by a foreign power or an agent of a foreign power.
5. (U) "In determining whether or not probable cause exists for purposes of an order under
50 U.S.C. § 1823(a)(3), a judge may consider past activities.of the target, as wellas facts
and circumstances relating to current or future activities of the target." 50 U.S.C.
§ 1805(b). As it relates to United States citizens or aliens lawfully admitted forpermanent residence, "agent of a foreign power" means any person who:a. (U) Knowingly engages in clandestine intelligence-gathering activities for or on
behalf of a foreign power, whose activities involve or may involve a violation of
the criminal statutes of the United States;b. (U) Pursuant to the direction of an intelligence service or network of a foreign
power, knowingly engages in any other clandestine intelligence activities for oron behalf of such foreign power, whose activities involve or are about to involve a
violation of the criminal statutes of the United States;

207

UNCLASSIFIED-FOR OFFICIAL USE ONLYUNCLASSIFIED - FOR OFFICIAL USE ONLY
Domestic Investigations and Operations Guidec. (U) Knowingly engages in sabotage or international terrorism, or activities thatare in preparation therefore, for or on behalf of a foreign power;d. (U) Knowingly enters the United States under a false or fraudulent identity for oron behalf of a foreign power or, while in the United States, knowingly assumes a
false or fraudulent identity for or on behalf of a foreign power; ore.. (U) Knowingly aids or abetstany person in the conduct of activities described insubparagraph 'a,' 'b,' or 'c,' above or knowingly conspires with any person to
engage in activities described in subparagraph 'a,' 'b,' or 'c,' above. 50 U.S:C.
§ 1801(b) (2).
(U) For purposes of the above statute, 50 U.S.C. § 1801(a) (1) defines "foreign
power" to.include "a group engaged in international terrorism or activities in
preparation therefore," 50 U.S.C. § 1801(a) (4), as well as, amongother things, "aforeign government or any component thereof, whether or not recognized by theUnited States." Title 50 of the United States Code Section 1801 (c) defines"international terrorism" as activities that:(a) (U) Involve-violent acts or acts dangerous to human life that are a violation of
the criminial laws ofthe United-Statesorof anyState, or that would be a
criminal violation if committed within the jurisdiction of the United States or
any State;(b) (U) Appear to be intended(1) (U) To intimidate or coerce a civilian population;(2) (U) To influence the policy of a government by intimidation or coercion;or(3). (U)To affect the conduct of a government by assassination or kidnapping;and(c) (U) Occur totally outside the United States, or transcend national boundaries
in terms of.the means by which they are accomplished, the-persons they
appear intended to coerce or intimidate, or the locale in: which theirperpetrators operate or seek asylum by the applicant to justify the belief that:(i) the target is a foreign power or agent of a foreign power; (ii) the premises
or property to be.searched contains foreign intelligence information; and (iii)the premises or property to be searched is owned, used, possessed by, or is intransit to or from a foreign power or-an agent of a foreign.power.
6. (U) A statement of the proposed minimization procedures that have been approvedby the
Attorney General;
7. (U) A detailed description of the nature of the foreign intelligence information sought andthe manner in which the physical search will be conducted;
8. (U) A Certification by-the Director of the FBI or one of nine other individuals authorized
by Congress or the President to provide such certifications that the information being. sought is foreign intelligence information; that a significant purpose of the search is toobtain foreign intelligence information; that such information cannot reasonablybe
208
UNCLASSIFIED-FOR OFFICIAL USE ONLYUNCLASSIFIED - FOR OFFICIAL USE ONLY
Domestic Investigations and Operations Guide
obtained by normal investigative techniques; that the informatioh sought is "foreign
intelligence information" as defined by FISA; and-includes a statement explaining thecertifier's basis for the certification.
(U) Note: Title 50 of the United States Code Section 1804 specifies the Assistant to the
President for National Security Affairs; E.O. 12949, as amended specifies the Director of
the FBI, Deputy Director of the FBI, the Director of National Intelligence, the Principal
Deputy Director of National Intelligence, the Director of the Central-Intelligence;Agency,
the Secretary of State, the Deputy Secretary of State, the Secretary of Defense, and the
Deputy Secretary of Defense as appropriate officials to make certifications required by
FISA.
9. (U) Where the physical search may involve the residence of a United States person, theAttorney General must state what investigative techniques have previously been used toobtain the foreign intelligence information concerned and the degree to which thesetechniques resulted in acquiring such information;
10. (U) A statement of the facts concerning all previous applications before the FISA courtthat have been madeinvolvingany of the persons, premises, or property specified in theapplication and the actions taken on each previous application;
11.I.(U) The Attorney General may require any other affidavit or certification from any otherofficer in connection with an application; and12. (U) The Court may require the applicant to furnish such other.information as maybe
necessary to make the determinations required to issue an Order.
C. (U) Length of Period of Authorization for FISC Orders
1. (U) Generally, a.FISC Order approvingan unconsented physical search will specify theperiod of time during which physical searches are approved and provide that the,government will be permitted the period of time necessary to achieve the purpose, or for
90 days, whichever is less, except that authority may be:a. (U) For no moie than one year for "Foreign Power" targets (establishments); orb. (U) For no more than 120 days for an agent of a foreign power, with renewals for
up to one year for non-United States persons.
2. (U) An extension of physical search authority may be granted on the same basis as theoriginal order upon a separate application for an extension and upon new findings madein the same manner as the original order.
3. (U) Emergency FISA Authority
a. (U) The Attorney General may authorize an emergency physical search under
FISA when he reasonably makes a determination that'an emergency situation
exists that precludes advance FISA court review and approval, and there exists a
factual predication for the issuance of a FISA Court Order. In such instances, a
FISC judge must be informed by the Attorney General or his designee at the timeof the authorization and an application according to FISA requirements is
submitted to the judge as soon as is practicable but not more than seven (7) days
after the emergency authority has been approved by the Attorney General.
209
UNCLASSIFIED-FOR OFFICIAL USE ONLYUNCLASSIFIED - FOR OFFICIAL USE ONLY
Domestic.Investigations and Operations Guideb. (U) If a court order is denied afteran emergency authorization has been initiated,no information gathered as a result of the search may be used in any manner
except if with the approval of the.Attorney General, the information indicates athreat of death or serious.bodily harm to any person.
c. (U//FOUO) For an emergency FISA for physical search.
I

b2
b7E

4. (U) Special Circumstances(U) The President through the Attorney General may also authorize a physical searchunder FISA without a court order for periods of up to one year, if the Attorney Generalcertifies that the search will be solely directed at premises, information, material, orproperty that is used exclusively by or under the open and exclusive control of a foreign
power; there is no substantial likelihood that the physical search will involve the premises,
information, material, or property of a United States person; and there are minimization
procedures that havebeen reported to the court and Congress. The FBI's involvement insuch approvals is usually in furtherance of activities pursued according to E.O. 12333.
Copies of such certifications are to be transmitted to the FISA Court (see 50 U.S.C.
§ 1822[a]).
(U) Information concerning United States persons acquired through unconsented physicalsearches may only be used according to minimization procedures. See: 50 U.S.C.
§§ 1824(d)(4) and 1825(a).
5. (U) Required Notice(U) If an authorized search involves the premises of a United States.person, and theAttorney General determines that there is no national security interest in continuing thesecrecy of the search, the Attorney General must provide notice to the United States
person that the premises was searched and the identification of any property seized,
altered, or reproduced during the search.
6. (U//FOUO) FISA Verification of Accuracy Procedures(U//FOUO
b7E

a. (U//FOUO) Each case file for which an application-is prepared fi submission to
the FISC will include a sub-fileito be labeled
IThis sub-file
is to contain copies of the supportive documentation relied upon when making theesrtifictions to the|I
file is to include:i. (U//FOUO

b2
b7E

b2
b7E

ii.* (U//FOUO)|
210
UNCLASSIFIED-FOR OFFICIAL USE ONLY

b2
b2
b7E

UNCLASSIFIED - FOR OFFICIAL USE ONLY
Domestic Investigations and Operations Guideiii. (U//FOUO
b2
b7E

b. -(U//FOUO
b2
b7E

7. (U//FOUO) FISA Physical Search AdministrativeSub-file(U//FOUO) Each-case file for which an application is or has been

prepared forsubmission to theFTISC will include a sub-file to be labeled[This sub-file is to contain copies of all applications to and~orders issted by the FISC for the conduct of physical searches in the investigative ca
The following data must be included in thisia. (U//FOUO.--

b. (U//FOUO--. ....

b2
b7E

-b27

b7E

"

b2

b7E

8. (U//FOUO) FISA Review Board for FISA Renewals(U//FOUO

b2
b7E

a. (U//FOUO
b2
b7E

b. (U//FOU)b2
b7E

c. (U//FOUO

b
b2
b7E

211
UNCLASSIFIED-FOR OFFICIAL USE ONLYUNCLASSIFIED - FOR OFFICIAL USE ONLY
Domestic Investigations and Operations Guideb2
b7E

d. (U//FOUO) Appealing

Decision of the Rviw Rn

.

b2
b7E

(U//FOUOI
b2
b7E

212
UNCLASSIFIED-FOR OFFICIAL USE ONLYUNCLASSIFIED - FOR OFFICIAL USE ONLY
Domestic Investigations and Operations Guide
11.14. (U) Investigative Method: Acquisition of foreign
intelligence information in
conformity with Title VII of the Foreign Intelligence SurveillanceAct
11.14.1. (U) Summary(U) Titles I and III'ofthe FISA (codified as 50 U.S.C. §§ 1801,et seq.) provide the standard,
traditional methods-of collection against agents of foreign powers(including United States andnon-United States persons) and foreign power establishments
inside the United States. Title VII
of FISA, "Additional Procedures Regarding Certain Persons
Outside the United States," provides
means for collections of individuals outside the United States.
11.14.2. (U) Legal Authority(U) FISA Amendments Act of 2008 (122 Stat 2436)(U) AGG-Dom, Part V.A.13
11.14.3.

(U) Definition of Investigative Method(U) Title VIIis to be used for conducting FISAs on certain
persons located outside the UnitedStates11.14.4.

(U//FOUO) Standards for Use and Approval Requirements
for Investigative
Method(I//FOUO) See requirements under DIOG Sections 11.12
and 11.13 and requirements specified
above.
11.14.5.

(U) Duration of Approval(U//FOUO) See requirements under DIOG Sections

11.12 and 11.13(U//FOUO) Specific Collection Procedures for Title
VII(U) The relevant procedures (or collections) under Title
VII are:A. (U) Section 702 - "Procedures for Targeting Certain Persons
Outside the United States
Other than United States Persons"(U//FOUO) Under Section 702, the Government has theauthority to target non-United States
persons who are located outside the United States if thecollection is effected with theassistance of a United States provider and if the collection
occurs inside the United States
This section does not require a traditional FISA request.
Rather, under this section the
Attorney General and the Director of National Intelligence
are required to file yearly
determinations (filed as "Certifications") with the FISC
that authorize the targeting of
persons reasonably believed to be located outside theUnited States to acquire foreign
intelligence information. The Certifications are accompanied
by, in the case of the FBI, anaffidavit signed by the FBI Director. In addition, the FBI
is required to file "Targeting
Procedures" designed to ensure that the acquisition is limited
to persons reasonably believed
to be located outside the United States and "to preventthe intentional acquisition of any
communications. as to which the sender and all intended
recipients are known at the time of
the acquisition to be located in the Ujnited States."Finally,
the FBI is also required to follow
minimization.procedures.
11.14.6.

213
UNCLASSIFIED-FOR OFFICIAL USE ONLYUNCLASSIFIED - FOR OFFICIAL USE ONLY
Domestic Investigations and Operations Guide
B. (U) Section 703 - "Ceitain Acquisitions Inside the United States
Targeting United States
Persons Outside the United States"(U//FOUO) Under Section 703, the Government has the authority
to target
Statespersons who are located outside the United States if the collection is effectedUnited
with theassistance of a United States provider and if the collection occurs
inside the United States.
This section only authorizes.electronic surveillance or the acquisitionof stored electronic
communications or stored electronic data that'requires a court order.
Under this section, theFBI will submit a FISA iequest and obtain a FISC order and secondary
orders, as needed.
The-process is the same as the current FISA process. Refer to the FISA
Unit's website forfurther information. This section allows for emergency authorizationand the FBIs Standard
Minimization Procedures apply to the collection. Finally, under
the statute, the surveillancemust cease immediately if the target enters the United States.
If the FBI wishes to surveil theUnited States person while he or she is in the United States, the FBI
must obtain a separate
court order under Title I (electronic surveillance) and/or Title III(physical
search) of FISA inorder to surveil that United States person while the person is locatedin the United States.
C. (U) Section 704 - "Other AcquisitionsTargeting United States
Persons Outside theUnited States!'(U//FOUO) Under Section 704, the Government has the authority to target UnitedStatespersons who are located outside the United States if the collection occurs
outside the UnitedStates:(i.e., without the assistance of a United States' provider). The
statute requires thatthe
FISA court issue an order finding probable cause to believe that
the United States person
target is an agent of a foreign power and reasonably believed to
be located outside the UnitedStates "undercircumstances in which the targeted United States person has a.reasonable
expectation of privacy and a warrant would be required if theacquisition were conducted in
the United States for law enforcement purposes." Under this section,
the FBI will submit a
FISArequest and obtain a FISC order but will not obtain secondary
orders.
The process for
obtaining these orders is the same as the currentFISA request process.
Referto the FISA
Unit's intranet website for further information. This section allows
for emergency
authorization and the FBI's Standard Minimization Procedures
apply to the collection.
Finally, surveillance authorized under this section must cease
if the United States person
enters the. United Statesbut may be re-started if the person is again
reasonably believed to beoutside, the United States during the.authorized period of surveillance.
However, if there is aneed to surveil the target while the target is located insidetheUnitedStates,a separate court
order must be obtained.
(U//FOUO) Generally, the FBI.requires the assistance of other
USIC agencies to implement
this type of surveillance: Specific procedures for requesting that
another USIC agency
implement the surveillance for the FBI, if necessary, are classified
and delineated in FBI
Corporate Policy 121N.
D. (U) Section 705 - "Joint Applications and Concurrent
Authorizations"(U//FOUO) Section 705(a), "joint applications," allows
for the FISC
FBI, authorize a joint application for targeting a United Statesperson to, upon request of the
703 and 704 (inside and outside the Uriited States simultaneously). under both Sections

214
UNCLASSIFIED-FOR OFFICIAL USE ONLYUNCLASSIFIED - FOR OFFICIAL USE ONLY
Domestic Investigations and Operations Guide(U//FOUO) Section 705(b), "concurrent authorizations," states that if an order has
been
obtained under Section 105 (electronic surveillance under Title I of FISA) or 304 (physicalsearch under Title III of FISA), the Attorney General may authorize the targetingof a UnitedStates-person while such person is reasonably believed to be located outside
the United States.
The. Attorney General has this authority under E.O. 12333 § 2.5. In otherwords, if a UnitedStates person target of a "regular" FISA travels outside the United'States during
theauthorized period of the surveillance, the Attorney General, under Section 705(b) and E.O.
12333 § 2.5, can concurrently authorize surveillance to continue while the person
is overseas
obviating the need to obtain a separate order urder Sections 703 or 704. To effectuate
thisauthority, the Attorney General's "Approval page" on all FBI United States person
FISAs
contains standard language authorizing surveillance abroad, if needed.
(U//F.OUO

b2
b7E

215
UNCLASSIFIED-FOR OFFICIAL USE ONLYUNCLASSIFIED - FOR OFFICIAL USE ONLY
Domestic Investigations and Operations Guide

12. (U) Assistance to Other Agencies
12.1. (U) Overview(U//FOUO) Part II of the AGG-Dom authorizes the FBI to conduct investigations
in order todetect or obtain information about, and prevent and protect against, federal
crimes and threats tothe national security and to collect foreign intelligence. Part III of the
AGG-Dom, Assistance to,
OtherAgencies, authorizes the FBI to provide investigative assistance.toother federal, state,
local or tribal, or foreign agencieswhen the investigation has those same
objectives or when theinvestigative assistance is legally authorized for other purposes. Accordingly,
FBI employees
may provide assistance even if it is not for one of the purposes identified
as grounds for an FBI
investigation or assessment, if providing the assistance is otherwise
authorized by law. For
example, investigative assistance is.legally authorized in certain
contexts to state or local
agencies in the investigation of crimes under state or local law, as provided
in 28 U.S.C.
§§ 5 4 0-felonious killing of state and local law enforcement officer; 540A-violent
crime
against travelers; 540B-serial killings, and to foreign agencies in theinvestigation of foreign
law violations pursuant to international agreements. The FBI may use
appropriate lawful
methods in-any authorized investigative-assistance activity.
12.2. (U) Purpose and Scope(U) The AGG-Dom permits FBI personnel to provide investigative

assistance to:A. (U) Authorized intelligence activities of other USIC agencies;
B. (U) Any federal agency in the investigation of federal crimes, threats
to the national security,
foreign intelligence collection, or any other purpose that may be
lawfully authorized;
C. (U) Assist the President in determining whether to use the armed
forces pursuant to 10 U.S.C.
§§ 3 31-33,'when DOJ-authorized as described in
Section 12.5.B.l.c, below;
D. (U) Collect information necessary to facilitate public demonstrations
in order-to protect theexercise of First Amendment rights and ensure public health and safety,
when DOJauthorized and within the restrictions described in Section
12.5.B.1.d, below;
E. (U) State or local agencies in the investigation of crimes
under state or local law where
authorized by federal law (e.g., 28 U.S.C. §§ 540-felonious killingof state and local law
enforcement officer; 5 40A-violent crime against travelers; 540B-serial
killings);
F. (U) State, local, or tribal agencies in the investigation ofmatters that may involve federal
crimes or threats to national security, or for such other purposes
as may be legally authorized;
andG. (U) Foreign agencies in the investigations of foreigin law
violations pursuant to international
agreements, and as otherwise set forth below, consistent with'theinterests of the UnitedStates (including national security interests) and with due considerationof the effect on any
United States person.
(U) The FBI is further authorized to provide technical and scientificassistance to all duly
constituted law enforcement agencies, other organizational
units of the.Department of-Justice,and other federal agencies. 28 C.F.R. § 0.85(g). The FBI's
authority and procedures forproviding technical assistance is further set forth in Section
12.6 below.
216
UNCLASSIFIED-FOR OFFICIAL USE ONLYUNCLASSIFIED - FOR OFFICIAL USE ONLY
Domestic Investigations and Operations Guide(U) Authorized investigative assistance by the FBI to other agencies includes
participation in
joint operations and activities with such agencies. (AGG-Dom, Part III.E.1)
The procedures forproviding investigative assistance, together with the approval:and notification
requirements, areprovided below.
12.3. (U//FOUO) Standards for Providing and Approving Investigative
Assistance to
Other Agencies(U//FOUO) The determination of whether to provide FBI assistance to otheragencies is both"
statutory and discretionary and must be based on consideration of thefollowing factors:
A. (U//FOUO) Assistance is within the scope authorized by the AGG-Dom;
B. (U//FOUO) Assistance is not based solely on the exercise of First Amendment activities oron the race,.ethnicity, national origin or religion of the subject;.andC. (U//FOUO) Assistance is an appropriate use of personnel and financial
resources.
12.4. (U) Documentation, Record Retention and Dissemination
A. (U) Documentation(U//FOUO) When providing assistance to a dbmestic or foreign agency;
the required
documentation in an appropriate case file includes: (i) the name andtype of agency; (ii) theinvestigative methods used; (iii) the opening and closing dates of the request:and (iv
notifications required for the investigative activity.-b2b7E

B. (U) Records Retention for Assistance Furnished to Another
Agency(U//FOUO) A database of records created with theF
lis maintained to permit the
prompt retrieval of the status of the assistance activity (opened or closed), the dates of
opening and closing, and the basis for the assistance activity. (AGG-Dom,
Part III.E.3)
C. (U) Dissemination of Information(U//FOUO) For unclassified information, theIshould be used to document thedissemination of information to: (i).United States Intelligence
Community Agencies; (ii)
United States Federal Agencies; (iii) State, Local, or Tribal Agencies;
Agencies. Dissemination to Foreign Agencies must be in accordance and (iv) Foreign
withthe FBI Foreign
Dissemination Manual,dated May 23, 2008. Classified informationmust be disseminatedpursuant to applicable federal law, Presidential directive, Attorney
General policy and FBI
policy.
12.5.

(U) Duration, Approval and Notice for Investigative

Assistance to Other Agencies(U//FOUO) Investigative assistance that may be fumished to other agencies is described below
by agency type. Dissemination of information to other agencies
must be consistent with Director

217
UNCLASSIFIED-FOR OFFICIAL USE ONLY

b2
b

b7E

UNCLASSIFIED -.FOR OFFICIAL USE ONLY
Domestic Investigations and Operations Guide
of National Intelligence directives, the AGG-Dom, DIOG Section 14, FBI Foreign
Dissemination Manual, and'any applicable MOU/MOA, law, treaty or otherpolicy.
(U//FOUO) Sensitive Investigative Matter: Any assistance to other agencies
involving asensitive investigative niatter requires CDC review, SAC approval, and notification
to theappropriate FBIHQ substantive Unit Chief and Section Chief. (If assistance is toa foreignagency, notification to the Office of International Operations (O10) Unit Chiefand Section Chiefis also required.) Additionally, FBIHQ must provide noticeto the DOJ Criminal Division or
NSD as soon as practicable, but not later than 30 calendar days after the initiationof any'assistance involving a sensitive investigative matter (see classified appendix
for additional noticerequirements),
A. (U) United States Intelligence Community Agencies
1. (U) Authority'(U//FOUO) The FBI may provide investigative assistance (including operational
support)to authorized intelligence activities of other USIC agencies. (AGG-Dom,
Part III.A)
Investigative assistance must be in compliance with interagency memorandaofunderstanding/agreement, if applicable. Forexample,-specific approvaland notification
requirements exist for CIA domestic activities.
2. (U) Approval(U//FOUO) Prior SSA approval is required for providing assistance tothe USIC
assistance uses investigative methods beyond those authorized in assessments. when theAssistanceto other agencies using an investigative method authorized.only for predicatedinvestigations requires supervisory approval at the same level required forthe respective
investigative method if used in an FBI investigation. Specifically, higher
supervisory
approval and notification requirements may exist for conducting a joint operation(e.g.,
investigative operations with the Department of Defense [DoD], DepartmentofHomeland Security), a sensitive investigative matter, and using particularinvestigative
methods as noted in Sections 10 and II, and the Division policy guides.
Assistance forinvestigative methods beyond those authorized in assessments must
be documented in the
FD-999. Approval for use of specific technologies is setforth in Section
12.6 below andtheOTD Manual.
B. (U) United States Federal Agencies
1. (U) Authorities
a. (U//FOUO) The FBI may provide assistance to any other federal agency
in theinvestigation of federal crimes or threats to the national security or in
the collection of
positive foreign intelligence. (Pursuant to Section 9, collection of
positive foreign
intelligence requires prior approval from FBIHQ CMS.) The FBI may
investigative assistance to any federal agency for any other purpose thatprovide
may belegally authorized, including investigative assistance to the Secret
Service in supportof its protective responsibilities. (AGG-Dom, Part III.B.I) See DIOG
Section 12.6
below for guidance in providing technical assistance to federal
agencies.

218
UNCLASSIFIED-FOR OFFICIAL USE.ONLY

UNCLASSIFIED - FOR OFFICIAL USE ONLY
Domestic Investigations and Operations Guideb. (U//FOUO) The FBI must follow MOU/MOA with other federal agencies
whereapplicable. Specific approval and notification requirements exist for
CIA and DoD
domestic-activities.
c. (U) Actual or Threatened Domestic Civil Disordersi.

(U) At the direction of the Attorney General, the Deputy Attorney
General, or
the Assistant Attorney General for the Criminal Division, the FBI
shallcollectinformation relating to actual or threatened civil disorders to assist
the:President
in determining (pursuant to the authority of the President.under 10 U.SC.
§§ 331-33) whether use of the armed forces or militia is required andhow adecision to commit troops should be implemented. The information
sought shallconcern such matters as: (AGG-Dom, Part III.B.2)(a) (U) The size of the actual or threatened disorder, both in numberof people
involved or affected and in a geographic-area;(b) (U) The potential for violence;(c) (U) The potential for expansion of the disorder in light.of community
conditions and underlying causes of the disorder;(d) (U) The relationship of the actual or threatened disorder to the enforcement
federal law or court orders and the likelihood that state or local authorities ofwill
assistin enforcing those laws or orders; arid(e) (U) The extent of state or local resources available to handle the disorder.
ii.
(U) Civil disorder investigations will be authorized only
for a period of 30 days,
but the authorization may be renewed for subsequent 30 day
periods.
iii. (U) The only investigative methods that maybe usedduring a civil disorderinvestigation are:(a) (U) Obtain publicly available information;(b) (U) Access and examine FBI and other DOJ records, and obtain
informationfrom any FBI or other DOJ personnel;(c) (U) Access and examine records maintained by, and request informationfrom,,other federal, state,,local, or tribal, or foreign
governmental entities oragencies;(d) (U) Use online services and resources (whether nonprofit orcommercial);(e) (U) Interview members of the public and private entities; and(U//FOUO) Note: Such interviews may only be conducted
if theemployee identifies himself or herself as an FBI employee and FBI
accurately
discloses the purpose of the interview.
(f) (U) Accept information voluntarily.provided by governmental
or private
entities.

219
UNCLASSIFIED-FOR OFFICIAL USE ONLYUNCLASSIFIED - FOR OFFICIAL USE ONLY
Domestic Investigations and Operations Guide(U) Other methods may be used only if authorized by the Attorney
General,Sthe Deputy Attorney General, or the Assistant Attorney
General for the
Criminal Division.
d. (U) Public Health and Safety Authorities in Relation
toi.

Demonstrations(U) At the direction of the Attorney General, the Deputy
Attorney General, or
the Assistant Attorney General for the Criminal Division,
the FBI shall collectinformation relating to demonstration activities.that are likely
to require thefederal government to take action to facilitate the activities
and provide publichealth and safety measures with respect to those activities.
The information
sought in such an investigation shall be that needed to facilitatean adequate
federal response to ensure public health and safety and toprotect the exercise ofFirst Amendment rights, such as:(a) (U) The time, place, and type of activities planned.
(b) (U) The number of persons expected to participate.
(c) (U) The expected means and routes of travel for participantsand expected
time of arrival.
(d).(U) Any plans for lodging or housing of participants in connection
with thedemonstration.
ii.

(U) The only investigative methods that may be usedin an investigation;under
this paragraph are:(a) (U) Obtain publicly available information;(b) (U) Access and examine FBI and other DOJ records,
and.obtain informationfrom any FBI or other DOJ personnel;(c) (U) Access and examine records maintained by, andrequest information from,other federal, state, local, or tribal, or foreign governmental
entities oragencies;(d) (U) Use online services and resources (whether nonprofit

or commercial);(e) (U) Interview of members of the public and private entities;
and(U//FOUO) Note: Such interviews may only be conducted
if the FBI
employee identifies himself or herself as an.FBI employee
andaccurately
discloses the purpose of the interview.
(f) (U) Acce itnf6rmation voluntarily provided by governmental
or private
entities.
(U) Other methods may be used only if authorized by the
Attorney General,the Deputy Attorney General, or the Assistant Attorney
General for the

Criminal Division.

2. (U) Approval(U//FOUO) Prior SSA approval is required for assistanceto another federal agency when
the assistance uses investigative methods beyond
those authorized in assessments.
220
UNCLASSIFIED-FOR OFFICIAL USE ONLYUNCLASSIFIED - FOR OFFICIAL USE ONLY
Domestic Investigations and Operations Guide
Assistance to other agencies using an investigative method authorized
investigations requires supervisory approval at the same level required only for predicatedfor the respective
investigative method if used in an FBI investigation, as provided in
Section I I
Specifically, higher supervisory approval and notification requirements
may exist for
conducting ajoint operation, a sensitive investigative matter, andusing particularinvestigative methods, as noted in Sections 10 and I I and in theDivision policy guides.
Assistance for investigative methods beyond those authorized
in assessments must be
documented in the.FD-999. Approval for use of specific technologies is set forthin
Section 12.6, below and the OTD Manual.
C. (U) State, Local, or Tribal Agencies
1. (U) Authorities
a. (U) The FBI may provide investigative assistance to state,
local, or tiibal agencies in
the investigation of matters that may involve federal crimes or threats
to the natioial
security, or for other legally authorized purposes. Legally authorizedpurposes
include,but are not limited'to, a specific federal statutory grant of authority
such
as
that
provided by 28 U.S.C. §§ 5 4 0-felonious killing of state and local
law enforcement
officer; 540A-violent crime against travelers; 540B--serial
killings.
(AGG-Doni,PatIII.C) The FBI is further authorized to provide other material,
scientific andtechnical assistance to state, local, and tribal agencies. (See 28
C.F.R. § 0.85[g] andDIOG Section 12.6, below.)b. (U//FOUO) The FBI must follow applicable MOU/MOA
and/or treaties when it
provides assistance to state, local, and tribal agencies.
c. (U//FOUO) As a federal agency, the FBI's authority to investigate
derives from fedefal statutes and is generally limited to violhtions criminal offensesof federal law. See
18 U.S.C. § 3052, 28 U.S.C. § 533 (1) and 28 C.F.R. § 0.85.
Withsuch as those cited in Section 12.2.E., above, the FBI does not havelimited exceptions,any federal
authority to investigate state crimes. FBI:employees can assist
in the investigation ofother criminal matters with state and local authorities only if there
is a reasonablebasis to believe that the investigation will prevent, detect or lead to evidenceofviolation of federal law or a threat to the nationalsecurity)

b2

b7E

d. (U//FOUO

b2
b7E.

221
UNCLASSIFIED-FOR OFFICIAL USE ONLYUNCLASSIFIED - FOR OFFICIAL USE ONLY
Domestic Investigations and Operations Guide

b2

b7E

e. (U//FOUO)
b2
b7E

f.

(U//FOUO

b2

g. (U//FOUOI
b2
b7E

h. (U//FOUO
b2
b7E

i. (U//FOUO) When credible information is received by an FBI employee concerning
serious criminal activity not within the FBI's investigative jurisdiction,theemployee must promptly transmit the information or refer the complainant FBI
to a lawenforcement agency having jurisdiction, except when disclosure would
jeopardize an
ongoing.investigation, endanger the safety of an individual, disclose the identity
of ahuman source, interfere with a human source's cooperation, or reveal legallyprivileged information. If full-disclosure is not made for any of the reasons indicated,
then,.whenever feasible, the FBI employee must make at least limited
disclosure to alaw enforcement agency or agencies having jurisdiction, and full
disclosure must be
made as soon as the need for restricting the information is nolonger present. Where
222
UNCLASSIFIED-FOR OFFICIAL USE ONLYUNCLASSIFIED - FOR OFFICIAL USE ONLY
Domestic Investigations and Operations Guide
disclosure is not made to the appropriate law enforcement agencies
within 180 days,
the FBI employee/Field Office must notify the appropriate substantive
Unit at FBI
Headquarters in writing concerning the facts and circumstances
concerning thecriminal activity. FBI Headquarters is required to make periodic
reports
Attorney General on such non-disclosure and incomplete disclosures. to the Deputy(AGG-Dom,Part VI.C.2)
2. (U) Approval(U//FOUO) Prior SSA approval is required'for assistance to state, local,
when the assistance uses investigative methods beyond those authorized, or tribal agencies
in assessments.
Assistance to other agencies using an investigative method authorized
only
for predicatedinvestigations requires supervisory approval at the same level
requiredfortherespective
investigative method if used in an FBI investigation. Specifically,
higher supervisory
approval and notification requirements may exist for conducting ajoint operation,asensitive investigative matter, and using particular investigative
methods, as noted in
Sections 10 and I I and in the Division policy guides. Assistancefor investigative
methods beyond those authorized in assessments must be documented
in the FD-999.
Approval for use of specific technologies is set forth in Section 12.6,
below
and the OTD
Manual.
D: (U) Foreign Agenciesl. (U//FOUO) General: The foundationofthe FBI's international
program is the Legat
Each Legat is the Director's personal representative in the foreigncountries in which
he/she resides or has regional responsibilities. The Legat's job is'to
respond to the FBI's
domestic and foreign investigative needs. The Legat can accomplish
this because he or
she has developed partnerships and fostered cooperation
with his-or her foreigncounterparts on every level and is familiar with investigative
rules, protocols, andpractices that differ from country to country. This is the Legat's
As such, foreign agency requests.for assistance will likely come primary responsibility.
to the FBI through theLegat. If, however, foreign agency requests for assistancebypass the Legat, the FBI
employee must notify the Legat and OIO, as discussed in greater
detail below.
2. (U) Authorities
a. (U//FOUO) At the request of foreign law enforcement,
intelligence,agencies, the FBI may conduct investigations or provide assistance or security
to investigations
by such agencies, consistent with the interests of the United States(including national
security interests) and with due consideration of the effecton any United States
person. (AGG-Dom, Part III.D. 1)The FBI must follow applicable
MOUs, MOAs;
Mutual Legal Assistance Treaties (MLAT) and other treaties
when it provides
assistance to foreign governments.
i.

(U//FOUOJ
b2
b7E

223
UNCLASSIFIED-FOR OFFICIAL USE ONLYUNCLASSIFIED - FOR OFFICIAL USE ONLY
Domestic Investigations and Operations Guideb. (U//FOUO)

b
b2
b7E

c. (U//FOUO) The FBI may not provide assistance to foreign law enforcement
intelligence, or security officers conducting investigations within
the Unitedunless such officers have provided prior written notification to the Attorney States
Generalof their status as an agent of a foreign government,as required by 18
U.S.C. § 951.
(AGG-Dom, Part III.D.2) The notification required by 18 U.S.C.
§ 951 is notapplicable to diplomats, consular officers or attach6s.
d. (U//FOUO) Upon the request of a foreign government agency, theFBI may conduct
background inquiries concerning individuals whose consent is documented.
AGGDom, Part III.D.3)
e. (U//FOUO) The AGG-Dom, Part III.D.4 authorizes the FBI
to provide other material
and technical assistance to foreign governments to the extent not otherwise
prohibitedby law. AG Order 2954-2008 authorizes the FBI to provide technical assistancetoforeign governments, as referenced below in Section 12.6.
3. (U) Approvala. (U//FOUO) Prior SSA approval is required for all assistance to foreign
agencies. Allassistance must be documented in the FD-999 and that approval should be
documented in the file.
b. (U//FOUOJ
b2
b7E

c. (U//FOUOb
b2
b7E

d.

(U//FOUO*

b2
b7E

b2
b7E

224
UNCLASSIFIED-FOR OFFICIAL USE ONLYUNCLASSIFIED - FOR OFFICIAL USE ONLY
Domestic Investigations and Operations Guide

b2
b7E

ii.

(U//FOUO]

b2
b7E

4. (U) Noticea. (U//FOUO)

b2
b7E

b. (U) The FBI must notify the DOJ NSD concerning investigation
or assistance where
both: (i) FBIHQs approval for the activity is required (e.g.,
FBIHQ approval required
to use a particular investigative method); and (ii) the activity
relates to a threat to theUnited States national security. The FBIHQ Divisionapproving
the use of theinvestigativemethod must notify DOJ NSD as soon as practicable, but
no later than
30 calendar days after FBIHQ approval (see classified appendix forI
I _.
j(AGG-Dom, Part III.D.1)
5. (U) Dissemination

I

b2
b7E

(UI/FOUO) All dissemination of FBI information to foreign agencies must
be conductedaccording to the FBI Foreign Dissemination Manual; dated May
23, 2008
12.6. (U//FOUO) Standards for Providing and Approving Technical Assistanceto.Foreign,State, Local and Tribal Agencies
A. (U) Authority
1. (U//FOUO)
b2
b7E

225
UNCLASSIFIED-FOR OFFICIAL USE ONLYUNCLASSIFIED - FOR OFFICIAL USE ONLY
Domestic Investigations and Operations Guidec. (U//FOUO)

b2

b7E

d. (U//FOUO)

b2

b7E

e. (U//FOUO
f. (U//FOUOr

b2
l

b2
b7E

g. (U//FOUO

b2
b7E

2. (U//FOUO
b2
b7E

3.

(U/F0UO)|

B. (U) Approval(U//FOUO) All technical assistance must be approved by the Director
or his designatedsenior executive FBI official, as provided in the OTD manual. All technicalassistance must
be documented in an FBI assessment file, predicated investigation file, a domestic policecooperation file, a foreign police cooperation file, or other investigative/technicalassistancecontrol file Additionally, all.technical assistancemust be documentedin the FD-999 or its
successor.

226
UNCLASSIFIED-FOR OFFICIAL USE ONLYb2
b7E

UNCLASSIFIED - FOR OFFICIAL USE ONLY
Domestic Investigations and Operations Guide

13. (U) ExtraterritorialProvisions
13.1. (U) Overview(U//FOUO) The.FBI may conduct investigations abroad, participate,with foreign officials ininvestigations abroad,or otherwise conduct activities outside theUnited States. The guidelines
for conducting investigative activities outside of the United States
are currently contained in: (i)The Attorney General'sGuidelinesfor ExtraterritorialFBI Operationsand Criminal
Investigations; (ii) The Attorney General'sGuidelinesfor FBINational
Security Investigations
and ForeignIntelligence Collection; and (iii) The Attorney
General Guidelineson theDevelopment and Operationof FBI CriminalInformants
and Cooperative Witnesses inExtraterritorialJurisdictions(collectively, the Extraterritorial Guidelines).
The Attorney
General'sGuidelinesfor ExtraterritorialFBIOperationsare
currently being drafted, as
discussed in DIOG Section 2.1, and will supercede the above
listed guidelines, or applicableprovisions thereof.
13.2. (U) Purpose and Scope(U//FOUO) As a general rule, the Extraterritorial Guidelines apply
when FBI personnel orconfidential human sources are actively enaged:in -iestiie
activi outside thebordes oftheUnited States

b2
b7E

b2

A. (U//FOUO

b7E
b2

B. (U//FOUO

b7E

c. (U//EOUO

b7E
b7E

D. (U//FOUO)

b2

i .b7E
E. (U//FOUO)

b7E

F. (U//FOUO)I

b

b[b7
b2

b7E

H.

ISn

OF/FOA

b2
b2

b7E
b7E

J. (U/FOUO)
b2
b7E

227
UNCLASSIFIED-FOR OFFICIAL USE ONLYUNCLASSIFIED - FOR OFFICIAL USE ONLY
Domestic Investigations and Operations Guide(U//FOUO) FBI personnel planning to engage in any of the investigative
the subsection above must obtain the concurrence of the appropriate Legatactivities described inand must comply withthe remaining procedural requirement of the Extraterritorial. Guidelines. For additional
information consult the Extraterritorial Section of the OGC website.
13.3. (U) Legal Attache-Program(U//FOUO)The foundation of the FBI's international programis the Legat. Each Legat is the
Director's personal representative in the foreign countries
in which he/she resides or has regional
responsibilities. The Legat's job is to respond to the FBI's domestic
and extraterritorial
investigative needs. Legats can accomplish this mission because
they have developed
partnerships and fostered cooperation with their foreign counterpartson every level and arefamiliar withlocal investigative rules, protocols, and practices
which differ from country tocountry. For additional information consult the FBIHQ 010
website.

228

UNCLASSIFIED - FOR OFFICIAL USE ONLY
Domestic Investigations andOperations Guide

14. (U) Retention and Sharing of Information
14.1. (U) Purpose and Scope(U//FOUO) Every FBI component is responsible for the creation and maintenance of authentic,
reliable, and trustworthy records. Without complete and accessible records,.the FBI cannot
conduct investigations, gather and analyze intelligence, assist with the prosecution of criminals,
or perform any of its critical missions effectively.
(U//FOUO) The FBI is committed to ensuring that its records management programaccomplishes the following goals:
A. (U//FOUO) Facilitates the documentation of official decisions, policies, activities, andtransactions;

B. (U//FOUO) Facilitates the timely retrieval of needed information;
C. (U//FOUO) Ensures continuity of FBI business;
D. (U//FOUO) Controls the creation and growth of FBI records;
E. (U//FOUO) Reduces operating costs by managing records according to FBI business needs
and by disposing of unneeded records in a timely manner;
F. (U//FOUO) Improves efficiency and productivity through effective records storage andretrieval methods;
G. (U//FOUO) Ensures compliance with applicable laws and regulations;
H. (U//FOUO) Safeguards the FBI's mission-critical information;
I. (U//FOUO) Preserves the FBI's corporate meinory and history; andJ. (U//FOUO) Implements records management technologies to support all of the goals listed
above.
14.2. (U) The FBI's Records Retention Plan, and Documentation(U//FOUO) The FBI must retain.records relating to investigative activities according to a records
retention plan approved by the NARA. (AGG-Dom, Part VI.A.1)(U//FOUO) The FBI's disposition authorities provide specific instructions about the length oftime that records must be maintained. In some instances, records may be destroyed-after aprescribed period of time has elapsed. Other records are never destroyed and are transferred to
NARA a certain number of years after a case was closed.
A. (U//FOUO) The FBI must maintain a database or records system that permits, with respect toeach predicated investigation, the prompt retrieval of the status of the investigation (open or
closed), the dates of opening and closing, and the basis for the, investigation. (AGG-Dom,
Part VI.A.2)(U//FOUO) The FBI has updated its official File Classification System to cover records
related to all investigative and intelligence collection activities, including assessments.
Records are maintained in the FBI's Central Records System or other designated systems ofrecords, that provide the required maintenance and retrieval functionality.
229
UNCLASSIFIED-FOR OFFICIAL USE ONLYUNCLASSIFIED - FOR OFFICIAL USE ONLY
Domestic Investigations and Operations Guide
B. (U//FOUO) Assessments must also adhere to the standards
as set forth in the Records
Management Division Disposition Plan and Retention Plan.
All records,
assessments, may be destroyed or expunged earlier than the destruction including
schedule throughproper authority.
(U//FOUO) All Bureau records are maintained for their full retention
periods, except undercertain. circumstances under which they may be either destroyedearlier or retained.longer.
Records may be retained for a longer period than their disposition
authority specifTis,if they
are subject to a litigation freeze. Court orders may direct thatcertain records be expunged
from a case file, or (more rarely) that the entire case file be
expunged. Under certain
circumstances, individuals may also request that certain records
be expunged. Expungementof records may mean the physical removal and destruction of somedepending on the court order and the governing statute or program, or all of the record or,
it may mean the removal,
sealing; and secure storage of records away from the remaining
file. In most instances, only
certain documents, not the entire file, are subject to expungement.
14.3. (U) Information Sharing(U//FOUo) The FBI 2008 National Information Sharing Strate.
(NISS) provides the common
vision, goals, and framework needed to guide inf6rmation
sharing initiatives with our federal,state, local, and tribal agency partners; foreign government
counterparts, and private sector
stakeholders. The FBI NISS addresses the cultural and technologicalchanges required to move
the FBI to "a responsibility to provide" culture. This will beaccomplished by using the bestpractices and technology standards of both communities as we
support the intelligence and law
enforcement communities in collection, dissemination,
analysis,collaboration,and operational
efforts.
A. (U) Permissive Sharing(U//FOUO) Consistent with the Privacy Act and any other applicable laws
and memorandaof understanding or agreement with other-agencies concerning
the dissemination of
information, the FBI may disseminate information obtainedor produced through activities
under the AGG-Dom:
1. (U//FOUO) Within the FBI and to all other componentsof the Department of Justice if
the recipients have need of the information in the performanceof their official duties.
2. (U//FOUO) To other federal agencies if disclosure is compatible
with the purpose forwhich the information was collected and it is related to their
responsibilities. In relation
to other USIC agencies, the determination whether the informationis related to therecipient responsibilities may be left to the recipient.
3. (U//FOUO) To state, local, or Indian tribal agencies directly
engaged in the criminal
justice process where access is directly related to a law enforcement
function of therecipient agency.
4. (U//FOUO) To congressional committees as authorized
by the DOJ Office ofLegislative Affairs.
5. (U//FOUO) To foreign agencies if the FBI determinesthat the information is related totheir responsibilities; the dissemination is consistent with
the interests ofthe United
230
UNCLASSIFIED-FOR OFFICIAL USE ONLYUNCLASSIFIED - FOR OFFICIAL USE ONLY
Domestic Investigations and Operations Guide
States (including national security interests); and where thepurpose ofcompatible with the purpose for which the information was collected. the disclosure is
6. (U//FOUO) If the.information is publicly available, does not
identify United States
persons, or is disseminated with the consent of the person whom
it concerns..
7. (U//FOUO) If the dissemination is necessary to protect.thesafety or security of persons
or property, to protect against or prevent a crime or imminent
threatsecurity, or to 6btain information for the conductof an authorized to the national
FBI investigation.
8. (U//FOUO) If dissemination of the information is otherwise
permitted by the Privacy
Act (5 U.S.C.§ 552a) (AGG-Dom, Part VI.B.1)(U//FOUO) All FBI information sharing activities under this section
shall be according toCororate Policy Directive 12D, "FBI Sharing Activities with Other
Government
Agencies,"
95D "Protecting Privacy in.the Information Sharing Environment,"
and any amendments
thereto and applicable succeeding policy directives.
B. (U) Required Sharing(U//FOUO) The FBI must share and disseminate information as
required by statutes, treaties,
Executive Orders, Presidential directives National Security Council
directives, Homeland
Security Council directives, DNI directives, Attorney General-approved
policies, and MOUsor MOAs; as consistent with the Privacy Act.
14.4. (U) Information Related to Criminal Matters
A. (U) Coordinating with Prosecutors(U//FOUO) In an investigation relating to possible criminal activity
in violation of federallaw, the FBI employee conducting the investigation must
maintain periodic written or oral
contact with the appropriate federal prosecutor, as circumstances
warrant and as requested by
the prosecutor. When, during such an investigation, a matter
appears arguably to warrant
prosecution, the FBI employee must present the relevantto the appropriate federal
prosecutor. Information on investigations that have been facts
closed must be available on request
to a United States Attorney or his or her, designee or an appropriate
Department of Justiceofficial. (AG-Dom, Part VI.C)
B. (U) Criminal Matters Outside FBI Jurisdiction(U//FOUO) When credible information is received by an
FBI employee concerning serious
criminal activity not within the FBI's investigative jurisdiction;
the FBI employee must
promptly transmit the information or refer the complainant to a-law
enforcement agency
having jurisdiction, except where disclosure would jeopardizeanongoing
investigation,
endanger the safety of an individual, disclose the identity of a CHS,
interfere with thecooperation of a CHS, or reveal legally privileged information.
If full disclosure is not madefor the reasons indicated, then, whenever feasible, the FBI
must make at least
limited disclosure to a law enforcement agency or agenciesemployee
having jurisdiction, and full
disclosure must be made as soon as the need for restricting
disclosure is no longer present.
Where full disclosure is not made to the appropriate law enforcementdays, the FBI employee/Field Office must promptly notify-FBIHQ agencies within 180
in writing of the facts andcircumstances concerning the criminal activity. The FBI
must make periodic reports.to the231
UNCLASSIFIED-FOR OFFICIAL USE ONLYUNCLASSIFIED - FOR OFFICIAL USE ONLY
Domestic Investigations and Operations Guide
Deputy Attorney General on such non-disclosures and incomplete
disclosures, in a form
suitable to protect the identity of a CHS. (AGG-Dom, Part
VI.C)
C. (U) Reporting of Criminal Activity(U//FOUO) When it appears that an FBI employee has engaged
in criminal activity in thecourse of an investigation under the AGG-Dom, the FBI must
notify the USAO or an
appropriate DOJ Division. When it.appears that a CHS has engaged
in criminal activity in thecourse of an investigation under the AGG-Dom, the FBI mustproceed
as provided in the
AGG-CIJS. When information concerning possible criminal activitybyany other person
appears in the course of an investigation under the AGG-Dom,
the
FBI
must
initiate an
investigation of the criminal activity if warranted. (AGG-Dom,
Part VI.C.3)(U//FOUO) The reporting requirements under this paragraph relating to criminal
activity by
an FBI employee or a CHS do not apply to otherwise illegal
activity
conformity with the AGG-Dom or other Attorney General guidelinesthat is authorized inor to minor traffic
offenses. (AGG-Dom, Part VI.C.3)
14.5. (U) Information Related to National Security
and Foreign Intelligence Matters(U//FOUO) All information sh ar ing with a foreign government
related to classified national
securiy and foreign intelligice-mist-ad here to theFBI Foreign Dissemination
Manal effectie
05/23/2008 and effective policies governing MOUs.
(U//FOUO)The general'principle reflected in current law
andresponsibility to provide information as consistently and fully policy is that there is a
as possible to agencies with
relevant responsibilities to protect the United States and its people
from terrorism.and otherthreats to the national security, except as limited by specific constraints
on such sharing. The
FBI's responsibility in this area includes carrying out the requirementsof the MOU Between theIntelligence Community, Federal Law Enforcement Agencies, andthe Department of Homeland,
Security Concerning Information Sharing (March 4, 2003), or any successor
memorandum.of
understanding or-agreement. Specific requirements also exist forinternal .coordination andconsultation with other DOJ components, and for sharing national
security and foreign
intelligence information with White House agencies, as
providedinthe ensuing paragraphs.
(AGG-Dom, Part VID)
(U) Department of JusticeA. (U//FOUO) The DOJNSD must have access to all information
obtained by the FBI throughactivities relating to threats to the national security or
foreign intelligence. The Director of
the FBI and the Assistant Attorney General for National
Security must consult concerningthese activities whenever requested-by either of them,and the FBI must provide such reports
and information concerning these activities as the AssistantAttorney General for National
Security may request. In addition to any reports or information
the Assistant Attorney
General for National Security may specially request
under this subparagraph, the FBI must
provide annual reports to the NSD
concerning its foreign intelligence collection program,including information concerning the scope and natureofintelligence collection
activities in each FBI Field Office. (AGG-Dom, Part VI.D.foreign
1)
B. (U//FOUO) The FBI must keep the NSD apprisedofactivities under the AGG-Dom that is necessary to theall information obtained throughability of the Urnited States toinvestigate or protect against threats to the national security,that includes regular232
UNCLASSIFIED-FOR OFFICIAL USE ONLYUNCLASSIFIED - FOR OFFICIAL USE ONLY
Domestic Investigations and Operations Guide
consultations between the FBI and the NSD to exchange advice
and information relevant toaddressing such threats through criminal prosecution or other means.
(AGO-Dom, Part
VI.D.1)
C. (U//FOUO) Except for counterintelligence investigations, a relevant
to and must receive information from the FBI relating to threats to USAO must have accessthe national security, andmay engage in consultations with the FBI relating to such threats,
to the same extent as the
NSD. The relevant USAO must receive such access and informationfrom the EBI,Field;
Offices. (AGG-Dom, Part VI.D.1)
D. (U//FOUO) In a counterintelligence investigation - e.g., an investigation
relating to a matterdescribed in Part VII.S.2 of the AGG-Dom - the FBI's providing
information to andconsultation with a relevant USAO is subject to authorizationby thewith the Executive Office for United States Attorneys and the FBI, NSD. In consultation
the NSD must establish
policies setting forth circumstances in which the FBI will consult
with.the NSD prior to
informing a relevant USAO about such an investigation. The policies
established by the NSD
must (among other things) provide that:
1. (U//FOUO) The NSD will, within 30 days, authorize the FBI
to share with the USAO
information relating to certain espionage investigations, as
defined by the policies, unlesssuch information is withheld because of substantial natiobial ecurity considerations; and2. (U//FOUO) The FBI may consult freely with the USAO concerninginvestigations within
the scope of this subparagraph during an emergency, so long as
the NSD is notified ofsuch consultation as soon as practicable after the consultation.
(AGG-Dom, Part VI.D.1)
E. (U//FOUO) Information shared with a USAO pursuant to
DIOG subparagraph 14.5 (National
Security) must be disclosed only to the United States Attorney or
any AUSA designated by
the United States Attorney as points of contact to receive suchinformation.
States Attorney and designated AUSA must have an appropriate security The United
clearance andmust
receive training in the handling of classified information andinformation derived from FISA,
including training concerning the secure handling and storageof such information andtraining concerning requirements and limitations relating to theuse, retention, anddissemination of such information. (AGG-Dom, Part VI.D.I)
F. (U//FOU) The disclosure and sharing of information by
the FBI under this paragraph issubject to any limitations required in orders issued by the FISC,
controls imposed by theoriginators of sensitive material, and restrictions established by
the Attorney General or.theDeputy Attorney General in particular cases. The disclosure
the FBI under this paragraph that may disclose the identity ofarid sharing of information by
a CHS is governed by therelevant provisions of the AGG-CHS. (AGG-Dom, Part VI.D.1)(U) White House(U//FOUO) In order to carry out their responsibilities, the President,
Assistant to the President for National Security Affairs, the Assistantthe Vice President, theto the President forHomeland Security Affairs, the National Security Council (NSC) andits staff, the Homeland
Security Council (HSC) and its staff, and other White House officials
and offices require
information from all federal agencies, including foreign intelligence,and information relating tointernational terrorism and other threats to the national security.
The FBI accordingly may
233
UNCLASSIFIED-FOR OFFICIAL USE ONLYUNCLASSIFIED - FOR OFFICIAL USE ONLY
Domestic Investigations and Operations Guide
disseminate to the White House foreign intelligence and national security
information obtained
through activities under the AGG-Dom, subject to the following standards
and procedures.
A. (U//FOUO) White House must request such information throughthe NSC staff or HSC staff
including, but not limited to, the NSC Legal and Intelligence Directorates
and Office of
Combating Terrorism, or through the President's Intelligence Advisory
Board or the Counsel
to the President. (AGG-Dom, Part VI.D.2.a)(U//FOUO) If the White House sends a request for such inforination-to
the FBI without firstsending the request through the entities described above, the request
must be returned to theWhite House for resubmission.
B. (U//FOUO) Compromising information concerning domestic officials
or politicalorganizations, or information concerning.activities of United States persons
intended to affectthe political processin the United States, may be disseminated to theWhite House only withthe approval of the Attorney General, based on a determination thatsuch dissemination isneeded for foreign intelligence purposes, for the purpose ofprotecting
against international
terrorism or other threats to the national security, or for the.conduct offoreign affairs.
However, such approval is not required for dissemination-to the WhiteHouse of information
concerning efforts of foreign intelligence services to penetrate theWhite House, orconcerning contacts by White House personnel with foreign intelligence
service personnel.
(AGG-Dom, Part VI.D.2.b)
C. (U//FOUO) Examples of types of information that are suitablefor dissemination to the WhiteHouse on a routine basis include, but are not limited to (AGG-Dom,
Part VI.D.2.c):
1. (U//FOUO) Information concerning international terrorism;
2. (U//FOUO) Information concerning activities of foreign intelligence
services in the
United States;
3. (U//FOUO)Information indicative of imminent hostilities involving
any foreign power;
4. (U//FOUO) Information concerning potential cyber threats to theUnited States.or its
allies;5. (U//FOUO) Information indicative of policy positions adopted
by foreign officials,
governments, or powers, or their reactions to United States foreign
policy initiatives;
6. (U//FOUO) Information relating to possible changes in leadership positionsof foreign
governments, parties, factions, or powers;
7. (U//FOUO) Information concerning foreign economic or foreign
political matters thatmight have national security ramifications; and8. (U//FOUO) Information set forth in regularly published national
intelligencerequirements.
D. (U//FOUO) Communicationsby the FBI to the White House
that relate to a national security
iatter,and concern a litigation issue for a specific pending casemust be made known to the
Office of the Attorney General, the Office of the Deputy Attorney
General, or the Office of
the Associate Attorney General. White House policy may limit
or prescribe the White House
personnel who may request information concerning such issues
from the FBI. (AGG-Dom
Part VI.D.2.d)
234
UNCLASSIFIED-FOR OFFICIAL USE ONLYUNCLASSIFIED - FOR OFFICIAL USE ONLY
Domestic Investigations and Operations Guide
E. (U//FOUO) The limitations on dissemination of informationby the FBI to the White House
under the AGG-Dom do not apply to dissemination to the WhiteHouse of informationacquired in the course of an FBI investigation requested by the WhiteHouse into thebackground of a potential employee or appointee, or responses
to requests from the WhiteHouse under E.O. 10450 relating to security requirements
for government employment.
(AGG-Dom, Part VI.D.2.e)
14.6. (U) Special Statutory Requirements
A. (U) Dissemination of information acquired under the FISA is, to the extent providedin
that
Act, subject to minimization procedures and other requirements
specifiedin that Act. (AGGDom, Part VI.D.3.a)
B. (U) Information obtained through the use of NSLs under 15
U.S.C. § 1681v (NSLs to obtainfull credit reports) may be disseminated in conformity with thegeneral standards of AGGDom, Part VI, and DIOG Section I 1.9.3.G. Information.obtained
through the use of NSLs
under other statutes may be.disseminated in conformity with the general standardsof theAGG-Dom, Part VI, subject to any applicable limitationsin their governing statutory
provisions (see DIOG Section 11.9.3.G): 12 U.S.C. § 3414(a)(5)(B); 15 U.S.C.
§ 1681u(f);18 U.S.C. § 2709(d); 50 U.S.C. § 436(e). (AGG-Dom, Part VI.D.3.b)

235
UNCLASSIFIED-FOR OFFICIAL USE ONLYUNCLASSIFIED - FOR OFFICIAL USE ONLY
Domestic Investigations and Operations Guide

15. (U) Intelligence Analysis and Planning
15.1. (U) Overview(U//FOUO) The AGG-Dom provide specific guidance and authorization
for intelligence analysis
and planning. This authority enables the FBI to identify and understandtrends,causes, andpotential indicia of criminal activity and other threats to theUnited States that wouldiot beapparent from the investigation of discrete matters alone. By meansof intelligence analysis andplanning, the FBI can more effectively discover criminal threats,
threats
to the national security,and other matters of national intelligence interest, and can provide
the critical support needed forthe effective discharge of its investigative responsibilities andother authorized activities. (AGGDom, Part IV)(U//FOUO) In carrying out its intelligence functions under Part
IV of the AGG-Dom, the FBI isauthorized to collect information using all assessment investigative
methods authorized in Part Iof the AGG-Dom as described in the-DIOG Section 5b2
b7E

Investigative activities under theAGG-Dom and ther legally authorized acites throughwhich the FBI acquires information, data, or intelligence may
be utilized, structured,and prioritized to support and effectuate the FBI's intelligence properly
mission. (AGG-Dom, Part
Ii.A.3.d and Part IV, Intro.)(U//FOUO) Note: In the DIOG,'the word "assessment" has two
distinct meanings. The AGGDom authorizes as an investigative activity an "assessment,"
which requires an authorizedpurpose as discussed in Section 5. The USIC, however,also uses the word "assessment" todescribe written intelligence products, as discussed in Section
15.7.B.
15.2. (U) Purpose and Scope
A. (U//FOUO) Functions Authorized: The AGG-Dom authorizes
the FBI to engage in
intelligence analysis and planning to facilitate and support
investigative
activities and otherauthorized activities. The functions authorized:include:
1. (U//FOUO) Development of overviews and analyses
concerning threats to andvulnerabilities of the United States and its interests, suchas domain management as
related to the FBI's responsibilities;
2. (U//FOUO) Research and analysis to produce reports andassessments
products) concerning matters derived from or relevant to investigative (analyticalactivities or otherauthorized FBI activities; and3. (U//FOUO) The operation of intelligence and information
systems that facilitate andsupport investigations and analysis through the compilation
and analysis of data andinformation on an ongoing basis. (AGG-Dom,
Introduction B)
B. (U//FOUO) Integration of Intelligence Activities: Inorder to protect against national
security ahd criminal threats through intelligence-driven
intelligence activities into all investigative efforts by: operations, the FBI should integrate

236
UNCLASSIFIED-FOR OFFICIAL USE ONLYUNCLASSIFIED - FOR OFFICIAL USE ONLY
Domestic Investigations and Operations Guide
1. (U//FOUO) Systematically assessing particular geographic areas
potential threats, vulnerabilities, gaps, and collection opportunitiesor sectors to identify
in.response
collection requirements that support the broad range of FBI responsibilities; to FBI
2. (U//FOUO) Pro-actively directing resources to collectagainstmatters of interest to the nation and the FBI, and developing potential threats and othernew collection capabilities
where needed;
3. (U//FOUO) Continuously validating collection capabilities
to ensure information
integrity;
4. (U//FOUO) Deliberately gathering information in response
to articulated priority
intelligence requirements using all available collection resources,
then expeditiously
preparing the collected information-for analysis and dissemination and promptly
disseminating it to appropriate partners at the local, state,.nationaland foreign level; and5. (U//FOUO) Purposefully evaluating the implications,of collected information on current
and emerging threat issues.
C. (U//FOUO) Analysis and Planning not Requiring
the Initiation of an AGG-Dom Part II
Assessment. (see DIOG Section 5):1

b2
-b7E

As part of such analysis, an FBI employee can analyze historical information alreadycontained within: (i) FBI data sstems (ii) US systems
to which the FBI employe hasaccess (e.g.,; (iii) any other United States Government datasystem to which the BI employee has access; and (iv) the
FBI employee can also conductopen-source Internet searches. Open-source Internet searches
do not include any paid-forservice databases such as Lexis-Nexis and Choicepoint

b

b

b2

b7E

15.3. (U) Civil Liberties and Privacy(U) Tlie'FBI must collect intelligence critical -to the FBI'sability to carry out its intelligence andlaw enforcement mission. While conducting intelligence
analysis and planning, the FBI willconduct.its activities in compliance with the Constitution, federallaws, the.AGG-Dom and otherrelevant authorities in order to protect civil,liberties andprivacy.
15.4. (U) Legal Authority(U) The FBI is an intelligence agency as well as a law
basic, functions extend. beyond limited investigations enforcement-agency. Accordingly, itsof discrete matters, and include broader
analytic and planning functions. The FBI's responsibilities inthis area derive from various
administrative and statutory sources. See, e.g., E.O. 12333§ 17(g); 28 U.S.C. §§ 532 note
(incorporating P.L. 108-458 §§ 2001-2003) and-534
note (incorporating P.L. 109-162 § 1107).
(U//FOUO) The scope of authorized activities under Part IIof"investigation" in a narrow sense, such as solving particular the AGG-Dom is not limited tocases or obtaining evidence for use
237
UNCLASSIFIED-FOR OFFICIAL USE ONLYUNCLASSIFIED - FOR OFFICIAL USE ONLY
Domestic Investigations and Operations Guidein particular criminal prosecutions. Rather, the investigative activities
authorized under the
AGG-Dom may be properly used to provide critical informationneeded for broader analytic andintelligence purposes to facilitate the solution and preventionof crime, protect the national
security, and further foreign intelligence objectives. These
purposes include use of theinformation in intelligence analysis and planning under AGG-Dom,
IV, and disseminationof the information to other law enforcement, USIC, and White HousePart
agencies under AGG-Dom,
Part VI. Accordingly, information obtained at all stages ofinvestigative activity is to-be retainedand disseminated. for these purposes as provided in the AGG-Dom,or in FBI policy consistent
with the AGG-Dom, regardless of whether it furthers investigative
objectives in a narrower or
Smore immediate sense. (AGG-Dom, Part II)
15.5. (U/FOUO) Standards for Initiating or Approving
Intelligence Analysis andPlanning(U//FOUO) If an FBI employee wishes to engage in Intelligence
Analysis and Planning that
requires the collection or examination of information notavailable: (i) through an open-source
Internet search; (ii) in the FBI's existing files; (iii) in the USIC
data
employee has access; or (iv) in any other United States Government systems to which the FBI
data system to which the
FBI employee has acces, an assessment must be initiated.
An FBI employee or. approving official,
A. (U//FOUO) An authorized purpose and objective exists
for the conduct of an assessment (e.g.,
information is.needed in order to conduct appropriate intelligence
analysis ard planning);
B. (U//FOUO) The assessment is based on factors otherthan
the exercise of First Amendment
activities or on the race, ethnicity, national origin or
religion of the subject; andC. (U//FOUO) The assessment is an appropriate use of
personnel and financial resources.
15.6. (U//FOUO) Standards for Initiating or Approving
the Use of
Investigative Method in Intelligence Analysis and Planning an Authorized
A. (U//FOUO)The use of the particular investigative method
is likely to further an objective of
the assessment;
B. (U/FOUO) The investigative method selected is theleast intrusive method, reasonable under
the circumstances;
C. (U//FOUO) If the assessment relates to positive foreign
intelligence
openly and corsensually with United States persons, to the extent the FBI must operate
practicable.
D. (U//FOUO) The anticipated value of the assessment
justifies the use of the selected
investigative method or methods; andE. (U//FOUO) The investigative method is an appropriate useof personnel and financial
15.7. (U) AuthorizedActivities in Intelligence Analysis

and Planning(U) The FBI may engage in intelligence analysis andto facilitate or support
investigative activities authorized by the AGG-Dom orplanning
other legally authorized activities.
Activities the FBI may carry out-as part of Intelligence
Analysis and Planning include:

238
UNCLASSIFIED-FOR OFFICIAL USE ONLYUNCLASSIFIED - FOR OFFICIAL USE ONLY
Domestic Investigations and Operations Guide
A. (U//FOUO) Strategic Intelligence Analysis(U//FOUO) The FBI is authorized to develop overviews and analysesof threats to andvulnerabilities of the United States and its interests in areas related
to the FBI's
responsibilities, including domestic and international criminal
threats
and international activities, circumstances, and developments affectingand activities; domestic
the national security.
FBI overviews and analyses may encompass present, emergent,and potential threats andvulnerabilities,,their contexts and causes, and identification and analysis ofmeans ofresponding to them. (AGG-Dom, Part IV)
1. (U//FOUO) Domain Management by Field Offices(U//FOUO) As part of Strategic Analysis Planning activities,
theinformation in order to.improve or facilitate "domain awareness" FBI may collect"domain management." "Domain management" is the systematic and may engage inprocess by which the
FBI develops cross-programmatic domain awareness andleverages its knowledge toenhance its ability to: (i) proactively identify threats, vulnerabilities,
and intelligence gaps;(ii) discovernew opportunities for needed intelligence collection
and prosecution; and (iii)
set tripwires to provide advance warning of national security
and criminal threats.
Effective domain managerfent iiables the FBI to identify significant
threats, detect
vulnerabilities within its local and national domain, identify
new sources and threat
indicators, and recognize new trends so that resources canbe appropriately allocated at
the local level in accordance with national priorities.
,(U//FOUO) Through a properly authorized assessment, domainisundertaken at the local and national levels. All National Domainmanagement
Assessments are
initiated.and coordinated by the DI. Examples of domainmanagement
activities include,but
but areare not
not limited
limited to:to:census crime statistics,
case information, domain entities, trend analysis, source development,
and placement of'b2
b7E

products are contairied in the(U//FOUO) The Field Office "domain" is the territory and issues for whicha Field Office
exercises responsibility, also known as the Field Office's area-of-responsibilyit(AOR),
Domain awareness is the: (i) strategic understandingof national security and criminal
threats and vulnerabilities; (ii) FBI's positioning
to collect against these threats andvulnerabilities; and (iii) the existence of intelligence gaps related to the domain.
FOUO All infrmation collected for domain
ement must be documented in an
Ue d_las.directed in the

Additionallv at any time tha
a separate substantive classification assessment fileor
subfile, according to the investigative matter, must be openedon the individual.
FBIHQ DI provides specific guidance in its_
but
not limited to: the initiatioh, opening, codrdination and-purpose for Field.regarding,
Office andNational Domain Assessments.
239
UNCLASSIFIED-FOR OFFICIAL USE ONLY

b2
b7E

b2
E

UNCLASSIFIED - FOR OFFICIAL USE ONLY
Domestic Investigations and Operations Guide
2. (U//FOUO) Collection Management(U//FOUO) Collection Manauement is a formal business process
through which
Intelligence Information Needs and Intelligence Gaps (e.g., unknowns)
are expressed asIntelligence Collection Requirements (questions or statements
requesting information)and prioritized in a comprehensive, dynamic Intelligence Collection
Plan. Results aremonitored, and collectors are re-tasked as required.
B. (U) Written Intelligence Products(U//FOUO) The FBI is authorized to conduct research, analyze
information, and prepare
reports andintelligence assessments (analytical products) concerning
matters relevant toauthorized FBI activities, such-as: (i) reports and intelligenceassessments(analytical product)
concerning types of criminals or criminal activities; (ii) organizedcrime groups, terrorism,
espionage, or other threats to the national security; (iii) foreign
intelligence matters; or (iv)the scope and nature of criminal activity in particular geographic
areas or sectors of theeconomy. (AGG-Dom, Part IV)(U//FOUO) United States Person Information: Reports,. Intelligenceother FBI intelligence products should not contain -United-States.person Assessments, andinformation
including the names.of United States corporations, if the pertinent
intelligence can beconveyed without including identifying information.
(U//FOUO) FBI intelligence products, both.raw andfinished, serve a wide range ofaudiences from national-level policy and decision-makers,
intelligence agencies, and state,
local and tribal law enforcement agencies.
(U//FOUO) Intelligence products prepared pursiant to this Section
include, but are notlimited to: Domain Management, Special Events Management
Threat Assessments,
Intelligence Assessments, Intelligence Bulletins, Intelligence
Information Reports; WMD
Scientific and Technical Assessments, and Regional Field
Office Assessments.
C. (U) Intelligence Systems(U//FOUO) The FBI is authorized to operate intelligence, identification,
tracking, andinformation systems in support of authorized investigative
activities, or for such other or
additional purposes as may be legally authorized, suchas intelligence and tracking systems
relating to terrorists, gangs, or organized crimegroups. (AGG-Domr Part IV)(U//FOUO]

b2
b7E

240
UNCLASSIFIED-FOR OFFICIAL USE ONLYUNCLASSIFIED - FOR OFFICIAL USE ONLY
Domestic Investigations and Operations Guide(U//FOUO) When developing a new database, the FBI OGC Privacy andCivil Liberties Unit
must be consulted to determine if a Privacy Impact Assessment (PIA) must
be prepared.
D. (

b2
b7E

(u//FOUOA
b2

b7E

(U//F

O)l

b2
b7E

241
UNCLASSIFIED-FOR OFFICIAL USE ONLYUNCLASSIFIED -'FOR OFFICIAL USE ONLY
Domestic Investigations and Operations Guide

16. (U) Undisclosed Participation (UDP)
16.1.

(U) Overview(U//FOUO) Undisclosed participation (UDP) takes place when anyone
acting on behalf of theFBI, including but not limited to an.FBI employee or confidential humansource (CHS), becomesa member or participates in the activity of an organization
on behalf of the U.S. Government
without disclosing FBI affiliation to an appropriate official of the organization.
A. (U) Authorities. The FBI derives its authority to engage in UDP
in organizations
its investigative and intelligence collection missions from two primary sources. as part of(U) First, Executive Order (E.O.) 12333 broadly establishes policy for
the United States
Intelligence Community (USIC). Executive Order 12333 requires
the adoption of proceduresfor undisclosed participation in organizations on behalf of elementsof the USIC within the
United States. Specifically, the Order provides "... [n]oone acting on behalf of theIntelligence Community may join or otherwise participate in any
in the UnitedStates on behalf of theany element of the Intelligence Communityorganization
without first disclosing
such person's intelligence affiliation to appropriate officials of theorganization, except inaccordance with procedures-established by the head ofthe Intelligence
Community element
concerned .... Such participation shall be authorized only if it is essential
to achieving lawful
purposes as determined by the Intelligence Community element
head.or
12333, Section 2.9, Undisclosed Participation.in Organizations Within designee." (E.O.
the United States).
The Order also provides, at Section 2.2, that "[n]othing in [E.O.
12333]
shall be construed toapply to or interfere with any authorized civil or criminal law enforcement
responsibility ofany department or agency."(U) Second, in addition to itsrole as member of the USIC, the FBI
is also the primarycriminal investigative agency of the federal government with authority
investigate all violations of federal law that are not exclusively assignedand responsibility to.
to another federal
agency. This includes the investigation of'crimes involving international
terrorism andespionage. As a criminal investigative agency, the FBI has theauthority to engage in UDP aspart of a predicated investigation or an assessment.
(U//FOUO) The FBI's UDP policy is designed to incorporate the.
FBI's responsibilities asboth a member of the USIC and as the primary criminal investigative
agency of the federal
government and, therefore, applies to all investigative and information
the FBI. It is intended to provide uniformity and clarity so that FBI collection activities of
employees have one setof standards to govern all UDP. As is the case throughout the
DIOG,
different constraints exist if the purpose of the activity is the collectionhowever, somewhatof positive foreign
intelligence that falls outside the FBI's law enforcement authority.
Those constraints arereflected where applicable below.
.B. (U//FOUO) Mitigation ofRis.
b2
b7E

242
UNCLASSIFIED-FOR OFFICIAL USE ONLYUNCLASSIFIED - FOR OFFICIAL USE ONLY
Domestic Investigations and'Operations Guideb2
b7E(U//Fouo)

b2

b7E

16.2.

(U) Purpose, Scope, and Definitions

A. (U//FOUO
b2
b7E

B. (U//FOUO.

b2
b7E

c. (U//FOUO
b2
b7E

243
UNCLASSIFIED-FOR OFFICIAL.USE ONLYUNCLASSIFIED - FOR OFFICIAL USE ONLY
Domestic Investigations and Operations Guide

1. (!//FOUJO
b2
b7E

2. (U//FOUO

b2
b7E
b7E.

3. (U//FOUO
b2
b7E

4. (UI/FOU .JO

b2
b2
Sb7E

D. (U//FOUOb2
b7E

b2

E. (U//FOUO1

'

1r

b7E

b7E

G. (U//FOUO)

b
b2
b7E

244
UNCLASSIFIED-FOR OFFICIAL USE ONLYUNCLASSIFIED - FOR OFFICIAL USE ONLY
Domestic Investigations and Operations Guideb2
b7E

H. (U//FOUOUI

b2
b7E

1. (U/IFOUO
b2

2. (U//FOUO(U//FOUO

b27
b7E

3.

(b7E

(U//FOUO

52E

b2

b7E

I. (U//FOUO

b2
b7E

16.3.

(U) Requirements for Approval

A. (U//FOUO)

b2
b7E

245
UNCLASSIFIED-FOR OFFICIAL USE ONLYUNCLASSIFIED - FOR OFFICIAL USE ONLY
Domestic Investigations and Operations Guide

1. (U//FOUO

b2
b7E

2. (U//FOUO)
b2
b7E

3. (U//FOUO

b
b2
b7E

B. (U//FOiO) Specific Requirements for General Undisclosed Participation(Non-sensitive
UDP):
b2
b2
b7E

1. (U//FOUO

a. (U//FOUO
b2
b7E

b. (U//FOUOb
b2
b7E

2. (U//FOUO
(b7E

b2

(UFovob2a. (U//FOUO
b2
b7E

246
UNCLASSIFIED-FOR OFFICIAL USE ONLYUNCLASSIFIED - FOR OFFICIAL USE ONLY
Domestic Investigations and Operations Guideb. (U//FOUO)

b2
b7E

c. (U//FOUO
b2
b5
b7E

d. (U//FOUO)
b2.

b5
b7E

C. (U//FOUO-

E

I. tuoub2b2

1. (U//FOUO

b7E

b. (U//FOUO)
b2
b5
b7E

c. (U//FOUO)
b2
b7E

247
UNCLASSIFIED-FOR OFFICIAL USE ONLYUNCLASSIFIED - FOR OFFICIAL USE ONLY
Domestic Investigations and Operations Guide

b2
b7E
b2

2. (U//FOUO

b7E(U//FOUO)b2

b5
b7E

3. (U//FOUO)

b2
b2

S(U/FOUO

a.

b2E

U/IFOUO

b2
b7E

b. (U//FOUO
b2

b5
b7E

a. (U//FOUO

b2

b5
b7E

16.4.

(U) Supervisory Approval Not Required(U//FOUO
J

b2
b7E

A. (U//FOUO
__b7E

b2

B. (U//FOUOl
b7E

248
UNCLASSIFIED-FOR OFFICIAL USE ONLYUNCLASSIFIED - FOR OFFICIAL USE ONLY
Domestic Investigations and Operations Guideb2

b7E

C. (FOTO

b2

Sb7E

D. (U//FOUO

b2
b7E '

E. (U//FOUob2
b7E

16.5.

(U//FOUO) Standards for Review and Aprovalb2

A.. U//FOUO

b7E

1. (U//FOUO)

2.

b2
b7E

(U//FOUO)l

3. (U//FOUO

b2 b7b7E
b7E

b2

"

5. (U//FOUO

b2
b2
b7E

B. (U//FOUO

b
b2

b7E
b2

1. (U//FOUO)
.2.

b7E

UFOb7E

249
UNCLASSIFIED-FOR OFFICIAL USE ONLYUNCLASSIFIED - FOR OFFICIAL USE ONLY
Domestic Investigations and Operations Guideb2

C. (U//FOUO

b7E

b2
b7E

D. tU//FOUOf[

E. (U//FOUO)

16.6.

b2
b7E

(U) Requests for Approval of Undisclosed ParticiatiA. (U//FOUO
b2
b7E

b2
-b7E

B. (U//FOUO

.b2

b7E

1. (U//FOUO
2:(U//FOUO)
b2
'b7E

3.

(U/FOUO11

b2

b7E

b2

4. (U//FOUO

b7E

5. (U//FOUO

(b7E

b2

250'
UNCLASSIFIED-FOR OFFICIAL USE ONLYUNCLASSIFIED - FOR OFFICIAL USE ONLY
Domestic Investigations and Operations Guide

b2

b7 E

6. (U//FOUO

C. (U//FOUO

b2

b7E

16.7.

(U) Duration(U//FOuoi
b2
b7E

b2

16.8.

(U//FOUO

b7E

b2

b5

A. (U//FOUO

b7E
b2

1. (U//FOUO)

b5
b7E

2. (U//FOUO

b2

.b5

b7E

b2
b5

(U//FOUO)

b7E

B. (U//FOUO)l
b2
b5
b7E

251
UNCLASSIFIED-FOR OFFICIAL USE ONLYUNCLASSIFIED - FOR OFFICIAL USE ONLY
Domestic Investigations and Operations Guide
16.9. (U//FOUQ) UDP EXAMPLES

b2

b7E

A. (U//FOUO)

b2
b5(U/FOUO

b7E

I

B. (U//FOUOJ

b2
b7E(U//FOUO)r

I

b2
b5
b7E

C. (U//FOUO)

b2
b7E

252
UNCLASSIFIED-FOR OFFICIAL USE ONLYUNCLASSIFIED - FOR OFFICIAL USE ONLY
Domestic Investigations and Operations Guide(U//FOUOn__

b2
b5
b7E

D. (//FOUO

I

I

b2
b7E

b2

(U//FOUO

b5

E. (U//FOUO.

b2

b7E

b7E

(U//FOUO)I
b2

b5
b7E

F. (U//FOUO
b2
b7E

253
UNCLASSIFIED-FOR OFFICIAL USE ONLYUNCLASSIFIED - FOR OFFICIAL USE ONLY
Domestic Investigations and Operations Guide(U//FOUO)

b2

b5
b7E

G. (U//FOUO)

*

*

b2
b7E

b2

(U//FOUO)I

b5
b7E__________________________________________________(U//FOUO__________

b2
b2

b2
b5
b7E

I.

(U//FOUO

b2(U//FOUO)F

b2

b7E

b5
b7E

254
UNCLASSIFIED-FOR OFFICIAL USE ONLYUNCLASSIFIED - FOR OFFICIAL USE ONLY
Domestic Investigations and Operations Guideb2

J. (U//FOUO)
b2
b5(U//FOUOl

_____

*

K. (U//FOUO)[

b7E

b2
b7E

(U//FOUO
b2

b5
b7E

255
UNCLASSIFIED-FOR OFFICIAL USE ONLYUNCLASSIFIED - FOR OFFICIAL USE ONLY
Domestic Investigations and Operations Guide

17.

(U) Otherwise Illegal Activity

17.1. (U) Overview(U//FOUO) Otherwise Illegal Activity (OIA) is conduct in the course of duties by an-FBI
employee (to.include a UCE) or CHS which constitutes a crime under local, state, or federal law
if engaged.in by a person acting without authorization. Under limited circumstances, OIA can beb2
authorized for an FBI employee or CHS to obtain information or evidence necessary for theb7E
success of an investigation under the following circumstances: (i) when that information orevidence is not reasonably available without participation in the OIA;
Aor (iii)

when necessary to prevent serious-bodily injury or death. Certain types of OIA are not authorized
such as participation in an act of violence, except in self-defense, or participation in conduct thatwould constitute an unlawful investigative technique such an illegal Wiretap.
17.2. (U) Purpose and Scope(U//FOUQ).The-use of OIA may be approved in-the course of undercover activities or operations
that involve an FBI employee or that involve use of a CHS. When approved, OIA should be
limited or minimized in scope to only that which is reasonably necessary under thecircumstances including the duration and geographic area to which approval applies, if
appropriate.
17.3.. (U//FOUO) OIA in Undercover Activity
A. (U//FOUO) General. The use of the undercover method is discussed in the DIOG Section.11.8. OIA is often proposed as part of an.undercover scenario or in making the initial
undercover contacts before the operation is approved. Specific approval for OIA must be
obtained in the context of these undercover activities or operations in addition to generalapproval of the scenario or the operation.
B. (U//FOUO) OIA by an FBI employee in-an undercover operation relating to activity inviolation of federal criminal law that does not concern a threat to the national security
or foreign intelligence: must be approved in conformity with the AGG-UCO. Approval of
OIA in conformity with the AGG-UCO is sufficient and satisfies any approval requirementthat would otherwise apply under the AGG-Dom. Additional discussion is provided in the
Field Guide for FBI Undercover and Sensitive Operations. An SAC may approve the OIA
described in-subsection 17.5.
-1. (U//FOUO) When a-UCE provides goods and service (reasonably unavailable to thesubject except as provided by the United States government) that facilitate a felony, or its
equivalent under federal, state, or local law, it is a sensitive circumstance. In thesesensitive circumstances, additiorial authorization by an Assistant Director is required after
review by the Criminal Undercover Operations Review Committee (CUORC).
2. (U//FOUO) Participation in otherwise illegal activity that involves a significant risk ofviolence or physical injury requires authorization by the Director, Deputy Director, ordesignated Executive Assistant Director after review'by the CUORC.
C. (U//FOUO) OIA by an FBI employee in an undercover operation relating to a threat tothe national security or foreign intelligence collection must conform to the AGG-Dom.
256
UNCLASSIFIED-FOR OFFICIAL USE ONLYUNCLASSIFIED - FOR OFFICIAL USE ONLY
Domestic Investigations and Operations Guide
The DOJ NSD is the approving component for OIA that requires approval beyond that
authorized for SAC approval described in DIOG subsection 17.5, below. However, as
authorized by the Assistant Attorney General for NSD, officials in other DOJ components
may approve OIA in such investigations.
17.4. (U//FOUO) OIA for a Confidential Human Source(U//FOUO) OIA by a CHS must be approved in conformity with the AGG-CHS and the FBI
CHSPM.
17.5. (U//FOUO) Approval of OIA by a Special Agent in Charge(U//FOUO) An SAC may authorize the following OIA for an FBI employee when consistent
with other requirements of this section, the AGG-UCO, and other FBI- policy:.
A. (U//FOUO) Otherwise illegal activity that would not be a felony under federal, state, local, or
tribal law;
B. (U//FOUO) Consensual monitoring of communications, even if a crime under state, local, or
tribal law;
(U//FOUO) Note: Other approvals for the consensual monitoring may apply such as that
required when the consensual monitoring involves a sensitive monitoring circumstance. See
DIOG Section 11.5.4.
(U//FOUO) Note: For those, state, local and tribal governments that do not sanction orprovide a law enforcement exception available to the FBI for one-party consent recording ofcommunications with persons within their jurisdiction, the SAC must approve the consensual
monitoring of communications as an OIA. Prior to the SAC authorizing the OIA, one-party
consent must be acquired. The SAC may delegate the OIA approval authority to an ASAC or
SSA.
C. (U//FOUO) The controlled purchase, receipt, delivery, or sale of drugs, stolen property, orother contraband;
D. (U//FOUO) The payment of bribes;(U//FOUO) Note: the payment of bribes and the amount of such bribes in a public corruption
matter may be limited by other FBI policy; see the CID PG.
E. (U//FOUO) The making'of false representations in concealment of personal identity or thetrue ownership of a proprietary; andF. (U//FOUO) Conducting a money laundering transaction or transactions involving an
aggregate amount not exceeding $1 million.
(U//FOUO) Exception: An SAC may not authorize an activity that may constitute material
support to terrorism, a violation of export control laws, or a violation of laws that concern
proliferation of weapons of mass destruction. In such an investigation, an SAC may authorize an
activity that may otherwise violate prohibitions of material support to terrorism only according tostandards established by the Director of the FBI and agreed to by the Assistant Attorney Generalfor National Security. (AGG-Dom, Part V.C.3)

257
UNCLASSIFIED-FOR OFFICIAL USE ONLYUNCLASSIFIED - FOR OFFICIAL USE ONLY
Domestic Investigations and Operations Guide
17.6. (U//FOUO) Standards for Review and Approval of OIA(U//FOUO) No official may recommend or approve participation by an FBI employee in OIA
unless the participation is justified:
A. (U//FOUO) To obtain information or evidence necessary for the success of the investigationand not reasonably available without participation in the otherwise illegal activity;
B. :(U//FOUO)
[or
b2
b7E

C. (U//FOUO) To prevent death or serious bodily injury.
17.7. (U//FOUO) OIA not authorized(U//FOUO) The following activities may not be authorized for an FBI employee:
A. (U//FOUO) Directing or participating in acts of violence;(U//FOUO) Note: Self-defense and defense of others. FBI employees are authorized toengage in any lawful'use of force,. including the use of force in self-defense or defense ofothers in the lawful discharge of their duties.
B. (U//FOUO) Activities whose authorization-is prohibited.by law, including unlawful
investigative methods, such as illegal, non-consensual, electronic surveillance or illegal
searches.
(U//FOUO) Note: Subparagraph B includes activities that would violate protected
constitutional or federal statutory rights in the.absence of a court order or warrant such as
illegal wiretaps and searches.
17.8. (U//FOUO) Emergency Situations(U//FOUO) Without prior approval, an FBI employee may engage in OIA that could be
authorized under this section only if necessary to meet an immediate threat to the safety of
persons or property or to the national security, or to prevent the compromise of an investigationor the loss of a significant investigative opportunity. In such a case, prior to engaging in the OIA,
every effort should be made by the-FBI employee to consult with the SAC, and by the SAC toconsult with the USAO or appropriate DOJ Division where the authorization of that office orDivision would be required unless the circumstances preclude such consultation. Cases in which
OIA occur pursuant to this paragraph without the authorization required must be reported as soon
as possible to the SAC, and by the SAC to FBIHQ and to the USAO or appropriate DOJ
Division.

258
UNCLASSIFIED-FOR OFFICIAL USE ONLY