ten8, ee pee RF 4 © ENE: HW eon GH Be “th (o;change:t : ae AED
DEPARTMENT  OF  THE  NAVY 
Headquarters  United  States  Marine  Corps 
Washington,  D.C.    20380 
5  December  1983 
FOREWORD 
1.  PURPOSE 
FMFM 1A,  Counterintelligence,  sets  forth  information  and  gmdanaconcennngtheito^ 
of  counterintelligence  activities  within  the  Marine  Corps. 
2.  SCOPE 
This  manual  discusses  the  mission,  responsibilities,  organization,  functions,  and  employment  of 
considerations  are  also  discussed. 
3.  SUPERSESSION 
This  publication  supersedes  FMFM  2-4,  Counterintelligence  dated  15  March  1979. 
4.  CHANGES 
Recommendations  for  improving  this  manual  are  invited  from  commands  as  well  as  direOly  from  individuals. 
The  attached  User  Suggestion  Form  should  be  utilized  by  individuals  and  forwarded  to: 
Commanding  General 
Marine  Corps  Development  and  Education  Command  (Code  D  046) 
Quantico,  Virginia    22134 
5.  CERTIFICATION 
Reviewed  and  approved  this  date. 
BY  DIRECTION  OF  THE  COMMANDANT  OF  THE  MARINE  CORPS 
_  k  mTVwomey—   ; 
Major  General,  U.S.  Marine  Corps 
Commanding  General 
Marine  Corps  Development  and  Education  Command 
Quantico,  Virginia 
DISTRIBUTION:  TBD 
Reviewed   &    approved    for    reprinting 
by    CMC    (PP)    on    25    Mar    1985. 
For  saW  hv  the  SuperintemSent  of  Document*.  U.S.  Government  Printing  Office.  WwMnston.  D.C.  20102
r 
USER  SUGGESTION  FORM 
From: 
To:        Commanding  General,  Marine  Corps  Development  and  Education  Command  (Code  D  046), 
Quantico,  Virginia  22134 
Subj:     FMFM  2-4,  Counterintelligence;  recommendation  concerning 
1 .    In  accordance  with  the  Foreword  to  FMFM  2-4,  which  invites  individuals  to  submit  suggestions  concerning  this 
FMFM  directly  to  the  above  addressee,  the  following  unclassified  recommendation  is  forwarded: 
Pag-  Article/Paragraph  No.  Line  No.  Figure/Table  No. 
Nature  of  Change:  D  Add  D  Delete  D  Change  □  Correct 
1.    Proposed  New  Verbatim  Text:    (Verbatim,  double  spaced;  continue  on  additional  pages  as  necessary.) 
2.    Justification/Source:    (Need  not  be  double  spaced.) 
NOTE: 
Only  one  recommendation  per  page.
( 
t- 
f 
DEPARTMENT  OF  THE  MAVY 
II 
NO  POS  T*  Gt: 
necessaov 
if  mailed 
1*4    THf. 
urn  ted  st*  res 
OFFICIAL  BUSINESS 
BUSINESS  REPLY  MAIL 
'  FlkST    C  LASS 
PtOVllT     *0.     Ii«9^ 
iS-ii'JC  TOW.    O   C 
POSi*Gf     -ILL    r.L    l-»»0    nv   L'NM LC    STATED    MARINE     CO«r>S 
To: 
Commanding  General 
Marine  Corps  Development  and  Education  Command 
(Code  D  046) 
Quantico,  Virginia  22134
FMFM  2*4 
Record  of  Changes 
Change 
No. 
Date  of 
Change 
Date  of 
Entry 
Organization 
Signature 
(reverse  blank)
( 
Countennte/Hgenc, 
Tat>'e  of  content, 
SeeH°"  t.       lnUosJucti 
Par«Sraph 
ion 
10! 
102 
103 
104 
Section  2. 
20i 
202 
203 
204 
205 
206 
207 
Se<Jtion  3. 
301 
302 
303 
304 
305 
306 
307 
308 
309 
310 
311 
312 
313 
General 
2S2£5~M--» 
c°"»<eri„,eHi9ence 
pm  i  °Perations 
Employment  of  r„ 
Communications 
Page 
M 
1-3 
1-4 
1-5 
2-1 
2-1 
2-6 
2-8 
2-12 
2-13 
2-13 
3-1 
3-1 
3-1 
3-5 
3-6 
3-7 
3-11 
3-18 
3-21 
3-22 
3-24 
3-24 
3-25
FMFM  2-4 
Section  4.  Counterintelligence  Garrison  Operations 
401  General 
402  Counterintelligence  Survey 
403  Counterintelligence  Evaluation 
404  Counterintelligence  Inspections 
405  Technical  Surveiltaice  Countenneasures  Support 
406  Reports 
4-1 
4-1 
4-6 
4-6 
4-7 
4-8 
Section  5.  Counterintelligence  Planning 
501  General 
502  Planning  Preceding  the  Operation 
503  Counterintelligence  Targets 
504  Counterintelligence  Target  Reduction  ,w™ti«n« 
505  Sequence  of  Counterintelligence  Activities  for  Amphibious  Operations 
5-1 
5-2 
5-2 
5-5 
5-5 
Section  6.       Counterintelligence  Training 
60! 
602 
603 
604 
605 
606 
607 
General 
Responsibilities 
Purpose  and  Scope 
Basic  Counterintelligence  and  Security  Training 
Training  of  Officers  and  Staff  Noncommissioned  Officers 
Training  of  Intelligence  Section  Personnel 
Training  of  Counterintelligence  Team  Personnel 
6-1 
6-1 
6-1 
6-2 
6-2 
6-2 
6-3 
Appendixes: 
B 
C 
D 
E 
F 
G 
Format  for  Personnel  Data  Form,  Persons  Captured,  Missing  (Nonhostile),  or 
Missing  in  Action 
Counterintelligence  Reports 
Sample  Format  for  Counterintelligence  Estimate 
Partially  Computed  Counterintelligence  Measures  Worksheet 
JOPS  Format  for  a  Counterintelligence  Appendix 
Format  for  a  Counterintelligence  Plan 
Sample  Format  for  Counterintelligence  Reduction  Plan 
A-l 
B-l 
C-l 
D-l 
E-l 
F-l 
G-l 
IV
FMFM  2-4 — 
-Section  1 
Section  1 
Introduction 
101.  General 
a.  Importance.  Counterintelligence  is  that  aspect  of 
intelligence  devoted  to  neutralizing  or  destroying  the 
effectiveness  of  hostile  foreign  intelligence  activities, 
and  to  the  protection  of  information  against  espionage, 
personnel  against  subversion  and  terrorism,  and  instal- 
lations and  material  against  sabotage.  Counterintelli- 
gence measures  enhance  security,  aid  in  reducing  risks 
to  the  command,  and  are  essential  in  achieving  surprise 
during  military  operations.  Accordingly,  counterintel- 
ligence provides  a  significant  contribution  to  a  com- 
mand's operations  security  (OPSEC)  program.  As  an 
element  of  intelligence,  counterintelligence  must  be 
closely  coordinated  and  thoroughly  integrated  with  the 
overall  intelligence  effort.  The  success  of  any  military 
operation  is  dependent  on  reliable  intelligence  and 
effective   counterintelligence.   Fleet    Marine   Force 
'"      Manual  (FMFM)  2-1 ,  Intelligence,  provides  guidance 
for  intelligence  activities  within  the  Marine  Corps. 
b.  Basis  for  Counterintelligence  Activities/The 
enemy  can  be  expected  to  use  every  available  means 
to  thwart  or  otherwise  impede  our  forces  with  his 
efforts   directed   towards   intelligence    collection, 
sabotage,  subversion,  and  terrorism.  Enemy  intelli- 
gence collection  activities  are  directed  toward  obtaining 
detailed  knowledge  of  our  forces  and  their  capabilities, 
limitations,  vulnerabilities,  intentions,  and  probable 
courses  of  action,  as  well  as  information  concerning 
the  area  of  operations,  including  weather,  terrain,  and 
hydrography.  Knowledge  on  the  part  of  the  enemy  con- 
cerning an  operation  projected  by  friendly  forces  will 
enable  him  to  concentrate  his  efforts  on  preparing  the 
objective  for  defense,  attacking  friendly  staging  areas, 
and  disrupting  the  operation  through  sabotage,  ter- 
rorism,   and    subversive    activities.    Accordingly, 
counterintelligence  is  essential  to  the  security  of 
our  forces  from  the  inception  of  planning  until  the 
operation  is  completed. 
1-1
FMFM  2-> 
-Section  2 
Section  2 
Counterintelligence  Organization  and  Functions 
201.  General 
Marine  Corps  counterintelligence  teams  are  organized, 
trained,  and  equipped  to  provide  combat  support  to  the 
Fleet  Marine  Force  (FMF).  During  peacetime,  in  addi- 
tion to  planning,  preparing,  and  training  for  combat, 
Marine  counterintelligence  units  also  provide  various 
counterintelligence  services  and  support  to  enhance  the 
security  and  readiness  of  the  Marine  Corps. 
The  wide  range  and  continuing  nature  of  counterintelli- 
gence, and  its  integration  within  the  overall  intelligence 
effort,  require  an  understanding  of  the  national  intelli- 
gence organization  as  well  as  of  the  intelligence  and" 
counterintelligence  units  of  the  Armed  Forces.  The  prin- 
cipal organizations  concerned  with  intelligence  and 
counterintelligence  are  summarized  in  the  following 
paragraphs.  (See  fig.  2-1.) 
202.  National  Intelligence  Organizat'a  is 
a    National  Security  Council  (NSC).  The  National 
Security  Act  of  1947  established  the  National  Security 
Council  to  advise  the  President  on  the  integration  of 
domestic,  foreign,  and  military  policies  relating  to 
national  security.  The  NSC  acts  as  the  highest 
Executive  Branch  entity  providing  review  of,  guidance 
for,  and  direction  to  the  conduct  of  all  national  foreign 
intelligence,  counterintelligence,  special  activities,  and 
attendant  policies  and  programs.  The  NSC,  or  a  com- 
mittee established  by  it.  considers  and  submits  to  the 
President  a  policy  recommendation,  to  include  dissents, 
on  each  special  activity,  and  reviews  proposals  for  other 
sensitive  intelligence  operations. 
b.  Central  Intelligence  Agency  (CIA).  The  Central 
Intelligence  Agency   also   was   established   by   the 
2-1
202 
FMFM  2-4 
r~n 
■C=D 
r^n-r^~i 
IE 
H   Q (ZED 
{  »mrc0X  J 
C 
Figure  2-1.  Organization  for  Intelligence. 
National  Security  Act  of  1947  and  is  authorized  by: 
this  act,  as  amended;  the  CIA  Act  of  1949,  as  amended; 
and  other  appropriate  directives  and  applicable  laws  to: 
•  Collect,  produce,  and  disseminate  foreign  in- 
telligence and  counterintelligence,  including  infor- 
mation not  otherwise  obtainable.  The  collection  of 
foreign  intelligence  or  counterintelligence  within  the 
United  States  must  be  coordinated  with  the  Federal 
Bureau  of  Investigation  (FBI). 
•  Collect,  produce,  and  disseminate  intelligence  on 
foreign  aspects  of  narcotics  production  and 
trafficking. 
•  Conduct  counterintelligence  activities  outside  the 
United  States  and,  without  assuming  or  perform- 
ing any  internal  security  functions,  conduct 
counterintelligence  activities  within  the  United 
States  in  coordination  with  the  FBI. 
•  Coordinate  counterintelligence  activities  and  the 
collection  of  information  not  otherwise  obtainable, 
when  conducted  outside  the  United  States  by  other 
-  departments  and  agencies. 
•  Conduct  special  activities  approved  by  the  Presi- 
dent. No  agency  except  the  CIA  (or  the  Armed 
Forces  of  the  United  States  in  time  of  war  declared 
by  Congress  or  during  any  period  covered  by  a 
report  from  the  President  to  Congress  under  the 
War  Powers  Resolution)  may  conduct  any  special 
activity  unless  the  President  determines  that  another 
agency  is  more  likely  to  achieve  a  particular 
objective. 
•  Perform  services  of  common  concern  for  the 
intelligence  community,  as  directed  by  the  NSC. 
•  Carry  out,  or  contract  for  research,  development, 
and  procurement  of,  technical  systems  and  devices 
relating  to  authorized  functions. 
•  Protect  the  security  of  its  installations,  activities, 
information,  property,  and  employees  by  appropri- 
ate means,  including  such  investigations  of  applicants, 
employees,  contractors,  and  other  persons  with 
similar  association  with  the  CIA  as  may  be  necessary. 
•  Conduct  such  administrative  and  technical  support 
activities,  within  and  outside  of  the  United  States, 
'as  are  necessary  to  perform  the  functions  described 
above,  including  procurement  and  essential  cover 
and  proprietary  arrangements. 
The  Director  of  the  CIA  also  serves  as  the  Director  of 
Central  Intelligence  (DCI).  The  DCI  is  the  senior 
2-2
FMFM  2-4 
202 
intelligence  advisor  to  the  President; has  authorityfor 
aroroval  of  the  National  Foreign  Intelligence  Program 
>TteNational  Intelligence  Tasking  Center  <NITQ. 
■3J Section  of  the  DO.  is  responsible f br  tastag 
and  coordination  of  national  foreign  intelligence  col- 
lection activities.  In  addition,  iheDCI  is  iff™*** 
for  the  protection  of  inteDigencesources  and  methods 
Srn^SSzcddisclosnre^eDa  also  serves  as 
the  Chairman  of  the  National  Foreign  Intelligence 
Board  (NFffi). 
National  Foreign  Intelligence  Board 
(1}  The  National  Foreign  Intelligence  Board  is  the 
focal  point  for  the  national  intelligence  organiza- 
tion and  is  the  primary  agency  for  coordinating 
intelligence  and  the  intelligence  activities  of  govern- 
mental departments.  The  NFIB  is  comprised  of 
senior  representatives  of  national -foreign  intelli- 
gence community  organizations  who  are  involved 
in  the  collection,  processing,  and  production  of 
national  intelligence.  The  membership  is  as  follows: 
•  Director  of  Central  Intelligence,  Chairman. 
.  Deputy  Director  of  Central  Intelligence,  Vice 
Chairman  and  CIA  member. 
•  Director,  National  Security  Agency. 
•  Director,  Defense  Intelligence  Agency. 
•  Director,  Intelligence  and  Research,  Depart- 
ment of  State. 
.  Assistant  Director,  Federal  Bureau  of  Investiga- 
tion (Intelligence  Division). 
«  Principal  Deputy  Assistant  Secretary  for  Inter- 
national Affairs,  Department  of  Energy. 
.  Special  Assistant  to  the  Secretary  of  the 
Treasury  (National  Security). 
.  Appropriate  representatives  from  offices  for 
reconnaissance  programs  within  the  Department 
of    Defense    will    serve    as    members    when 
programs  under  their  purview  are  to  be  discussed; 
they  may  attend  as  observers  at  other  sessions. 
•  Senior  representatives  of  military  intelligence 
services  will  attend  ss  observers  and  may  partict- 
pateattheinvitationof  the  Directorof  Central 
Intelligence. 
(2)  The  NFIB  is  responsible  for: 
.  Production,  review,  and  coor  lination  of 
>      national  foreign  intelligence. 
•  Interagency  exchanges  of  foreign  intelligence 
-  information. 
.  Arrangements  with  foreign  governments  on 
intelligence  matters. 
•  Protectionof  intelligence  sources  and  methods. 
.  Activities  of  common  concern  to  the  intelligence 
community. 
.  Other  matters  referred  to  it  by  the  Director  of 
Central  Intelligence. 
d.  Department  of  State.  The  Department  of  State 
(Bureau  of  Intelligence  and  Research)  is  response  for. 
.  Overtly  collecting  information  relevant  to  United 
States  foreign  policy  concerns. 
.  Producing  and  disseminating  foreign  intelligence 
concerning  United  States  foreign  policy,  as 
required,  for  the  execution  of  the  Secretary  of 
State's  responsibilities. 
.  Disseminating,  as  appropriate,  reports  received 
from  United  Slates  diplomatic  and  consular  posts. 
.  Transmitting  intelligence  community  report 
requirements  to  the  Chiefs  of  United  States 
Missions  abroad. 
.  Supporting  Chiefs  of  U.S.  Missions  in  discharging 
^statutory  responsibilities  for  directs  and 
coordination  of  mission  activities. 
2-3
202 
FMFM  2-4 
(Note:  The  Bureau  of  Intelligence  and  Research  pro- 
vides intelligence,  research,  and  analysis  for  the  Depart- 
ment of  State  and  other  Federal  agencies.  The  Bureau 
primarily  is  concerned  with  political  intelligence  and 
produces  intelligence  studies  and  current  intelligence 
analysis  essential  to  foreign  policy  determinations.) 
e.  Department  of  the  Treasury.  The  Department  of 
the  Treasury  is  responsible  for: 
.     •'  ■  * 
•  Overtly  collecting  foreign  financial  and  monetary 
information. 
•  Participating  with  the  Department  of  State  in  the 
overt  collection  of  general  foreign  economic 
information. 
•  Producing  and  disseminating  foreign  intelligence 
concerning  United  States  economic  policy,  as 
required,  for  the  execution  of  the  Secretary  of  the 
Treasury's  responsibilities. 
•  Conducting  activities,  through  the  United  States 
Secret  Service,  and  as  authorized  by  the  Secretary 
of  the  Treasury  or  the  President,  to  determine  the 
existence  and  capability  of  surveillance  equipment 
used  against  the  President  of  the  United  States,  the 
Executive  Office  of  the  President,  other  Secret 
Service  protectees,  and  United  States  officials. 
f.  Department  of  Energy  (DOE).  The.Department 
of  Energy  is  responsible  for: 
•  Participating  with  the  Department  of  State  in  the 
overt  collection  of  information  on  foreign  energy 
matters. 
•  Producing  and  disseminating  foreign  intelligence  nec- 
essary for  discharge  of  the  Secretary's  responsibilities. 
•  Participating  in  the  formulation  of  intelligence  col- 
lection and  analysis  requirements  where  the  special 
expert  capability  of  the  department  can  contribute. 
•  Providing  expert  technical,  analytical,  and  research 
capability  to  other  agencies  within  the  intelligence 
community. 
g.  National  Security  Agency  (NSA).  The  National 
Security  Agency  is  responsible  for  the: 
•  Establishment  and  operation  of  an  effective  unified 
.organization,  for  signals  intelligence  activities, 
except  for  the  delegation  of  operational  control 
..  over  certain  operations  conducted  through  other 
elements  of  the  intelligence  community.  No  other 
department  or  agency ;  may  engage  in  signals 
intelligence  activities  except  when  delegated  by  the 
Secretary  of  Defense. 
•  Control  of  signals  intelligence  collection  and  pro- 
cessing activities,  including  assignment  of  resources 
to  an  appropriate  agent  for  such  periods  and  tasks 
as  required  for  the  direct. support  of  military 
commanders. 
•  Collection  of  signals  intelligence  information  for 
national  foreign  intelligence  purposes  in  accordance 
with  guidance  from  the  Director  of  Central 
Intelligence. 
•  Processing  of  signals  intelligence  data  for  national 
foreign  intelligence  purposes  in  accordance  with 
guidance  from  the  Director  of  Central  Intelligence. 
•  Dissemination  of  signals  intelligence  information 
for  national  foreign  intelligence  purposes  to 
authorized  elements  of  the  government,  including 
the  military  services  in  accordance  with  guidance 
from  the  Director  of  Central  Intelligence. 
•  Collection  processing  and  dissemination  of  signals 
intelligence  information  for  counterintelligence 
purposes. 
•  Execution  of  the  responsibilities  of  the  Secretary 
of  Defense  as  executive  agent  for  the  communica- 
tions security  of  the  United  States  Government. 
•  Conduct  of  research  and  development  to  meet  the 
needs  of  the  United  States  for  signais  intelligence 
and  communications  security. 
•■  Protection  of  the  security  of  its  installations, 
activities,  property,  information,  and  employees  by 
appropriate  means,  including  such  investigations  of 
applicants,  employees,  contractors,  and  other 
persons  with  similar  associations  with  the  NSA,  as 
are  necessary. 
( 
2-4
FMFM  2-4 
202 
•  Security  regulations,  covering  operating  practices, 
including  the  transmission,  handling,  and  distri- 
bution of  signals  intelligence  and  communications 
security  material  within  and  among  the  elements 
under  control  of  the  Director  of  the  National 
Security  Agency,  and  exercising  the  nec^fa^ 
supervisory  control  to  ensure  compliance  with  toe 
regulations. 
.  Conduct  of  foreign  cryptolcgic  liaison  relation- 
ships, with  liaison  for  intelligence  purposes 
conducted  in  accordance  with  policies  formulated 
by  the  Director  of  Central  Intelligence. 
.  Conduct  of  such  administrative  and  technical 
support  activities,  within  and  outside  the  United 
States,  as  are  necessary  to  perform  the  functions 
authorized  above,  to  include  procurement. 
(Note-  The  National  Security  Agency/Central  Security 
Service  (CSS)  is  a  separate  agency  within  the  Depart- 
ment of  Defense  and  is  under  the  direction  and  con- 
trol of  the  Secretary  of  Defense.  The  basic  functions 
of  the  NSA/CSS  include  communications  security, 
signals  intelligence,  and  related  cryptotogjcal  activities. 
The  CSS  was  established  under  the  NSA  in  1972  to 
provide  for  the  centralized  management  and  control 
of  the  service  cryptologic  agencies  of  the  military 
departments.  The  Director  of  the  NSA  concurrently 
serves  as  the  Chief  of  the  CSS.  Further  information 
is    contained    in    FMFM    2-3,    (C)    Signals   In- 
telligence/Electronic Warfare  Operations  (U).) 
h    Federal  Bureau  of  Investigation  (FBI).  The 
Federal  Bureau  of  Investigation,  under  the  supervision 
of,  and  pursuant  to,  the  regulations  prescribed  by  the 
Attorney  General,  is  responsible  for: 
•  Conducting  counterintelligence  and  coordinating 
counterintelligence  activities  of  other  agencies 
within  the  intelligence  community  in  the  United 
States.  Counterintelligence  activity  of  the  rBI 
involving  military  or  civilian  personnel  of  the 
Department  of  Defense  shall  be  coordinated  with 
the  Department  of  Defense. 
-  Conducting  counterintelligence  activities  outside  the 
United  States  in  coordination  with  the  CIA  as 
required  by  procedures  agreed  to  by  the  Director 
of  Central  Intelligence  and  the  Attorney  General. 
•  Conducting,  within  the  United  States,  activities  to 
collect  or  support  foreign  intelligence  collection 
requirements  of  other  agencies  within  the  intelli- 
gence community  or,  when  requested  by  the 
Director  of  the  National  Security  Agency,  support- 
ing the  communications  security  activities  of  the 
United  States  Government. 
.  Producing  and  dL«seminating  foreign  intelligence 
and  counterintelligence. 
•  Carrying  out  or  contracting  for  research  develop- 
ment and  procurement  of  technical  systems  and 
devices  relating  to  the  functions  authorized  above. 
i  Defense  Intelligence  Agency  (Dt A)  (Department 
of  Defense).  The  Defense  Intelligence  Agency  was 
established  by  a  Secretary  of  Defense  directive  The 
chain  of  command  runs  from  the  Secretary  of  Defense 
through  the  Joint  Chiefs  of  Staff  to  the  Director,  DI  A. 
The  DIA  performs  the  following  functions: 
.  Develops  and  produces  all  DOD  intelligence 
estimates  and  contributions  to  national  estimates 
for  the  National  Foreign  Intelligence  Group. 
.  Provides  for  the  assembly,  integration,  and 
validation  of  all  DOD  intelligence  requirements  and 
the  assignment  of  relative  priorities  thereto;  assigns 
specific  requirements  to  DOD  collection  resources; 
and  originates  requests,  when  necessary  to 
non-DOD  collection  resources  to  fulfill  DOD 
requirements. 
.  Maintains  a  single  DOD  collection  requirements 
registry  and  facility  which  is  fully  compatible  with 
any  national  requirements  registry  and  facility. 
.  Provides  plans,  programs,  policies,  and  procedures 
for  DOD  collection  activities. 
.  Provides  all  DOD  current  intelligence. 
.  Conducts  coordinating  and  planning  activities  to  • 
achieve  maximum  economy  and  efficiency  in  the 
conduct  and  management  of  all  DOD  intelligence 
activities. 
.  Provides  military  intelligence  to  the  Secretary  of 
Defense,  staff  assistants  to  the  Secretary,  m.t.tao 
2-5
203 
  FMFM  2-4 
departments.  Joint  Chiefs  of  Staff,  specialized  DOD 
agencies,  unified  and  specified  commands,  and 
other  organizations  in  the  national  intelligence 
community. 
•  Cooperates  with  the  CIA  and,  other  intelligence 
organizations  for  mutual  support;  common  and 
combined  usage  of  facilities,  resources."  and  train- 
ing programs;  and  elimination  of  duplication.^ 
•  Manages  the  Defense  Attache  System. 
j.  Defense   Investigative   Service  (DIS).  The 
Defense  Investigative  Service  was  established  in  1972 
as  a  separate  operating  agency  and  is  currently  under 
the  direction  of  the  Office  of  the  Secretary  of  Defense 
(Policy).  DIS  conducts  personnel  security  investigations 
(PSI's)  for  DOD  components  within  the  50  states,  the 
District  of  Columbia,  and  the  Commonwealth  of 
Puerto    Rico.    It    also    investigates    unauthorized 
disclosure  of  information  at  the  national  level  within 
DOD  components  lacking  investigative  capabilities  and 
on  cases  crossing  component  lines.  DIS  administers 
assigned  Defense  Industrial  Security  Programs  on 
behalf  of  the  DOD  and  other  federal  departments  as 
directed.  The  Army,  Navy,  and  Air  Force  investigative 
organizations  assume  PSI  leads  on  behalf  of  the  DIS 
in  areas  outside  the  continental  United  States  and  are 
responsible  for  pursuing  investigative  matters  resulting 
from  PSI's   with   significant  counterintelligence   or 
criminal  ramifications.  As  a  central  control  point  for 
PSI's,  the  DIS  operates  the  Personnel  Security  In- 
vestigation Center,  the  National  Agency  Check  Center, 
and  the  Defense  Central  Index  of  Investigations  for 
DOD  components. 
Staff  for  Intelligence  has  general  staff  responsibility 
for  all, matters  pertaining  to  intelligence  and 
counterintelligence  requirements,  and  for  super- 
vising Army  intelligence  and  counterintelligence 
collection,  production,  and  dissemination.  The 
ACSI  reports  directly  to  the  Chief  of  Staff,  U.S. 
Army. 
(2)  Army  Intelligence  and  Security  Command. 
The  U.S.  Army  Intelligence  and  Security  Com- 
mand, under,,  the  .-supervision  of  the  ACSI,  is 
responsible  for  Army  counterintelligence  activities 
in  the  United  States  and  certain  other  specified 
geographic  areas.  Military  intelligence  groups 
(counterinteuigence)  are  the  primary  operating 
elements  of  the  intelligence  agency  with  the  mission 
of  providing  counterintelligence  support  in  specific 
geographic  areas.  The  military  intelligence  groups 
are  further  organized  into  regional  field  offices,  and 
resident  offices. 
(3)  Tactical  Counterintelligence  Elements.  Coun- 
terintelligence support  to  Army  tactical  units  is  pro- 
vided by  military  intelligence  battalions  or  groups 
comprising  counterintelligence  elements  as  well  as 
by  other  intelligence  specialists.  Tactical  intelligence 
units  are  controlled  by  the  commander  of  the  unit 
to  which  they  are  attached,  with  general  staff  super- 
vision exercised  by  the  unit  intelligence  officer. 
Additional  counterintelligence  units  may  also  be 
assigned  to  Army  support  commands  for  area 
security. 
c 
b.  Department  of  the  Air  Force 
203.  Military  Department  and  Service 
InteHigence  Organizations 
a.  Department  of  the  Army 
(1)  Assistant  Chief  of  Staff  for  Intelligence  (ACSI)f, 
Department  of  the  Army.  The  Assistant  Chief  of 
(1)  Assistant   Chief   of   Staff,   InteHigence.  The 
Assistant  Chief  of  Staff,  Intelligence  reports  directly 
to  the  Chief  of  Staff,  U.S.  Air  Force  and  has  general 
staff  responsibility  for  matters  pertaining  to  the 
intelligence  activities  of  the  Air  Force.  The  ACSI 
develops  and  implements  Air  Force  intelligence 
plans  and  policies;  coordinates  the  collection, 
production,  and  dissemination  of  air  intelligence; 
and  monitors  the  worldwide  targeting  efforts. 
2-6
FMFM  2-4 
203 
(2)  Inspector  General  (IG).  The  Inspector  General 
acts  as  an  advisor  to  the  Chief  of  Staff,  U.S.  Air 
Force  and  serves  as  a  professional  assistant  to  the 
Secretary  of  the  Air  Force.  The  Inspector  General 
provides  for  the  investigation  of  matters  within  Air 
Force  jurisdiction  involving  crime,  espionage, 
sabotage,  subversion,  disaffection,  and  related 
matters.  The  Inspector  General  also  directs  the 
counterintelligence  programs  within  the  Air  Force 
and  establishes  security  policy. 
<3)  Office  of  Special  Investigation  (OSI).  The  Office 
of  Special  Investigation,  under  the  direction  of  the 
Inspector  General,  provides  criminal,  coumerinteUi- 
gence,  personnel  security/and  special  investigative 
services  to  Air  Force  activities;  and  collects,  analyzes, 
and  reports  information  concerning  these  matters. 
c.  Department  of  the  Navy 
(1)  Director  o«  Naval  InteMgence  (ONI).  The  Direc- 
tor of  Naval  Intelligence  exercises  overall  staff 
responsibility  throughout  the  Department  of  the 
Navy  in  matters  pertaining  to  intelligence,  counter- 
intelligence, and  security. 
.  v     (2)  Naval  Intelligence  Command  (NIC).  Under  the 
command  of  the  Chief  of  Naval  Operations  (CNO), 
the  Commander,  Naval  Intelligence  Command 
(COMNAVINTCOM)  commands  the  Naval  Intel- 
ligence Command  headquarters  and  those  compo- 
nent commands  assigned  by  the  Chief  of  Naval 
Operations.  COMNAVINTCOM's  mission  is  to 
direct  and  manage  the  activities  of  the  Naval  Intel- 
ligence Command  to  ensure  the  fulfillment  of  the 
intelligence  requirements  and  responsibilities  of  the 
Department  of  the  Navy.  The  NIC  headquarters 
provides  the  requisite  staff  support  to  the  com- 
mander in  fulfilling  his  responsibilities  with  regard 
to  managing  intelligence  manpower,  personnel,  and 
training;  intelligence  collection,  production,  and 
dissemination;  intelligence  planning,  programming; 
and  budgeting;  and  providing  Navy-wide  manage- 
ment of  the  special  security  officer/special  activities 
ofiker  programs. 
(a)  The  component  commands  include:  ; 
•  The  Naval  Intelligence  SupportlCenter 
(NISQ,  which  analyzes  and  produces 
scientific,  technical,  and  current  intelligence, 
and  develops  threat  assessments  on  foreign 
naval  systems.  ; 
•  The  Naval  Field  Operational  Intelligence 
Office  (NFOI),  which  produces  finished 
operational  intelligence,  ocean  surveillance 
-information,  and  indications  and  warning. 
•  The  Naval  Intelligence  Processing  Systems 
Support  Activity  (NIPSSA),  which  plans 
and  manages  naval  intelligence  information 
processing  and  communication  systems. 
(b)  The  Naval  Investigative  Service  (NIS), 
formerly  a  component  command,  became  a 
second  echelon  command  in  September  1981; 
therefore,  the  Naval  Intelligence  Command  no 
Ions*'  has  investigative  or  counterintelligence 
rec-.nnsibilities. 
(3)  Naval  Investigative  Service  (NIS).  The  Director 
of  the  Naval  Investigative  Service  maintains  a 
worldwide  organization  composed  of  Navy  and 
Marine  Corps  personnel  responsive  to  command  re- 
quirements of  both  Services.  In  addition  to  the 
investigation  of  major  criminal  offenses,  the  Nib 
is  responsible  for  counterintelligence  investigations 
and    operations,    except    those    combat -related 
counterintelligence  matters  within  the  functional 
responsibilities  of  the  Marine  Corps.  (See  par. 
103g.)  During  combat  or  in  a  combat  contingency 
environment,  the  commander  amphibious  task 
force  (CATF)  and  the  commander  landing  force 
(CLF)  ashore  exercise  immediate  control  over 
assigned  Navy  and  Marine  Corps  investigative  and 
counterintelligence  assets.  In  addition  to  regularly 
assigned  Marine  Corps  counterintelligence  person- 
nel NIS  may  also  be  provided  with  counterintelli- 
gence personnel  from  FMF  commands  during 
peacetime  in  accordance  with  a  Service  agreement 
between  the  Commandant  of  the  Marine  Corps 
(CMC)  and  the  Director  of  NIS.  Further  details  on 
the  jurisdiction  and  responsibilities  of  NIS  are 
contained  in  SECNAV  Instruction  5520.3_. 
2-7
204 
FMFM  2-4 
(4)  Director  of  Intelligence,  Headquarters,  U.S. 
Marine  Corps.  The  Director  of  Intelligence,  Head- 
quarters, U.S.  Marine  Corps,  is  responsible  to  the 
Commandant  of  the  Marine  Corps  for  the  formu- 
lation of  plans  and  policies  pertaining  to  intelligence 
and  counterintelligence  within  the  Marine  Corps. 
The  Head,  Counterintelligence  Branch  is  the  prin- 
ciple advisor  to  the  Director  of  Intelligence  for 
counterintelligence  matters.  The  Counterintelli- 
gence Branch  performs  the  following  functions: 
•  Prepares  counterintelligence  plans,  policies,  and 
directives. 
•  Formulates  counterintelligence  doctrine  and 
missions. 
•  Coordinates  with  national  level  government 
agencies. 
•  Acts  as  counterintelligence  military  occupa- 
tional specialty  (MOS)  sponsor. 
•  Maintains  staff  cognizance  over  counterintelli- 
gence field  units  and  staff  management  of 
training. 
•  Exercises  staff  responsibility  for  human  intelli- 
gence (HUMINT)  resources  and  certain 
classified  programs. 
•  Coordinates  with  the  Naval  Investigative  Service 
(NIS)  in  special  investigations  and  operations. 
•  Provides  for  the  evaluation  and  procurement  of 
specialized  equipment. 
•  Conducts  security  reviews. 
•  Reviews  reports  from  the  field  commands  con- 
cerning security  violations,  loss  of  classified 
material,  and  compromises. 
•  Coordinates  the  release  of  information  for 
foreign  disclosure. 
•  Provides  representatives  to  national  level 
counterintelligence  and  security  committees. 
204.  Fleet  Marine  Force 
Counterintelligence 
Organization  r. 
a.  Staff  Counterintelligence  Officer    - 
(1)  The.  staff  counterintelligence  officer  is  an  integral 
part  of  the  intelligence  staff  of  FMF  headquarters, 
Marine  amphibious  forces  (MAFs),  divisions,  and 
aircraft  wings.  The  staff  counterintelligence  officer 
advises  and  assists  the  assistant  chief  of  staff,  G-2 
in  carrying  out  the  command's  counterintelligence 
responsibilities  and  is  the  focai  point  foi\.the  coor- 
dination of  the  counterintelligence  effort.  . 
(2)  The  staff  counterintelligence  officer  performs  the 
following  functions: 
•  Assists  and  advises  the  G-2  in  the  formulation, 
interpretation,  and  implementation  of  counter- 
intelligence policy. 
•  Coordinates  counterintelligence  services 
provided  to  the  command. 
•  Serves  as  the  principal  point  of  contact  between 
the  command  and  the  NIS  in  mattery  involving 
the  investigation  of  actual,  potential,  or 
suspected  espionage,  sabotage,  terrorism,  and 
subversive  activities,  including  defection", 
ensuring  that  information  about  these  activities 
is  reported  promptly  to  the  nearest  Naval 
Investigative  Service  representative. 
•  Maintains  liaison  with  the  NIS  and  other 
counterintelligence  agencies. 
•  Monitors  the  command  counterintelligence  and 
security  training  program  and  provides  advice 
and  assistance  for  the  maintenance  of  an  effec- 
tive program. 
•  In  coordination  with  the  communication  officer 
and  other  staff  officers,  advises  in  the 
maintenance  of  the  physical  security  aspects  of 
communications  security. 
2-8
FMFM  2-4 
204 
(3)  The  staff  counterintelligence  officer  performs  the 
following  operational  functions: 
•  Prepares  counterintelligence  directives,  plans 
reports,  and  estimates,  including  portions  of 
estimates,  reports,  and  studies  prepared  under 
the  supervision  of  other  G-2  elements. 
.  Plans,  implements,  and  supervises  all  active  and 
passive  counterintelligence  measures  within  the 
command. 
.  Coordinates  counterintelligence  measures, 
operations,  and  activities  with  lower,  adjacent, 
and  higher  headquarters. 
.  Provides  counterintelligence  advice  and  input  to 
contingency    operation    plans    for    training 
exercises. 
•  Maintains  counterintelligence  reference  material 
for  contingency  planning  and  provides  for 
further  dissemination  as  appropriate. 
.  Serves  as  a  member  of  the  command's  opera- 
tions security  (OPSEC)  committee,  where  such 
committees  exist. 
«  Plans,  implements,  and  coordinates  the  collec- 
tion of  information  through  special  operations 
and  the  use  of  human  intelligence  resources 
during  combat  operations. 
.  Conducts  planning  for  the  intelligence  and 
counterintelligence  processing  of  friendly 
prisoners  of  war  who  have  been  returned  to 
friendly  control. 
(4)  The  primary  efforts  of  the  staff  counterintelli- 
gence officer  are  directed  toward  planning  and  coor- 
dinating combat  counterintelligence  operations  and 
ensuring  that  assigned  or  attached  counterintelli- 
gence teams  are  employed  properly.  Counterintel- 
ligence planning  must  be  incorporated  into  all 
contingency  operation  plans  to  ensure  effective 
employment  of  counterintelligence  assets  and  proper 
security  of  operational  elements.  During  traimng 
exercises,  counterintelligence  planning  is  accomplished 
as  early  as  possible  and  provides  for  the  realistic 
training  of  counterintelligence  personnel. 
(5)  The  staff  counterintelligence  officer  seives  as  the 
headquarter's    counterintelligence    advisor    and 
monitors  the  overall  command  counterintelligence 
program.  Counterintelligence  personnel  will  not 
perform  routine  administrative  duties  associated 
with  the  information  security  program,  including 
processing  security  clearances,  maintaining  com- 
mand access  programs,  and  maintaining  the  unit's 
or  command's  classified  files.  These  tasks  are  the 
functional  responsibility  of  the  command  admin- 
istrative personnel;  assistant  chief  of  staff,  G-l ;  and 
the  command  security  manager.  The  staff  counter- 
intelligence officer  coordinates  counterintelligence 
services  and  makes  recommendations  to  the  security 
manager  on  the  adjudication  of  security  investiga- 
tions, violations,  and  compromises. 
(S)  The  staff  counterintelligence  officer  is  respon- 
sible for  recommending  to  the  assistant  chief  of 
staff  G-2  the  mission,  tasks,  and  responsibilities  of 
the  assigned  or  attached  counterintelligence  team(s). 
The  staff  counterintelligence  officer  coordinates  and 
supervises  the  overall  counterintelligence  effort  and 
tasking  of  assigned  or  attached  counterintelligence 
teams(s).  The  relationship  of  the  staff  counterintel- 
ligence officer  and  the  team  commander  is  similar 
to  that  of  a  staff  officer  and  the  commander  of  a 
subordinate  unit.  The  team  commander  should  be 
permitted  to  deploy  the  team  in  a  manner  best 
suited  to  accomplish  his  assigned  mission  and  tasks. 
(7)  At  the  Marine  amphibious  force  (MAF)  level 
the  staff  counterintelligence  officer  must  monitor  all 
counterintelligence  activity  within  the  MAF,  in- 
cluding that  of  detached  counterintelligence  teams 
or  subteams,  to  ensure  that  MAF  counterintelli- 
gence objectives  are  accomplished.  Accordingly, 
close  coordination  of  all  counterintelligence 
activities  must  be  accomplished  among  al  stall 
counterintelligence  officers  at  all  levels  of 
command. 
(8)  In  order  to  ensure  comprehensive,  all-source 
counterintelligence  estimates  and  views  are  available 
to  the  supported  commander,  the  staff  counterin- 
telligence officer  must  possess  access  to  appropriate 
compartmented  intelligence  material. 
2-9
204 
  FMFM  2-4 
b.  Counterintelligence  Teams 
(1)  Counterintelligence  teams  are  combat  support 
elements,  organic  to  the  MAF,  organized  and 
equipped  under  tables  of  organization  and  equip- 
ment of  the  4722  series.  As  intelligence  specialist 
teams,  they  are  assigned  to  the  assistant  chief  of 
staff,  G-2  to  accomplish  specific  counterintelligence 
objectives.  The  assistant  chief  of  staff,  G-2  exercises 
direction,  control,  and  supervision  of  the  teams 
through  the  staff  counterintelligence  officer. 
(2)  Counterintelligence  teams  are  assigned  to  major 
FMF  commands.  Three  teams  are  normally  assigned 
to  each  MAF  and  one  team  each  to  the  Head- 
quarters, Fleet  Marine  Force  Pacific  (FMFPAC) 
and  Fleet  Marine  Force  Atlantic  (FMFLANT).  The 
control  and  coordination  of  counterintelligence 
teams  at  the  MAF  level  is  essential  to  ensure  an 
economical,  flexible,  and  coordinated  response  to 
the  enemy  intelligence  threat  within  the  MAF  area 
of  responsibility .  Garrison  counterintelligence  team 
attachments  will  be  the  responsibility  of  the  respec- 
tive FMF  headquarters  and  will  be  coordinated  with 
the  Commandant  of  the  Marine  Corps. 
(3)  Counterintelligence  teams  assigned  to  the 
MAF  are  normally  retained  in  a  general  support 
role  under  the  centralized  control  of  the  MAF. 
In  cases  where  units  are  widely  separated,  opera- 
tions would  be  facilitated,  or  units  are  deployed 
separately;  counterintelligence  teams  may  be 
further  attached  to  divisions,  aircraft  wings,  or 
Marine  amphibious  brigades  (MAB's).  When  com- 
mands of  less  than  division,  aircraft  wing,  or  MAB 
size  require  direct  counterintelligence  support, 
attachment  of  counterintelligence  subteams  is 
appropriate.  The  MAF  counterintelligence  organi- 
zation is  shown  in  figure  2-2.  Counterintelligence 
DIVISION 
AC  OF  S  G-2 
CI  TEAM 
CI  TEAM 
T 
SCI 
CI  TEAM 
Gp 
AIRCFIAFT 
WING 
ACOFS 
G-2 
SC 
CI* 
JEI \M 
SCI 
ACOFS 
G-2 
LEGEND: 
■■  Direction/Operational  Control 
  Tasking  Coordination 
*  Attached  as  required  from  MAF  CI  TEAMS 
CI* 
TEAM 
Figure  2-2.  Marine  Amphibious  Force  Counterintelligence  Organization. 
2-10
FMFM  2-4 
204 
support  for  these  units  is  normally  provided  by  the 
MAGTF  headquarters  counterintelligence  teams  or 
by  locally  assigned  counterintelligence  assets.  Coun- 
terintelligence subteams  or  teams  (as  appropriate 
to  the  operational  environment)  may  be  assigned 
by  the  FMF/MAF  commander  to  the  force  service 
support  group  (FSSG)  when  the  FSSG  cannot  be 
supported  by  the  division,  aircraft  wing,  or  Marine 
air-ground  task  force  (MAGTF)  counterintelligence 
assets  and  requires  direct  counterintelligence 
support.  f 
(4)  Counterintelligence  teams  assigned  to  Head- 
quarters, FMFPAC  and  FMFLANT  prov.de  the 
commander  with  the  means  to  meet  specific  opera- 
tional requirements  and  provide  support  to  areas 
where  gaps  in  counterintelligence  coverage  may 
exist  due  to  deployment  of  MAF  commands. 
(5)  The  standard  counterintelligence  team  consists 
of  five  officers,  nine  enlisted  counterintelligence 
specialists,  and  two  administrative  clerks.  The  team 
is  organized  into  a  team  headquarters  and  four 
subteams,  each  consisting  of  one  officer  and  two 
counterintelligence  specialists.  The  counterintelli- 
gence team  is  based  on  a  modular  concept  permit- 
ting the  task  organization  of  a  team  by  the  attach- 
ment or  detachment  of  subteams  as  required.  The 
standard  counterintelligence  team  organization  is 
shown  in  figure  2-3. 
TEAM  HEADQUARTERS 
1  Capt  Team  Commander 
1  MSgt  CI  Chief 
2  LCpl  Admin  Clerk 
SUBTEAM 
1  Lt  Subteam  Commander 
1  GySg!  CI  Specialist 
1  Sgt  CI  Specialist 
I 
r 
SUBTEAM 
1  WO  Subteam  Commander 
1  SSgt  CI  Specialist 
1  Sgt  Specialist 
Figure  2-3.  Standard  Counterintelligence  Team. 
(6)  Counterintelligence  teams  are  equipped  for  tac- 
tical operations  and  maintain  sufficient  organic 
equipment  to  support  the  team  headquarters  and 
the  separate  deployment  of  fully  equipped  sub- 
teams.  The  team  is  not  capable  of  self-administra- 
tion and  requires  administrative  and  logistics  sup- 
port from  the  unit  to  which  assigned  or  attached. 
Equipment  authorized  by  counterintelligence  teams 
tables  of  equipment,  however,  remains  organic  to 
the  counterintelligence  team  regardless  of  supply 
and  maintenance  assistance  and  support. 
(7)  Counterintelligence  teams  operate  under  the 
staff  cognizance  of  the  assistant  chief  of  staff,  G-2 
and  perform  the  following  functions  as  directed: 
.  Conduct  active  and  passive  counterintelligence 
operations  including  counterespionage,  counter- 
subversion,  counterterrorism,  and  counter 
sabotage  in  support  of  tactical  units  during 
combat  operations. 
.  Conduct  intelligence  collection  operations  utiliz- 
ing humnu  intelligence  sources  during  combat 
operations. 
.  Conduct  counterintelligence  investigations  per- 
taining to  espionage,  sabotage,  terrorism,  and 
subversion,  including  defection  and  other 
special  counterintelligence  investigations  as 
required  during  combat  operations. 
.  Assist  the  staff  counterintelligence  officer  in  the 
preparation  of  counterintelligence  estimates  and 
plans  for  areas  of  operation  reflected  by  con- 
tingency plans. 
♦  Participate  in  field  training  exercises  of  Marine 
amphibious  units  (MAlTs)  or  larger  commands. 
Participation  in  exercises  of  smaller  units  is 
appropriate  provided  realistic  and  meaningful 
counterintelligence  activities  can  be  developed 
Participation  should  include  assignment  ot 
counterintelligence  personnel  to  the  exercise 
planning  staff  to  ensure  adequate  counter- 
intelligence activity  in  the  exercise. 
.  Maintain    information    concerning    person- 
alities,   organizations,    and    installat.ons    of 
2-11
205 
FMFM  2-4 
counterintelligence   interest 
combat  contingency  plans. 
which    support 
Conduct  counterintelligence  surveys  of  commands 
and  installations  to  determine  the  security 
measures  necessary  to  provide  protection 
against  espionage,  sabotage,  subversion,  and 
terrorism  and  the  unauthorized  disclosure  of, 
or  access  to,  classified  material. 
>  Conduct  counterintelligence  evaluations  and 
inspections  of  areas  containing  classified 
material. 
»  Conduct  technical  surveillance  countermeasures 
(TSCM)  inspections  and  surveys  of  sensitive 
areas  in  accordance  with  MCO  05511.11 — . 
These  inspections  and  surveys  are  conducted  by 
a  designated  counterintelligence  team  within 
each  MAF,  which  has  a  TSCM  capability. 
•  Preparation  and  conduct  of  penetration  inspec- 
tions to  test  the  counterintelligence  and  security 
measures  of  the  command.  These  inspections 
may  be  in  conjunction  with  the  OPSEC  pro- 
gram where  appropriate.  Counterintelligence 
assets  should  direct  their  efforts  towards  iden- 
tification of  friendly  vulnerabilities  which  can 
be  exploited  by  hostile  collection  assets  and 
recommend  appropriate  countermeasures  to  the 
command  OPSEC  officer. 
•  Provide  instructors  in  counterintelligence  and 
security  subjects  for  the  command  training 
program.  (Section  6  provides  details  on 
counterintelligence  and  security  subjects  for 
command  training  programs.) 
•  During  combat  operations,  collect  and  maintain 
information  designed  to  identify,  locate,  and 
recover  friendly  personnel  captured,  missing 
(nonhostile),  and  missing  in  action. 
•  Conduct  the  intelligence  and  counterintelligence 
debriefing  of  friendly  prisoners  of  war  who  are 
returned  to  U.S.  control. 
•  Conduct  liaison  with  unit  intelligence  sections 
and  local  intelligence,  counterintelligence,  and 
law  enforcement  agencies  as  appropriate. 
(8)  Counterintelligence  interest  in  physical  security 
will  often  overlap  with  the  functional  responsibilities 
of  the  provost  marshal.  During  the  conduct  of  coun- 
terintelligence surveys,  counterintelligence  personnel 
are  concerned  with  physical  security  as  it  relates  to 
all  aspects  of  counterintelligence,  while  in  the  case 
of  counterinteUigence  evaluations  and  inspections, 
this  interest  primarily  is  directed  toward  the  protec- 
tion of  classified  material.  Concurrently,  functional 
interests  of  the  provost  marshal/military  police  are 
physical  security  measures  designed  to  safeguard  per- 
sonnel; prevention  of  unauthorized  access  to  equip- 
ment, facilities,  material,  and  documents;  and  the 
safeguarding  of  them  against  espionage,  sabotage, 
terrorism,  damage,  and  theft.  The  overlapping 
physical  security  interests,  equally  applicable  m 
garrison  and  combat,  must  be  effectively  coordinated 
to  ensure  optimum  security  of  the  command.  Coun- 
terintelligence personnel  may  not  be  utilized  to  assess 
physical  security  areas  unrelated  to  counterintelli- 
gence, such  as  armories,  post  exchanges,  disbursing 
offices,  and  clubs,  where  the  security  thrust  is  the 
prevention  of  damage,  theft,  and/or  pilferage.  This 
function  is  under  the  cognizance  of  the  provost 
marshal. 
(9)  Counterintelligence  assets  should  not  be  utilized 
to  perform  functions  such  as  criminal  investigations 
or  incident  reporting  which  would  more  appro- 
priately come  under  the  cognizance  of  other  assets 
available  to  the  commander. 
205.  Marine  Corps  Supporting 
Establishment  Counterintelligence 
Personnel 
CounterinteUigence  personnel  are  assigned  to  major 
Marine  Corps  bases  and  support  activities  to  advise  and 
assist  in  planning  and  implementing  the  command 
counterinteUigence  effort. 
CounterinteUigence  personnel  assigned  to  the  supporting 
establishment  perform  nontactical  counterinteUigence 
functions  normaUy  performed  by  FMF  staff  counter- 
inteUigence officers  and  counterintelligence  teams. 
2-12
FMFM  2-4 
207 
206.  Commands  Without  Assigned 
Counterintelligence  Personnel 
and  other  areas  used  for  the  preparation  or  stowage  of 
classified  material. 
Commands  that  do  not  have  counterintelligence  person- 
nel assigned  or  attached,   are  still  responsible  for 
establishing  counterintelligence  measures  to  ensure  the 
security  of  the  command  and  to  deny  the  enemy,  infor- 
mation which  might  be  used  to  increase  the  effectiveness 
of  hostile  operations  against  the  command.  These  com- 
mands, however,  conduct  neither  counterintelligence  in- 
vestigations,  nor   special   operations   against   enemy 
capabilities  in  the  fields  of  espionage,  sabotage,  subver- 
sion, or  terrorism.  If  these  types  of  investigations  or 
operations  appear  to  be  required,  a  request  must  be  sub- 
mitted to  the  local  Naval  Investigative  Service  office. 
When  appropriate,  the  request  should  go  through  the 
chain  of  command  for  concurrence  of  the  commander 
who  has  counterintelligence  staff  advisors. 
Those  commands  not  assigned  or  attached  counterintel- 
ligence personnel  normally  operate  as  part  of  larger  com- 
mands having  counterintelligence  personnel.  These  coun- 
terintelligence specialists  are  usually  available,  upon 
request,  to  provide  advice  and  assistance  on  such  mat- 
ters as  conducting  lectures  and  demonstrations,  testing 
unit  security,  advising  on  counterintelligence  measures  to 
be  adopted,  and  checking  security  of  offices,  war  rooms, 
207.  Liaison 
Effective  performance  in  the  field  of  counterintelligence 
requires  extensive  liaison.  Counterinteligence  activities 
often  closely  parallel  functions  and  responsibilities  of 
other  organizations  and  agencies  and,  in  some  cases,  may 
overlap.  Close  and  continuous  liaison  and  coordination 
aids  in  the  effectiveness  of  operations,  the  exchange  of 
information,  and  in  providing  for  mutual  assistance. 
Policies  and  procedures  for  liaison  and  the  coordination 
of  counterintelligence  activities  are  developed  and  pro- 
mulgated at  the  general  staff  level.  Depending  on  the  area 
of  operations  and  the  type  of  counterintelligence  activity, 
liaison  and  coordination  is  normally  conducted  by  coun- 
terintelligence elements  with  local  intelligence,  counter- 
intelligence, security  and  law  enforcement  organiza- 
tions/agencies, and  civil  affairs  and  psychological  opera- 
tions units  where  appropriate.  In  all  cases,  liaison  must 
be  conducted  within  jurisdictional  limitations  imposed  by 
higher  authority. 
(reverse  blank)         2-13
FMFM  2-4- 
Section  3 
Section  3 
Counterintelligence  Combat  Operations 
301.  General 
Major  Fleet  Marine  Force  (FMF)  units  are  provided  coun- 
terintelligence support  by  assigned  or  attached  counter- 
intelligence teams.  During  tactical  operations,  counter- 
intelligence activities  are  characterized  by  aggressive, 
resourceful,  and  well-coordinated  operations  designed  to 
protect  the  command  from  hostile  intelligence  collection, 
sabotage,  terrorism,  and  subversive  activities.  Counter- 
intelligence teams  contribute  to  mission  accomplishment 
by  assisting  the  commander  in  accomplishing  his  coun- 
terintelligence responsibilities. 
sabotage,  terrorist,  and  subversive  activities,  and  to 
recommend  measures  necessary  for  the  protection  of 
information  against  espionage,  personnel  against  sub- 
version and  terrorism,  and  installations  and  materiel 
against  sabotage. 
303.  Categories  of  Counterintelligence 
Operations 
Counterintelligence  operations  within  the  Fleet  Marine 
Forces  normally  comprise  the  following  five  categories: 
302.  Counterintelligence  Mission 
The  mission  of  counterintelligence  assets  in  Fleet  Marine 
Force  units  is  to  plan  and  recommend  the  implementation 
of  measures  designed  to  discover,  neutralize,  or  destroy 
the  effectiveness  of  actual  or  potential  hostile  intelligence, 
a  Military  Security.  Military  security  encompasses 
all  measures  taken  by  a  command  to  protect  itself  from 
sabotage,  terrorism,  and  subversion,  and  to  deny 
information  to  the  enemy.  In  Fleet  Marine ^  
Force 
units,  it  emphasizes  protection  of  airfields  and  other 
3-1
303 
FMFM  2-4 
major  installations,  and  the  defeat  of  hostile  target 
acquisition  efforts.  Typical  measures  include  operations 
security  (OPSEC),  counterreconnaissance,  &™»**- 
signs,  passwords,  and  restrictions  on  access  to  selected 
areas  and  installations. 
(1)  Operations  Security 
'a)  OPSEC  denies  the  enemy  prior  knowledge 
of  essential  elements  of  friendly  information 
(EEFI)  regarding  command  activities,  plans, 
operations,  and  intentions.  The  enemy  collects 
this  information  through  a  variety  of  means.  To 
effectively  counter  this  threat,  commanders 
must  have  access  to  reliable  information  on 
enemy  intelligence  capabilities.  This  informa- 
tion must  be'timely  and  accurate  to  ensure  com- 
manders maximum  security  for  their  operations. 
(b)  Counterintelligence  units  support  the  com- 
manders' OPSEC  programs  by  providing  assess- 
ments of  friendly  vulnerabilities;  briefings  on 
enemy  threats  of  espionage,  sabotage,  subver- 
sion and  terrorism;  and  assistance  in  estab- 
lishing safeguards  against  those  security  threats. 
(c)  OPSEC  is  the  functional  responsibility  of 
the  operations  officer  (G-3/S-3).  To  be  effective, 
OPSEC   principles   and   concepts   must   be 
established  and  continuously  practiced  during 
the  conduct  of  peacetime  operations  as  well  as 
in  combat  environments.  Commanders,  staffs, 
and  individuals  at  all  echelons  of  command  are 
responsible  for  developing  an  effective  OPSEC 
program.  Commanders  must  determine  what 
OPSEC   measures  to   implement,   when  to 
implement  them,  and  what  level  of  risk  they  are 
willing  to  accept. 
(d)  An  OPSEC  committee  should  be  formed  at 
each  command  consisting  of  the  following  staff 
sections:  G-3  (Chairman),  G-2,  G-4,  G-l,  public 
affairs,  communications-electronics,  adjutant, 
medical,  and  others  as  desired.  The  committee 
is  responsible  for  the  overall  planning  and 
monitoring  of  the  OPSEC  program.  Command- 
ers should  ensure  that  OPSEC  is  considered^ 
the  initial  planning  phase  of  all  operations.  The 
OPSEC  plan  should  include,  as  a  minimum,  ue 
EEFI  for  the  operation  and  should  state  specific 
countermeasures  which  will  be  implemented  to 
enhance  surprise  and  increase  security  for  the 
command  operation.  OPSEC  concepts  and 
techniques  should  be  developed  to  include  the 
following: 
1   Central  Control  and  Direction.  This  may 
be  accomplished  through  the  establishment 
of  an  OPSEC  team  comprised  of  members 
of  the  operations  section  (G-3/S-3),  intelli- 
gence section  (G-2/S-2),  and  communi- 
cations-electronics section.  Through  assets 
available   to   them   (counterintelligence, 
signals  intelligence,  photoimagery  interpre- 
tation, etc.),  the  OPSEC  team  will  direct  its 
efforts  towards  the  identification  of  enemy 
intelligence  collection  assets  and  recom- 
mending countermeasures,  including  the  use 
of  deception. 
2  Close  Integration  of  Operations,  Communi- 
cations Security,  and  Counterintelligence. 
Members  of  the  OPSEC  team  will  review  and 
monitor  operation  plans,  actions,  and  after- 
action reports  for  evidence  of  indicators  which 
disclose  EEFI,  establish  patterns,  or  provide 
other  mission-oriented  information  to  the 
enemy.  Continuous  efforts  will  be  maintained 
to  discover  enemy  methods  of  informauon 
collection  directed  towards  the  command. 
Upon  discovery  of  such  indicators  and/or 
methods,  recommended  methods  of  improv- 
ing friendly  security  and/or  nullifying  the 
enemy's  collection  capabilities  will  be  provided 
to  the  commanders. 
3  Operations  Security  Data   Base.  The 
OPSEC  officer  is  responsible  for  developing 
and  maintaining  an  OPSEC  data  base  As 
information  is  developed  on  friendly  vulner- 
abilities and  enemy  intelligence  capabilities, 
?t  is  analyzed,  acted  on,  and  filed  in  an  easily 
retrievable  manner.  The  information,  espe- 
cially that  concerning  enemy  intelligence 
capabilities,  is  continually  updated  and  used 
to  plan  methods  of  information  denial 
and/or  deception.  The  type  information  that 
might  be  found  in  the  data  base  is  as  follows: 
•  Unit    communication    equipment/ 
procedures. 
•  Communication  violations. 
•  Counterintelligence  measures  in  effect. 
«  Imagery  of  friendly  positions. 
3-2
FMFM  2-4 
303 
•  Technical  collection  and  operational 
capabilities  of  known  enemy  units  in  the 
area  of  operations,  including  operational 
capabilities  of  equipment. 
•  Enemy  sightings/contacts. 
•  Clandestine  enemy  personnel,  organiza- 
tions, and  installations. 
•  Record  of  camouflage/blackout  discipline. 
(2)  Counterreconnaissance.  Of  all  the  counter- 
intelligence measures  that  are  taken  by  a  unit  in 
combat,  one  of  the  most  effective  is  counterrecon- 
naissance. Units  may  be  assigned  both  reconnais- 
sance and  counterreconnaissance  responsibilities; 
these  two  activities  complement  each  other  and  are 
inseparable.  Good  reconnaissance  ensures  a  certain 
amount  of  security,  and  counterreconnaissance  pro- 
vides a  certain  amount  of  reconnaissance  informa- 
tion; however,  a  unit  armed  and  equipped  for  a 
pure  reconnaissance  mission  is  not  ordinarily  given 
a  supplementary  counterreconnaissance  mission  as 
accomplishment  of  the  counterreconnaissance  mis- 
sion generally  requires  defeat  of  hostile  reconnais- 
sance elements.  The  primary  object  of  reconnais- 
sance is  collection  of  information,  not  combat. 
Counterintelligence  includes  all  measures  taken  to 
prevent  hostile  observation  of  a  force,  area,  or 
place.   Counterreconnaissance  can   include  the 
setting  up  of  a  defensive  screen  to  deny  enemy 
reconnaissance  or  an  offensive  screen  designed  to 
meet  and  destroy  enemy  reconnaissance.  In  combat 
air  operations,  counterair  operations  to  deny  or 
reduce  an  enemy's  capability  for  visual,  photo- 
graphic, or  electromagnetic  reconnaissance  may  be 
defined  as  counterreconnaissance. 
(a)  Principles   of    Counterreconnaissance. 
Counterreconnaissance  elements  focus  on 
friendly  forces  being  screened;  hostile  recon- 
naissance forces  are  destroyed  or  neutralized  by 
combat,  and  friendly  screening  forces  are 
echeloned  in  depth. 
(b)  Forms  of  Counterreconnaissance 
1_  The  defensive  screen  is  protective  and  is 
usually  established  behind  natural  obstacles. 
2  The  offensive  screen  meets  the  enemy's 
reconnaissance  forces  and  destroys  them. 
An  offensive  screen  may  be  moving  or  sta- 
tionary depending  on  the  activities  of  the 
friendly  force  being  screened. 
3_  The  commander's  adoption  of  a  form  of 
counterreconnaissance  screen  is  dependent 
upon  the  situation,  mission,  weather,  and 
terrain;  thus  the  form  of  counterreconnais- 
sance  screen  adopted  need  not  reflect  solely 
the  tactical  mission  of  the  command.  The 
fact  that  there  are  offensive  and  defensive 
screens  does  not  imply  a  requirement  for 
their  employment  only  in  support  of  a  like 
tactical  mission.  An  offensive  jcreen  may 
well  be  employed  to  support  a  tactical  mis- 
sion of  defense,  while  an  attack  mission  may 
be  supported  best  by  a  defensive  screen. 
(3)  Countersigns 
(a)  Dissemination 
1_  Countersigns,  each  consisting  of  a 
challenge  and  password,  are  normally  issued 
as  a  tab  to  the  counterintelligence  appendix 
to  the  intelligence  annex  to  the  operation 
order.  They  appear  as  shown  in  the  follow- 
ing examples: 
identifying 
Code  Number 
Challenge        Password 
Lamp 
Powder 
Glass 
Wheel 
Quaint 
Table 
2_  Words  that  are  closely  associated  or 
normally  used  in  conjunction  with  one 
another  are  avoided.  Unless  compromised 
or  otherwise  changed,  countersigns  are  nor- 
mally effective  for  no  more  than  24  hours. 
Dissemination  of  the  initial  primary  and 
alternate  countersign  for  the  first  period 
troops  are  ashore  can  be  made  in  the  coun- 
terintelligence appendix  to  the  intelligence 
annex.  Subsequent  countersigns  can  be 
disseminated  in  a  message  such  as  the 
following:  Code  II  countersign  effective 
01.2300  (local  time),  alternate  code  13. 
3-3
303 
FMFM  2-4 
(b)  Compromise.  When  a  unit  knows  or 
suspects  that  the  designated  countersign  has 
been  compromised,  the  alternate  is  put  into 
effect  by  that  unit.  Landing  force  headquarters 
must  be  immediately  notified  so  that  subor- 
dinate and  adjacent  units  can  be  informed  that 
the  alternate  countersign  is  in  effect  and  a  new 
alternate  countersign  is  then  designated. 
(c)  Use  of  the  Countersign.  It  must  be 
emphasized  that  countersigns  are  not  used  when 
other  means  of  identification  -^re  possible.  Fur- 
ther, neither  the  challenge  nor  the  password  is 
given  in  a  loud  voice. 
b.  Civil  Security.  Civil  security  operations  include  all 
the  counterintelligence  measures  affecting  the  popula- 
tion of  the  area.  Typical  measures  include  security 
screening  of  civilian  labor,  imposition  of  curfews,  other 
circulation  control  measures,  and  the  monitoring  of 
suspect  political  groups. 
hostile  and  unfriendly  intelligence  collection,  sabotage, 
terrorism,  and  subversive  organizations  and  activities. 
These  operations  are  conducted  by  trained  counterin- 
telligence personnel  and  include  the  following: 
(1)  Counterespionage.  Counterespionage  opera- 
tions are  designed  to  detect  or  expose  hostile 
espionage  efforts  and  to  institute  offensive  measures 
intended  to  penetrate  and  nullify  hostile  intelligence 
plans  and  operations,  thus  contributing  to  the 
security  of  the  FMF  in  the  field. 
(2)  Countersubversion.  Countersubversion  opera- 
tions are  designed  to  detect,  prevent,  or  neutralize 
the  activities  of  subversive  groups.  Because  sub- 
versive activity  is  closely  related  to  and  frequently 
supports,  conceals,  or  provides  a  favorable  environ- 
ment for  hostile  espionage  and  sabotage  operations, 
the  countersubversive  mission  may  include  offen- 
sive measures  directed  toward  the  origin  of  hostile 
subversive  plans  and  policies. 
c.  Embarkation  Security.  Embarkation  security  con- 
sists of  the  special  application  of  military  and  civil  security 
measures  to  the  embarkation  phase,  which  includes  the 
movement  to  the  point  of  embarkation  and  the  actual 
embarkation.  Examples  include  the  screening  of  civilians 
employed  in  the  port  or  airfield,  control  of  contact  be- 
tween troops  and  civilians,  covering  or  removing  tactical 
markings  and  other  unit  designations,  and  moving  to  the 
port  or  airfield  under  cover  of  darkness. 
d.  Wartime  Information  Security  Program  (WISP). 
The  Wartime  Information  Security  Program  is  the  con- 
trol and  examination  of  communications  to  prevent 
disclosure  of  information  of  value  to  an  enemy  and  the 
collection  of  information  of  value  to  the  United  States. 
e.  Special  Operations.  Special  counterintelligence 
operations  include  the  specialized  employment  of  active 
and  deceptive  counterintelligence  techniques  and  pro- 
cedures in  the  conduct  of  covert  operations  against 
(3)  Countersabotage.  Countcrsabotage  operations 
require  a  comprehensive  program  of  defensive 
measures  and  aggressive  offensive  action  to 
penetrate  saboteur,  partisan,  or  other  dissident 
groups  to  determine  sabotage  plans,  and  to  iden- 
tify saboteurs,  methods  of  operation,  and  specific 
targets.  Sabotage  is  a  principal  weapon  of  guerrilla 
and  partisan  groups,  and  is  increasingly  important 
as  a  threat  to  rear  area  logistics  installations. 
(4)  Counterterrorism.  Countenerrorism  operations 
are  designed  to  detect,  restrain,  or  neutralize  those 
terrorist  organizations  and  personalities  who  pose 
a  threat  to  U.S.  installations  and  personnel,  or 
other  interest.  Counterterrorism  operations  will  be 
conducted  in  the  same  manner  as  other  special 
operations  and  will  include  the  collection  and 
analysis  of  information  pertaining  to  the  terrorist 
threat.  (The  term  antiterrorism  refers  to  the  defen- 
sive measures  by  DOD  to  reduce  the  vulnerability 
of  DOD  personnel  and  their  dependent  facilities 
and  equipment  to  terrorist  acts.  Antiterrorism 
measures  should  not  be  confused  with  counter- 
terrorism  operations). 
3-4
FMFM  24 
304 
304.  Forward  Area  Operations 
a.  Offensive  Operations 
(1)  Counterintelligence  operations  during  the  attack 
consist  primarily  of  neutralizing,  exploiting,  or 
destroying  counterintelligence  targets  which  are 
known  to  be  located  in  the  enemy  held  areas.  These 
targets  are  normally  contained  in  the  counterintel- 
ligence target  reduction  plan  (see  par.  504). 
(2)  Counterintelligence  elements  are  normally 
deployed  with  the  command  headquarters  rather 
than  forward  tactical  elements  in  order  to  provide 
timely  support  to  those  areas  where  enemy  intelli- 
gence activities  require  a  greater  counterintelligence 
effort. 
(3)  A  defensive  situation  allows  for  greater  develop- 
ment and  exploitation  of  counterintelligence 
targets.  Counterintelligence  elements  normally 
accomplish  the  following: 
(2)  Counterintelligence  personnel  may  be  deployed 
with  forward  elements  depending  on  the  number 
and  criticality  of  identified  counterintelligence 
targets  within  the  objective  area.  In  some  instances, 
it  is  advantageous  for  counterintelligence  personnel 
to  take  immediate  custody  of  persons  of  counter- 
intelligence interest,  while  in  the  case  of  installa- 
tions, exploitation  may  be  delayed  until  forward 
elements  have  occupied  or  passed  through  the 
objective  area.  The  preservation  and  protection  of 
installations  of  counterintelligence  interest,  pending 
exploitation  by  counterintelligence  personnel,  is 
arranged  with  commanders  of  lead  units. 
(3)  Flexibility  of  operations  is  required  to  ensure 
coverage  of  all  counterintelligence  targets.  Counter- 
intelligence personnel  may  be  deployed  from  one 
unit  to  another  and  from  rear  areas  to  forward 
elements  as  the  situation  changes. 
b.  Defensive  Operations 
(1)  In  the  defense,  counterintelligence  efforts  are 
primarily  directed  against  the  enemy  intelligence 
efforts  to  collect  information  concerning  FMF 
units,  infiltration  of  enemy  intelligence  agents, 
sabotage,  and  terrorist  activities.  In  a  static 
situation,  the  enemy  can  be  expected  to  increase  all 
of  these  activities,  as  well  as  to  increase  guerrilla 
force  operations  against  installations,  command 
posts  (CP's),  lines  of  communications,  supply,  and 
other  critical  areas. 
•  Develop  an  effective  human  source  collection 
system  targeted  against  enemy  intelligence 
activities. 
•  Conduct  operations  against  enemy  intelligence 
organizations  and  activities. 
•  Screen  and  interrogate  those  civilians  and 
prisoners  of  war  who  are  known  to  be,  or 
suspected  to  be,  of  possible  counterintelligence 
interest. 
•  Provide  security  services  to  enhance  the  security 
of  critical  installations  and  activities. 
•  Conduct  briefings  for  the  command  and  other 
organizations,  such  as  military  police,  psycho- 
logical operations  units,  and  civil  affairs  units, 
on  hostile  intelligence  activity  and  methods  of 
operation. 
•  Conduct  counterintelligence  investigations  as 
required. 
•  Conduct  investigations  and  collect  information 
to  aid  in  identifying,  locating,  and  recovering 
friendly  personnel  captured,  missing  (non- 
hostile),  and  missing  in  action. 
(4)  During  a  defensive  situation,  counterintelligence 
elements  may  also  initiate  human  intelligence 
(HUMINT)  resources  collection  programs  if  the 
counterintelligence  situation  permits  and  the 
resources  are  available.  These  programs  are  design  al 
to  collect  order  of  battle  (OOB)  information  end 
information  concerning  enemy  intentions.  Addi- 
tionally, counterintelligence  units  may  participate  in 
3-5
305 
FMFM  2-4 
certain  special  operations  concerning  infiltration  of 
sources,  deceptive  operations,  and  exploitation  of 
enemy  intelligence  agents  as  directed  by  higher 
headquarters. 
c.  Retrograde  Operations 
(1)  During  retrograde  operations,  the  security  of 
troop  movements  and  lines  of  communications  are 
of  prime  importance  to  the  commander.  Counter- 
intelligence operations  and  the  collection  of  infor- 
mation must  be  compatible  with  the  commander's 
courses  of  action  and  designed  to  limit  the  effec- 
tiveness of  enemy  intelligence  activities  during  the 
movement. 
(2)  Counterintelligence  units  are  norma'';;  con- 
cerned with  the  following  functions  during  a 
retrograde  operation: 
•  Collecting  information  on  enemy  intelligence 
activities  that  could  hinder  friendly  troop 
movement. 
•  Maintaining  continuous  liaison  with  military 
police  and  other  security  forces  responsible  for 
the  control  of  refugees  and  other  civilians  in 
order  to  detect  persons  of  possible  counterin- 
telligence interest. 
•  In  support  of  units  involved,  assisting  in  and 
coordinating  the  inspection  of  vacated  com- 
mand post  areas  to  ensure  that  no  information 
or  material  has  been  left  behind  which  might 
benefit  enemy  forces. 
•  Evaluating  personnel  of  counterintelligence 
interest  for  evacuation  and/or  protection. 
•  Evaluating  sources  of  information  for  evacua- 
tion or  further  operational  employment. 
•  Coordinating  activities  with  counterintelligence 
and  security  units  of  higher  and  adjacent 
commands. 
305.  Rear  Area  Operations 
Those  areas  in  which  combat  service  support  (CSS) 
activities  are  accomplished  are  referred  to  as  rear  areas. 
These  areas  provide  a  lucrative  target  for  enemy  intelli- 
gence activity  and  guerrilla  operations.  Enemy  espionage, 
sabotage,  terrorist,  and  subversive  activities,  and  the 
disruption  of  lines  of  communications  within  rear  areas 
may  serve  to  jeopardize  combat  operations. 
Counterintelligence  support  for  rear  areas  is  normally 
provided  by  the  counterintelligence  team  supporting  the 
Marine  air-ground  task  force  (MAGTF)  headquarters. 
Counterintelligence  activities  in  support  of  rear  area 
security  include  the  following: 
•  Collecting  information  concerning  hostile  intelligence 
personalities,  organizations,  and  activities  in  rear  areas. 
•  Conducting  operations  to  destroy,  neutralize,  or 
exploit  hostile  intelligence  elements. 
•  Developing  HUMINT  programs. 
•  Providing  security  services,  including  technical 
surveillance  countermeasures  (TSCM)  support  to 
enhance  the  security  of  commands. 
•  Conducting    counterintelligence 
required. 
investigations    as 
•  Screening  and  interrogating  those  civilians  and 
prisoners  of  war  who  are  known  to  be,  or  are 
suspected  to  be,  of  counterintelligence  interest. 
•  Conducting  further  exploitation  of  counterintelligence 
targets  referred  from  forward  tactical  commands. 
•  Providing  assistance  in  and  support  for  the  command 
security  orientation  and  indoctrination  program. 
•  Conducting  briefings  for  unit  and  installation  com- 
manders on  the  hostile  intelligence  threat  and  providing 
recommendations  to  enhance  security  measures. 
•  Conducting  investigations  and  collecting  information 
to  aid  in  identifying,  locating,  and  recovering  friendly 
personnel  captured,  missing  (nonhostile),  and  missing 
in  action. 
3-6
FMFM  2-4 
306 
306.  Employment  of  Counterintelligence 
Teams 
a.  Operational  Concept 
(1)  Counterintelligence  teams  are  normally  assigned 
to  the  MAGTF  and  provide  general  support  within 
the  MAGTF  area  of  operations.  Control  of  coun- 
terintelligence teams  by  the  force  commander  pro- 
vides the  commander  with  the  means  to  meet  the 
specific  operational  requirements  of  various  com- 
mands within  the  force  and  to  hold  counterintelli- 
gence teams  or  subteams  at  force  level  to  effect 
counterintelligence  support  of  subordinate  com- 
mands as  required.  In  some  instances,  due  to  the 
time  element,  tactical  conditions,  or  operational  ex- 
igencies, it  may  be  necessary  for  the  force  com- 
mander to  attach  some  or  all  counterintelligence 
teams  to  his  subordinate  tactical  commands. 
(2)  Counterintelligence  teams  are  not  normally 
placed  under  the  operational  control  of  commands 
of  less  than  Marine  amphibious  brigade  (MAB) 
size.  However,  in  the  case  of  a  landing  force  of  less 
than  MAB  size,  assignment'of  subteams  is  appro- 
priate. In  addition,  under  those  circumstances 
where  attachment  of  subteams  to  an  infantry 
regiment  or  aircraft  group  would  facilitate  the  early 
reduction  of  specific  counterintelligence  targets, 
attachment  of  counterintelligence  personnel  to 
those  units  may  be  appropriate. 
(3)  During  operations  involving  widely  separated 
units  in  areas  of  dense  population,  counterintelligence 
subteams  may  be  made  available  to  the  unit  com- 
manders to  accomplish  specific  counterintelligence 
missions  assigned  by  higher  headquarters. 
(4)  The  tactical  concept  of  operations  in  depth 
governs  the  execution  of  counterintelligence  plans 
and  operations.  Counterintelligence  teams  can  be' 
deployed  on  an  area  coverage  concept  or  by  unit 
assignment. 
(a)  Area  Coverage 
1_  Counterintelligence  teams  deployed  for 
area  coverage  are  assigned  a  specific 
geographic  area  of  responsibility  and  pro- 
vide counterintelligence  support  to  com- 
mands located  within  that  area.  The  team 
continues  to  operate  within  the  assigned  area 
even  though  the  tactical  or  support  units 
operating  in  the  area  change. 
2_  The  area  coverage  concept  allows  counter- 
intelligence operations  to  focus  on  the  enemy's 
intelligence  organization  and  activities  while 
remaining  unfragmented  and  unrestricted  by 
the  tactical  areas  of  responsibility  assigned  to 
supported  units.  Area  coverage  provides  the 
greatest  continuity  of  counterintelligence 
operations  and  allows  counterintelligence  per- 
sonnel to  become  thoroughly  familiar  with  the 
area,  enemy  intelligence  organization  and 
operations,  and  counterintelligence  targets. 
3^  Area  coverage  is  particularly  effective 
during  counterinsurgency  operations  where 
the  insurgent  prefers  to  operate  on  the 
political  or  military  boundaries. 
(b)  Unit  Assignment.  Counterintelligence  teams 
deployed  on  a  unit  assignment  basis  normally 
remain  with  the  supported  unit  and  operate 
within  that  unit's  area  of  responsibility.  As 
tactical  units  displace,  it  is  necessary  for  higher 
echelons  to  provide  counterintelligence  coverage 
for  the  areas  vacated.  Reiief  of  an  area  can  be 
accomplished  in  the  following  manner: 
1_  Augmentation  Subteams.  Augmentation 
subteams  may  be  attached  from  the  force 
level  to  assault  units,  in  advance  of  opera- 
tions, to  provide  adequate  personnel  for 
reduction  of  specific  counterintelligence 
targets  during  the  initial  phases  of  the 
operation  and  to  prepare  for  the  transfer  of 
areas  of  responsibility  from  assault  units  to 
force  without  loss  of  continuity.  These  sub- 
teams  operate  under  the  direct  control  of 
the  assault  unit  during  the  reduction  of 
3-7
306  - 
FMFM  24 
counterintelligence  targets  and  then  remain 
in  place  as  the  unit  advances,  thereby  ensur- 
ing continuous  coverage  as  the  force  moves 
forward  and  assumes  control  of  the  area. 
2_  Leapfrog  System.  This  method  requires 
the  team  initially  responsible  for  an  area  to 
be  detached  from  the  assault  unit  and  a  new 
team  attached.  The  new  team  is  attached 
sufficiently  in  advance  to  permit  the  team  to 
become  thoroughly  familiar  with  current 
operations.  This  method  of  relief  permits  the 
team  familiar  with  the  area,  informants,  and 
targets  to  remain  and  conduct  more  exten- 
sive operations  and  is  similar  to  the  area 
coverage  concept  but  on  a  smaller  scale. 
3^  Relay  System.  This  method  requires  f^rce 
counterintelligence  teams  to  be  held  in  reserve 
and  dispatched  forward  to  assume  control  of 
areas  as  the  assault  units  move  forward. 
detailed  preparation,  is  required.  The  counterintel- 
ligence targets  which,  in  the  overall  counterintelli- 
gence picture,  require  early  reduction  can  then  be 
selected  and  the  employment  of  teams  planned. 
(3)  The  commander  landing  force  (CLF),  once 
established  ashore,  assumes  immediate  control  over 
all  assigned  counterintelligence  assets.  In  some 
instances,  Naval  Investigative  Service  (NIS) 
elements  may  be  assigned  in  support  of  the  land- 
ing force.  In  such  cases,  jurisdiction  and  respon- 
sibility must  be  clearly  denned  for  efficient  utiliza- 
tion of  counterintelligence  assets.  Normally,  Marine 
counterintelligence  teams  are  assigned  responsibility 
for  counterintelligence  operations  and  investiga- 
tions which  directly  support  tactical  units.  Coun- 
terintelligence operations  and  investigations  of  a 
general  support  nature  in  rear  areas  are  more  com- 
patible with  the  Naval  Investigative  Service's 
organization  and  mission. 
b.  Factors  Bearing  on  the  Employment  of  Coun- 
terintelligence Teams 
c.  Employment  of  Counterintelligence  Teams  at 
Division  Level 
(1)  The  characteristics  of  an  objective  area  deter- 
mine the  character  and  extent  of  counterintelligence 
operations  required  within  that  area.  The  density 
of  the  population,  its  cultural  level,  the  attitude  of 
the  people  and  political  groups  toward  friendly  and 
enemy  forces  and  their  susceptibility  to  enemy 
penetration  (hostile  intelligence  threat)  and  pro- 
paganda, and  the  stability  of  local  governments  are 
all  factors  in  determining  the  number  of  counter- 
intelligence teams  needed  to  accomplish  the  coun- 
terintelligence mission. 
(2)  The  number  of  counterintelligence  teams 
available  has  a  significant  bearing  on  the  ultimate 
accomplishment  of  the  counterintelligence  mission. 
Over  estimation  of  the  teams'  capabilities  will  result 
in  dispersion  of  activity  on  many  targets  with 
limited  effectiveness.  Careful  planning  and  a  grasp 
of  the  overall  counterintelligence  pattern  of 
operations  from  rear  to  forward  areas,  plus  detailed 
(1)  The  relative  number  of  personnel  devoted  to 
counterintelligence  is,  as  a  rule,  greater  in  the 
Marine  division  zone  of  actior  than  in  support 
areas   The  constant  contact  of  opposing  ground 
forces  and  the  presence  of  indigenous  or  displaced 
populations  in  the  combat  or  occupied  areas  afford 
the  enemy  a  better  opportunity  to  penetrate  the 
counterintelligence  screen.  The  counterintelligence 
team  operating  with  a  division  is  usually  in  the  posi- 
tion of  being  the  first  security  unit  to  enter  territory 
recently  cleared  of  the  enemy.  Its  role  in  counter- 
intelligence operations  is  of  primary  importance  in 
laying   the   groundwork   for  all   later   security 
measures.  The  team  secures  the  most  obvious 
targets,  the  agents  left  behind  by  the  enemy  for 
espionage  and  sabotage,  the  best  known  collabo- 
rators with  the  enemy,  and  key  public  buildings 
such  as  the  seat  of  the  local  government  and  the 
communication  centers.  Prompt  action  by  a  coun- 
terintelligence  team    is    often    of   great   value 
to  the  security  of  friendly  forces  and  can  make 
3-8
FMFM  2-4 
306 
available,  through  interrogations  and  seized  docu- 
ments, important  elements  of  tactical  intelligence. 
(2)  The  counterintelligence  team  normally  confines  its 
activities  to  the  area  roughly  forward  of  the  division 
command  post.  Responsibility  for  rear  areas  must  be 
assumed  by  higher  echelons.  Counterintelligence 
teams  operating  with  a  division  are  generally  deployed 
by  subteams  which  are  responsible  for  the  counter- 
intelligence coverage  of  specific  areas  within  the 
jurisdiction  of  the  command.  Each  subteam  acts  as 
an  independent  unit,  but  its  activities  are  coordinated 
by  the  team  commander,  who  maintains  his  head- 
quarters near  the  division  command  post. 
(3)  Time  is  of  the  essence  during  the  assault  phase 
of  an  operation.  Counterintelligence  teams 
employed  with  an  assault  division  will  generally 
limit  their  screening  operations  to  the  identification 
and  classification  of  civilians  disguised  as  military 
personnel,  enemy  agents,  and  collaborators. 
Although  immediate  tactical  interrogations  may  be 
conducted,  providing  time  permits,  normally 
suspects  will  be  passed  to  rear  areas  for  more  detail- 
ed interrogations  and  classification.  (Also  see  par. 
307b.) 
d.  Employment  of  Counterintelligence  Teams  at 
Aircraft  Wing  Level 
(1)  There  is  no  significant  difference  in  the  mission 
of  counterintelligence  teams  employed  with  either 
ground  or  air  units;  however,  employment  with  air 
units  is  normally  characterized  by  a  static  situation. 
(2)  An  aircraft  wing  is  sometimes  widely  dispersed 
with  each  aircraft  group  operating  from  a  separate 
field,  and  wing  headquarters  operating  ashore  with 
the  landing  force.  Since  wing  equipment  is  highly 
susceptible  to  damage  and  difficult  to  replace,  wing 
units  are  a  high  priority  target  for  enemy  sabotage 
and  terrorism.  In  most  instances,  air  units  have  a 
requirement  for  the  employment  of  large  numbers 
of  indigenous  personnel  who  become  a  source  for 
enemy  intelligence  activities.  Under  these  condi- 
tions, it  may  be  necessary  to  provide  subteams  to 
Marine  aircraft  groups  (MAG's)  or  independent 
squadrons. 
(3)  In  air  operations  or  an  airborne  movement, 
counterintelligence  personnel  are  included  in  the  ad- 
vance command  echelon  to  advise  the  commander 
on  the  control  and  security  of  sensitive  areas, 
civilian  control  measures,  screening  of  local 
residents  and  transients,  and  to  check  establish- 
ments in  the  vicinity  as  may  be  required. 
e.  Employment  of  Counterintelligence  Teams  at 
Marine  Air-Ground  Task  Force  Level 
(1)  A  counterintelligence  team  supporting  the 
MAGTF  headquarters  normally  operates  in  the  rear 
areas.  Generally,  the  MAGTF  headquarters  team 
completes  and  follows  up  on  all  matters  of  coun- 
terintelligence interest  initiated  by  assault  units, 
conducts  special  operations  of  a  relatively  long-term 
nature,  and  provides  assistance  on  military  and  civil 
security  matters.  The  MAGTF  headquarters  coun- 
terintelligence team  normally  has  the  capability  to 
perform  technical  surveillance  countermeasures 
inspections  and  surveys  for  the  entire  MAGTF  and 
will  establish  and  operate  the  MAGTF  counterin- 
telligence interrogation  center  if  required. 
Paragraph  305  details  the  functions  appropriate  for 
counterintelligence  support  in  rear  areas. 
(2)  Within  rear  areas,  two  organizations  requiring 
counterintelligence  support  are  the  CSS  organization 
and  the  civil  affairs  unit.  The  former  is  primarily 
concerned  with  military  security  and  the  latter  with 
civil  security.  Despite  the  apparent  differences  of  in- 
terest between  the  two  units,  their  counterintelligence 
problems  are  interrelated.  A  dissident  civilian 
population  hampering  the  efforts  of  a  civil  affairs 
unit  to  establish  effective  administrative  control  in 
an  area  is  also  likely  to  be  the  primary  source  of 
support  for  guerrilla  operations  capable  of  disrupt- 
ing logistics  operations  through  sabotage,  terrorism, 
and  harassment  attacks.  The  MAGTF  headquarters
306 
FMFM  2-4 
counterintelligence  team  is  normally  responsible  for 
the  counterintelligence  support  for  these  units.  This 
includes  support  for  installations  and  facilities 
dispersed  through  the  combat  service  support  areas. 
The  number  of  team  personnel  supporting  civil 
affairs  units  depends  on  the  number  of  refugees  to 
be  identified  in  the  area. 
f.  CounterinteMgence  Team   Operations.  Em- 
ployment of  the  team  and  team  operations  in  combat 
is  influenced  by  the  mission  of  the  supported  command. 
The  mission  assigned  the  team,  and  the  tactical  scheme 
of  maneuver  for  the  unit  which  the  team  is  supporting, 
also  influence  the  type  of  team  control,  methods  of 
communication,  equipment,  deployment  of  subteams, 
and  the  determination  of  the  team's  area  of  operations 
and  targets,  including  the  development  of  a  counter- 
intelligence target-reduction  plan.  Based  on  the  mis- 
sion, the  team  commander  formulates  the  plan  for  the 
employment  of  his  team. 
(1)  Team  Planning.  The  successful  accomplishment 
of  the  team's  mission  requires  thorough  planning 
by  the  team  commander.  The  following  must  be 
considered  when  planning  for  team  operations: 
•  Detailed  study  of  all  available  maps  and  pho- 
tographs of  the  projected  area  of  operations. 
•  Study  of  all  available  intelligence  products  per- 
tinent to  the  area  of  operations. 
•  Location  of  all  important  targets  and  specific 
buildings  on  the  map.  These  are  categorized  and 
studied  and  plans  formulated  for  coverage  and 
reduction.  Target  priorities  must  be  assigned  in 
advance  to  ensure  efficient  use  of  personnel.  An 
estimate  and  follow-up  request  must  be  made 
for  troop  requirements  and  employment  in- 
cidental to  any  sealing  off  ox  uncovering  action. 
Marine  Corps  counterintelligence  personnel  are 
rarely  available  in  sufficient  numbers  to  handle 
such  actions  alone.  The  area  surrounding  a 
target  is  studied  to  determine  points  where  seal- 
ing off  would  be  most  effective.  Streets'  and 
approaches  to  targets  are  studied  thoroughly, 
thereby   minimizing  the   need   for   extensive 
physical  reconnaissance.  Main  traffic  routes  are 
studied  to  determine  locations  in  which  to 
establish  screening  centers  and  checkpoints. 
•  Acquisition  or  development  of  black,  gray,  and 
white  lists  of  persons  in  the  target  area.  (See  par. 
503.) 
•  Study  of  all  available  records  listing  public  offi- 
cials opposed  to  the  enemy  and  other  persons 
who  could  be  of  value  in  administrative 
assignments,  such  as  members  of  the  police 
force,  fire  department,  post  office,  railway, 
telephone,  telegraph,  and  broadcasting  stations. 
Much  of  this  data  can  be  obtained  from  civil 
affairs  units  and  the  various  G-2/S-2  sections. 
•  Acquisition  of  available  information  concerning 
pro- American  or  antiopposition  elements,  such  as 
guerrillas  and  partisans  in  the  zone  of  operations 
and  other  areas,  which  would  facilitate  immediate 
utilization  of  such  groups  if  necessary. 
•  Acquisition  and  study  of  all  information  con- 
cerning other  underground  forces,  groups,  and 
personnel  who,  by  reason  of  training  and  ex- 
perience, can  provide  assistance  in  the  conduct 
of  counterintelligence  interrogations. 
•  Counterintelligence  contingency  materials 
(CICM),  the  Naval  Intelligence  Processing 
System  (NIPS),  and  the  Marine  ,\ir-Ground  In- 
telligence System  (MAGIS)  segments,  as  well  as 
other  data  bases,  are  valuable  sources  of 
information. 
(2)  Team  Control.  Control  of  the  team  operations 
is  centralized  under  the  team  commander.  Only  in 
those  situations  where  team  operations  require  the 
detachment  of  subteams  to  subordinate  commands 
and  centralized  control  is  unfeasible  should  opera- 
tional control  be  released  to  the  commanders  of  the 
units  to  which  the  subteams  are  attached. 
(3)  Tactical  Deployment  of  the  Team 
(a)  During  both  static  and  fluid  tactical  situa- 
tions in  populated  areas,  the  team  headquarters 
3-10
FMFM  2-4   
307 
normally    is    centrally   located   and    easily 
accessible  to  indigenous  personnel.  Locating  the 
team  headquarters  within  a  headquarters  com- 
mand post  is  undesirable  since  it  must  be 
accessible  to  indigenous  personnel,  thereby 
increasing  the  security  problem.  The  team  head- 
quarters  is   located   to    provide   maximum 
assistance  to  other  agencies  and  to  ensure  pro- 
tection by  them  if  required;  however,  during 
fluid  tactical  situations  in  uninhabited  areas,  the 
team  headquarters  may  be  located  in  or  near  the 
supported  unit's  command  post. 
(b)  In  deploying  team  personnel,  consideration 
is  given  to  retaining  at  least  one  subteam  at  the 
team  headquarters  for  special  assignments  and 
emergencies. 
(c)  When  counterintelligence  teams  are  held  in 
reserve,  team  personnel  are  organized  and 
equipped  so  that  the  augmentation  subteams 
may  be  immediately  dispatched  when  forward 
units  require  counterintelligence  reinforcements. 
(d)  Subteams  are  attached  to  subordinate  units 
sufficiently  in  advance  to  coordinate  the  former's 
plans  and  target  reduction  plan  with 'the  unit's 
scheme  of  maneuver  and  assigned  mission. 
(e)  Whenever  possible,  subteams  are  employed 
in  area  rather  than  unit  support.  This  permits 
the  employment  of  as  many  personnel  as 
required  in  areas  where  counterintelligence 
operations  are  extensive.  Units  whose  zones  of 
action  do  not  require  counterintelligence  opera- 
tions do  not  have  counterintelligence  personnel 
attached.  The  team  commander  must  provide 
for  the  rapid  detachment/attachment  of 
subteams  as  the  counterintelligence  situation 
develops. 
(f)  In  effecting  the  relief  of  a  counterintelligence 
team,  it  is  the  responsibility  of  the  team  being 
relieved  to  turn  over  prisoners,  records,  and  in- 
formants to  the  team  assuming  responsibility 
for  the  area.  To  make  this  transition  as 
smoothly  as  possible,  one  or  two  men  from  the 
team  relieved  remain  behind  to  familiarize  the 
relieving  team  with  the  counterintelligence  situa- 
tion in  the  area,  or  representatives  of  the  relief 
team  are  sent  forward  to  effect  familiarization 
with  the  counterintelligence  situation. 
307.  Counterintelligence  Operations 
Counterintelligence  operations  in  a  combat  environment 
require  detailed  planning  and  coordination.  Counterin- 
telligence operations  are  usually  conducted  in  conjunc- 
tion with,  and  require  support  from,  other  units.  To  be 
effective,  all  elements  involved  must  be  thoroughly  bnefed 
and  knowledgeable  of  the  purpose  and  objectives  of  the 
operation. 
a.  Counterintelligence  Screening  Operations. 
Counterintelligence  screening  operations  are  designed 
to  identify  and  apprehend  enemy  intelligence  agents, 
subversives,  terrorists,  and  saboteurs  attempting  to 
infiltrate  friendly  lines  or  conceal  themselves  among  the 
population.  In  a  conventional  warfare  situation, 
screening  operations  primarily  consist  of  screening 
refugees  and  prisoners  of  war  and  using  checkpoints 
in  populated  areas. 
(1)  Coordination 
(a)  Refugee  and  prisoner-of-war  screening  is 
planned  and  coordinated,  where  possible,  with 
military  police  elements,  interrogator-  translator 
teams  (ITT's),  civil  affairs  units,  and 
pyschological  operations  elements. 
(b)  The  tactical  commander  is  primarily  con- 
cerned with  the  movement  of  refugees  and 
prisoners  through  his  area  without  disrupting 
operations,  and  with  obtaining  information  of 
tactical  value  from  these  refugees  or  prisoners. 
Screening  operations  must  be  compatible  with 
the  commander's  scheme  of  maneuver. 
(2)  Preparation 
(a)  Prior  to  the  operation,  counterintelligence 
personnel  must  become  thoroughly  familiar 
with  all  available  information  concerning  the 
enemy  intelligence  organization,  the  military 
and  political  situation  within  the  enemy  con- 
trolled area,  and  the  geography  of  the  area. 
1    In  order  to  successfully  identify  enemy 
intelligence    agents, 
counterintelligence 
3-11
307 
FMFM  2-4 
personnel  must  be  knowledgeable  of  the 
enemy  intelligence  organization,  including 
its  mission,  methods  of  operation,  officials, 
schools  and  training,  known  agents,  and 
policies  and  regulations. 
2_  Knowledge  of  the  political  situation  and 
of  the  restrictions  placed  on  the  population 
within  the  enemy  controlled  area  aid  in 
detecting  discrepancies  during  the  screening. 
Information  required  includes  travel  retric- 
tions,  curfews,  draft  and  conscription 
regulations,  civilian  labor  forces  and  work 
patterns,  and  the  education  system. 
3_  Obtaining  order  of  battle  information  is 
primarily  the  responsibility  of  the  interrogator- 
translator  teams;  however,  counterintelligence 
personnel  must  be  aware  of  the  snemy 
military  units  operating  within  the  area,  and 
knowledgeable  of  their  disposition,  composi- 
tion, activities,  training,  equipment,  history, 
and  commanders'  personalities.  This  informa- 
tion aids  in  identifying  military  intelligence 
personnel  or  other  persons  attempting  to  hide 
their  identity. 
4_  Counterintelligence  personnel  must  also 
be  familiar  with  the  geogjaphy  and  the 
political,  social,  and  economic  conditions  of 
the  area.  Travel  conditions,  distances,  major 
landmarks,  customs,  and  composition  of  the 
population  are  essential  to  the  successful 
screening  operation. 
(b)  Preparation  for  the  operation  also  includes 
compiling  a  list  of  personnel  of  known  counter- 
intelligence interest,  a  list  of  indicators  to  aid  in 
identifying  persons  of  counterintelligence  interest, 
and  basic  data  sheets  which  may  be  completed 
on  persons  being  screened.  This  information  is 
distributed  to  key  personnel  participating  in  the 
operation  to  aid  in  idendfying  those  persons 
requiring  interrogation  by  counterintelligence  per- 
sonnel. The  basic  data  sheets  are  filled  out  to  aid 
in  determining  the  individual's  knowledge  and  in 
formulating  questions  for  further  interrogation. 
The  basic  data  sheet  contains,  as  a  minimum,  the 
following  information: 
•  Basic  identification  data  of  the  individual 
and  his  family  including  name,  aliases,  date 
and  place  of  birth,  sex,  race,  religion, 
citizenship,  address,  and  marital  status. 
•  Education  and  professional  experiences. 
•  Knowledge  of  languages,  foreign  travel,  mil- 
itary service,  and  technical  qualifications. 
•  Political  affiliations  and  membership  in 
other  groups  and  organizations. 
•  Details  of  current  travel  to  friendly  lines  or 
point  of  capture,  to  include  point  of  depar- 
ture, times,  and  circumstances. 
•  Additional  questions  may  be  included  which 
relate  to  specific  indicators  revealing  areas 
of  counterintelligence  interest. 
(3)  Initial  Screening 
(a)  Prisoners  of  war  and  refugees  normally 
enter  prisoner-of-war  and  refugee  channels  rear- 
ward of  the  forward  edge  of  the  battle  area 
(FEBA)  for  further  movement  to  rear  areas.  Ini- 
tial screening  is  conducted  as  soon  as  possible 
after  the  prisoners  of  war  or  refugees  come 
under  friendly  control.  Initial  screening  is  usual- 
ly accomplished  by  unit  intelligence  personnel, 
ITT's,  or  counterintelligence  personnel.  In  the 
case  of  a  large  number  of  refugees,  assistance 
in  initial  screening  may  be  provided  by  military 
police,  civil  affairs  units,  psychological  opera- 
tions personnel,  and  tactical  troops,  if  available. 
(b)  Persons  identified  or  suspected  to  be  of 
counterintelligence  interest  are  separated  from 
other  prisoners  of  war  or  refugees  and  referred 
to  counterintelligence  personnel  for  interroga- 
tion, after  information  of  immediate  tactical 
value  has  been  obtained.  Personnel  of  counter- 
intelligence interest  are  exploited,  if  possible, 
and  then  evacuated  to  higher  headquarters  for 
further  detailed  interrogation  and  exploitation 
by  rear  area  counterintelligence  teams.  Further 
counterintelligence  screening  also  continues  for 
3-12
FMFM  2-4 
307 
other  prisoners  of  war  and  refugees  at  the  higher 
echelons.  Procedures  for  the  handling  of 
captured  enemy  personnel  are  contained  in 
FMFM  2-1,  Intelligence,  and  FM  19-40,  Enemy 
Prisoners  of  War,  Civilian  Internees,  and 
Detained  Persons. 
(4)  Conduct  of  the  Screening 
(a)  In  many  cases,  numerous  prisoners  of  war 
and  refugees  preclude  counterintelligence  inter- 
rogation of  every  individual.  The  initial  screen- 
ing is  designed  to  identify  those  persons  who 
are,  or  are  most  likely  to  be,  of  counterintelli- 
gence interest  and  who  requiie  interrogation  by 
counterintelligence  personnel.  The  success  of  the 
screening  operation  is,  therefore,  directly 
influenced  by  the  degree  of  preparation  and  the 
quality  of  the  information  provided  to  person- 
nel conducting  the  initial  screening. 
(b)  Counterintelligence  interrogation  is  designed 
to  confirm  or  to  deny  that  the  person  is  of  coun- 
terintelligence interest  and  to  exploit  the  infor- 
mation obtained  when  appropriate.  Persons 
who  are  determined  not  to  be  of  counterintelli- 
gence interest  are  returned  to  the  prisoner-of- 
war  or  refugee  channels  as  appropriate.  Those 
persons  who  are  of  counterintelligence  interest 
are  evacuated  through  counterintelligence  chan- 
nels for  further  interrogation  and  exploitation 
by  rear  area  counterintelligence  teams.  An 
interrogation  report  is  completed  on  each  in- 
dividual referred  for  further  interrogation.  This 
report  clearly  identifies  those  areas  of  counter- 
intelligence interest  and  includes  as  much  infor- 
mation as  possible  concerning  the  individual's 
identity  and  documentation,  background,  recent 
activities,  and  route  of  travel  to  friendly  lines  or 
point  of  capture.  A  sample  format  for  the  inter- 
rogation report  is  contained  in  appendix  B. 
(5)  Indicators 
(a)  Indicators  to  aid  in  the  identification  of 
possible  hostile  infiltrators  are  determined  after 
a  thorough  study  of  the  enemy  area,  the  political 
and  military  situation,  and  the  enemy  intelli- 
gence organization. 
(b)  For  maximum  effectiveness,  indicators  must 
relate  to  the  specific  area  of  operations; 
however,  the  following  general  indicators  may 
serve  as  a  guide  to  identify  persons  as  possible 
infiltrators: 
•  Persons  of  military  age  who  are  not 
members  of  the  armed  forces. 
•  Persons  without  identification  or  with 
unusual  or  altered  documents. 
•  Persons  attempting  to  avoid  detection  or 
questioning,  or  displaying  peculiar  activity. 
•  Persons  using  enemy  methods  of  operation. 
•  Person.,  possessing  unusually  large  amounts 
of  money,  precious  metals,  or  gems. 
•  Persons  traveling  alone  or  in  pairs. 
•  Persons  having  a  pro-enemy  background, 
family  members  in  enemy  areas,  or  who 
have  collaborated  with  the  enemy. 
•  Persons  with  a  suspicious  story  or  who  have 
violated  regulations  in  enemy  areas. 
(6)  Other  Methods  of  Screening.  In  addition  to 
interrogation,  the  following  methods  of  screening 
can  be  used  separately  or  in  combination: 
•  Insertion  of  informants  into  prisoner-of-war 
and  refugee  channels  and  detention  centers. 
•  Use  of  concealed  informants  at  screening  col- 
lection points. 
•  Use  of  sound  equipment  in  holding  areas. 
•  Polygraph  examination. 
•  Specialized  identification  equipment. 
(7)  Mobile  and  Static  Checkpoints 
(a)  Checkpoints  are  used  in  screening  opera- 
tions in  populated  areas  and  along  routes  of 
3-13
307 
FMFM  2-4 
travel  to  detect  and  prevent  enemy  infiltration 
of  espionage,  sabotage,  terrorist,  and  subversive 
agents  and  to  collect  information  which  may  not 
otherwise  be  available  to  intelligence  units. 
(b)  The  preparation  for  employment  of  moo»le 
and  static  checkpoints  is  the  same  for  Oiher 
screening  operations.  Lists  of  persons  known  or 
suspected  of  enemy  activity  (black  and  gray 
lists),  and  of  indicators,  are  normally  utilized 
in  the  screening  operation ,  Specialized  detection 
equipment  may  also  be  used,  if  available. 
(c)  Checkpoints  are  established  at  strategic  loca- 
tions where  sufficient  space  is  available  for  con- 
ducting searches  and  assembling  the  people  to 
be  screened.  Provision  is  made  for  the  security 
of  the  checkpoint,  and  personnel  are  position- 
ed to  the  front  and  rear  of  the  checkpoint  to 
apprehend  those  attempting  to  avoid  it. 
•  A  mobile  checkpoint  can  be  used  as  a 
moving  system  whereby  the  screening  team, 
either  mounted  in  vehicles  or  on  foot,  selects 
individuals  to  be  stopped  for  questioning 
and  a  check  of  identity.  The  mobile  check- 
point also  may  be  established  at  various 
locations,  usually  for  periods  not  to  exceed 
1  day. 
a  detailed  and  coordinated  plan  that  has  been 
prepared  well  in  advance.  (Information  on  targets 
and  target  reduction  can  be  found  in  paragraphs 
503  and  504.)  Counterintelligence  teams,  in  most 
instances,  cannot  neutralize,  guard,  or  physically 
control  targets  without  assistance.  In  some  cases, 
for  the  seizure  and  protection  of  well-defended 
targets,  this  assistance  must  come  from  ground 
combat  units.  In  other  cases,  the  assistance  may  be 
provided  by  combat  support,  combat  service 
support,  or  aviation  units.  It  is  essential  that 
the  required  assistance  be  provided  for  during 
the  planning  phase.  Counterintelligence  personnel 
will  normally  accompany  the  troops  used  in 
target  reduction  to  advise,  assist,  and  examine 
and/or  exploit  the  target  at  the  earliest  possible 
time.  In  some  instances,  it  may  be  advantageous 
for  counterintelligence  personnel  to  rendezvous 
with  the  assigned  troops  at  the  target  area.  Except 
in  unusual  cases,  the  tactical  effort  will  take 
precedence  over  the  neutralization  and  exploitation 
of  counterintelligence  targets.  If  assistance  in 
target  reduction  is  not  available,  counterintelligence 
elements  may  have  to  rely  on  their  own  assets 
to  neutralize  or  exploit  targets.  In  friendly  control- 
led areas,  counterintelligence  elements  may  also 
receive  assistance  from  civil  police  and  security 
agencies. 
•  Static  checkpoints  are  those  manned  per- 
manently by  military  police  or  combat 
troops  at  entrances  to  towns,  bridges,  and 
other  strategic  locations. 
(d)  Screening  teams  may  be  composed  of  combat 
troops,  intelligence  interrogators,  military  police, 
counterintelligence  personnel,  civil  affairs  person- 
nel, or  a  combination  of  such  personnel.  Screen- 
ing teams  conduct  the  initial  screening  and  refer 
suspects  to  the  counterintelligence  element  for 
interrogation  and  further  exploitation. 
b.  Neutralization  and  Exploitation  Operations 
(1)  Operational  Support.  The  timely  seizure  and 
exploitation  of  counterintelligence  targets  require 
(2)  Target  Personalities.  Target  personalities  are 
often  valuable  sources  of  combat  and  strategic  in- 
telligence information.  Information  of  immediate 
tactical  value  must  be  promptly  obtained  and  the 
individual  evacuated  to  higher  headquarters  as  soon 
as  possible.  If  evacuation  is  to  be  delayed  due  to 
the  tactical  situation,  a  report  of  the  circumstances 
must  be  forwarded  to  higher  headquarters  so  that 
arrangements  may  be  made  for  further  interroga- 
tion, exploitation,  and  disposition  when  the  tactical 
situation  permits.  It  is  essential  that  target  per- 
sonalities be  handled  separately  and  that  they 
remain  out  of  contact/association  with  prisoners 
or  other  persons  detained  or  being  evacuated. 
(3)  Target  installations.  The  exploitation  of  in- 
stallations should  be  accomplished  by  counterintel- 
ligence personnel  immediately  following  the 
neutralization  of  the  installation  if  the  tactical 
3-14
FMFM  2-4 
307 
situation  permits.  The  installation  is  searched 
thoroughly  for  documents,  equipment,  and  other 
material  of  intelligence  or  counterintelligence 
interest.  Procedures  for  the  disposition  of  enemy 
documents  and  materia!  are  contained  in  FMFM 
2-1,  Intelligence.  In  some  instances,  it  may  be 
desirable  to  retain  the  documents  or  material  within 
the  installation  for  thorough  examination  by 
technical  intelligence  personnel  or  other  specialists. 
Due  to  explosive  devices  (i.e.,  boobytraps,  mines, 
etc.),  extreme  caution  should  be  used  when 
searching  installations  known  or  suspected  to  have 
been  occupied  by  the  enemy. 
c.  Investigations  and  Internal  Security  Functions 
(1)  Investigations.  During  combat  operations, 
counterintelligence  personnel  may  be  required  to 
conduct  investigations  concerning  personnel, 
security  matters,  espionage,  sabotage,  terrorism, 
and  subversive  activities  (including  defection).  The 
investigation  is  a  duly  authorized,  systematic, 
detailed  examination/inquiry  to  uncover  and  report 
the  facts  of  a  matter.  While  facts,  hearsay,  infor- 
mation, opinions,  allegations,  and  investigators' 
comments  may  make  a  significant  contribution, 
they  should  be  clearly  labeled  as  such  in  the  report 
of  investigation.  Thf  Naval  Investigative  Service 
manual,  NIS-3,  Manual  for  Investigations,  may  be 
used  as  a  guide  for  investigation  techniques  and 
procedures. 
(a)  Counterintelligence  investigations  utilize 
basic  investigative  techniques  and  procedures 
and  are  designed  to  detect,  prevent,  and/or 
neutralize  actual  or  potential  threats  to  the 
security  of  the  command.  The  primary  purpose 
of  the  investigation  is  to  provide  the  commander 
with  sufficient  factual  information  to  reach  a 
decision  or  to  ensure  the  security  of  his 
command. 
(b)  Investigations  may  be  conducted  overtly  or 
discreetly  depending  on  the  type  of  investiga- 
tion and  the  area  of  operations.  Investigations 
will  normally  include  the  examination  of 
records,  interviews  or  interrogations,  and  the 
collection  and  handling  of  evidence.  Surveil- 
lance and  the  conduct  of  raids  and  searches  may 
also  be  appropriate  as  the  investigation 
progresses. 
(c)  Upon  assumption  of  primary  counterintel- 
ligence jurisdiction,  counterintelligence  in- 
vestigations will  be  conducted  in  accordance 
with  guidance  contained  in  NIS-3,  Manual  for 
Investigations,  and  instructions  published  by  the 
MAGTF  commander. 
(d)  Certain  unique  problems  are  involved  in 
conducting  investigations  of  indigenous  person- 
nel in  a  tactical  environment.  Counterintelli- 
gence personnel  are  normally  responsible  for 
conducting  security  investigations  of  indigenous 
personnel  employed  by  FMF  units  and  may  also 
be  involved  in  the  investigation  of  indigenous 
personnel  retained  in  official  civilian  positions. 
Difficulty  in  investigations  often  will  be  en- 
countered due  to  a  lack  of  files  and  records  in 
the   repositories  of  civilian  police  and  in- 
vestigative agencies,  as  such  documentation  may 
have  been  destroyed  or  removed  during  tacti- 
cal operations.  Every  effort  must  be  made  to 
check  all  files  and  records  which  are  available. 
Special  investigative  techniques,  such  as  the  use 
of  polygraph  examinations  by  criminal  in- 
vestigative personnel,  may  be  required.  The 
utilization  of  indigenous  personnel  by  FMF 
units  presents  a  definite  security  threat  because 
of  the  enemy's  efforts  to  penetrate  units  through 
the  use  of  indigenous  civilian  employees  who  are 
sympathetic  to,  or  may  be  coerced  into  serving, 
the  enemy  cause.  All  units  utilizing  indigenous 
personnel  must  exercise  caution  to  preclude  the 
enemy's   collection   of  information,   both 
classified  and  unclassified,  useful  to  the  him.  In 
addition  to  the  initial  security  investigation,  con- 
tinual checks  are  made  on  employees.  Counter- 
intelligence elements  maintain  close  liaison  with 
the  civil  affairs  units  responsible  for  providing 
civilian  labor  to  military  forces. 
(2)  Troop  Movement  Security.  The  movement  of 
troops  is  of  vital  concern  to  the  enemy  and,  in  many 
cases,  may  provide  the  first  indication  of  friendly 
intentions.      Enemy      intelligence      activity 
3-15
307 
FMFM  2-4 
may  be  expected  to  increase  prior  to,  during,  and 
immediately  after  the  movement  of  troops.  Troop 
movement  security  is  designed  to  deny  the  enemy 
as  much  information  as  possible,  to  prevent  es- 
pionage and  sabotage  from  interfering  with  the 
movement,  and  to  ensure  the  element  of  surprise. 
Counterintelligence  personnel  coordinate  closely 
with  the  commander's  staff  and  provide  security 
services  and  assistance  as  required. 
(a)  Some  of  the  services  and  assistance  normal- 
ly provided  by  counterintelligence  personnel  in- 
clude the  following: 
•  Providing  advice  and  assistance  on  security 
matters  during  the  preparation  of  plans  for 
the  movement. 
•  Conducting  counterintelligence  evaluations 
and  inspections,  providing  recommenda- 
tions for  maximum  secrecy,  and  assisting  in 
instructions  to  unit  personnel  concerning 
troop  movement  security. 
•  Observing  the  move,  investigating  and 
reporting  security  violations,  and  providing 
briefs  on  other  security  threats. 
(b)  The  following  security  measures  must  be 
considered  regardless  of  the  type  of  transpor- 
tation utilized  for  the  move: 
•  Imposing  the  Wartime  Information  Secur- 
ity Program. 
•  Monitoring  or  restricting  communication 
facilities. 
•  Increasing  emphasis  on  security  education 
programs. 
•  Gradually  reducing  leave  and  liberty,  if 
appropriate. 
•  Surveillance  of  areas  and  facilities  where 
loose  talk  may  be  prevalent. 
•  Removing  or  covering  tactical  markings  and 
other  identifying  marks  on  vehicles  and 
equipment. 
•  Providing  instructions  for  the  storage  or 
destruction  of  personal  diaries,  mail,  and 
other  documents  and  papers. 
•  Arranging  for  special  issue  of  equipment 
and  clothing,  and  for  other  administrative 
activities  in  such  a  manner  that  will  minimize 
the  indication  that  a  move  is  imminent. 
•  Covering  and  guarding  certain  material  and 
equipment  to  conceal  its  identity  and  pre- 
clude unauthorized  access  during  the  move. 
•  Providing  security  guards  ai  loading  points, 
at  critical  areas  along  the  route,  and  at  the 
destination. 
•  Inspecting  vacated  areas  to  ensure  that 
nothing  of  intelligence  value  has  been  left 
which  might  indicate  the  destination,  iden- 
tity, or  mission  of  the  unit. 
•  Inspecting  and  evaluating  the  destination 
area  for  physical  security  hazards  when 
possible. 
•  Deceptive  actions  designed  to  mislead  the 
enemy  when  approved  by  the  senior  area 
commander  or  higher  authority. 
(3)  Counterintelligence  Surveys,  Evaluations,  and 
Inspections.  In  a  combat  environment,  counterin- 
telligence surveys,  evaluations,  and  inspections, 
including  TSCM  inspections  and  surveys,  are  con- 
ducted in  essentially  the  same  manner  as  during 
garrison  operations  (see  sec.  4);  however,  counter- 
intelligence surveys  and  TSCM  inspections  and 
surveys  are  usually  limited  to  permanent  installa- 
tions in  rear  areas.  In  those  instances  where 
perimeter  security  is  the  responsibility  of  a  tactical 
unit,  the  physical  security  portion  of  the  counter- 
intelligence survey  is  primarily  concerned  with  those 
areas  within  the  perimeter  containing  classified 
material  and  areas  susceptible  to  sabotage  and  ter- 
rorist attack.  Special  weapons  sites  require  extra 
emphasis  and  may  include  counterintelligence 
monitoring  of  shipments  in  addition  to  other  security 
services. 
3-16
FMFM  2-4 
307 
(4)  Port  and  Harbor  Security.  Port  and  harbor  secur- 
ity is  normally  provided  jointly  between  military  police 
and  the  counterintelligence  elements  supporting  the 
logistics  command  operating  the  port.  Counterintelli- 
gence elements  concentrate  their  efforts  on  countenn- 
temgence  security  procedures  and  special  operations. 
•  Counterintelligence  security  procedures  for 
ports  and  harbors  are  essentially  the  same  as 
those  required  for  installations,  with  the  addi- 
tion of  controls  established  for  ships  and  their 
crews.  Special  emphasis  is  required  for  ships 
under  a  foreign  flag. 
•  Special  operations  place  emphasis  on  hostile 
sabotage  and  subversive  activity.  Special  opera- 
tions are  normally  required  within  the  port  as 
well  as  the  surrounding  area. 
d.  Special  Operations.  Special  operations  are  con- 
ducted by  counterintelligence  personnel  and  require 
detailed  planning,  coordination,  and  control.  (See  par. 
303e.)  Procedures  for  the  conduct  of  special  operations 
are  contained  in  FM  30-17A,  (C)  Counterintelligence 
Special  Operations  (U). 
e.  Intelligence  Collection 
(1)  Counterintelligence  teams  can  collect  both  counter- 
intelligence and  combat  intelligence  information 
through  the  use  of  HUMINT  resources.  In  addition 
to  its  counterintelligence  functions,  a  team  may  be 
assigned  additional  responsibility  for  combat  intelli- 
gence collection,  particularly  in  low  counterintelligence 
threat  areas;  however,  care  must  be  exercised  to  ensure 
that  these  responsibilities  do  not  impair  the  accom- 
plishment of  the  overall  counterintelligence  mission. 
(2)  The  procedures  and  authority  for  the  conduct 
of  human  intelligence  operations  and  certain  special 
operations  are  normally  provided  by  the  senior  area 
commander.  Guidance  and  operational  procedures 
for  HUMINT  operations  are  contained  in  DIAM 
58-11,  Volumes  1  and  2,  and  FM  30-18,  (S)  Intelli- 
gence Collections  Operations  (U). 
{.  Wartime  Information  Security  Program 
(1)  The  WISP  is  designed  to  control  and  examine 
communications  to  prevent  disclosure  of  informa- 
tion of  value  to  the  enemy  and  to  collect  informa- 
tion of  value  to  the  United  States. 
(2)  DOD  Directive  5230.7  assigns  responsibility  and 
provides  guidelines  for  WISP  planning  within  the 
Department  of  Defense,  to  include  national,  armed 
forces,  civil,  enemy  prisoner  of  war  and  civilian 
internee,  and  field  press  WISP's. 
(3)  OPNAVINST  5530.6B  is  a  Joint  Service  direc- 
tive which  provides  basic  policy  and  guidance  for 
commanders  in  the  establishment  and  operation  of 
the  U.S.  Armed  Forces  WISP.  Armed  Forces  WISP 
is  the  examination  and  control  of  personal  com- 
munications to  or  from  persons  in  the  Armed 
Forces  of  the  United  States  and  persons  accom- 
panying or  serving  with  the  Armed  Forces  of  the 
United  States. 
(4)  OPNAVINST  5530.0A  is  a  Joint  Service  direc- 
tive which  provides  basic  policy  and  guidance  for 
commanders  in  the  establishment  and  operation  of 
civil  WISP,  the  review  of  civilian  communications, 
such  as  messages,  printed  matter,  and  films, 
entering,  leaving,  or  circulating  within  areas  or  ter- 
ritories occupied  or  controlled  by  the  Armed  Forces 
of  the  United  States. 
(5)  OPNAVINST  5530.1 1  is  a  Joint  Service  direc- 
tive which  provides  basic  policy  and  guidance  for 
the  establishment  and  operation  of  WISP  for  the 
incoming  and  outgoing  communications  of  enemy 
prisoners  of  war  and  civilian  internees  held  by  the 
United  States  military  authorities  outside  the  limits 
of  the  United  States  and  Puerto  Rico. 
(6)  Additional  responsibilities  are  published  by 
unified  and  specified  commanders,  type  com- 
manders, fleet  and  numerical  fleet  commanders, 
special  commanders,  and  area  coordinators. 
3-17
308 
FMFM  2-4 
(7)  FSeet  Marine  Force  units  are  primarily  con- 
cerned with  Armed  Forces  WISP,  the  objectives  of 
which  are  to  prevent  the  disclosure  of  information 
that  might  assist  the  enemy  or  adversely  affect  any 
policy  of  the  United  States,  and  to  collect  and 
disseminate  information  to  assist  the  United  States 
in  the  successful  prosecution  of  a  war. 
(8)  Fleet  Marine  Force  units  must  be  prepared  to 
institute  WISP  when  directed;  WISP  is  a  functional 
responsibility  of  the  G-l. 
308.  Tactical  Counterintelligence 
Interrogation 
Within  the  area  of  operations,  there  may  be  numereous 
people  who  are  viewed  as  threats  to  security,  perhaps  solely 
due  to  their  presence  in  the  combat  zone.  The  number  of 
suspect  personnel  will  vary,  but  frequently  it  will  preclude 
detailed  interrogation  of  all  but  a  selected  few  who  are  of 
primary  interest.  Counterintelligence  personnel  will  be  partly 
dependent  upon  such  agencies  as  the  provost  marshal,  civil 
affairs  units,  and  interrogator-translator  units  (ITU's)  to 
identify  suspect  persons  or  persons  of  counterintelligence 
interest.  In  some  situations,  the  number  of  persons  volun- 
teering information  to  counterintelligence  operation  permits 
concentration  on  those  of  the  greatest  potential  interest  or 
value.  Most  suspects  are  apprehended  while  trying  to  enter 
the  area,  or  their  cover  stories  (which  will  closely  parallel 
their  true  places  of  origin  and  identities)  are  exposed.  The 
counterintelligence  interrogator's  success  in  such  interroga- 
tions is  primarily  dependent  upon  his  questioning  skill, 
linguistic  ability  or  support,  knowledge  of  the  area  of  opera- 
tions and  adjacent  areas,  and  familiarity  with  the  intellec- 
tual, cultural,  and  psychological  peculiarities  of  the  persons 
encountered. 
•  Refugees  and  displaced  persons. 
•  Line  crossers. 
•  Deserters  from  enemy  units. 
•  Civil  prisoners. 
•  Enemy  intelligence  personnel. 
•  Inmates  of  enemy  detention  camps. 
•  Members  of  underground  resistance  organizations 
seeking  to  join  friendly  forces. 
•  Collaborators  with  the  enemy. 
•  Target  personalities,  such  as  black,  gray,  or  white 
list  personalities. 
•  Volunteer  informants. 
•  Persons  who  must  be  questioned  because  they  are 
under  consideration  for  employment  with  FMF 
units  or  for  appointment  as  civil  officials. 
b.  Objectives  of  Counterintelligence  Interroga- 
tions. The  counterintelligence  interrogation  in  com- 
bat areas  assists  in  the  accomplishment  of  three  major 
objectives: 
(1)  In  the  screening  process,  refugees  whose  very 
presence  threatens  overall  security  are  removed 
from  the  battlefield. 
(2)  In  detailed  interrogations,  enemy  agents  with 
espionage,  sabotage,  terrorist,  or  subversive  mis- 
sions are  detected. 
a.  Types  of  Subjects.  As  the  battlelines  in  combat 
change,  entire  segments  of  the  population  may  be  over- 
run. The  local  population  in  any  area  may  also  be 
increased  by  refugees  and  displaced  persons  (persons 
from  other  countries  conscripted  by  enemy  forces  for 
labor).  The  following  categories  of  persons  are  of 
counterintelligence  interest: 
(3)  The  wide  range  of  activities  permits  the  collec- 
tion of  information  of  value  to  other  intelligence 
and  security  agencies  and  to  the  planners  of  military 
operations.  Counterintelligence  interrogators  must 
be  especially  alert  to  obtain  and  report  information 
of  immediate  tactical  value  which  may  not  have 
been  previously  obtained  or  reported. 
3-18
FMFM  2-4 
308 
c  Indicators  Warranting  Suspicion.  Counterintel- 
ligence personnel  must  be  alert  during  interrogations 
for  indications  of  intelligence  activity.  Indicators 
which,  separately  or  collectively,  may  generate 
suspicion  that  a  subject  is  in  the  employ  of,  or  acting 
in  sympathy  with,  enemy  forces  are  as  follows: 
(1)  Access  to  Information  or  Targets.  A  prospec- 
tive terrorist,  subversive,  espionage,  or  sabotage 
agent  must  have  access  to  the  information  desired 
by  the  enemy  or  to  the  target  installation  to  be 
destroyed  in  order  to  carry  out  his  mission.  The  in- 
terrogation should  establish  a  subject's  accessibility 
to  potential  targets,  including  his  location  at  the 
time  he  was  apprehended. 
(2)  Technical  Skilis.  Proficiency  in  certain  technical 
skills  is  frequently  an  attribute  of  an  espionage  or  sab- 
otage agent.  The  subject  who  has  a  mastery  of  one 
or  several  foreign  languages  and  a  knowledge  of  radio 
operation  or  cryptography  is  questioned  carefully  on 
the  nature  and  purpose  of  his  training  in  those  fields. 
His  practical  experience  and  his  work  in  those  fields, 
during  or  shortly  prior  to  the  war,  should  give  coun- 
terintelligence personnel  cause  for  strong  suspicion, 
and  the  individual's  story  must  be  closely  examined. 
(5)  Family  In  Enemy-Held  Territory.  Enemy  pressure 
is  often  applied  to  individuals  whose  families  reside 
under  enemy  control,  particularly  if  the  family  has 
no  past  connection  with  the  enemy-held  area. 
(6)  Inconsistent  Story.  Small  discrepancies  in  the 
subject's  story  may  be  important.  Distance  com- 
pared to  travel  time;  accent  peculiar  to  an  area  the 
subject  refuses  to  acknowledge  as  his  own;  unrea- 
sonable explanation  of  deferment,  exemption,  or 
discharge  from  military  service;  exemption  from 
labor  conscription;  or  implausible  reasons  for  risk- 
ing the  crossing  of  combat  lines  may  be  warning 
signals  to  the  counterintelligence  interrogator. 
Contradictions  in  a  subject's  story  do  not  warrant 
jumping  to  conclusions;  however,  counterintelli- 
gence personnel  must  remain  alert  to  all  possibil- 
ities. Allowances  must  be  made  for  defective 
memory  or  lack  of  logic  due  to  emotional  stress. 
(7)  Suspicious  Actions  or  Activities.  Unusual 
interest  displayed  by  indigenous  persons  in  troop 
units  or  equipment,  or  persistent  loitering  in  the 
vicinity  of  troop  units  and  installations  without 
reasonable  explanation,  are  sufficient  to  warrant 
interrogation  for  the  purpose  of  clarifying  the  status 
of  a  person  so  involved. 
(3)  Documents  and  Funds.  An  overabundance  of 
documents  and  new  documents  of  questionable 
authenticity  are  reason  for  doubt  and  provide  the 
basis  for  detailed  questioning.  Discrepancies  in  the 
document's  contents  or  conflicts  between  data  and 
the  subject's  story  may  lead  to  the  detection  of 
hostile  agents.  Unexplainable  possession  of  large 
amounts  of  money,  valuable  jewelry,  or  other  items 
of  great  value  are  investigated  carefully. 
(4)  Pro-Enemy  Background.  Residence  or  travel  in 
enemy  territory,  membership  in  a  hostile  party,  or 
known  former  collaboration  with  the  enemy  are 
facts  of  obvious  importance.  Counterintelligence 
personnel  must  determine  whether  the  subject  is 
actually  in  sympathy  with  the  enemy  or  has  acted 
merely  to  serve  his  own  best  interests  with  regard 
to  his  life,  the  welfare  of  his  family,  or  his  property. 
(8)  Violations  of  Civil  or  Military  Regulations. 
Mere  violation  of  military  regulations  in  an  area 
controlled  by  the  military,  such  as  mandatory  reg- 
istration, curfews,  travel  restrictions,  or  declaration 
of  weapons,  may  be  relatively  unimportant  to  coun- 
terintelligence elements.  However,  the  motives 
which  cause  such  violations  despite  severe  penalties 
must  be  compelling  and  possibly  may  be  of  great 
interest  to  counterintelligence  personnel. 
(9)  Modus  Operandi.  The  frequent  similarity  in 
tactics  of  hostile  agents  working  for  the  same  enemy 
agency,  their  means  of  contact  with  their  agent 
handlers,  type  of  cover  story,  and  manner  of 
collecting  and  reporting  their  information  may 
lead  to  identification  of  suspects  with  a  known 
enemy  agency  or  group.  Established  patterns  of 
3-19
308 
FMFM  2-4 
activity  or  behavior  of  enemy  agents  are  disseminated 
to  other  intelligence  and  security  agencies  to  assist  in 
the  identification  of  agents  still  operating. 
(2)  The  suspect,  or  any  person  being  interrogated, 
may  also  be  an  important  source  of  information  of 
intelligence  value,  strategic  and/or  tactical. 
d.  Screening  or  Initial  Interrogation.  Initial  inter- 
rogation and  screening  are  generally  synonymous, 
except  that  the  former  indicates  that  there  will  be  a 
follow-up  detailed  interrogation,  while  screening  in- 
volves the  selection,  by  brief  questioning,  of  a  relatively 
small  number  of  persons  from  a  large  group,  for 
detailed  interrogation.  In  both  cases,  the  technique, 
purpose,  and  scope  of  the  questioning  are  generally  the 
same.  The  object  is  to  select  for  detailed  interrogation, 
a  reasonable  number  of  persons  who  appear  to  be 
suspect  or  knowledgeable  on  matters  of  counterintel- 
ligence interest.  Initial  interrogation  or  screening  is 
generally  concerned  with  identity,  background,  recent 
activities,  travel  or  escape  routes,  and  information  of 
immediate  value.  Documents  and  personal  belongings 
of  a  subject  are  examined;  the  circumstances  of  appre- 
hension are  studied;  and  available  files  are  checked. 
e.  Detailed  Interrogation.  Detailed  counterintelli- 
gence interrogations  may  be  conducted  in  joint  inter- 
rogation centers  or  at  interrogation  sites  established  by 
intelligence  or  counterintelligence  units.  Detailed  inter- 
rogation does  not  differ  radically  from  the  initial 
interrogation  except  that  attention  is  now  focused  on 
individuals  who  are  suspect  or  who  are  known  to  have 
extensive  information  of  interest.  A  study  of  the  ini- 
tial interrogation  report,  examination  of  the  subject's 
documents  and  belongings,  and  checks  of  avilable  files 
and  information  must  be  conducted  and  analyses  made 
in  preparation  for  the  interrogation. 
(1)  Details  of  the  subject's  personal  history  must  be 
reviewed.  Should  the  subject  admit  that  he  is  an 
enemy  agent,  he  becomes  an  important  source  of 
information  on  enemy  intelligence  methods  of 
operation  and,  perhaps,  on  identities  of  other 
hostile  agents.  This  will  lead  to  exhaustive  inter- 
rogations on  such  issues  as  hostile  intelligence, 
training,  and  missions  assigned.  However,  counter- 
intelligence personnel  must  be  alert  to  the  possible 
insertion  of  confusion  agents. 
(3)  The  questioning  usually  follows  a  logical 
sequence  to  avoid  confusing  the  subject  and  to 
facilitate  reporting;  however,  an  illogical  sequence 
may  be  used  as  a  technique  to  purposely  confuse 
the  subject  so  that  he  will  inadvertently  contradict 
himself.  The  interrogator  must  be  alert  for  dis- 
crepancies and  retain  his  psychological  advantage. 
(4)  Specific  techniques  of  interrogation  are  dis- 
cussed in  FM  30-15,  Intelligence  Interrogation. 
f.  Operation  of  a  Counterintelligence  Interro- 
gation Center 
(1)  A  counterintelligence  interrogation  center  serves 
as  a  centralized  location  where  persons  of  counter- 
intelligence interest  are  interrogated.  In  offensive 
situations  where  assault  unit  counterintelligence 
teams  are  reducing  priority  counterintelligence 
targets,  it  may  be  necessary  for  higher  echelons  to 
assume  the  interrogation  responsibility  at  the  lower 
echelon.  For  this,  the  use  of  augmentation  subteams 
is  of  value.  Each  major  command  with  counterin- 
telligence support  normally  establishes  such  in- 
terogation  centers,  thereby  supporting  the  concept 
of  counterintelligence  coverage  in  depth. 
(2)  A  centrally  located  counterintelligence  inter- 
rogation center  is  placed  in  operation  as  soon  as 
possible.  In  a  static  situation  when  the  counterin- 
telligence team  has  no  immediate  offensive  targets, 
consideration  may  be  given  to  selection  of  a  build- 
ing that  will  provide  adequate  facilities,  such  as  a 
waiting  room  for  arrivals,  an  interrogation  room, 
.  a  detention  room,  and  a  waiting  room  for  depar- 
tures. In  fast-moving  situations,  interrogation 
centers  are  necessarily  moved  rapidly  and  frequently. 
AH  units  concerned  with  disposition  of  line  crossers, 
refugees,  etc.,  must  be  kept  notified  as  to  the  loca- 
tion   of   interrogation    centers.    Additionally, 
3-20
FMFM  2-4 
309 
arrangements  must  be  made  for  the  guarding  and 
disposition  of  line  crossers,  refugees,  and  other  per- 
sons processed  at  such  installations. 
(3)  The  counterintelligence  interrogation  center  is 
normally  established  in  the  vicinity  of  the  prisoner- 
of-war  compound/collecting  point,  or  in  a  secure 
location  specified  by  the  operational  counterintel- 
ligence team/subteam  commander.  Regardless  of 
location,  a  close  working  relationship  is  established 
between  counterintelligence  and  interrogator- 
translator  units.  Routine  prisoner-of-  war  interroga- 
tion is  not  a  function  properly  assigned  to  the  coun- 
terintelligence team.  Team  personnel  are  utilized  to 
interrogate  only  those  prisoners  who  have  been 
determined  to  be  of  counterintelligence  interest. 
(4)  All  persons  detained  are  handled  and  treated  in 
accordance  with  the  applicable  Geneva  Conventions. 
(See  FM  27-10,  The  Law  of  Land  Warfare.) 
309.  Friendly  Prisoners  of  War  and 
Persons  Missing  (Nonhostile)  and 
Missing  in  Action 
Friendly  personnel  who  fall  into  the  hands  of  the  enemy 
can  be  a  source  of  information  through  the  compromise 
of  documents,  personal  papers,  or  as  the  result  of  effec- 
tive interrogation  or  coercion.  It  is  incumbent  upon  the 
tactical  commander  to  counter  this  threat  by  taking  those 
steps  necessary  to  counter  any  possible  disclosure  which 
would  affect  the  immediate  tactical  situation.  Counter- 
intelligence units  are  assigned  responsibility  for  the  col- 
lection of  information  of  potential  intelligence  value  on 
friendly  personnel  possibly  in  enemy  hands  and  the  col- 
lection of  intelligence  information  to  aid  in  identifying, 
locating,  and  recovering  those  personnel.  In  addition, 
counterintelligence  personnel  conduct  the  intelligence  and 
counterintelligence  debriefings  of  those  Marines  who  have 
been  detained  by  the  enemy  and  returned  to.  friendly  con- 
trol, as  well  as  those  personnel  who  were  recovered  or 
who  evaded  capture  during  an  incident  resulting  in  the 
capture  or  missing  status  of  a  Marine,  hospital  corpsman, 
or  other  assigned  personnel. 
Marine  Corps  commands  notify  the  nearest  counterin- 
telligence unit  when  Marine  Corps  personnel,  including 
hospital  corpsmen  or  other  assigned  personnel,  are  cap- 
tured or  determined  to  be  missing  (nonhostile)  or  missing 
in  action.  The  counterintelligence  unit  may  be  able  to  pro- 
vide information  which  could  aid  in  the  search  and 
recovery  efforts,  such  as  possible  routes  to  enemy  detec- 
tion centers,  location  of  possible  holding  areas,  and 
enemy  procedures  for  handling  and  evacuating  prison- 
ers. If  appropriate,  the  counterintelligence  element  can 
also  initiate  immediate  collection  action  utilizing  coun- 
terintelligence sources'to  gain  information  for  possible 
recovery  or  search  and  rescue  operations. 
If  the  search  or  recovery  attempts  are  unsuccessful,  the 
counterintelligence  unit  initiates  an  immediate  investiga- 
tion to  gather  basic  identification  data  and  to  determine 
the  circumstances  surrounding  the  incident.  The  investiga- 
tion is  designed  to  provide  information  to  aid  in  sub- 
sequently identifying  and  locating  the  individual,  to  assess 
the  potential  intelligence  gain  if  the  individual  is  held,  and 
to  collect  intelligence  information  which  will  be  of  value 
when  evaluating  future  intelligence  reports.  Format  for 
the  basic  identifying  data  required  is  contained  in  appen- 
dix A.  Every  attempt  is  made  to  obtain  a  recent  photo- 
graph and  a  sample  of  the  individual's  handwriting.  A 
synopsis  of  the  investigation,  including  a  summary  of  the 
circumstances,  is  prepared  on  the  counterintelligence 
report  form  (NAVMC  10481  [Rev   ]).  The  completed 
basic  identifying  data  form  is  attached  as  an  enclosure 
to  this  report.  The  investigation  must  be  as  thorough  and 
detailed  as  possible  and  classified  according  to  content. 
In  the  case  of  aircraft  incidents,  the  investigation  includes 
type  of  aircraft,  location  and  sensitivity  of  classified 
equipment,  bureau  or  registration  number,  call  signs,  and 
any  aircraft  distinguishing  marks,  such  as  insignia,  etc. 
When  feasible,  the  investigator  should  coordinate  with 
the  accident  investigation  team  or  aviation  safety  officer 
of  the  unit  which  experienced  the  loss. 
The  counterintelligence  report  with  the  attached  person- 
nel data  form  is  distributed  to  the  following  commands: 
•  *  Commandant  of  the  Marine  Corps  (Code  INT). 
•  *  Appropriate  headquarters  (Fleet  Marine  Force 
Pacific  [FMFPAC]  or  Fleet  Marine  Force  Atlantic 
[FMFLANT]). 
3-21
310 
FMFM  2-4 
•  *  Marine  air-ground  task  force  headquarters. 
9  Individual's  parent  command  (division,  wing,  or 
MAB). 
•  Each  counterintelligence  team  in  the  combat  area. 
These  reports  are  designed  to  aid  in  the  counterintelli- 
gence mission  and  are  not  intended  to  replace  the  nor- 
mal casualty  reporting  procedures.  When  the  counterin- 
telligence report  concerns  a  member  of  another  Service 
assigned  to  a  Marine  Corps  unit,  a  copy  of  the  report 
is  also  provided  to  the  appropriate  Service  organization. 
All  subsequent  information,  which  pertains  or  may  per- 
tain to  persons  captured  or  missing  in  action,  is 
distributed  in  the  same  manner  as  the  initial  counterin- 
telligence report. 
Insurgency  efforts  are  directed  and  highly  controlled  by  a 
hard  core  insurgent  infrastructure  which  employs  an  exten- 
sive intelligence  network.  Basic  responsibilities  of  counter- 
intelligence units  in  an  insurgency  environment  are  the 
denial  of  information  to  the  insurgent  force  and  the  iden- 
tification and  neutralization  of  the  insurgent  infrastructure, 
with  emphasis  placed  on  its  intelligence  apparatus. 
Counterinsurgency  operations  basically  are  aimed  at  the 
restoration  of  internal  security  in  the  area  of  operations, 
which  requires  a  vigorous  and  highly  coordinated  coun- 
terintelligence effort.  The  nature  of  insurgency  and  its 
covert  methods  of  operation  require  the  employment  of 
a  greater  number  of  counterintelligence  personnel  than 
is  necessary  for  conventional  operations. 
Marine  Corps  personnei  returned  to  friendly  control  after 
being  detained  by  the  enemy  are  debriefed  by  Marine 
Corps  counterintelligence  personnel.  Normally,  counter- 
intelligence personnel  supporting  the  unit  which  first  gains 
custody  of  the  individual  conduct  an  initial  debriefing  for 
information  of  immediate  tactical  value  and  the  location 
of  other  nrisoners  of  war  in  the  area.  As  soon  as  possible, 
the  returnee  is  evacuated  to  the  MAGTF  headquarters 
for  further  debriefing  or  for  evacuation  to  a  debriefing 
site  as  determined  by  higher  headquarters.  Upon  return 
of  a  person  who  was  captured,  listed  as  missing 
(nonhostile),  or  missing  in  action,  those  commands  listed 
(*)  in  paragraph  309  are  immediately  notified.  Specific 
guidance  for  the  processing  and  handling  of  Marine  Corps 
personnel  captured  or  missing  in  action  is  contained  in 
applicable  Marine  Corps  orders. 
a.  Jurisdiction.  The  commitment  of  Marine  Corps 
forces  for  counterinsurgency  operations  is  normally 
covered  by  a  status  of  forces  agreement  which  may 
include  limitations  and  restrictions  concerning  the 
investigation  and  apprehension  of  host  country  citizens 
or  other  operations  matters.  Host  country  counterin- 
telligence, security,  and  law  enforcement  agencies 
usually  are  extensively  engaged  in  counterintelligence 
and  security  operations  prior  to  the  arrival  of  U.S. 
forces.  Counterintelligence  units  may  be  assigned  to 
assist  these  agencies;  however,  Marine  Corps  counter- 
intelligence teams  are  normally  employed  in  support 
of  Marine  Corps  units.  Effective  counterintelligence 
operations  require  extensive  coordination  with  host 
country  intelligence,  counterintelligence,  security,  and 
law  enforcement  agencies. 
310.  Counterinsurgency  Operations 
b.  Employment  of  Counterintelligence  Teams 
To  effectively  conduct  counterintelligence  operations  in  an 
insurgency  environment,  counterintelligence  personnel  mast 
be  thoroughly  familiar  with  the  nature  of  insurgency— its 
causes,  characteristics,  and  peculiarities.  Information 
concerning  counterinsurgency  operations  and  intelligence 
and  counterintelligence  applications  are  contained  in 
FMFM  8-2,  Counterintelligence  Operations;  FM  30-17, 
Counterintelligence  Operations;  and  FM  30-17A,  (C) 
Counterintelligence  Special  Operations  (U). 
(1)  The  employment  of  counterintelligence  teams 
in  counterinsurgency  operations  is  similar  to  that 
described  in  paragraph  306.  Area  coverage  is 
usually  preferred  to  provide  continuity  of  opera- 
tions and  to  ensure  continuous  coverage  of  the  area. 
The  insurgent  infrastructure  and  intelligence 
apparatus  usually  have  been  operating  within  a 
given  area  for  many  years  and  are  thoroughly 
familiar  with  all  aspects  of  the  area  and  its  people. 
3-22
FMFM  2-4 
310 
Continuity  of  operations  and  other  characteristics 
of  the  area  coverage  concept  are  particularly  suited 
to  counter  the  insurgent  intelligence  threat. 
(2)  In  assigning  any  areas  of  responsibility,  ensure 
coverage  overlaps  to  preclude  gaps  occuring  be- 
tween areas.  Insurgent  forces  usually  prefer  to 
operate  on  the  political  or  military  boundaries 
where  the  assigned  responsibilities  of  U.S.  and 
allied  forces  may  be  vague  and  coordination  is  more 
difficult.  Counterintelligence  teams  employed 
through  unit  assignment  also  are  assigned  respon- 
sibility for  the  area  of  influence  around  the  unit's 
tactical  area  of  responsibility  (TAOR).  Under  the 
unit  assignment  concept,  rear  area  counterintelli- 
gence teams  assume  responsibility  for  any  gap  in 
coverage  that  may  develop. 
c.  Counterintelligence  Measures  and  Operations 
(1)  The  basic  counterintelligence  operations, 
techniques,  and  procedures  previously  discussed 
in  this  section  are  generally  applicable  in  an 
insurgency  environment.  Both  passive  and  active 
counterintelligence  measures  must  be  increased 
and  aggressively  pursued  to  effectively  thwart  the 
insurgent  strategy. 
(2)  All  commands  must  institute  and  continuously 
enforce  counterintelligence  and  security  measures 
to  deny  information  to  the  insurgent  force  and  to 
protect  the  command  from  sabotage.  In  coordina- 
tion with  host  country  authorities,  emphasis  is 
placed  on  security  measures  and  checks  of  in- 
digenous employees  or  other  persons  with  access 
to  installations  or  commands. 
(3)  A  significant  factor  in  counterinsurgency 
operations  is  population  and  resources  control. 
The  movement  channels  and  patterns  necessary  for 
support,  communications,  and  operations  of 
insurgent  forces  are  observed  and  controlled. 
Prior  to  implementing  control  measures,  the 
population  should  be  informed  of  the  reasons  for 
controls,  and  whenever  possible,  such  controls 
should  be  performed  and  enforced  by  host  country 
agencies. 
(4)  Counterintelligence  teams  must  implement 
imaginative  and  highly  aggressive  special  operations 
and  HUMINT  collection  programs  targeted  against 
the  insurgent  infrastructure  and  guerrilla  forces. 
The  primary  objective  of  special  operations  is  the 
identification,  location,  and  neutralization  of 
specific  members  of  the  insurgent  infrastructure 
through  systematic  intelligence  collection  and 
analysis  with  complete  documentation  concerning 
the  activities  of  each  individual.  This  allows  the  host 
country  to  be  provided  with  an  account  of  the 
individual's  illegal  activities  once  the  person  is 
apprehended.  Penetration  of  the  infrastructure 
must  be  obtained  at  all  levels  possible.  Human  in- 
telligence operations  are  implemented  to  cover 
critical  areas  to  identify  and  locate  insurgent  forces. 
Information  derived  from  HUMINT  programs  may 
also  be  useful  in  special  operations. 
(5)  In  counterinsurgency  operations,  cordon  and 
search  operations  may  be  employed  to  ferret  out  the 
insurgent  infrastructure  as  well  as  individual  unit 
elements  which  may  use  a  community  or  area  as 
cover  for  their  activities  or  as  a  support  base.  The 
cordon  and  search  operation  basically  consists  of 
security  forces  which  surround  the  area,  usually  at 
night,  to  prevent  persons  from  leaving  the  area;  a 
sweep  element  which  escorts  the  people  to  a  collec- 
tion point  at  first  light;  search  elements  which  search 
the  area;  and  screening  elements  to  process  and 
screen  the  people  for  identification  of  known  or 
suspected  infrastructure  or  guerrilla  force  personnel. 
Cordon  and  search  operations  should  be  conducted 
in  conjunction  with  host  country  forces  and 
organizations,  with  U.S.  forces,  including  counter- 
intelligence units,  providing  support,  advice,  and 
assistance  for  the  entire  operation.  As  a  minimum, 
host  country  personnel  should  be  part  of  the  screen- 
ing and  sweep  elements  of  any  cordon  and  search 
operation.  The  operation  is  often  conducted  in  con- 
junction with  medical,  civil  affairs,  and  psychological 
operations  programs  which  are  accomplished  after 
the  screening  phase.  Throughout  the  operation,  care 
must  be  exercised  to  prevent  an  adverse  psychologi- 
cal  effect   on   the  populace.    Details   concerning 
3-23
311 
FMFM  2-4 
the  intelligence  and  counterintelligence  aspects 
of  cordon  and  search  operations  are  contained  in 
FM  30-17,  Counterintelligence  Operations. 
311.  Counterintelligence  Funds 
Special  funds  for  conducting  counterintelligence  operations 
and  intelligence  collection  activities  by  counterintelligence 
teams  are  available  at  higher  headquarters.  These  funds  may 
be  made  available  upon  request  from  the  MAGTF.  Pro- 
cedures for  the  use,  control,  and  accountability  of  funds 
are  provided  by  the  issuing  headquarters. 
reports  disseminated  in  a  usable  form.  Counterintelli- 
gence reports  are  prepared  to  transmit  accurate  infor- 
mation to  units  that  can  take  action,  to  aid  in  the  pro- 
cessing of  intelligence,  and  to  serve  as  a  record  of  coun- 
terintelligence activities.  The  method  of  dissemination 
of  counterintelligence  information  depends  primarily 
on  the  nature  and  urgency  of  the  information,  the  loca- 
tion of  the  receiving  units,  the  security  requirements, 
and  the  means  available.  Normally,  information  is 
disseminated  by  message,  personal  liaison,  radio, 
telephone,  briefings,  messenger,  and  written  reports. 
Sample  formats  for  preparation  of  counterintelligence 
reports  are  provided  in  appendix  B  and  may  be 
modified  for  electrical  transmission.  Reports  are 
classified  according  to  content. 
312.  Files  and  Reports 
a.  Files.  Counterintelligence  teams  are  responsible 
for  establishing  and  maintaining  operational  files 
essential  to  their  combat  counterintelligence  mission. 
The  following  operational  files  are  normally  maintained 
in  a  combat  environment: 
•  Information  concerning  personalities,  organiza- 
tions, and  installations  of  current  and  future  coun- 
terintelligence interest.  Often  basic  information  of 
this  type  also  is  recorded  in  a  card  file  or  automatic 
data  system  (ADS)  for  ready  reference  and  is  cross- 
indexed  to  more  detailed  information. 
•  Correspondence  and  reports  concerning  specific 
operations  and  investigations. 
•  Source  records  containing  essentia]  data  on  sources 
of  information. 
•  Area  files  containing  basic  reference  data  and  in- 
formation on  enemy  intelligence  activity  and  coun- 
terintelligence measures  within  a  particular 
geographic  area. 
(1)  Spot  Report.  Spot  reports  are  used  to  rapidly 
report  and  disseminate  information  of  immediate 
value.  These  reports  are  not  limited  to  any  specific 
type  of  information  but  must  contain  sufficient  detail 
to  answer  basic  interrogadves  (who,  what,  when, 
where,  why,  and  how).  A  requirement  for  speed  in 
reporting  and  disseminating  establishes  the  criteria  for 
use  of  the  spot  report.  Information  contained  in  a 
spot  report  later  included  in  another  report  must  be 
clearly  identified  as  having  been  previously  reported 
so  as  not  to  be  considered  as  confirming  information. 
Source  and  information  evaluation  will  be  included 
on  all  spot  reports  together  with  the  coded  source 
identification,  when  applicable. 
(2)  Counterintelligence  Information  Report.  The 
information  report  is  the  basic  form  for  reporting 
collected  counterintelligence/intelligence  informa- 
tion. Information  is  normally  reported  by  subject 
category  and  includes  an  initial  evaluation  of  the 
source  and  the  information.  Significant  informa- 
tion addressing  national  requirements  will  be 
reported  by  the  MAGTF  staff  counterintelligence 
officer  (SCIO),  utilizing  DD  Form  13%.  The 
counterintelligence  information  report  format  has 
been  revised  to  coincide  with  DD  Form  1396 
format.  (See  DIAM  58-2A,  Vol  2  for  further 
guidance  in  completing  DD  Form  1396.) 
b.  Reports.  The  accomplishment  of  the  counterintel- 
ligence mission  requires  accurate,  timely,  and  pertinent 
(3)  Counterintelligence  Interrogation  Report.  The 
interrogation  report  notes  the  results  of  interroga- 
tions of  counterintelligence  interest.  Designed  to 
3-24
FMFM  2-4 
313 
provide  information  essentially  of  counterintelli- 
gence interest,  it  also  contains  information  which 
could  aid  other  intelligence  organizations/agencies 
in  their  evaluation  of  any  possible  interest  in  the 
persons  interrogated.  Often,  higher  headquarters 
will  require  that  certain  information/reports 
initially  be  submitted  on  all  persons  captured  or 
detained.  In  cases  where  a  person  is  of  interest  to 
both  counterintelligence  and  intelligence  inter- 
rogators, close  coordination  with  ITU's  is  required 
to  ensure  the  proper  submission  of  reports. 
(4)  Counterintelligence  Report  Form.  The  counter- 
intelligence report  form  3850  (NAVMC  10481 
[Rev   1)  will  be  used  to  report  the  results  of 
counterintelligence  investigations,  surveys,  evalua- 
tions, and  inspections.  When  longer  than  two 
pages,  the  first  page  of  the  report  contains  a  synop- 
sis. For  uniformity  and  ease  of  report  writing,  the 
counterintelligence  report  normally  contains  five 
major  sections -predication,  purpose,  background, 
results,  and  comments  or  recommendations. 
Enclosures  to  the  report  are  designated  in  numerical 
order  and  are  used  to  amplify  or  confirm  informa- 
tion contained  in  the  report.  In  the  case  of  physical 
security  evaluations  for  the  storage  of  classified 
material,  a  locally  produced  security  evaluation 
checklist  may  be  used  as  an  enclosure  to  the 
standard  report  form  in  lieu  of  lengthy  written 
comments. 
(5)  Counterintelligence  After-Action  Report.After- 
action  reports  are  prepared  by  counterintelligence 
teams  to  report  the  r  suits  of  counterintelligence 
operations  or  operations  which  were  supported  by 
counterintelligence  personnel  and  involved 
significant  counterintelligence  aspects.  In  addition, 
these  reports  serve  as  a  record  of  tactical  counter- 
intelligence support  activities  within  an  area. 
level  upon  which  it  can  be  acted.  Internal  and  external 
wire  communications  are  established  by  the  supported 
command  as  required. 
b.  Communication  Requirements 
(t)  A  counterintelligence  tactical  net  should  be 
established  for  each  counterintelligence  team.  In 
addition,  consideration  should  be  given  early  in  the 
planning  to  the  establishment  of  a  station  on  the 
counterintelligence  tactical  net.  Coordination 
should  be  established  with  the  communications- 
electronics  officer  to  obtain  radio  element  augmen- 
tation to  support  this  station. 
(2)  Internal  and  external  wire  communications  also 
must  be  planned  for  and  coordination  effected  with 
the  communications-electronics  officer. 
(3)  Where  feasible,  counterintelligence  circuits 
should  be  secure  to  preclude  compromise  of  sen- 
sitive information. 
c.  Communication  Management 
(1)  Staff  counterintelligence  officers/team  com- 
manders must  coordinate  with  the  communications- 
electronics  officer  regarding  frequency  allocation 
and  assignment.  Also,  particular  attention  must  be 
given  to  allocating  available  resources  for  the 
establishment  of  a  station  for  the  staff  counterin- 
telligence element  on  the  counterintelligence  tactical 
net. 
(2)  Consideration  should  be  given  to  planning  the  use 
of  various  frequencies  for  agent  communications. 
313.  Communications 
a.  Capabilities.  Each  counterintelligence  team 
possesses  organic  radio  equipment  to  enable  coordina- 
tion of  activities  and  the  reporting  of  information  to  the 
(3)  FMFM  10-1,  Communications,  provides  addi- 
tional information  regarding  communication 
systems,  concepts  of  operation,  planning,  training, 
maintenance,  and  communications  security  for  the 
Fleet  Marine  Forces. 
(reverse  blank)         3-25
FMFM  2-4- 
-Section  4 
Section  4 
Counterintelligence  Garrison  Operations 
401.  General 
402.  Counterintelligence  Survey 
The  primary  peacetime/garrison  mission  of 
counterintelligence  teams  is  planning,  preparing  and 
training  to  accomplish  their  combat  counterintelligence 
and  human  intelligence  (HUMINT)  functions. 
Secondarily,  counterintelligence  teams  provide  certain 
counterintelligence  services  to  enhance  the  security  of  the 
command  against  espionage,  sabotage,  terrorism,  subver- 
sion, and  inadvertent  disclosure  or  compromise  of  clas- 
sified material. 
Guidance  for  the  planning  and  conduct  of  combat  coun- 
terintelligence operations  and  for  training  are  provided 
in  sections  3,  5,  and  6.  This  section  provides  guidance 
for  conducting  Marine  Corps  counterintelligence  services 
whilo  in  garrison. 
The  counterintelligence  survey  is  designed  to  assist  com- 
manders in  establishing  systems,  procedures,  and  safe 
guards  to  protect  military  installations,  personnel,  and 
organizations  from  espionage,  sabotage,  terrorism,  and 
subversion.  To  determine  the  requirements  for  security, 
the  survey  includes  an  analysis  of  counterintelligence 
factors  influencing  security  at  the  installation,  a  determi- 
nation of  the  counterintelligence  measures  required  by 
the  sensitivity  or  criticality  of  the  installation,  an  assess- 
ment of  the  counterintelligence  measures  which  currently 
exist,  and  recommendations  to  bring  existing  counterintel- 
ligence measures  to  the  required  standard. 
The  counterintelligence  survey  is  not  a  recurring  service. 
The  purpose  of  the  survey  is  to  establish  requirements  to 
4-1
402 
FMFM  2-4 
fit  a  specific  installation,  rather  than  to  test  compliance 
with  requirements  already  established.  Once  a  counter- 
intelligence survey  has  been  conducted,  it  remains  valid 
unless  there  are  major  changes  in  the  physical  security 
characteristics  of  the  installation,  the  mission  of  the 
command,  or  the  potential  threat. 
a.  Initiation  of  a  Counterintelligence  Survey, 
The  request  for  a  counterintelligence  survey  originates 
with  the  commander  of  the  installation  concerned  or 
with  a  higher  commander  in  the  same  chain  of 
command.  Counterintelligence  surveys  are  normally 
requested  for  the  following  reasons: 
•  Activation  or  reactivation  of  an  installation  or 
major  command. 
•  Significant  change  in  mission  or  functions,  or  a 
major  physical  reorganization  of  an  installation  or 
major  command. 
•  New,  hazardous  conditions  within  an  installation 
which  necessitate  the  reevaluation  of  the  security 
system. 
•  Significant  changes  in  classified  material  produced, 
processed,  stored,  or  handled. 
•  Change  in  locale  or  environment  in  which  the 
installation  is  located. 
computer  system  security,  technical  surveillance 
countermeasures  (TSCM),  and  photography. 
(2)  Collection  of  Data.  Prior  to  conducting  the 
survey,  the  survey  team  must  become  as  thoroughly 
familiar  with  the  installation  or  command  as 
possible.  Information  concerning  the  mission, 
organization,  functions,  security  directives,  and 
previous  surveys,  evaluations,  and  inspections  of 
the  installation/command  provides  valuable  back 
ground  and  reference  data.  The  files  of  intelligence 
and  investigative  organizations  as  well  as  those  of 
the  provost  marshal's  office  may  provide  informa- 
tion on  particular  security  hazards  or  problems.  A 
complete  set  of  security  regulations  is  compiled  for 
ready  reference  during  the  survey.  Security  regula- 
tions for  reference  during  a  counterintelligence 
survey  include  but  are  not  limited  to  the  following: 
•  DODINST  5200. 1R  (to  be  used  as  a  reference 
when  reports  are  forwarded  outside  the  Depart- 
ment of  the  Navy. 
•  SECNAVINST  5521.6   
•  OPNAVINST  5510.1___. 
•  OPNAVINST  5510.45   
•  Applicable  Marine  Corps  orders  in  the  5500 
series. 
•  Upon  determination  that  a  record  of  a  previous 
survey  does  not  exist. 
•  Upon  a  major  change  in  potential  threat  to  the 
installation. 
b.  Preparation  for  Counterintelligence  Surveys 
(1)  Selection  of  Personnel.  The  number  of  person- 
nel used  to  conduct  the  survey  will  vary  depending 
on  the  size  and  nature  of  the  installation,  the  avail- 
ability of  counterintelligence  personnel,  and  any 
special  operational  or  technical  considerations.  If 
possible,  the  survey  team  should  include  personnel 
who    have   been    trained    in    methods   of  entry. 
(3)  Coordination.  Prior  to  initialing  the  survey,  a 
counterintelligence  representative  contacts  the 
commander  of  the  installation/organization  to  be 
surveyed  (or  his  representative)  to  coordinate  the 
following  matters: 
•  Determination    and    coordination    of    the 
proposed  scope  of  the  survey. 
•  Arrangements  for  access  to  necessary  records, 
buildings,  offices,  and  other  areas. 
•  Procurement  of  applicable  security  directives, 
if  not  previously  acquired. 
•  Arrangements   for  a  survey   team  escort,   if 
required. 
4-2
FMFM  2-4 
402 
•  Arrangements  for  an  initial  briefing  of  key  per- 
sonnel on  the  purpose  and  objectives  of  the 
survey,  if  desired. 
(4)  Preparation  of  Checklists.  The  study  and  analy- 
sis of  data  collected  on  the  installation  or  organiza- 
tion to  be  surveyed  may  indicate  the  necessity  or 
desirability  of  preparing  checklists  to  serve  as  a  guide 
for  personnel  conducting  the  survey.  The  checklist 
notes  general  or  specific  points  to  be  covered  and 
serves  as  a  reminder  to  surveying  personnel  to  satisfy 
the  predetermined  scope  of  the  survey.  General  points 
to  be  covered  are  common  to  all  installations  and 
organizations  and  include  document,  personnel,  and 
physical  security.  Each  of  these  major  divisions  are 
comprised  of  many  subdivisions. 
(a)  Document  security  considerations  may 
include  storage  containers,  marking  and  han- 
dling of  classified  documents,  application  of 
need-to-know,  duties  of  security  control  per- 
sonnel, downgrading  procedures,  maintenance 
of  classified  document  logs  and  receipts,  and 
destruction  procedures. 
(b)  Personnel  security  includes  all  aspects  of  the 
security  clearance  procedures,  including  clearance 
termination  and  the  security  education  program. 
(c)  Physical  security  includes  perimeter  fencing, 
lighting,  guard  system,  visitor  control  and  pass 
systems,  restricted  areas,  and  building  security. 
c.  Conduct  of  Counterintelligence  Survey 
(1)  Preliminary  Exterior  and  Interior  Checks.  The 
survey  begins  with  a  tour  of  the  installation  and  the 
surrounding  area  to  familiarize  the  survey  team 
with  the  physical  layout  of  the  former  and  its  rela- 
tionship to  the  latter.  During  this  tour,  the  survey 
team  locates  those  areas,  buildings,  or  offices  which 
require  special  security  considerations  or  which  are 
considered  to  be  sensitive.  After  the  tour,  it  may 
also  be  necessary  to  interview  certain  staff  officers 
to  determine  the  operational  importance  of  par- 
ticular areas  or  buildings. 
(2)  Determination  of  the  Installation's  Sensitivity. 
Analysis  of  the  collected  data,  and  the  tour  of  the 
installation  and  surrounding  area,  permit  the  survey 
team  to  make  a  preliminary  evaluation  of  the 
installation's  importance  to  national  defense  and  its 
vulnerability  and  value  as  an  espionage,  terrorist, 
or  sabotage  target.  An  accurate  appraisal  of  the 
security  needs  of  the  installation  in  relation  to  its 
sensitivity  and  importance  is  next  required  so  that 
specific  recommendations  are  commensurate  with 
actual  security  needs.  In  determining  the  installa- 
tion's sensitivity,  the  following  are  considered: 
(a)  Mission.  The  first  consideration  is  the  mis- 
sion of  the  organization  being  surveyed.  It  must 
be  determined  if  the  mission  is  continuous  or 
of  short  duration,  unclassified  or  classified,  and 
if  technical  or  highly  skilled  personnel  are 
necessary  for  its  successful  operation. 
(b)  Cost  of  Replacement  In  estimating  the  cost 
of  replacement  of  the  installation,  a  com- 
parative analysis  (not  a  dollar  and  cents  figure) 
is  made.  The  time  necessary  to  replace  person- 
nel, documents,  and  materiel  in  the  event  the 
installation  is  neutralized  or  destroyed  is 
estimated.  Further  consideration  is  given  to 
potential  sources  for  the  procurement  of  com- 
parable personnel,  and  to  sources  for  copies  of 
essential  and  critical  documents  to  replace  or 
reactivate  the  installation. 
(c)  Location.  Consideration  must  be  given  to 
installation  location  and  the  effect  surrounding 
elements  have  upon  its  security.  The  area  may 
be  highly  industrial,  congested  residential, 
urban,  or  sparsely  populated.  The  surrounding 
area  may  offer  favorable  natural  cover  to  enemy 
espionage,  terrorist,  or  sabotage  agents.  Con- 
sideration should  also  be  given  to  the  area's 
transportation  facilities  and  to  endemic  natural 
hazards,  such  as  flood,  forest  fires,  or  adjacent 
flammable  storage  areas. 
(d)  Security  Classification  of  Information.  A 
major  factor  in  evaluating  the  sensitivity  of  an  in- 
stallation is  the  classification  of  the  information 
stored,  used,  and  generated  theu  logically, 
information  of  greater  importance  to  national 
4-3
402 
FMFM  2-4 
defense  requires  greater  safeguarding  from  all 
standpoints.  While  regulations  establish  some 
safeguarding  requirements,  comparable  meas- 
ures, not  specifically  established  by  regulations, 
very  likely  are  required  in  other  areas.  In  con- 
sidering the  classification  of  information,  the 
auount  of  classified  information  present  must 
also  be  determined. 
(e)  Number  of  Like  Installations.  In  determin- 
ing the  overall  importance  of  an  installation, 
consideration  must  be  given  to  installations  or 
activities  capable  of  absorbing  the  functions  of 
the  surveyed  installation  to  maintain  mission 
continuity  in  the  event  the  surveyed  installation 
is  neutralized  or  destroyed.  If  no  other  organiza- 
tion can  assume  these  duties,  the  importance  of 
the  surveyed  installation  is  greatly  increased; 
however,  the  fact  that  similar  installations  or 
activities  exist  may  not  significantly  lower  the 
critical  rating.  Similar  installations  may  not  be 
in  a  position  to  absorb  the  mission  of  another, 
or  if  the  mission  is  primarily  devoted  to  a 
defined  geographical  area,  there  may  be  no 
substitution  regardless  of  how  many  similar  in- 
stallations exist.  In  considering  the  substitution 
or  replacement  of  an  installation  or  the  assump- 
tion of  its  mission,  consideration  must  be  given 
to  the  time  involved.  How  long  before  the 
changeover  or  substitution  can  be  effected?  Can 
the  alternate  installation  facilities  achieve  a  com- 
parable level  of  operating  efficiency?  If  the  alter- 
nate installation  cannot  operate  at  an  acceptable 
level  of  efficiency,  how  long  will  it  take  to  at- 
tain this  desired  level?  Will  this  transition  period 
affect  the  national  defense  effort  to  a  great 
degree? 
(f)  Importance  to  the  Defense  Effort.  In  some 
instances,  evaluation  of  the  installation's  impor- 
tance may  be  made  locally,  based  upon  a  joint 
effort  between  the  survey  team  and  the  installa- 
tion commander  and  his  staff.  Other  knowledge- 
able persons  within  the  installation  and  com- 
mand, and  the  evaluation  and  correlation  of 
available  information  from  other  agencies, 
adjacent  commands,  and  from  the  agency  utiliz-. 
ing  the  end  product  are  a.1-  o  of  prime  importance. 
In  most  instances,  this  evaluation  will  be  made 
at  higher  echelons  of  command.  The  basic  consid- 
eration is  the  importance  of  the  installation— its 
mission,  functions,  and  production— to  the  na- 
tional defense  effort.  The  mission  of  the  installa- 
tion is  a  fairly  good  indicator  of  hs  importance; 
however,  when  the  mission  is  compared  with  the 
cost  of  replacement,  location  of  the  installation, 
existence  of  similar  installations  able  to  absorb  the 
operation  of  the  surveyed  installation,  the  overall 
importance  of  the  surveyed  installation  may  be 
higher  or  lower  than  anticipated.  The  survey  team 
requires  such  information  before  determining  the 
actual  security  needs  of  the  particular  installation. 
When  the  sensitivity  rating  is  juxtaposed  with  the 
installation's  current  security  situation,  the  survey 
team  can  offer  recommendations  to  raise  or  lower 
the  level  of  security  on  the  installation  in  con- 
sonance with  its  sensitivity  or  importance  to  the 
national  defense  effort. 
(g)  Vulnerability  to  Terrorist  Attack.  An  evalua- 
tion of  the  installation  and  its  personnel  as 
possible  terrorist  targets  also  must  be  made. 
This  evaluation  is  based  also  on  the  elements 
listed  in  subparagraphs  402d(2)(a)  through  (0, 
and  on  the  potential  or  known  terrorist  threat. 
(3)  Determination  of  Existing  Security  Measures. 
Once  a  determination  of  the  relative  degree  of 
security  required  for  the  installation  has  been  made, 
a  detailed  examination  of  the  existing  security  situa- 
tion is  conducted.  This  examination  includes  all 
factors  pertaining  to  document,  personnel,  and 
physical  security  measures.  Examination  techniques 
are  dependent  on  the  number  of  personnel 
available,  personnel  capabilities,  time  available,  and 
choice.  Security  (document,  personnel,  and 
physical)  may  be  examined  separately  at  each  loca- 
tion at  different  times.  This  is  easier  but  more  time- 
consuming  than  examining  all  types  of  security 
simultaneously  at  each  location.  If  sufficient  per- 
sonnel are  available,  individuals  or  teams  may  be 
assigned  to  conduct  separate  portions  of  the  survey; 
however,  due  to  the  interrelationships  of  security 
elements  and  areas,  extensive  coordination  is 
required. 
4-4
FMFM  2-4 
402 
(a)  Document  Security.  Document  security  is 
probably  the  most  important  part  of  the  coun- 
terintelligence survey.  It  includes  a  systematic 
inspection  of  all  security  procedures  used  in  the 
hqpdling  of  classified  documents,  information, 
and  other  classfied  material.  Many  aspects  of 
document  security  may  appear  to  be  mechanical 
in  nature;  however,  these  may  be  misleading. 
Survey  team  personnel  must  visualize  the  secur- 
ity procedures  employed  from  the  viewpoint  of 
an  enemy  agent  in  order  to  identify  weaknesses 
and  vulnerable  areas  in  the  system.  A  clear 
understanding  of  installation/unit  organization 
is  required  to  check  the  security  and  flow  of 
classified  information.  The  inflow  of  classified 
information  generally  starts  at  higher  head- 
quarters and  flows  down  to  lower  echelons.  The 
outflow  of  classified  information  usually  follows 
the  reverse  pattern.  Normally,  all  accounting 
records  and  security  procedures  for  handling 
classified  documents  and  material  are  examin- 
ed at  one  •'jvel  of  command  before  moving  to 
the  next. 
(b)  Personnel  Security.  Personnel  security  in- 
cludes the  security  clearance  and  education  pro- 
grams. Personnel  security  clearance  procedures 
for  the  installation  or  unit  must  be  carefully 
audited  for  the  proper  initiation,  granting,  record- 
ing, and  termination  of  security  clearances.  In  ad- 
dition, the  distinction  between  clearance  level,  ac- 
cess, and  need-to-  know  is  clearly  emphasized  in 
examining  requirements  for  access  to  classified 
material.  The  security  education  program  of  the 
installation  or  unit  is  examined  for  completeness 
and  effectiveness.  Objectives  of  the  security  educa- 
tion program  are  to  protect  classified  information 
and  to  instill  a  sense  of  security  awareness  in  all 
personnel.  The  security  education  of  an  individual 
can  be  successful  only  when  security  is  consciously 
accepted  as  a  personal  responsibility.  Procedures 
for  conducting  required  briefings/debriefuigs,  as 
well  as  individual  proficiency  and  attitudes  toward 
security,  provide  an  indication  of  the  efficiency 
of  the  security  education  program. 
(c)  Physical  Security.  Physical  security  is 
distinct  from  document  and  personnel  security 
as  it  comprises  a  system  of  controls,  barriers. 
and  other  devices  and  procedures  to  prevent 
destruction,  damage,  and  unauthorized  access  to 
installations  and  facilities.  The  overall  physical 
security  of  an  installation  is  the  functional  respon- 
sibility of  the  provost  marshal;  however,  physical 
security  measures  which  directly  protect  areas  con- 
taining classified  material,  and  critical  areas 
susceptible  to  sabotage  and  terrorism,  are  of  direct 
concern  in  conducting  the  counterintelligence 
survey.  In  addition,  the  overall  physical  security 
measures,  plans,  and  procedures  of  the  installa- 
tion are  evaluated  as  they  relate  to  ail  aspects  of 
counterintelligence.  In  the  event  that  the  installa- 
tion/organization being  surveyed  has  on  record 
a  physical  security  survey  performed  by  the 
military  police,  a  statement  referring  to  the  report 
and  additional  recommendations,  if  any,  are 
sufficient.  If- there  is  no  record  of  a  previous 
survey,  the  provost  marshal  is  contacted  to 
schedule  and  coordinate,  with  the  counterintel- 
ligence agency,  the  conduct  of  a  physical  secur- 
ity survey.  When  the  installation  is  of  the  open 
post  type  with  few  physical  restrictions  directly 
related  to  counterintelligence  security  re- 
quirements, emphasis  is  on  an  examination  of  the 
physical  security  factors  directly  affecting  classified 
storage  areas,  security  areas,  critical  areas  that  re- 
quire protection  from  sabotage,  or  terrorist  at- 
tack, and  other  locations  designated  as  sensitive. 
(4)  Recommendations.  Based  on  the  security 
requirements  of  the  command  and  the  existing 
security  measures  and  procedures,  recommenda- 
tions are  made  to  safeguard  the  installation/ 
organization  against  espionage,  sabotage,  ter- 
rorism, and  subversion.  For  each  security  hazard, 
there  must  be  a  reasonable  recommendation  for 
correction.  In  formulating  realistic  recommenda- 
tions, consideration  is  given  to  cost,  time,  man- 
power, and  availability  of  materiel.  Alternate 
recommendations  may  be  made  to  ensure  correc- 
tive action  if  the  primary  recommendations  cannot 
be  implemented. 
(5)  Exit  Briefing.  Upon  completion,  and  after 
preliminary  formulation  of  the  results  and  tentative 
recommendations,    the    commander    and    his 
4-5
403 
FMFM  2-4 
staff  should  be  briefed  on  the  survey.  During  this 
briefing,  the  findings  and  tentative  recommenda- 
tions are  discussed.  A  successful  briefing  will,  in 
most  cases,  ensure  that  the  survey  team's  recom- 
mendations are  realistic  and  can  be  implemented 
with  minimum  difficulty. 
•  Examination  of  facilities  and  containers  used  for 
storing  classified  material  to  determine  adequacy. 
•  Examination  of  procedures  for  controlling  en- 
trances and  exits,  guard  systems,  and  special  guard 
instructions  relating  to  security  of  classified  material 
and  sensitive  areas. 
403.  Counterintelligence  Evaluation 
Counterintelligence  evaluations  are  similar  to  surveys,  but 
limited  in  scope.  An  evaluation  is  normally  conducted  for 
a  small  unit  or  a  component  of  a  larger  organization  when 
there  has  been  a  change  in  the  security  posture,  an 
activation  or  reactivation,  or  a  physical  relocation. 
Counterintelligence  evaluations  are  normally  limited  to 
areas  containing  or  processing  classified  material. 
The  counterintelligence  evaluation  may  be  limited  to  an 
assessment  of  only  one  type  of  security,  such  as  docu- 
ment, personnel,  or  physical  security,  or  it  may  include 
any  combination,  depending  on  the  needs  of  the  unit.  The 
procedures  for  the  preparation  and  conduct  of  the  evalua- 
tion are  the  :>ame  as  those  for  the  counterintelligence 
survey;  however,  they  usually  are  not  as  extensive.  The 
counterintelligence  evaluation  also  may  be  used  to  update 
counterintelligence  surveys  when  only  minor  changes  have 
occurred  within  an  installation  or  major  organization. 
404.  Counterintelligence  Inspections 
The  counterintelligence  inspection  is  performed  to  determine 
compliance  with  established  security  policies  and  proce- 
dures. The  scope  of  the  inspection  will  vary  depending  on 
its  type  and  purpose.  Inspections  may  include  the  following: 
•  Determination  if  assigned  personnel  with  access  to 
classified  material  are  properly  cleared. 
•  Determination  if  classified  material  is  properly  safe- 
guarded by  assigned  personnel. 
Counterintelligence  inspections  include  announced,  unan- 
nounced, and  penetration  inspections.  In  addition  to  for- 
mal inspections,  counterintelligence  elements  also  main- 
tain regular  contact  with  al!  supported  units  to  provide 
continuous  informal  assistance,  support,  and  advice 
regarding  security  matters. 
a.  Announced  Inspections.  An  announced  inspec- 
tion is  one  that  has  been  publicized.  All  personnel  con- 
cerned are  aware  of  the  inspection  schedule  and  make 
preparations  as  necessary.  Inspections  are  conducted 
on  a  recurring  basis  to  ensure  security  standards  remain 
at  a  high  level.  The  announced  inspection  is  often  ac- 
complished in  conjunction  with  inspections  conducted 
by  the  Inspector  General  and  the  commanding  general. 
b.  Unannounced  Inspections.  The  unannounced 
inspection  is  conducted  to  determine  compliance  with 
security  policies  and  procedures  at  a  time  when  special 
preparations  have  not  been  made.  The  unit  or  section 
to  be  inspected  is  not  informed  in  advance  of  the  in- 
spection. The  inspection  may  be  conducted  at  any  time 
during  or  after  normal  working  hours.  Counterintelli- 
gence personnel  conducting  unannounced  inspections 
must  have  with  them  their  credentials  and  authoriza- 
tion of  the  commander  to  conduct  the  inspection.  In 
addition,  a  responsible  person  from  the  command 
should  accompany  the  inspection  team. 
c.  Penetration  Inspections.  A  penetration  inspec- 
tion is  designed  to  provide  a  realistic  test  of  the  securi- 
ty measures  of  an  installation.  The  inspection  is  con- 
ducted in  such  a  manner  that  installation  personnel, 
other  than  the  commander  and  those  persons  he  desires 
4-6
FMFM  2-4   
405 
to  notify,  are  unaware  that  such  action  is  taking  place. 
This  type  of  inspection  may  be  all-inclusive  or  may  be 
limited  to  an  attsnpt  by  counterintelligence  personnel 
to  fraudulently  gain  access  to  a  specific  sensitive  area 
within  the  installation  for  the  purpose  of  performing 
simulated  espionage  or  sabotage  acts.  The  simulated 
activities  should  be  realistic  and  correspond  to  activities 
which  might  be  attempted  by  a  foreign  power  or  hostile 
agent.  The  penetration  inspection  must  be  thoroughly 
planned  and  coordinated.  Planning  for  the  inspection 
includes  consideration  of  the  following: 
•  A  responsible  person  from  the  inspected  command, 
knowledgeable  of  the  inspection,  must  be  available 
at  the  installation  during  the  inspection. 
•  Inspection  personnel  must  carry  a  letter  of  iden- 
tification and  authorization  to  be  used  only  in 
emergency  situations. 
•  If  at  any  time  during  the  inspection  a  situation 
arises  which  would  physically  endanger  personnel, 
the  inspection  is  immediately  terminated. 
•  The  inspection  must  not  impair  or  disrupt  the 
activities  of  the  command  or  installation  unless  that 
is  specifically  within  inspection  guidelines. 
•  Command  or  installation  personnel  must  not  be  uti- 
lized in  a  manner  that  would  tend  to  discredit  them. 
405.  Technical  Surveillance 
Countermeasures  (TSCM)  Support 
Historically,  hostile  intelligence  services  have  used 
technical  surveillance  monitoring  systems  in  their  espio- 
nage operations  against  U.S.  installations,  both  in  the 
United  States  and  abroad.  A  technical  surveillance 
monitoring  system  may  be  defined  as  any  visual  surveil- 
lance or  audio  monitoring  system  which  is  used  clandes- 
tinely to  obtain  classified,  or  sensitive  unclassified,  infor- 
mation for  intelligence  purposes.  These  monitoring 
systems  include,  but  are  not  limited  to,  the  following: 
•  Sound  pickup  devices,  such  as  microphones  and 
other  transducers  which  use  wire  and  amplifying 
equipment. 
•  Passive  modulators. 
•  Energy  beams  (i.e.,  electromagnetic,  laser,  and 
infrared). 
•  Radio  transmitters. 
•  Recording  equipment. 
•  Telephones  (i.e.,  taps  and  bugs). 
•  Photographic  and  television  cameras. 
Normally,  one  Marine  counterintelligence  team  assigned  to 
each  Marine  amphibious  force  (MAP)  maintains  a  TSCM 
capability  to  support  tactical  units  of  the  MAP.  This  capabil- 
ity, designed  primarily  for  combat  support,  also  supplements 
the  Naval  Investigative  Service  (NIS)  TSCM  responsibilities 
during  peacetime  garrison  conditions. 
The  purpose  of  the  TSCM  support  program  is  to  assist  the 
commander  in  his  overall  security  responsibilities  by  employ- 
ing devices  and  techniques  designed  to  locate,  identify,  and 
neutralize  the  effectiveness  of  hostile  intelligence  services 
technical  surveillance  activity.  Technical  surveillance 
countermeasures  support  consists  of  inspections  and  surveys. 
A  TSCM  inspection  is  an  evaluation  to  determine  the 
physical  security  measures  required  to  protect  an  area  against 
visual  and  audio  surveillance;  TSCM  surveys  include  a  com- 
plete electronic  and  physical  search  for  unauthorized 
modification  of  equipment,  the  presence  of  clandestine  audio 
and  visual  devices,  and  other  conditions  which  may  allow 
the  unauthorized  transmission  of  any  conversation  out  of 
the  area  being  surveyed.  All  TSCM  operations  are  governed 
DOD  Directive  5200.9,  SECNAVINST  5500.3 !_,  and 
MCO055I1.11   
Requests  for  TSCM  support  must  be  classified  and  no 
conversation  concerning  the  inspection  should  take  place 
in  the  vicinity  of  the  area  to  be  inspected.  Procedures  for 
requesting  inspections  and  surveys,  TSCM  responsibil- 
ities, and  further  information  on  the  audio  surveillance 
threat  are  contained  in  OPNAVINST  0500.46„_  and 
MCO  05511. 11_. 
4-7
408     FMFM  2-4 
406.  Reports  countermeasures  support  are  contained  in  appendix  B. 
Format  for  TSCM  reports  will  be  modified  to  meet  the 
Sample  formats  for  reports  concerning  counterintelli  Naval  Investigative  Service  requirements  when  sup- 
gence  surveys,  inspections,  and  technical  surveillance        plementing  the  NIS  effort. 
4-8
FMFM  2-4- 
-Section  5 
■5  9:! 
-"•  "A  1 
Section  5 
Counterintelligence  Planning 
501.  General 
changing  emphasis  by  hostile  intelligence,  sabotage,  ter- 
rorist, and  subversive  organizations. 
Counterintelligence  planning  is  accomplished  concur- 
rently with  other  intelligence  and  operational  planning 
and  continues  until  completion  of  the  operation.  All 
aspects  of  counterintelligence  activities  are  considered  to 
ensure  adequate  support  for  all  phases  of  the  operation. 
Counterintelligence  plans  become  more  detailed  at  each 
lower  echelon,  but  remain  flexible  to  respond  to  chang- 
ing situations. 
Counterintelligence  activities  are  characterized  by  imag- 
inative exploitation  of  all  available  resources.  The 
counterintelligence  effort  focuses  on  the  overall  hostile 
intelligence  collection,  sabotage,  terrorist,  and  subversive 
threat  and  is  sufficiently  flexible  to  adapt  to  the 
geographical  environment,  attitudes  of  the  indigenous 
population,  mission  of  the  supported  command,  and 
Counterintelligence  activities  do  not  achieve  maximum 
effectiveness  when  conducted  separately  from  other  in- 
telligence activities.  Counterintelligence  activities  must  be 
integrated  with  the  overall  intelligence  effort  and  be 
closely  coordinated  with  activities  of  other  intelligence 
specialist  teams  as  well  as  with  civil  affairs,  psychologi- 
cal operations,  and  similar  organizations  in  contact  with 
the  indigenous  population. 
Counterintelligence  participation  and  assistance  is 
included  early  in  the  planning  phase  of  tactical  operations 
so  that  commanders  benefit  from  counterintelligence 
information  and  assistance  in  the  early  formulation  of 
tactical  plans.  Particular  attention  is  directed  towards 
identification  of  friendly  vulnerabilities  to  be  exploited 
5-1
502 
FMFM  2-4 
by  hostile  collection  assets  and  toward  recommendations 
for  specific  counterintelligence  measures. 
502.  Planning  Preceding  the  Operation 
The  effectiveness  of  counterintelligence  operations  in  tac- 
tical areas  depends  largely  upon  the  planning  preceding 
the  operation.  The  counterintelligence  staff  officer  per- 
forms three  separate  functions  in  carrying  out  his  plan- 
ning responsibilities: 
•  Directs  the  effort  to  obtain  information  on  the 
enemy's  intelligence,  sabotage,  terrorism,  and 
subversion  capabilities. 
•  Provides  for  the  production  and  dissemination  of 
intelligence  on  the  enemy's  intelligence,  sabotage, 
terrorism,  and  subversion  capabilities,  including 
clandestine  and  covert  capabilities. 
•  Plans,  recommends,  and  monitors  counterintelli- 
gence measures  throughout  the  entire  command. 
a.  Collection  and  Processing  of  Information. 
The  determination  of  requirements  for  information  in 
counterintelligence  planning,  and  the  collection  and 
piocessing  of  such  information,  follow  the  same  pro- 
cedures prescribed  for  other  types  of  intelligence 
information.  (See  FMFM  2-1,  Intelligence.)  Especially 
pertinent  to  counterintelligence  planning  is  informa- 
tion on  every  aspect  of  the  enemy's  intelligence  system. 
Included  are  such  matters  as  the  hostile  intelligence 
organization,  means  available  to  the  enemy  for  the  col- 
lection of  information,  and  hostile  sabotage,  terrorism, 
and  subversion  agencies  and  capabilities. 
b.  Counterintelligence  Estimate.  Normally,  a 
counterintelligence  estimate  is  prepared  by  Fleet  Marine 
Force  (FMF)  organizations  having  counterintelligence 
personnel  assigned  or  attached.  Forming  the  basis  for 
the  counterintelligence  plan  and  appendix,  the  coun- 
terintelligence estimate  includes^he  enemy's  capabilities 
for  intelligence,  subversion,  terrorism,  and  sabotage 
and  the  effects  of  the  characteristics  of  the  area  on  these 
capabilities  and  friendly  counterintelligence  measures. 
If  a  counterintelligence  estimate  is  not  prepared,  the 
counterintelligence  officer  contributes  to  the  prepara- 
tion of  the  intelligence  estimate,  particularly  sub- 
paragraphs on  enemy  intelligence,  subversion, 
sabotage,  guerrilla  warfare,  terrorism,  and  the  effects 
of  the  characteristics  of  the  area  on  these  enemy 
capabilities.  See  appendix  C  for  a  sample  format  of 
a  counterintelligence  estimate. - 
c.  Counterintelligence   Measures  Worksheet. 
Based  upon  the  conclusions  reached  in  the  intelligence 
estimate  of  the  enemy  capabilities  for  intelligence, 
subversion,  terrorist  activities,  and  sabotage,  the  coun- 
terintelligence worksheet  is  prepared  or  revised.  This 
worksheet  is  an  essential  aid  in  counterintelligence  plan- 
ning and  is  the  basis  for  preparing  counterintelligence 
orders  and  requests.  See  appendix  D  for  an  example 
of  a  counterintelligence  measures  worksheet. 
d.  Joint  Operational  Planning  System  (JOPS). 
Counterintelligence  input  to  operation  plans  (counter- 
intelligence and  human  intelligence  (HUMINT) 
resources  appendixes)  will  be  in  the  current  JOPS 
format  (see  app.  E).  The  counterintelligence  plan  (see 
app.  F)  is  no  longer  used  as  the  counterintelligence  ap- 
pendix to  the  intelligence  annex  to  operation  plans. 
Nevertheless,  the  counterinteligence  plan  is  a  useful 
guide  for  planners  at  the  Marine  amphibious  force 
(MAF)  or  higher  level  as  a  working  paper.  Selected 
elements  of  JOPS,  Volume  II  may  be  integrated  into 
the  counterintelligence  plan,  as  required. 
503.  Counterintelligence  Targets 
a.  Selection  and  Priorities 
(1)  Counterintelligence  targets  include  personalities, 
installations,  and  organizations  of  intelligence  or 
counterintelligence  interest  which  must  be  seized, 
exploited,  or  protected. 
5-2
FMFM  2-4 
503 
02)  The  selection  and  assignment  of  targets  is  based 
on  an  assessment  of  the  overall  hostile  threat  and 
considers  both  the  immediate  and  obvious  threats 
to  jecurity  as  well  as  future  threats.  This  assessment 
normally  is  conducted  at  the  force  level  where  the 
resultant  counterintelligence  target  lists  are  also  pro- 
duced, and  which  include  any  counterintelligence 
targets  assigned  by  higher  headquarters. 
(3)  Numerical  priority  designations  are  assigned  to 
each  target  to  emphasize  the  relative  importance 
and  value  of  the  target  and/or  to  indicate  the  degree 
of  security  threat  and  urgency  in  neutralizing  or 
exploiting  the  target.  Priority  designations 
established  by  higher  headquarters  are  not  altered; 
however,  lower  echelons  may  assign  priorities  to 
locally  developed  targets. 
(1)  Black  List  Black  lists,  developed  or  compiled 
at  all  echelons  of  command,  contain  the  identities 
and  locations  of  individuals  considered  to  be  a 
threat  to  security  and  whose  capture  and  detention 
are  of  prime  importance.  The  black  list  includes  the 
following  persons: 
•  Known  or  Siispected  enemy  or  hostile  espionage, 
sabotage,  terrorist,  political,  and  subversive 
individuals. 
•  Known  or  suspected  leaders  and  members  of 
hostile  paramilitary,  partisan,  or  guerrilla 
groups. 
•  Political  leaders  known  or  suspected  to  be 
hostile  to  the  military  and  political  objectives 
of  the  United  States  and/or  an  allied  nation. 
(4)  Counterintelligence  targets  are  usually  assigned 
priority  designations  according  to  the  following 
criteria: 
(a)  Priority  One.  Those  targets  representing  the 
greatest  security  threat  or  possessing  the  largest 
potential  source  of  intelligence  or  counterintel- 
ligence information/material  and  which  must  be 
exploited  or  neutralized  as  soon  as  possible. 
(b)  Priority  Two.  Those  targets  of  lesser 
significance  than  priority  one  to  be  taken  under 
control  after  priority  one  targets  have  been 
neutralized  or  exploited. 
(c)  Priority  Three.  Those  targets  of  lesser  sig- 
nificance than  priority  one  or  two  to  be  neutral- 
ized or  exploited  as  time  and  personnel  permit. 
b.  Personalities.  Except  for  well-known  per- 
sonalities, most  persons  of  counterintelligence  interest 
are  identified  and  developed  by  counterintelligence 
units  once  operations  are  established  ashore.  Personali- 
ties are  divided  into  three  categories  comprising  those 
persons  who  are  a  threat  to  security,  whose  intentions 
are  unknown,  and  who  can  assist  the  intelligence  and 
counterintelligence  effort.  For  ease  in  identification,  a 
color  code  indicates  the  categories. 
«  Known  or  suspected  officials  of  enemy  govern- 
ments whose  presence  in  the  theater  of  opera- 
tions poses  a  security  threat  to  the  U.S.  forces. 
•  Known  or  suspected  enemy  collaborators  and 
sympathizers  whose  presence  in  the  theater  of 
operations  poses  a  security  threat  to  the  U.S. 
forces. 
•  Known  enemy  military  or  civilian  personnel  who 
have  engaged  in  intelligence,  counterintelli- 
gence, security,  police,  or  political  indoctrina- 
tion activities  among  troops  or  civilians. 
•  Other  enemy  personalities  indicated  by  the  G-2, 
such  as  local  political  personalities,  police 
chiefs,  and  heads  of  significant  municipal 
and/or  national  departments  or  agencies. 
(2)  Grey  List.  Gray  lists,  compiled  or  developed  at 
all  echelons  of  command,  contain  the  identities  and 
locations  of  those  personalities  whose  inclinations 
and  attitudes  toward  the  political  and  military 
objectives  of  the  United  States  are  obscure. 
Regardless  of  their  leanings,  personalities  may  be 
on  gray  lists  when  Known  to  possess  information 
or  particular  skills  required  by  U.S.  forces.  They 
may  be  individuals  whose  political  motivations  re- 
quire further  exploration  before  they  can  be  util- 
ized effectively  by  U.S.  forces.  Examples  of  indi- 
viduals who  may  be  included  in  this  category  are: 
5-3