1. The Department of Defense Intelligence Oversight Program
Instructor Notes:
For the next 60 minutes you will receive an orientation on the Department of Defense (DoD) Intelligence Oversight (IO) program.
You will not be experts on the topic by the end of the presentation.
You should, however, leave with an understanding of the fundamentals of IO and know where to find more information to further your understanding of this important subject.
Part 2

2. Continued From Part 1 Instructor Notes:
The next group of slides will discuss the procedures outlined in DoD regulation R.

3. DoD 5240.1-R Procedures 1–4 Applicability Collection Retention
Dissemination
Instructor Guidance:
The numbered list is animated to display each item upon mouse click.
Instructor Notes:
DoD R is the baseline document that feeds into an individual agency’s or military services’ policy.
It is divided into 15 chapters called procedures. They are called procedures because in most cases they prescribe how to go about collecting information within the intelligence community.
The purpose of the Procedures is to enable DoD intelligence components to effectively carry out their authorized functions while ensuring their activities that affect U.S. persons are carried out in a manner that protects their constitutional rights and privacy.
Procedure 1, Applicability, sets forth those for whom the regulations apply: All persons engaged in collection, production, or dissemination of foreign intelligence or counterintelligence or employment of intelligence resources
Procedure 2, Collection, sets forth the what, when, and how information about U.S. persons may be collected.
Procedure 3, Retention, sets forth the circumstances under which information may be retained: When appropriately collected and authorized.
Procedure 4, Dissemination, sets forth the circumstances under which information may be shared or released: When information about U.S. persons was appropriately collected and authorized for release to only other governmental organizations and agents.
During the next group of slides we will discuss in further detail these four Procedures.
Let’s start with Procedure one: Applicability.

4. Procedure 1: Applicability
Establishes to whom regulations apply:
DoD Intelligence components
Any organization or person engaged in intelligence or intelligence-related activities
Establishes to whom regulations DO NOT apply:
Law enforcement components
Requires compliance with all applicable policies and procedures
Instructor Notes:
Procedure 1 sets forth the applicability and scope of the regulations.
The regulations listed in DoD R apply to DoD intelligence components.
DoD intelligence components are named military intelligence organizations that are defined in the document’s Definitions section.
There is also a provision within the Definitions section that states that any organization conducting an intelligence or intelligence related activity is also considered a component of the defense intelligence community.
This regulation DOES NOT apply to law enforcement.
Law enforcement organizations operate under a separate set of authorities specifically oriented on their activities.
DoD R is about policing the intelligence community.
The procedure also prescribes that all intelligence functions be carried out in accordance with every applicable policy and procedure to that specific activity.

5. Procedure 2: Collection
Authorizes collection of information regarding U.S. persons only if:
Necessary to conduct a function assigned to the collecting components
Approved by authorized commander or director
The nature of the collection falls within any of the 13 defined categories
Instructor Notes:
Procedure 2 focuses on the collection of information; it provides the sole authority by which DoD intelligence components may collect information concerning U.S. persons.
Organizations collecting information for intelligence activities may do so only if the collection is:
Required by the assigned mission (approved by Command or directive authority)
Defined by at least 1 of 13 different categories
The categories are discussed on the following group of slides.

6. Procedure 2: Collection, cont.
Information obtained with consent
Publicly available information
Foreign intelligence
Counterintelligence
Potential sources of assistance to intelligence activities
Protection of intelligence sources and methods
Physical security
Instructor Guidance:
The numbered list is animated to display each item upon mouse click.
Instructor Notes:
If someone volunteers information, it is perfectly acceptable to collect.
Information may be collected through open source intelligence on the internet if it is considered publicly available.
Foreign and counterintelligence information may be collected.
Both bullets 3 and 4 speak to the fundamental missions of the intelligence community: foreign and counterintelligence.
Information regarding U.S. persons reasonably believed to be potential sources of intelligence or potential sources of assistance to intelligence activities may be collected to assess their suitability or credibility.
Information may be collected, if there is a foreign nexus, about U.S. persons who have access to information that reveals foreign intelligence and counterintelligence sources or methods.
Information about U.S. persons who are reasonably believed to threaten the physical security of DoD personnel, installations, operations, or personnel associated with the DoD may be collected if there is a foreign nexus. Information derived from personnel security investigations may be collected as well.

7. Procedure 2: Collection, cont.
Personnel security
Communications security
Narcotics (international)
Threats to safety
Overhead reconnaissance
Administrative purposes
Instructor Guidance:
The numbered list is animated to display each item upon mouse click.
Instructor Notes:
Information collected incident to investigations of compromises of Communications Security (COMSEC) material may be collected.
Information about U.S. persons reasonably believed to be engaged in international narcotics activities may be collected.
Information about U.S. persons that is necessary to protect the safety of any person or organization, including those who are targets, victims, or hostages of international terrorist organizations, may be collected when there is a discernible foreign nexus.
Incidentally collected information through overhead reconnaissance may be collected.
Intelligence activities as with any other activity have administrative requirements that require the maintenance of U.S. persons’ information, for example: unit rosters. This type of administrative information may be collected.

8. Kinds of Information Collected Since 9/11
Most prevalent sources of information:
Information obtained with consent
Publicly available information
Foreign intelligence
Counterintelligence
Physical security
Threats to safety
Instructor Guidance:
Items number 7 and 11 to enlarge upon mouse click, followed by the appearance of bracketed text: Require discernable foreign connection.
Instructor Notes:
These are the most likely kinds of information legitimately collected on U.S. Persons since 9/11.
[Click the mouse to initiate animation] In the case of physical security threats and threats to safety—numbers 7 and 11—it is DoD policy that there be a discernable foreign connection.
If a foreign connection can not be made, the situation falls under a law enforcement function. (For example, the intelligence community would not have targeted Timothy McVeigh; that type of targeting falls under a law enforcement function.)
There must be some identified foreign connection directing or encouraging the activities of individuals who threaten DoD equities before the intelligence community can target the collection of that information without an exception to policy or approval by an appropriately designated official.
Require discernable
foreign connection

9. Procedure 3: Retention
Authorizes retention of information regarding U.S. persons only if information was collected:
Pursuant to Procedure 2
Incidentally to an authorized collection
For a temporary period not to exceed 90 days
Instructor Notes:
Procedure 3 provides the sole authority by which DoD intelligence components may retain certain kinds of information concerning U.S. persons.
Information may be retained only if information was collected:
Pursuant to Procedure 2
Incidentally to an authorized collection
The information recognized as the type that may be retained after incidental collection is prescribed in DoD R.
For a temporary period not to exceed 90 days and solely for the purpose of determining permanent retention under the regulation’s procedures.

10. Procedure 4: Dissemination
Authorizes dissemination of information regarding U.S. persons without consent only if:
Information was collected and retained under Procedures 2 and 3
Recipient is reasonably believed to need such information and is a recognized party as defined by the procedure
Instructor Notes:
Procedure 4 provides the sole authority by which DoD intelligence components may disseminate information concerning U.S. persons without their consent only if:
Information was collected and retained under Procedures 2 and 3
The recipient is reasonably believed to need such information to carry out a legitimate government function and is:
An agency in the intelligence community
A DoD employee or contractor
Other Federal agency
Federal, State, or local law enforcement
Foreign government pursuant to an agreement
In the case of law enforcement, however, there is an additional condition required.
The information being disseminated must pertain to a reasonable belief of a violation of the crime within the jurisdiction of that law enforcement authority.
Within the intelligence community, information can be openly shared, but it is incumbent upon the recipient’s activity to determine whether it is appropriate to maintain within their files and in accordance with their mission.
For other government agencies, the disseminating organization must provide a review to determine the appropriateness of that information being necessary to a legitimate government function.

11. DoD 5240.1-R: Procedures 5-9 Intrusive collection techniques:
Electronic surveillance
Concealed monitoring
Physical searches
Searches and examination of mail
Physical surveillance
Instructor Notes:
Procedures 5-9 cover intrusive collection techniques for the purpose of intelligence gathering.
This presentation will not go into detail on Procedures 5-9. Please take some time and study these procedures on your own.

12. DoD R: Procedures 10-13
Undisclosed participation in organizations
Contracting procedures
Assistance to law enforcement
Experimentation on human subjects
Instructor Notes:
Procedure 10 provides for the fact that if an intelligence agent or operative or anyone acting on behalf of the intelligence community for intelligence purposes participates in private organizations, there may be a requirement to reveal their association with the intelligence community or gain permission from a higher authority not to do so.
Procedure 11 governs contracting procedures for intelligence related activities.
Procedure 12 provides for the provision of intelligence support to the law enforcement community; for example, support to law enforcement and support to emergency management agencies under “Defense Support to Civil Authorities” provisions as addressed in separate DoD Directives.
As a result of past CIA activities, Procedure 13 states that human subjects may be subjected to experimentation for intelligence purposes only if the subjects voluntarily consent and have full knowledge of such experimentation.
As you can see, questionable activities can involve a wide variety of issues.

13. DoD 5240.1-R: Procedures 14 and 15 Employee Conduct
Employees shall conduct intelligence activities in accordance to EO and DoD R
Leaders shall ensure adherence to the oversight policies and regulations
Reporting Questionable Activities
Such activities must be identified, evaluated, and reported
Instructor Notes:
Procedure 14 covers employee conduct; essentially, it states that employees of DoD intelligence components must be familiar with the procedures that govern their routine activities and any other procedures outside of this regulation that govern intelligence activities in which they are engaged.
Regulations govern every and any specific intelligence activity.
It talks about IG’s responsibilities and it talks about the oversight responsibilities of the intelligence component leaders.
Procedure 15 prescribes how to address issues in the intelligence community when they get off track—and they will—sometimes without malice and sometimes with.
Procedure 15 requires that these questionable activities be identified. It addresses the responsibilities of a Command to establish a reporting chain.
It prescribes the requirement for Command to look into allegations of misconduct and questionable activity, determine whether the allegation is substantiated or unsubstantiated, and then affect appropriate corrective action.
Procedure 15 is discussed in greater detail in the next section of the presentation.

14. Instructor Notes:

15. Who is Responsible? Commanders or Directors IGs JAGs and GCs
Intelligence personnel
ATSD(IO) and DoD GC
Instructor Notes:
Does this list of responsible actors look familiar?
These are the responsible actors for the whole IO program.
It makes sense that these responsible actors are tasked with identifying, investigating, and reporting questionable activities.
What are these responsible actors reporting on?
What qualifies as a reportable issue?

16. Reportable Issues Questionable intelligence activities
Significant or highly sensitive matters
Crimes reported to the Attorney General
Congressional testimony, notifications, reports, or briefings
Congressional committees
Individual members of Congress
Members of the Congressional staff
Instructor Notes:
There are a number of violations that are required by the DoDD R and the DTM that must be reported to the ATSD(IO):
Questionable intelligence activities
Significant or highly sensitive matters (this is an Executive policy enacted in 2007 and 2008)
Federal crimes reported to the Attorney General
Federal crimes associated with intelligence activities are reported to the Attorney General for possible prosecution in the Federal court system.
The President’s Intelligence Advisory Board wants to know beforehand of any Congressional testimony, notification, reports, or briefings either to the committees, the members of Congress, or their staff.
So, what qualifies as a questionable intelligence activity?
What qualifies for a significant or highly sensitive matter?

17. Questionable Intelligence Activities Defined
Instructor Notes:
A questionable intelligence activity—very simply—is an intelligence activity that leads to a suspicion that it may violate public law, Executive Order, presidential directive, DoD policy or regulation that governs the activity. It may also violate any subordinate derivative policy or regulation in the services, agencies, or command of the Department.
Remember, the activity must be related to an intelligence or intelligence related activity.
For example, if a counterintelligence case officer commits a crime but the crime has nothing to do with her mission or her function, it is not reportable under this regulation.
If the counter intelligence case officer chooses to use her badges and credentials—which is an intelligence resource and authority—to beat a traffic ticket or gain access to law enforcement information, it is reportable.

18. Significant or Highly Sensitive Activity Defined
Instructor Notes:
Reporting a significant or highly sensitive activity is a recent requirement from the White House.
A significant or highly sensitive activity threatens the reputation of the intelligence community thereby threatening the community’s access to certain authorities and capabilities.
Or call into question the propriety of the activity. For example, activities that:
Involve congressional inquiries or investigations. So, if Congress has a question based on an allegation from a citizen or an interest expressed by a congressional staff member, it needs to be reported.
Result in adverse media coverage. So, if the media splashes a headline across the Washington Post’s front page, ATSD(IO) has an interest in it.
Impact foreign relations or foreign partners. So, if an activity affects our foreign relations or is tied to national security, ATSD(IO) has an interest in it.
Disclose classified or protected information. So, if there is highly sensitive information that has been compromised and is tied to national security, ATSD(IO) has an interest in it. These things need to be reported.
As you can see, generally, the nature of these activities make reporting the activity a fairly immediate requirement.
Now that you know the types of activities that need to be identified and examined, you need to know how to report them.

19. Reporting Format Instructor Notes:
The reporting format answers the who, what, when, where, and why of the questionable activity.
It also requires information regarding what is being done about the activity.
ASTD(IO) wants to know what went on: Does the Command know about it?
Why does the Command think it is a reportable incident?

20. Reporting Format, cont.
Assessment of effect on national security, international relations, civil liberties, and privacy rights
Remedial action taken or planned
Actions taken if incident involves improper handling or compromise of classified information
Instructor Notes:
As you can see, there is some analysis and assessment.
This is a dynamic process; you may not have all the answers upfront, but if it is important enough to report, ATSD(IO) wants to know what you know so it can get the leadership informed and get in front of the issue to provide assistance and advice if needed.
Let’s discuss the variables that are essential for a successful IO program.

21. Classified Information Whistleblowing
The DoD Inspector General provides a mechanism to report allegations of violations that involve classified information.
DoDIG provides the following list of violations that should be reported to the DoD Hotline via the classified reporting mechanism:
Breach of classified systems involving Special Access Programs (SAPs)
Nuclear Surety
Unauthorized Disclosures
Intelligence Community Whistleblower Protection Act (ICWPA)
Security violations/compromise
Intelligence Oversight
After seeking resolution locally, or if unable to do so, contact the DoDIG before taking any “self-help” action.

22. Classified Information Whistleblowing
Instructions for submitting SECRET, TS, or ICWPA complaints are found on this site.

23. Instructor Notes:

24. Attributes of the Best IO Programs
In the past, the best IO programs:
Directly involved leadership
Tailored training programs
Integrated planning
Involved legal advisors
Established procedures for reporting and resolving IO issues
Instructor Notes:
Good, basic, fundamental leadership is an attribute shared by effective IO programs. The commanders have identified people who are responsible and held accountable—on their behalf—for carrying out an IO program.
Training programs are tailored to the organization’s mission and should be early, often, and creative.
The completion of the training programs is tracked to assure everyone involved is properly trained.
As stated earlier, intelligence supports operations, so the ideal IO program is a dynamic part of operational planning and execution.
The active involvement of the General Counsel, Judge Advocate General, or Staff Judge Advocate (SJA) should be in place to assure legal compliance.
If things get off track during any phase of an intelligence operation there must be a timely, detailed, and effective response to determine the facts and to implement appropriate corrective action.
Long gone is the acceptance of the unconstitutional activities once practiced. However, both inadvertent and intentional non-compliance with IO regulations and policies still occurs.

25. Kinds of Infractions Inadvertent non-compliance
Getting ahead of authorities
Lack of familiarity with regulations
Inappropriate open-source netsurfing
U.S. persons’ data improperly included in reports
Intentional non-compliance
Prisoner abuse by military intelligence personnel
Contract translator misconduct
Misuse of intelligence resources for personal gain
Instructor Notes:
The good news is that the intelligence community is not out of control. That said, non-compliance does still occur. IO non-compliance falls into two categories: inadvertent and intentional. Non-compliance occurs generally because people are out performing a difficult mission, trying to answer demanding questions regarding intelligence information for Commanders.
Non-MI commanders sometimes either get out ahead of authorities or there is not an appropriate review of intelligence product prior to publication.
Non-MI commanders often are not aware that there are rules to intelligence activities. And there are rules for a reason. There are rules in place to validate information, to keep commanders from making mistakes, and to keep people from getting killed.
Of course, the availability of the internet is always a temptation because it is a perfectly legitimate source of information, but it has to be done under the appropriate authorities and conditions.
If there is a pattern to be identified in these files, it would be in the general lapse of personal conduct in complying with governing regulations and authorities. There is also occasional criminal conduct, such as military intelligence (MI) personnel involved in prisoner abuse, employing contract translators who were left unsupervised, nonmilitary intelligence professionals trying to conduct intelligence collection activities generally in the human intelligence business that they are not trained to do for which they do not understand the rules, and the kind of petty, venal misuse of resources like flashing the badge and credentials to beat a traffic ticket. It is all over the map. But we are generally in pretty good shape, at least at the level of visibility that ASTD(IO) has.

26. IO Inspections: Suggested Methodology
Tailor the approach to the command
Understand the command and control relationships
Review internal SOPs and policies
Conduct organization and mission briefings
What are the ongoing or planned operations?
What supporting activities are ongoing or planned?
What controls are in place?
What oversight mechanisms are in place for compartmented programs?
Instructor Notes:
This is how ATSD(IO) conducts inspections. You have to understand the internal processes. A cookie-cutter solution to inspections or a single checklist does not exist. Every command is unique; agencies have different missions, and they have their requirements. Don’t get into a checklist mentality; IO is more than just looking at a 3-ring binder. The methodology has to be tailored.
You have to understand what’s going on within a command—what are the relationships.
ATSD(IO) wants to know what’s going on in the command and its intelligence activities.
ATSD(IO) wants to know what is going on in the command’s operations because intelligence supports operations.
ATSD(IO) wants to know what’s ongoing and what’s being executed.
ATSD(IO) wants to know what’s in the works for future execution, and what are the intelligence activities that support those operational plans.
Generally, you should start with command briefings. Ask questions similar to those shown on the slide. Find out about the classified programs that may not have the same level of visibility as routine intelligence activities.

27. IO Inspections: Suggested Methodology, cont.
Interview senior leadership and all personnel involved in intelligence activities
Examine pertinent documents and files
Hard copy files
Electronic files
Previous inspection reports and internal interviews
Training records
Product review
Records of reports and investigations under Procedure 15
Instructor Notes:
You have to talk to people; you’ve have to go down and conduct desk-side interviews if you want to discern what people know about the rules governing intelligence activities. Talk to:
Senior leadership
Intelligence supervisors
Intelligence staff personnel
Subordinate IGs
Legal advisors
You have to examine both hard and soft copies of files; it doesn’t have to be an exhaustive examination—spot checking can be effective. Every intelligence product needs an IO review regardless of source of material.
Check to see if the files have been appropriately marked and stored.
Check previous reports for any unresolved issues. Use these issues as questions while interviewing.

28. ATSD(IO) Reference CD, Checklists,
What resources does ATSD(IO) have?
Website:
Instructor Notes:
ATSD(IO) has resources to provide training and refresher information.
ATSD(IO) Reference CD, Checklists,
& Training Materials

29. Instructor Notes:

30. Review of Objectives You should now be able to:
Identify the key directives guiding intelligence oversight
Describe the components involved in intelligence activities
Identify the reporting procedures for questionable intelligence activities
Describe the IO inspection methodology
Instructor Guidance: (The numbered list is animated to display each item upon mouse click)
The key directives start with EO You can read it if you want the broadest view of the government’s intelligence community and its responsibilities. DoD Directive is the implementing policy. The main directive is R, which is the rulebook that governs intelligence activities.
In R there are certain named defense intelligence components whose heads have a little more authority than others in the community for approving certain activities. But, fundamentally, it’s any organization that is conducting intelligence or intelligence related activities because, again, the rules attach to the function, not the skill set of the people performing.
Procedure 15 set forth what must be reported along with the new guidance from the White House in the directive-type memorandum. Reporting is non-negotiable. If there is a question, it needs to be reported. Procedure 15 also requires immediate reporting rather than quarterly reporting, when necessary. That is a judgment call based on mature leadership and military assessment.
The IO inspection methodology resembles that of the IGs. The key point to understand is that a good inspection is tailored to the command’s mission. The Joint IGs—on behalf of their commanders—provide an independent assessment about intelligence activities. Their inspection methodology includes:
Understanding the operational tasking chain and ongoing activities
Interviewing decision makers, key IO personnel, and employees
Reviewing hard copy and electronic files associated with intelligence activities, training content and records, and reporting and response mechanisms

31. Four-Bullet Summation
Intelligence oversight is:
The command, control, and supervision of intelligence activities
The rules for governing the professional conduct of intelligence professionals
A program to protect privacy and civil liberties
A system of ethics and accountability
Instructor Notes:
Intelligence Oversight in four bullets; IO is:
Supervision of the intelligence activities operating under that commander or director’s responsibility
A set of rules that governs the conduct of those activities with the professionals carrying them out
A system of protection for the privacy, civil liberties, and Constitutional rights of the people of our country and those who fall into the category entitled to those rights as well
A system of ethics for fixing responsibility and holding accountable decision makers who carry out those activities on behalf of the U.S. government

32. ATSD(IO) Website Visit us on the web! http://atsdio.defense.gov
Instructor Notes:
The link above is a website at the unclassified level that folks can go to for information about what to expect during an inspection.
The website also provides a library of links to important documents that we’ve discussed today.

33. Other Ways to Contact ATSD(IO)
7200 Defense Pentagon, Washington, DC
Instructor Notes: Or

34. Questions?
Instructor Notes: