Counter-intelligence

1. Counter-intelligence

2. Introduction • Prevent hostile or enemy int orgs from successfully gathering and collecting intelligence against them. • Govts organize CI-agencies separately and distinct from their int collection svcs for specialized purposes. • In most countries, the CI-mission is spread over multiple organizations. • Usually a domestic CI-svcs work as part of a larger law enforcement org: -CIA - the United States. -MI-5 -Great Britain -KGB- Former USSR -Muhabarat – Arab Countries

3. Contd.. • Mil org have their own CI-forces, capable of conducting protective ops both at home and when deployed abroad. • Depending on the country, there can be various mixtures of civ and mil in foreign operations. US embassies have overt legal attaches who work for the FBI Legal attaches often work on transnational law enforcement, but may well have a liaison responsibility for defensive CI. • “Counter-espionage” and “Offensive CI” are interchangably used. Both counter HUMINT.

4. CI Operation • It is separate from other int org. e.g CIA in the US and MI-5 in the UK • Defense system of nations, are vulnerable; Int org work to protect the nations by helping concerned agencies by supplying the int. • The challenge: identifying and reporting a wide range of potential threats; requires threat assessment. If done seriously, it is a complex task.

5. Policy of Nation-States • ‘States’ lead double lives—one sort for display, the other to be pursued. • Ordinary citizens would not know the window of the “double lives” of state. • Decision makers need validated,timely and accurate int to make a plan. • Int services not only collect info, it engages in propaganda missions if it suits their NVIs. • The policy leadership should be alert enough to appreciate the value of such insights. • CI points - hostile actions both originated from one's own country and foreign intelligence services (FIS), a term of art that includes transnational and non-national adversaries.

6. Contd… U.S. has over sixteen plus agencies. It also includes selected tactical mil int and security org, as well as those responsible for security responses to transnational threats, to include terrorism, cyber warfare and computer security, covert employment of WMD, narcotics trafficking, and international organized crime. It is not complete! MI-6 (SIS): Produce secret int in sp of HMG's security, defence, foreign and economic policies as dir by the JIC and approved by Ministers. MI-5: Protect the State against substantial, covertly organized threats, primarily from terrorism, espionage and subversion and organized crimes.

7. Int and Law Enforcement Agencies In Democratic societies it is a challenge: what org, laws, and doctrines are relevant to protect against all sorts of terrorism in own country. • US- a very careful line drawn between intelligence and law enforcement. • UK-Security Service (MI5) and the Special Branch of the Metropolitan Police ("Scotland Yard"). • French magistrates have multiple functions that overlap US and UK functions of investigators, prosecutors, and judges. • Spain- Domestic: Interior Ministry, with mil sp, takes lead; International threats, the National Intelligence Center (CNI) has responsibility.

8. CI-Missions • CI is not a neg and responsive activity; it is both information gathering and protecting friendly intelligence services. It creatively but vigorously attacks the “structure and personnel of hostile int services”. • CI Msn incl: -Def analysis - look for vulnerabilities in one's own organization, and, with due regard for risk versus benefit, closing the discovered holes. -Offensive CE - neutralize discovered FIS personnel (arrest or, expel diplomats-PNG). It exploits FIS pers to gain int for one's own side, or actively manipulate the FIS personnel to damage the hostile FIS organization.

9. Contd.. • CI Force Protection Source Operations (CFSO) are human source ops, conducted abroad that are intended to fill the existing gap in national level coverage in protecting a field station or force from terrorism and espionage.

10. Int Cycle

11. Int Cycle Mgmt • Physical Security; Assets • Personnel Security: Staffs and agents • Comn Security (COMSEC); Against theft, means and tapping, … • INFO System Security (INFOSEC); protecting the info until it loses value. • Operational Security: Secure until op is executed. • Security Classification: Pers classification; documents class etc

12. Defensive CI-Ops • Looks for places in own org that could easily be exploited by foreign intelligence services (FIS). • Ops gainst a FIS might be against one's own nation, or another friendly nation. • Actions: • -sp a friendly govt: • military sp. • CI activities • humanitarian • aid to development -i.e. “nation building”

13. Contd.. • CI and CT analyses provide strategic assessments of foreign intelligence and terrorist groups and prepare tactical options for ongoing operations and investigations. • CE may involve proactive acts against foreign int- services, such as double agents, deception, or recruiting foreign intelligence officers. • Clandestine HUMINT sources can give the greatest insight into the adversary's thinking, they may also be most vulnerable to the adversary's attacks on one's own organization.

14. Offensive CI-Ops Best defense against foreign attacks on, or infiltration of, int services is active measures against those hostile services. • It is often called counterespionage (CE): -measures taken to detect enemy espionage or physical attacks against friendly int-services. - prevent damage and information loss. -turn the attempt back against its originator. • CE (not reactive); actively tries to subvert hostile int-services, by recruiting agents in the foreign service, by discrediting personnel actually loyal to their own service, and taking away resources that would be useful to the hostile service. All of these actions apply to non-national threats as well as to national organizations.

15. Contd… Within own country, or in a friendly one with cooperating police, the hostile agents may be: • Arrested, • If diplomats, declared PNG. • From the perspective of one's own intelligence service, exploiting the situation to the advantage of one's side is usually preferable to arrest or actions that might result in the death of the threat.

16. Contd… • The int priority sometimes comes into conflict with the instincts of one's own law enforcement organizations, especially when the foreign threat combines foreign personnel with citizens of one's country. • In some circumstances, arrest may be a first step, in which the prisoner is given the choice of cooperating, or facing severe consequence up to and including a death sentence for espionage. Cooperation may consist of telling all one knows about the other service, but, preferably, actively assisting in deceptive actions against the hostile service.

17. CI Protection of Int Services • Def-CI specifically for int - services involves risk. Effective int-ops are often risk-taking. The services need to mitigate risk with appropriate countermeasures. • FIS are especially able to explore open societies, and, in that environment, have been able to subvert insiders in the intelligence community.

18. Running Offensive CE-Ops