Introduction to CI Investigations Notes

The objective of this lesson is for each student to understand the purpose of CI investigation and investigative case types conducted IAW OSI policy and guidance.

OSI has two CI Investigative File types and two Administrative File types related to CI Investigations.

Initiated based on reasonable belief a military member, civilian employee or DoD contractor, or individual with access to DoD installations, personnel, or information is engaged in spying or has committed or attempted espionage, sabotage, treason, sedition, subversion, assassination, or international terrorist activity or otherwise poses a US national security threat.
Coordination with OSI/JA-NSLD is mandatory BEFORE opening an FFI.
FFIs will be completed within 365 Calendar Days .

Agents are required to create and maintain a hard copy case file.
Will include copies or originals of key and relevant documents, notes, and other information IAW AFOSIMAN 71-121.
If a PI is upgraded to an FFI, the case timeline will extend to 365 days from the original start date – the clock does not restart!
If additional time is required (circumstances out of OSI control): Region CI element will request an extension from OSI ICON Center at least two weeks in advance.
Extensions will not be granted if the investigative unit failed to expeditiously accomplish investigative steps, and there are no mitigating circumstances that would cause the investigation timeline to exceed the 365-day standard.

CI Investigations that do not meet the reasonable belief standard for an FFI but require an explanation of facts to determine whether information exists to sustain a reasonable belief of national security crime has been committed.
Will be upgraded to an FFI if the reasonable belief standard is met.
PIs will be Completed within 180 Calendar Days

Agents are required to create and maintain a hard copy case file.
Will include copies or originals of key and relevant documents, notes, and other information IAW AFOSIMAN 71-121.
If additional time is required (circumstances out of OSI control): Region CI element will request an extension from OSI ICON at least two weeks in advance.

Used to assess a CI concern that does not meet PI or FFI criteria; Will be conducted within 90 calendar days.
May develop into a PI or FFI.
Example – May be used for a failed CI scope polygraph referral where, at the onset, there are no additional indicators or information indicating an investigation is warranted.

Used to document matters and information referred to OSI that are outside our mission or jurisdiction, require OSI action but should be documented for future reference, or OSI referrals of matters to other agencies or OSI units.
Will not be used as “place-holders” or “catch-all repositories for miscellaneous CI info.

Task/Activity	Zero	IA	PI	Joint FFI	OSI-Lead FFI	Open File
Unit CC/SAC	Unit CC/SAC	Unit CC/SAC	Unit CC/SAC	Region	Region
Close File	Unit CC/SAC	Unit CC/SAC	Region/CC	ICON	ICON	ICON
Coord?	No	No	Yes	Yes	Yes
JA-NSL Coord?	No	No	Yes	Yes	Yes	Yes
IP Required?	--	No	Yes	Yes	Yes	Yes
Timeliness	--	No	Yes	Yes	Yes	Yes
Extensions	--	Region, 45 days	ICON, 90 days	ICON, 180 days	ICON, 180 days
Cover Name?	--	No	Yes	Yes	Yes	Yes
Documentation	Summary or 158	ROI or 158	Lead Agency ROI or 158	ROI

The result of any investigation is proportionate to the forethought, imagination, knowledge, and skill of the investigator.
Devising a Investigative Plan at the onset is essential to maximize productivity and thorough, satisfy evidentiary requirements, and conserve resources.
Acts as a roadmap for conducting an investigation
Just like an interrogation, the IP is part of the planning and preparation phase
A LIVING DOCUMENT

Requirements
- AFOSIMAN 71-121, All Criminal and CI Investigations
- AFOSII 71-144v1, Execution of AFOSI’s Counterintelligence Mission (On SIPR)
- Chapter 4, CI Investigations
Investigative Plan Format
- Locally developed, all inclusive list – a living document that fits YOUR requirements
Timelines
- IP is prepared within 5 days after initiation of an investigation
- Updated periodically and when significant steps occur – whichever is more frequent
Approval & Review Authorities
- Submitted to the field office’s Region

CONUS – FBI Coordination
- Who’s lead agency?
OCONUS – CIA Coordination
- Status of Forces Agreement (SOFA) Considerations
HQ OSI/JA-NSLD
- Coordination/Legal review for case initiation
- Your National Security Legal Advisor
Local JA
- Not typically involved, except in cases where a national security crime is NOT suspected – i.e. Security Violation
- OSI/JA-NSLD will assist prior to local JA involvement
ICON – will help you determine other necessary coordination or do it for you

Unlike criminal investigations, prosecution may not be the optimal method of resolution.
Other avenues for resolution:
- Removal from access to classified information or unfavorable security clearance eligibility adjudication
- Termination of contract
- Immigration/State Department action (deportation, visa denial, foreign military sales recalled)
- Policy/process deficiency or vulnerability identified, corrected, and/or changed
Goal may change during the investigation
- Identify / Neutralize / Exploit
Concurrent thought process is extremely important – OPSEC

Investigative activities must be associated with the corresponding CI2MS investigative file.
Units will include the following information in their summary of investigation, as well as their investigative plan:
- Allegation, purpose, and intent of the investigation to identify, neutralize, and/or exploit foreign intelligence entities (FIE ) or international terrorist organizations (ITO) treats
- Case category and offense (either UCMJ, USC, or both)
- Foreign threat nexus
- DoD or USAF threat nexus
- Any other relevant information required for the region commander, OSI ICON center, and OSI/JA-NSL to fully understand the investigative context.