Counterintelligence and National Security Investigations
Counterintelligence and National Security Investigations
This domain tests recognition, reporting, and investigation of foreign intelligence, espionage, insider threat, and security compromises. The focus is early detection, containment, and coordination rather than ordinary criminal charging alone.
Core rules
- Counterintelligence seeks to detect, identify, exploit, and neutralize foreign intelligence and international terrorist activity. Indicators include unexplained affluence, unusual foreign contacts, repeated security violations, unauthorized removal of classified material, and attempts to obtain need-to-know information.
- Classified information is handled on a need-to-know basis. Derivative classification, marking, storage, transmission, and destruction follow Executive Order 13526 and agency implementing rules. A signed SF 312 nondisclosure agreement creates enforceable obligations.
- Preserve the security incident scene and documents; do not confront a suspected foreign contact or disclose operational details outside authorized channels.
- Coordinate with the FBI, DoD counterintelligence components, and appropriate command authorities. Foreign nexus can change the investigative lead and reporting path.
- Insider threat reporting is not punishment; it is a risk-management and investigative trigger.
Worked example
A cleared airman reports that a foreign national asked detailed questions about a deployed unit's schedule and offered cash for photographs. The agent documents the contact, preserves messages, notifies counterintelligence and command channels, and avoids contacting the foreign national directly. Reasoning: the facts suggest potential foreign intelligence collection; preservation and coordination protect the investigation, while unilateral confrontation could tip off a network or compromise sources.
Traps
Treating a security violation as only an administrative issue; storing classified evidence in an unapproved container; sharing details with the unit without need-to-know; and assuming a criminal referral and a counterintelligence referral are mutually exclusive.