INSPECTOR GENERAL DEPARTMENT or DEFENSE 4500 MARK CENTER ALEXANDRIA. 2235071500 April 18, 2017 Ref: F01AGBP016410781 Mr. Jason Leopold Dear Mr. Leopold: This in response to your September 22. 2015. Freedom oflnformalion Acr (FOIA) requesr for a copy of report DODIGezolsel 10, Evaluarion of Unired Srares Army Counterintelligence Invesrigations and Evidence Handling Procedures. We received your request rhe same day and assigned it case number FOIA72016700781. The Office of the Deputy lnspecror General for lnrelligence and Special Program Assessments conducted a search and found rhe enclosed document responsive to your request. 1 determined rhar some redacted porrions are exempt from release pursuanr to 5 USC. 552 which pertains to information, rhe release of which would consrirute a clearly unwarranred invasion of personal privacy Additionally. the Unired Srares Army Intelligence and Securiry Command reviewed the report and determined rhar other portions are exempl from release in accordance with 5 U.S.C. 552 i. which pertains to informaIion that is currently and properly classit'ied pursuant ro Executive Order 13525. Secrion intelligence activities (including covert actionsx intelligence sources or methods or and 5 U.S.C. 552 (mm. information exempted from release by stature. in this instance 50 U.S.C. 30240), intelligence sources and methods. In view of the above you may consider rhis to be an adverse determination rhar may be appealed to the Department of Defense, Office of Inspector General, ATTN: FOIA Appellate Aurhoriry, Suite 101324, 4800 Mark Center Drive, Alexandria VA 2235071500. Your appeal, if any, must be postmarked within 90 days of the dare of this letter and should reference rhe file number above. I recommend that your appeal and its envelope both bear rhe notarion "Freedom of Information Act Appeal." You may seek dispute resolution services and assistance wirh your request from the OIG FOIA Public Liaison Officer at 70376049785. or rhe Office of Government InformaIion Services (0013) at 877768476448, ogis@nara.gov. or Please note that OGIS mediates disputes belween FOIA requesters and Federal agencies as a nonaexclusive alternative to litigarion. l-lowever, OGIS does noI have the authority ro mediate requests made under the Privacy Acr of 1974 (request to access one's own records). April 18, 2017 Ref: FOIA-2016-00781 If you have any questions regarding this matter, please contact the Department of Defense, Office of Inspector General FOIA Requester Service Center at 703-699-7498 or via email to foiarequests@dodig.mil. Sincerely, Mark Dorgan Division Chief FOIA, Privacy and Civil Liberties Office Enclosure(s): As stated 2 Report No. INSPECTOR GENERAL (1.5. Depuri'mcnt 0/00 "cnsc (U) Evaluation of United States Army Counterintelligence Investigations and Evidence Handling Procedures . Classifiea By:i UlliLCul Simian AI lily eriued Frpm: '??ulI-hnln Cannon-sir r1~ gdassifY On: 27.921292;- .1 I ll. INTEGRITY EFFICIENCY ACCOUNTABILITY EXCELLENCE Mission Our mission is to provide independent, relevant; and timely oversight of the Department of Defense that supports the war?gh ter; promotes accountability, integrity, and e?iciency; advises the Secretary of Defense and Congress; and informs the public. Vision Our vision is to be a model oversight organization in the Federal Government by leading change, speaking truth, and promoting excellence?a diverse organization, working together as one professional team, recognized as leaders in our ?eld. Fraud, Waste Abuse HOTLINE Department of Defense dodig. For more information about whistieblower protection, please see the inside back cover. Results in Brief (H) Iii-'ulimimn n] {lulled .S'mrcs Army (Inn?termiclliuewcc Inl?t?s?iilquimns and [t'i'idt'nt't? Hand/My Pi?uc'edin't?s (II) July I 4, Imus ill) Objectivi- Our objective was to determine whether continental United States Army counterintelligence investigative activities and evidence handling procedures complied with Executive Order 123 33, DOB policy, and US. Army regulations. (Ll) (U) Overall. we found that the Army is conducting counterinteliigence investigative activities and evidence handling procedures in accordance with Executive Order 12333, 000 policy, and U.S. Army regulations. However, we found that the Army does not have a policy for entering subjects of Limited Counterintelligence Assessments into the Defense Central Index of Investigations as outlined by Del) instruction 5505.07, "Titling and indexing Subjects of Criminal Investigations in the Department of Defense." january 27, 2012: Army Regulation 381-10, Army intelligence Activities, May 3, 2007; and Army Regulation 381-45, "investigative Records Repository," May 31, 2013. A Limited Counterintelligence Assessment is a local ?le initiated to determine if an incident or matter is of counterintelligence interest. Visit us at We recommend that the Director, US. Army Counterintelligence, Human Intelligence, Disclosure and Security authorize sending Limited Counterintelligence Assessments to the Investigative Records Repository so subject information from Limited Counterintelligence Assessments can?be indexed into the Defense Central Index of Investigations as is done with Preliminary Investigations and Full Field Investigations. ,5 L'mmnents and (U) The Army G-2 concurred with and addressed the speci?cs of Recommendation 3.1. We do not require any further management comments. Please see the Recommendations Table on the next page. Dome-2015410 [Project lI (U) Recommendations Table Ma 9 1 Recommendations No Additional 1 nag Requiring Comment Comments Required Director, U.S. Army Counterinteliigence, Human None 3.1 Intelligence, Disclosure and Security (U) BODIES-2016410 (Project No. If 1 :1 GENERAL DEPARTMENT OF DEFENSE 4800 MARK CENT ER DRIVE ALEXANDRIA, VIRGINIA 22350-1500 July 13. 2016 MEMORANDUM FDR OF THE ARMY, OFFICE OF THE DEPUTY CHIEF OF STAFF. SUBJECT: Evaluation of United States Army Counterintelligence investigations and Evidence Handling Procedures [Report No. We are providing this ?nal report for your information and use. This report relates to the US. Army's Investigations and evidence handling procedures and was completed in accordance with the 016?s oversight responsibilities, as described in Section of the Inspector General Act of 1978, as amended. (U) Our evaluation was conducted to determine whether continental United States Army counterinteiligence investigative activities and evidence handling procedures complied with Executive Order 12333, policy, and U.S. Army regulations. Overall, the Army is conducting counterinteliigence investigative activities in accordance with established policy. (U) We considered management comments on the draft of this report. The United States Army G-2 concurred with Finding and the recommendation. We do not require any further management comments. We appreciate the courtesies extended to the staff. Please direct questions to me at (mam-7430* a- t- . homes or General for . - and Special Program Assessments This Page Left Blank Intentionally Contents if 1' (UJOlJleciive 7 (U) Applicable Criteria 7 (U)Background 8 (U) The Army is following Executive Order 12333, Current and U.S. Army Regulations for Conducting Continental United States Counterintelligence Investigative Activity and Evidence Handling Procedures 11 (U) CONUS Cl investigative Activities 11 (U) Evidence Handling Procedures 15 (U) Conclusion 1 6 .. .. . (U) Subject Information from Limited Counterinteiligence Assessments are not indexed in the Defense Central index of Investigations (U) Limited Counterinteliigence Assessments (U) The Defense Central Index of Investigations 18 (U) Recommendation an limit? . . .. .21 Investigative Processes 21 (U) The U.S. Army CI Policy for Obtaining Government Emails from Defense information Systems Agency 23 (U) "Resolved" CI Full Field Investigation 74 (U) The Special Investigations Detachmenr 24 (U) Responsibility for Operational Control of CONUS CI investigations . Scope and Methodology Computer Processed Data 99 (U) Prior Coverage an ARMY lh) E0 sec 79 DONG-2016410 Iv .. . . US Army CI Investigation Process {juggli'az-nak .4 4 United States Army, Of?ce of the Deputy Chief of Staff'21 :12 Dome-2016410 Iv] Introducti on 4'14 I.. (U) Our objective was to determine whether continental United States Army Counterintelligence (C1) investigative activities, and evidence handling procedures, complied with Executive Order 12333, policy, and US. Army regulations. l? Win. :11 'i (U) Executive Order 12333, "United States Intelligence Activities? (U) Directive 5240.01, Intelligence Activities,? dated August 27, 2007 (Incorporating Change 1 and Certi?ed Current Through August 27, 2014] (U) 5240.01-R, "Procedures Governing the Activities of Intelligence Components that Affect United States Persons." dated December 1982 (U) Army Regulation (AR) 381-10, Army intelligence Activities,? dated May 3, 2007 (U) AR 381-12, ?Threat Awareness and Reporting Program,? dated October 4, 2010 (U) AR 381-20, "The Army Counterintelligence Program,? dated May 25, 2010 (U) AR 381-45, "anestigative Records Repository," dated May 31, 2013 (U) AR 195-5, "Evidence Procedures," dated February 22, 2013. (U) Executive Order 12333, as amended, identi?es the intelligence and Cl elements of the Army, Navy, Air Force, and Marine Corps as elements of the Intelligence Community. lt directs the commanders and heads of those elements to collect (including through clandestine means), produce, analyze, and disseminate defense and defense-related intelligence and CI to support departrnental requirements and, as apprOpriate, national requirements. The order also directs the Secretary of Defense to protect the security of installations, activities, information, property, and employees by appropriate means, including investigation of applicants, employees, contractors, and other persons with similar associations with the as are necessary. The order specifies that I7 elements of the Intelligence Communiw are authorized to collect. retain, or disseminate information concerning United States persons only in accordance with procedures established by the head of the Intelligence Community element concerned (or by the head of a department containing such element) and approved by the Attorney General of the United States consistent with the authorities provided by Part] of the order, after consultation with the Director of National Intelligence. Executive Order 12333 serves as the basis for the following and Army intelligence and counterintelligence policy guides: 5240.01, 5240.01-R, AR 381?10 and AR 381-201 Directive 5240.01 is the primary authority used by Defense Intelligence Components that allows Cl elements to collect. process and retain, or disseminate information concerning U.S. persons. 5240.01-R implements Directive 5240.01 and allows intelligence components to carry out their authorized functions while ensuring that their activities which effect 05. persons are carried out in a manner that protect the constitutional rights and privacy of 0.5. persons. AR 381-10 includes guidance on the conduct of intelligence collection techniques by Army components and provides reporting procedures for certain Federal crimes. AR 381-12 details what incidents and behaviors are reportable to Army counterintelligence personnel. AR 381-20 speci?es policy, standards, reaponsihilities, authorities, and procedures for all aspects of the (U) Army Counterintelligence Programs to include Cl investigative activities. AR 195-5 dictates the evidence handling procedures that are applicable to Army counterintelligence personnel. ill 3} (U) CI and eSpionage investigations are some of the most sensitive and complicated activities within the investigative realm. Specifically, Ci and espionage investigations of 11.3. citizens have heightened sensitivity and scrutiny due to protections under US. laws that citizens have regarding privacy. The US. Army Criminal Investigation Division is responsible for investigating all felonies with an Army nexus. U.S. Army counterintelligence special agents conductinvestigations in the United States and AR 381-20, Chapter 4. cows-2015410 ?Jr-ac action (U) worldwide to detect, identify, assess and counter. neutralize. or exploit the foreign intelligence, foreign adversary. international terrorist, and insider threat to the Army and (U) According to entrance brie?ngs we received, the 308th Military Intelligence (Mi) Battalion (EN) is responsible for conducting continental United States Army Ci investigations. Personnel assigned to local field of?ces of the 308th Ml BN conduct Army Cl investigations. The field of?ces report to one of the four companies that make up the 308th MI EN. The 308th Special investigations Detachment has a worldwide mission and conducts high visibility Ci investigations. The 308th Ml BN provides investigative support elements, and the 310th Ml BN provides technical investigative support. The 902nd Ml Group has command and control of the 308th and 3 10th BN5. Management and oversight of continental United States Cl investigations is conducted through several leadership echelons and includes personnel from the 308th, the 902nd by means of the CONUS Counterinteliigence Coordinating Authority [and at the G-ZX level through the US Army Counterintelligence Coordinating Authority CA). Approval authorities for the majority of investigative processes are several layers above the operational level of CI investigations. (See Appendix B.) The Army has three categories of Cl investigations: Limited Counterintelligence Assessments (LEA), Preliminary investigations and Full Field (FF) investigations. AR 381-20, "The Army Counterintelligence Program," defines LCAs, Fla, and FFs. The LCA may he conducted upon receipt of information that indicates a potential foreign intelligence or international terrorist threat to the Army or The LCA is initiated to facilitate the proactive collection of information regarding those threats. An LCA determines whether the incident or matter is of counterintelligence interest prior to opening a formal investigation. The PI is a limited duration inquiry into the circumstances surrounding a reported incident, or matter of potential counterintelligence interest, to determine if there are speci?c facts giving reason to believe that a threat to national security may exist. Finally, the FF investigation is Ibid 19 liliI?OClb c?on (U) conducted when there are speci?c and articulate facts giving reason to believe that individuals under Army CI jurisdiction are involved in acts that may constitute threats to national security. An LCA may normally be authorized for up to 60 days but can be extended. A PI may normally be authorized for six months, but also can be extended. A FF investigation has no time limit. A PI should be transitioned into a FF investigation when there is a preponderance of evidence that the original allegation or report is true or when information of a more serious nature is developed. noose-20154111 1o ?indingA ?Elsi"! "i 1 I I I. ?Moi mulling . -I ll (if: if; 1 r. (U) We reviewed 55 CONUS LCAS. PIS, and FF Investigations and found the Army followed Executive Order 12333, Policy, and US. Army regulations. (See Appendix A Table 1) Per AR 381-20 ?The Army Counterintelligence Program," Cl investigations are conducted to: ARMY ENSCOM ill 3" Full-Iii] (2) [Um ARMY (3). 50 3024?} (3) (um ARMY it.) USC my?) ARMY USU (5) (Um ARMY INSCOM: {bull}, 50119133? Jill-Hi] DONG-2016110 111 I, In't Fi riding A 5U USC ti jol-Hi) (8) [um ARMY (hi Eu (U/Fe?ej Army CI investigations must always be conducted using appropriate legal standards and in a manner that would not jeopardize the potential for prosecution. Agents conducting Cl investigations must be quali?ed, possess Army intelligence badges and credentials, and be knowledgeable of the elements of proof for national security crimes as established in the Uniform Code of Military Justice and Title 18, United States Code. CI investigations must produce ?ndings, which are accurate, concise, objective, and admissible in a court of law. Hie-969 To determine if applicable policies and regulations were followed, we reviewed the following documents required by AR 381-20 for LCAs, P15 and FFs: (1) Counterintelligence Incident Reports; (2) Referrals; Authorizations and opening memoranda; (4) Investigative plans; Procedure approvals; Records checks; Banking record requests; (8) Subject interview proposals; extension authorizations; [10) Evidence custody documents; and evidence storage facilities. Counterintelligence incidentReporting. According to AR 381-12, "Threat Awareness and Reporting Program,? Chapter 5, Army CI agents are required to notify the appropriate CI coordinating authority about reportable Cl incidents through a Counteri ntelligence incident Report. The CI coordinating authority determines if the reported incident warrants a CI investigation. if the information documented in the Counterintelligence Incident Report merits further investigation, the CI personnel reslaonsible for submitting the report are instructed to open an LCA, PI or FF. We come-20: 5-110 112 lindingA reviewed the LCAs, Pie and We and determined that the Counterintelligence Incident Report process, as outlined in AR 381-12, was followed to initiate CI investigations. (See Appendix Referrals. Army CI personnel are authorized by AR 381-20 "The Army Counterintelligence Program,? Chapter 4? to initiate Cl investigations based upon referrals of information from other intelligence and law enforcement agencies. We found that Army Ci investigations initiated from referrals of information by outside intelligence and law enforcement agencies were properly documented. (Hf-130863 Authorizations and Opening Memoranda. in accordance with AR 381?20, Chapter 4. CI investigations must be properly authorized by appropriate Army CI personnel. An LCA may only be authorized by a Cl Special Agent in the grades of 0-3. Chief Warrant Of?cer 3, or a civilian pay grade of (16?13 or above with duty as a commander, operations officer or special agent in charge of Cl unit with an investigative mission. A CONUS Pi may only be authorized by the CONUS CICA, or commander of the 902ml MI Group. A CON US FF may only be authorized by the ACICA. All of the cases we reviewed were initiated by the authorized CI authorities and had the appropriate opening memoranda. Investigative Plans. investigative plans, according to AR 381-2 0, Chapter 4, are blueprints for CI investigations and will be used to describe the purpose and objectives of an investigation. The regulation stipulates that investigative plans should be prepared for every FF. The regulation does not state that investigative plans are necessary for LCAs or Pls. Our review of cases disclosed that investigative plans were completed for the FF investigations. We also found that investigative plans were prepared for some LCAs and Pis. Although not required by regulations for an LCA or PI, an investigative plan is a good management tool for all levels of Cl investigations. DONG-2016410 113 ?nding A (wees-ea Procedure Approvals. Special investigative procedures speci?c to Cl investigations are outlined in 5240.01-8, "Procedures Governing the Activities of intelligence Components that Affect United States Persons." and AR 381-10, Army Intelligence Activities.? A CI special agent conducting an LCA can perform limited investigative activities to include basic records checks, interview sources of information and identify additional leads. During an LCA, the CI agent may not collect and retain physical evidence that requires any approvals that are speci?ed in AR 381-10 and subject interviews can't be done unless approved by the Procedure 6. ARMY {In 50 These procedures must be approved by appropriate Cl authorities and legal staff before utilization. Our review disclosed that the special investigative procedures were not conducted without the approval of the appropriate Cl authorities and legal staff and were documented accordingly. Records Check. Cl special agents are permitted by AR 381-2 0, Chapter 4 to conduct record checks ofloca1,state, and federal law enforcement and intelligence agencies as well as Army ?les for LCAs, P13 and FFs. The CI agents may, with approvals from appropriate authorities. request and receive banking records and information from consumer reporting agencies. During our review we found that Army Cl agents were conducting appropriate records checks and observing proper procedures for requesting and obtaining ?nancial records. [ll/$9909 Subject Interview Proposals. Subject interview preposals are required by AR 381-20, Chapter 4. Subject interviews by Army CI agents must be approved by the ACICA. Prior to approval, the Cl agent submits a subject interview proposal. The proposal is reviewed by the appropriate legal staff and then submitted to the ACICA for approval. We found that the investigations where subject interviews were done or about to be conducted, the proposal was approved or submitted for approval in accordance with AR 381-20 requirements. Doors-gowns [14 Finding A Extension Authorizations. As stated earlier, the LEA and PI have time limits for completion. According to AR 381-20, Chapter 4, an LCA may be opened for 60 days. After 60 days an extension must he submitted and approved by either the CICA or the ACICA. The PI has a six month time limit. If more time is needed to resolve the investigation, an extension is granted by the ACICA with consultation from the CONUS CICA. We found that LCA and PI extensions were completed in accordance with AR 381-20 and documented in the case file by the either the CICA or ACICA. A FF does not have a time limit. (H) i :Litralihif' .. 011 February 22, 2013, the U.S. Army issued an updated AR 195-5, "Evidence Procedures." Only U.S. Army law enforcement entities were required to follow these procedures prior to the updated regulation. The new version was expanded to include U.S. Army Ci investigations. When we started our evaluation, the 902nd was drafting a standard operating procedure for evidence handling in order to comply with the updated AR 195-5. (U) Evidence Custody Documents and Storage Facilities. During our site visits. we spoke with available primary evidence custodians and examined evidence storage facilities. According to AR 195-5, Chapter 4, Cl units must store evidence in accordance with AR 381-20. For Cl units, AR 381-20, Chapter 4, states that evidence seized daring a Cl investigation may be stored in a security container or a secure room authorized for the storage of material up to SECRET. Access to the evidence must be restricted to the primary or alternate evidence custodian. We checked to determine if there was either a security container or room designated to store evidence. We found that the CI units we visited had proper facilities for storing evidence. We also spoke to the evidence custodians to determine if they knew: what their duties and responsibilities were; how to properly mark and store evidence; how to complete DA Form 4137 Evidence] Property Custody documents; if there were valid orders for their evidence custodian appointments; and proper evidence handling procedures. The evidence custodians we interviewed understood their duties and AR 195-5 requirements. Boole-2016410 I15 Finding A - We reviewed the evidence ledger and DA Form 4137 Evidence/Property Custody documents. According to AR 195-5, Chapter 2, the evidence ledger shows evidence accountability through cross reference with DA Form 4137. The evidence ledger accounts for document numbers assigned to DA Forms 4137 and must be maintained in a bound book. The evidence ledger is prepared with six columns that annotate the Document Number/ Date Received; Cl Case Control Number; Description of Evidence; Date of Final Disposition; Final Disposition; and Remarks. The DA Form 4137 must be used to inventory and account for seized evidence. The Cl agent who ?rst acquires the evidence is responsible for completing the DA Form 4137. We checked to determine if the evidence ledger was maintained in accordance with policy. the DA Forms 4137s were ?lled out properly and evidence could be cross referenced from the ledger to the DA Form 4-137. We found that the CCA evidence ledger was prepared in accordance with AR 195-5 and the DA Forms 4137s were completed properly and could be cross referenced from the ledger. {l lil . :rz. (U) We determined that CONUS Cl investigative activities complied with Executive Order 12333, policy, and U3. Army regulations We also found that CONUS CI evidence handling procedures are in accordance with AR 195-5. DOUG-2016410 I16 ding r3 (?ll-?inning ii II litfin, 7.21:1 ly.? 'Hinure; omit-,5 91$ "yellwh Subject information from Preliminary Investigations (PIS) and Full Field investigations are indexed in the Defense Central Index of Investigations (DCII). However, the Army does not index subject information from Limited Counterintelligence Assessments into the DCII because the LCAs are not sent to the Investigative Records Repository. An LCA is a local investigative ?le that records investigative activity but it is destroyed after one year. If LCA subject information is not indexed in the DCII before destruction, the subject information and any record of the investigative activity is not retrievable for future reference. AR 381-10, Army Intelligence Activities," May 3, 2007, Chapters Zand 3 allow collection and retention of Persons information, and AR 381-45, ?Investigative Records Repository," May 31. 2013, Chapters 1 and 2 authorize investigative files to be sent to the Investigative Records Repository for subject information indexing in the DCII. 1) sump-a! ?i 9;?1 lel'jir :1 [U/?F?tiej The AR 381-20, "The. Army Counterinteliigence Program" Chapter 4. states that an LCA can be opened upon receipt of information, which indicates a potential foreign intelligence or international threat to determine if the incident or matter is of CI interest. The LCA is the shortest and least intrusive of the investigative activities. The PIS and FF investigations are more thorough permitting case agents to request and use ARMY 5" Also, AR 381-20, Chapter 4-9b describes an LCA as "any ARMY [bi (fit if] USC 30340] investigative activity that exceeds 72 hours.? LCAs can include DOUG-2016410 I17 mgr-funny . a I LCAsare often the ?rst level of investigative activity taken and are used to collect information for the purpose of establishing whether the incident or matter is of Cl interest. The [?15 and FFs, once completed, are forwarded to the investigative Records Repository where subject information is entered into the However, the Army does not do so for (U) According to AR 381-10, Chapters 2 and 3, US. Army Intelligence is permitted to collect and retain information concerning U.S. Persons. Long term storage of US. Persons information is authorized and the Investigative Records Repository is considered a long term records holding area. AR381-45, Chapter 2 authorizes US. Army Intelligence organizations to send investigative ?les, including investigations of persons, to the Investigative Records Repository for long term retention. At the Investigative Records Repository, the investigative file is reviewed and materials relating to a subject on which there is no existing ?le will be accessed into the Investigative Records Repository as a new dossier, assigned an identifying number, and entered into the if subject information is already indexed into the the will be updated to reflect the addition of new material. Currently, the Army is indexing and FFs investigations in the DCli in accordance with AR 381-10 and AR 381-45 but not indexing LCAs. (U) i-r?iwunr u: (U) In February 1966, the DCII was created with the U.S. Army appointed as the executive agent for that program. In 1972, Defense investigation Service, later named Defense Security Service, became the DCll's executive agent. In 2010, the Deputy I Secretary of Defense transferred administrative responsibility for DCII to the Defense Manpower Data Center. Dome-2016410 I13 Finding :3 The non is de?ned in 5 use. 552, 32 ceezeea (U) The DCII contains reference to investigative records created and held by the components. The records indexed are primarily those prepared by the investigative agencies of the Military departments and Defense Investigation Service. covering criminal, fraud, counterintelligence, and personnel security information. This index also includes security clearance determinations made by the various components of the Information in the DCII is not usually available to the general public since general release would violate the privacy of individuals whose names are indexed therein. (U) The is a central repository for investigative records, to include counterintelligence investigative records. The LEA is an Army counterintelligence investigative record as are the P1 and FF. Therefore, it is necessary to maintain the LEA investigative file for future reference. During our LCA reviews, we checked subject information against the data base and determined that LCA subject info was not in the DCII. During interviews we were told that LCA subject information was not entered into the because it wasn't required. (U) The is a central location that is used to index investigative records and is checked by personnel conducting background investigations and security clearance adjudicators. it is important to maintain an accurate reporting history for subjects of all investigative activity and have those records available for review by investigators conducting personnel security investigations for security clearances and by DOD clearance adjudicators who determine an individual's access and suitability to classi?ed information. Indexing LCA subject information into the DCII ensures that subject information is preserved for personnel security investigations and adjudicator review. I19 A) "I'f Finding .V. .. - \?l4lle, 1.1; (U) Recommendation 3. 1 (II) We recommend that the Director, US. Army Counterintelligence, Human Intelligence, Disclosure and Security authorize sending LCAs to the Investigative Records Repository so subiect information from LCAs can be indexed into the as is done with and FF investigations. min? UHIH. US. Army, G-Z, agrees with the ?nding and recommendation. The Army included guidance in the revision of AR 381-20 requiring investigating elements to retire all LCAs in the Investigative Records Repository and submit a Report of Investigation to the Investigative Records Repository within 45 days of completing the LCA. The Investigative Records Repository indexes retired investigations in the DCII. in July, 2015, the US. Army Counterintelligence Coordinating Authority issued interim guidance to CI elements Army-wide, implementing the revised policy. [I'llf' Al"! (U) The US. Army G-Z has addressed our recommendation and-no further comments are required. I20 ?3 Other nteresc :{Uj illher Matters of Interest_ When the evaluation team made site visits and conducted interviews, a number of experienced Army CI personnel provided additional matters ofinterest concerning changes to some counterinteiligence policy and investigative processes the personnel thought would promote efficiency. Some of the recommended changes are incongruous with what current regulations and policy permit. Others were not. Overall, interviewees wanted more transparency from management concerning policy changes that effect investigative operations. Speci?cally, interviewees said that if management requested and considered input concerning investigative policy changes, it could assist with developing better and more ef?cient investigative policy. We did not perform veri?cation field work on these issues as they were outside the focus of our evaluation. Management is not required to provide comments to this section. These matters of interest were reported to the evaluation team by U.S. Army counterintelligence personnel and we are providing them to management for situational awareness and any action it deems appropriate. (U) investigative Access Sources fS-h?N-Fj According to AR 381-20. ?The Army Counterintelligence Program" . . H. Chapter 10_2 C. IMUMI 140.] (Mm at 2. According to AR 381-20, Chapter 10-21: cools-2015410 [21 Ether.- xii-51?. eisoi' .nteres: (hull. F50 I3: I in [bus full-In) (U) Procedure 9 Authorizations (U) As de?ned in 5240.141, "Procedures Governing the Activities of Intelligence Components that Affect United States Persons," 3 Procedure 9 is physical surveillance of United States Persons by DOD intelligence components for foreign intelligence and counterintelligence purposes and can be approved by the head of the intelligence component concerned or a designated senior of?cial of the component. NIUSL ?3ll2-l(i) (U) Pursuant to AR 381-10, Army Intelligence Activities," Chapter 9?5, related to Procedure 9 approvals, with regards to surveillance of US. persons within counterintelligence jurisdiction, the 902nd commander could approve a Procedure 9 for the Group if the authority is delegated by the Army G-Z. interviewees stated that a Procedure 9 is the least intrusive of procedures, includes an extensive legal review by the 902nd and are used in Pls, which the 902nd Group commander is authorized to initiate. Although the 902nd Group Commander can authorize the initiation of a PI, ARMY INSCUM: [hi 50 USC 302-10) Since the 902nd Group commander has the authority to initiate a PI, those we interviewed ARMY St: USC pools-2015410 122 a: flier-19m of "interest (U) Loco! Sto?ludge Advocates Could Provide Routine investigative Support to Field Offices (U) Pursuant to AR 381-10, Activities,? Chapter 1-6a, Commanders will seek legal advice from their supporting U.S. legal adviser for procedures 5-13. Senior CI personnel that we interviewed suggested that a legal review of routine investigative processes such as obtaining emails from local servers, search authorizations and af?davits could be referred to local Staff Judge Advocate of?ces for approval. Local Staff Judge Advocate?s of?ces provide legal support to the US. Army Criminal Investigative Command's Special Agents and the installation Provost Marshal. Additionally, interviewees stated that utilizinglocal Staff Judge Advocates for routine investigative processes would reduce turn-around time and unburden 902nd and INSCOM legal staff for other requirements. However, consideration must be taken to ensure local Staff Judge Advocates have appropriate clearance levels and the sensitivity of Cl investigations must be accounted for. '11" 1., -. i' Ni ?ii. .ui- "fitJ?Jt'fi'l?ll'ilifll'. i- lili' 4 Limi' ..-. .i?wjirm'v (U) Interviews disclosed that the ACICA, without warning, issued new investigative guidance for retrieving US. Government emails from the Defense information Systems Agency (DISA) enterprise. According to interviewees, the new policy is more stringent and no explanation was provided to the ?eld for the change. (U) The new ACICA policy letter, "Retrieving Defense Information System Agency Enterprise Email,? dated March 6, 2014, directs ?eld agents to create a packet for submission to the local legal of?ce for review and approval. it? ?1 5? 3 123 11 e: chat-tars o? inter-esl'lt'l'r'i (U) AR 381-20, ?The Army Counterintelligence Program,? Chapter 4-1313, states that one of the requirements for closing a FF investigation is when the original allegation has been "resolved." However, interviewees related that there is no de?nition or criteria of what "resolved" means and that not properly de?ning what a ?resolved? investigation is could lead to arbitrary or speculative decisions concerning case termination. Interviews disclosed that some investigations are terminated as "resolved" and the allegations are neither refuted nor established as required by Army Regulation 381-20, Chapter 4-2c. 1) Hill). sec 000164015410 I24 If her Matters of uteres: ARMY I). E0 I353). sec. [i if 11min! I?i-iNl if; i liguldful?, According to AR Army Counterintelligence Program,? Chapter 3-2b, the ACICA maintains technical control of Army Cl controlled activities, which are those activities requiring enhanced oversight, legal review, and access control because of their potential for abuse, their sensitivity as they relate to nation] security, and the need for ensuring senior leadership knowledge. They consist of Cl investigations, Cl source operations [excluding Cl force protection source operations), and Cl projects. ?Technical control" as defined by AR 381-20 "The Army Counterintelligence Program," conveys the authority to ensure complete and proper accounting of Cl investigative and operational activities; compliance with established law and policies; quality assurance,- interagency coordination at the national level; investigative coordination across theater boundaries; and Army leadership knowledgeability of signi?cant CI activities. (U) Headquarters, Department of the Army, Army Doctrine Reference Publication 1-02, de?nes ?technical control? as supervision of human intelligence, counterintelligence, and signals intelligence collection tactics, techniques, and procedures. "Technical control" does not interfere with tasking organic human intelligence, counterinteliigence, and signals intelligence collection assets; it ensures adherence to existing policies or regulations by providing technical guidance for human intelligence, counterintelligence and signals intelligence tasks within the information collection plan. DOING-2015410 I25 (Di-16?" wagers Oi". (U) "Operational control? as de?ned by The Army Doctrine Reference Publication, 1:02, is the authority to perform those functions of command over subordinate forces involving organizing and employing commands and forces, assigning tasks, designing objectives, and giving authoritative direction necessary to accomplish themission. ARMY in $33034DONG-20164.10 I 25 pendiztes 1} u; A.) i-i iie'ing'fw i? - (U) We conducted this evaluation from November 26, 2013, through February 12, 2016, in accordance with the "Quality Standards for Inspection and Evaluation" published by the Council of inspectors General on Integrity and Ef?ciency in January 2012. Our objective was to determine whether CONUS US. Army Ci investigative activities and evidence handling procedures complied with Executive Order 12333, policy and US. Army regulations. We worked closely with an experienced Army CI subject matter expert during the course of this evaluation. (U) To meet our objective, we reviewed US. law, and Army regulations and policy to determine current CI investigative activities and evidence handling procedure. We made 18 site visits where we reviewed cases and interviewed leadership and ?eld agents. The site visit locations included all four 308th company headquarters, seven field offices, the Special investigations Detachment, CCA, Army Operations Security Detachment, and the Army Cl Center. We interviewed investigative oversight personnel at the US Army ACICA, CONUS CICA, 308th and 310th Battalions. We also met with personnel from the Defense intelligence Agency, US Army intelligence Center of Excellence, and the We evaluated 55 open CONUS Cl LCAs, Pl and FF investigations that the 902ml provided upon our request to review cases within the evaluation period. (See table 1.) We evaluated those FFs, P15 and Mills to determine observance of established administrative and operational procedures. We also evaluated existing case management, investigative processes, and oversight mechanisms for efficiencies. 00016-2015-110 I 27 _o endixes Appendix . . .. 'i'uin'r: i. Ufi'H'ihuiitm qurmyL?i Period CI Investigation Case Category Limited Counterintelligence Full Field Preliminary OfficeDom nations . . . . investigations investigations ARMY INSLUM: En 135313.331: I 4(c) Source: US. Army Cl Investigations case review i . . .. . . 'llj?i i? 3 (U) We did not use computer processed data to perform this evaluation. wining"- (U) No prior coverage has been conducted on United Stated Army Counterinteliigence Investigations and Evidence Handling Procedures in the past five years. 000162016410 [23 "l .l :1 II) 5% - Acpendi ARMY 1. '51: \1 (m (I 1. E0 sec ch] ARMY E0 lit?Qt?. sec. Source: US. Army Cl Investigations case review ma DONG-2016410 29 . .1 'l Hum Appendixes [11? .v . I .I ARMY lb) (3 1, 5? USC DONG-2016410 ISO . . . Muir,? .- its turn): Management (_2ir__r_n_i_ngrr in 11": i?rianagemenr: Comments DEPARTMENT OF THE em mummcmursm?. 1mm mm" mmrmeommow JUII 17 no DAMI-CDG MEMORANDUM FDR DEPARTMENT OF DEFENSE INSPECTOR GENERAL, 4800 MARK CENTER DRIVE. ALEXANDRIA. VIRGINIA 22350-1500 SUBJECT: (U) Draft Evaluation of United States Army Counterin'et?ganoe Lng?ge?ans and Evidence Handling Procedures (ijeel Nu. D2014-DINT- .000: 1. (U) The concurs with the ?nding at the 27 April 2016. Department Of Defense (DOD) Inspector General (IE-I) drattrepurt ooncemtng Its evaluation of Un'rted States Army Counterinteillgenoa Investigations and Evidence Handling Procedures {Prom No. The Don lG found that eubkct Information from Limited Countarinie?lgence (GI) Assessments (Lama's: not indexed In the Deiensa Central Index of Investigation I). 2 (UIIFOUOI To eddmse the ?nding. the Army included gwdanoa in the revision of Army Regulation 331-20. TheArmy Countarlntatllganca Program. The guidance requires Investigating elements to retire In the us. Army Investigative Records Repository (IRE) and submit a Report of Investigation (ROI) lo the IRR within 45 days 0! wmpte?ng the LCM. The Indexes retired hms?na?om In the DCII. This will ensure Army with DOD Instruction 5605.07. Titling and Subjects 01' Criminal mutilation: in the Departmental Defense. 21' January 2012. in July 2015. The Army Gourderlnteillgenoe Coordinating Authorlnr (ACICA) promulgated interim guldenoe in CI elements Implementing the revised poIIdy. 3. (U) The Anny conducted a review of the IG reportand donwre with the SECREWNOFORN 4. The om otthe mi? cuar etstaff. (3.2 gum cam 8.563: O. Adi-b n. ROBERT P. ASHLEY. Lieutenant General. as Deputy Chief of Staff. 5-2 DODIG-2016-110 I31 I I'ln'xl'. .Ilf?l Acronyms and. Abbreviations (U (U) ACICA AR an cm Cl cucA comus ncu DISA FF INSCOM LCA MI Pl US Army Counterintelligence Coordinating Authority Army Regulation Battalion Cyber Counterinteliigence Activity Counterinteiligence Coordinating Authority Continental United States Defense Central Index of Investigations Defense Information Systems Agency US Department of Defense Full Fieid US Army Intelligence and Security Command Limited Counterintelligence Assessment Military intelligence Preliminary investigation (U) Dome-2015.110 az SEW Whistleblower Protection U.S. DEPARTMENT OF DEFENSE The Whistleblower Protection Enhancement Act of 2012 requires the Inspector General to designate a Whistleblower ProtectiOn Ombudsman to educate agency employees about prohibitions on retaliation, and rights and remedies against retaliation for protected disclosures. The designated ombudsman is the Hotline Director. For more information on your rights and remedies against retaliation, visit wer. For more information about IG reports or activities, please contact us: Congressional Liaison congressional@dodlg.mil; 703.604.8324 Media Contact public.affairs@dodig.mll; 703.604.8324 Update Reports Mailing List Twitter Hotline dodigmil/hotllne OF I INSPECTOR GENERAL 1-800 Mn: 14 (Jenn-r Urin- VA 15m} wwu?:ullgmil any?: I