26 March 1996




This instruction assigns responsibilities for establishing North American Aerospace Defense Command (NORAD) and United States Space Command (USSPACECOM) counterintelligence (CI) requirements. It describes coordination with US and Canadian CI organizations to support those requirements, and it addresses processes for coordinating CI issues with NORAD/USSPACECOM headquarters elements. It outlines principles for command relationships and support requirements between HQ NORAD/HQ USSPACECOM and the CI organizations of the military departments. This instruction applies to HQ NORAD and HQ USSPACECOM and its components. It does not apply to US Air Force Reserve nor Air National Guard units.

1. References:

1.1. Executive Order 12333, United States Intelligence Activities.

1.2. DoD Directive 5240.2, DoD Counterintelligence.

1.3. DoD Instruction 5240.10, DoD Counterintelligence Support to Unified and Specified Commands.

1.4. DoD Directive 5100.3, Support to the Headquarters of Unified, Specified, and Subordinate Joint Commands.

1.5. Joint Pub 2-01.2, Joint Doctrine, Tactics, Techniques, and Procedures for CI Support to Operations.

1.6. MCC100-34, Canada-United States Basic Security Plan.

2. Terms Explained:

2.1. Counterintelligence (CI). Information gathered and activities conducted to protect against espionage, other intelligence activities, sabotage, or assassinations conducted by or on behalf of foreign governments or elements thereof, foreign organizations, or foreign persons, or international terrorist activities. CI encompasses collection, production, operations, and investigations and excludes the preventative security countermeasures (personnel, physical, document, and communications security), operations security, and counter-imagery programs.

2.2. Counterintelligence Collection. The systematic acquisition of information on espionage, sabotage, terrorism, and related hostile intelligence activity conducted for, or on behalf of, foreign powers, organizations, or persons, that are directed against or threaten national security interests. The primary purpose of CI collection is to detect these activities and to support investigative operations designed to deter, neutralize, or exploit them.

2.2.1. CI collectors focus on foreign intelligence services and their organization, methods of operation, personnel, activities, communications, funding, and support. The transfer of militarily critical technologies, international terrorism, and identifying threats to the security of DoD and HQ NORAD/HQ USSPACECOM resources are key matters of interest.

2.3. Counterintelligence Production. The process of collating, evaluating, interpreting, and analyzing information of counterintelligence significance and publishing studies, assessments, estimates, and reports.

2.3.1. The US Defense Intelligence Agency (DIA) annually solicits CI production topics from unified Commands. HQ NORAD/HQ USSPACECOM's response to this annual call is one means to obtain finished studies, estimates, and analyses that are responsive to CI requirements. US military counterintelligence organizations also solicit production proposals from the component commands and military departments. Since a limited DoD CI production capacity serves a large number of customers, it is essential that requirements be carefully selected, thoroughly staffed, and forcefully articulated to reflect HQ NORAD/HQ USSPACECOM's priorities.

2.4. Counterintelligence Investigations. CI Investigations seek to neutralize activities cited in paragraph 2.1, apprehend perpetrators, and satisfy requirements for prosecution, or establish groundwork for CI operations. Indications or evidence that a member or employee of HQ NORAD/HQ USSPACECOM or one of its component commands is, or may be, engaged in these activities must be referred to the appropriate investigative organization using the guidelines set forth in paragraph 5.3.5.

2.5. Counterintelligence Operations. Actions taken against foreign intelligence services to counter espionage and other clandestine intelligence activities which are inimical to national security. CI operations are executed to identify and exploit hostile agents, neutralize foreign intelligence operations, uncover espionage penetrations, and identify foreign intelligence service targeting of personnel, operations, and resources.

2.5.1. Counterintelligence operations are coordinated at the national level. Within the US, the cognizant military CI organization coordinates operational activity with the US Federal Bureau of Investigation. Operations involving Canadian interests are coordinated with the Canadian Security Intelligence Service (CSIS) or the Canadian Forces Special Investigations Unit (SIU), as appropriate. Military CI operations involving OCONUS aspects are coordinated with the US Central Intelligence Agency.

2.6. Counterintelligence Point of Contact (CI-POC). An officer assigned to the headquarters of a component command and appointed by the commander to serve as the command focal point for the command's CI support requirements and intra-command CI activities,

2.7. Counterintelligence Support Officer (CISO). A military member in the rank of 04 or above, or a civilian equivalent, who is serving or has served in the Air Force Office of Special Investigations (AFOSI), or the Naval Investigative Service Command (NISCOM),or is a senior US Army or Marine Corps CI officer, or civilian, with the respective military department specialty designator 35E or 0210, or civilian equivalent, and is experienced in CI investigations, operations, collection and production, who functions as the command CI coordinating authority. The Unified CISO is the US focal point for CI support. CI activities will be coordinated as required, and as appropriate, between Canadian and US commanders.

3. General. HQNORAD and HQ USSPACECOM receive counterintelligence (CI) support from the DIA, Director of General Intelligence, and the CI organizations of the military departments, hereafter referred to as the CIO's. DIA provides CI analysis and production support. The CIO's provide collection, production, operations, and investigations support on a worldwide basis; the CIO's also provide awareness training. The Commander-in-Chief NORAD (CINCNORAD)/ Commander-in-Chief USSPACECOM (USCINCSPACE) establishes the priorities for CI activities and operations relevant to the command. The USSPACECOM CISO integrates the CINC's CI priorities into operational planning through the J2. The CISO's responsibilities include coordinating CI issues with the CIO's and advising the command on CI matters through all levels of conflict. The CISO coordinates with US and Canadian CI organizations, component command CI points of contact, and CISO's of other unified commands to support CINCNORAD/USCINCSPACE CI requirements.

4. Objectives and Goals. The objective of this instruction is to establish the structure to identify and implement HQ NORAD/ HQ USSPACECOM CI requirements and outline the processes for coordinating with and tasking component CI organizations. The goal of this effort is to identify, counter, or neutralize threats from foreign intelligence services or terrorists to the personnel, operations, or resources of HQ NORAD/HQ USSPACECOM and components.

5. Responsibilities:

5.1. CINCNORAD/USCINCSPACE. Establishes the Command's CI requirements and CI priorities.

5.2. Commanders and Component Commands:

5.2.1. Appoint a command counterintelligence point of contact (CI-POC) to serve as the focal point for inter- and intra-command CI activities and training.

5.2.2. Submit their CI requirements to the CIO's for the following types of support: collections, investigations, operations, and training, and coordinate these requirements with the CISO.


5.3.1. Provides expertise to CINCNORAD/USCINCSPACE and the staff on CI collection, production, investigative and operational capabilities.

5.3.2. Informs CINCNORAD/USCINCSPACE and the staff on significant CI activities in HQ NORAD/HQ USSPACECOM's area of operation and functional areas of responsibility. Ensures that HQ/NORAD and HQ/USSPACECOM are provided timely and credible warning of CI derived security threats to NORAD/USSPACECOM interests.

5.3.3. Provides staff support on CI and CI-related matters: Presents periodic briefings to CINCNORAD/USSPACECOM on relevant investigations, operations, collection activities, and production efforts. Incorporates CI considerations into all planning documents prepared or reviewed within the command. The CISO is responsible for Appendix 3 to Annex B of CICNNORAD/USCINCSPACE CONPLAN's and OPLAN's. Develops and refines procedures to obtain wartime and low intensity conflict CI support for space assets located in areas where CI organizations come under the OPCON of theater unified commanders. Coordinates the personal security of CINCNORAD/USCINCSPACE during travel to locations where there is a potential threat of personal attack. Staffs the annual submission of CI production requirements to DIA and ensure they adequately reflect HQ NORAD/HQ USSPACECOM priorities. Initiates and manages a CI Awareness and Briefing Program at HQ NORAD and HQ USSPACECOM, monitors component command programs, and provides information to support training efforts.. The program will, at a minimum, train all personnel on the threat from foreign intelligence activities and brief personnel on the requirement to report requests for information by unauthorized persons. These requests may indicate attempts by foreign intelligence services or terrorists organizations to recruit sources of information, to obtain or gain access to controlled key technologies, or to carry out other activities detrimental to the accomplishment of HQ NORAD/HQ USSPACECOM missions. Establishes within HQ NORAD/HQ USSPACECOM a repository for current CI studies, estimates, and analyses produced by the CIA, FBI, DIA and the CIO's on topics of interest to HQ NORAD/HQ USSPACECOM.

5.3.4. Coordinates with the CIO's to ensure they are informed of HQ NORAD/HQ USSPACECOM CI requirements and priorities.

5.3.5. Refers CI matters for investigation involving: Military personnel assigned to HQ NORAD and HQ USSPACECOM or the regions or component commands to the appropriate US or Canadian CI agency for investigation and disposition. Civilian personnel employed by HQ NORAD and HQ USSPACECOM, or the component commands in the United States, to the FBI or the appropriate Canadian investigative agency; when overseas, to the military department responsible for providing administrative and logistical support.

5.3.6. Establishes and maintains liaison with headquarters officials of the CIO's, DIA, CIA, FBI, and the CISO's of other unified and specified commands in whose area of responsibility NORAD/USSPACECOM assets are located. Requests CI support and information from the appropriate agencies.

5.3.7. Initiates reporting through the chain of command when procedural anomalies or failures relating to CI support occur.

5.3.8. Participates in JCS, combined, and component command CI forums and CI exercises.

5.4. Component Command CI points of Contact (POC):

5.4.1. Act as the focal point for their command's CI support requirements and intra-command CI activities.

5.4.2. Respond to CISO requests for information.

5.4.3. Coordinate with the CIO element responsible for local CI support to the component command headquarters.

5.4.4. Manage the component CI awareness program. Training programs will be established from the headquarters to the individual unit level.

6. Procedures:

6.1. Command Relationships. Command relationships are determined by the situation. During crises, the provisions of appropriate war or contingency plans will be applied. The general principles for command relationships and support requirements between CIO's and HQ NORAD/HQ USSPACECOM throughout the spectrum of peace and conflict are described in the following paragraphs.

6.1.1. Peace.During peacetime, contingencies for which there are no plans, and operations other than war where there is no CJCS-approved plan under execution which provides for OPCON of CI elements, CI organizations and activities remain under OPCON of their military department and organizational headquarters. Under these circumstances, HQ NORAD/HQ USSPACECOM CI requirements are sent directly to the appropriate component CIO.

6.1.2. Exercises.During exercises, CI units that are deployed or detailed to participate in scenario play within a unified command's area of operations (AO) fall under the OPCON and tactical tasking authority of that unified command. CI units providing non-scenario, real-world collection, operations, and investigative coverage retain normal peacetime command relationships. Peacetime channels for requesting CI support will be used.

6.1.3. Operations Other Than War (OOTW).When executing an approved plan that provides for OPCON of CI elements in OOTW, the commanders of unified commands assume OPCON of CI elements through their component commands. Requests for CI support from CI assets in the AO during OOTW must be made through the appropriate unified command.

6.1.4. War.During times of war, declared hostilities, or execution of approved plans, CI organizations in the affected theaters come under the OPCON of the theater unified commanders through their respective component commanders in accordance with the provisions of the operations, contingency, or special purpose plan under execution. Similarly, specified commands exercise OPCON over CI assets which support service elements assigned for operations in accordance with the provisions of the plan under execution. Requests for CI support to or from CI assets in the AO during war must be made through the appropriate unified command.

Director of Intelligence