# Army Intelligence and Security Command **Entity class:** United States Army direct-reporting command **Domain:** Military intelligence / security / counterintelligence / cyber **Aliases:** INSCOM; U.S. Army Intelligence and Security Command **Headquarters:** Fort Belvoir, Virginia **Maturity:** Developed ## Definition The **United States Army Intelligence and Security Command (INSCOM)** is the largest command in the [[wiki/Army Intelligence and Security Enterprise|Army Intelligence and Security Enterprise]] and the Army's operational intelligence integrator. The Army's public profile describes approximately **18,500 soldiers, Army civilians and contractors at 180 locations in 45 countries**. Its official mission extends beyond Army support: INSCOM exercises mission command over operational intelligence and security forces, synchronizes worldwide multidiscipline and all-source operations, and delivers linguist, advanced-skills, acquisition, logistics, communications, and other specialized capabilities for Army, joint and coalition commands **“and the Intelligence Community.”** ## Why Its Scale Matters INSCOM makes visible an intelligence architecture the public often misses. Army intelligence is not confined to battlefield scouts or one Washington headquarters. Theater military-intelligence brigades, cryptologic units working with NSA, aerial ISR, counterintelligence, cyber-intelligence formations, human-intelligence support and the [[wiki/National Ground Intelligence Center|National Ground Intelligence Center]] operate across a global and domestic installation network. This makes Army intelligence a major counterterrorism system. After September 11, INSCOM deployed assets to Southwest Asia, raised force-protection posture worldwide and in the continental United States, expanded analysis, and used its Information Dominance Center to turn national and service reporting into intelligence for commanders and national law-enforcement agencies. ## Domestic Infrastructure and Authority INSCOM's U.S. presence is operationally consequential even though the command is not a general civilian police force. Its domestic bases, networks, reachback sites, watch functions, analysis, counterintelligence, cyber support, training and force-protection systems are part of the infrastructure used to detect, attribute, defend against and share terrorism-related threats. It can support civilian agencies under applicable authorities while civilian departments retain their own investigative and prosecutorial roles. In cyberterrorism, this infrastructure may be the primary operational terrain. A malicious campaign can affect domestic targets while its actor, command-and-control, financial support or exploit chain is foreign or transnational. Army/DoD networks and intelligence can therefore be indispensable to the response without converting INSCOM into civilian police. The oath to defend the Constitution against enemies foreign and domestic states the service obligation; the authority for a specific domestic collection or action comes from the Constitution, statutes, executive authorities, command status and interagency arrangements. The most concrete analogy is **plumbing**. INSCOM and adjacent Army/DoD organizations build, secure, connect and instrument pipes through which data, tasking and intelligence products move. Those pipes include computers, data centers, sensors, communications, fusion environments, machine-learning systems, analytic platforms, secure facilities, and worldwide transport networks. A maintainer can defend the pipe, observe pressure and flow, identify an anomalous route, preserve logs and deliver authorized telemetry without personally reading every item of content. In cyber counterterrorism, this infrastructure-level visibility can be more important than the organizational label attached to the analyst who ultimately evaluates the threat. “Army force” should therefore not be reduced to soldiers visibly holding weapons. Armed coercive force is one narrowly governed capability. The larger and more continuously used layer is infrastructure. When the nation confronts a catastrophic terrorist event, it can route the response through the largest authorized military and national-intelligence pipes while a civilian agency remains the public-facing and legal lead. Partner architectures such as [[wiki/Five Eyes|Five Eyes]] also create cross-border routes for collection and sharing. A claim that such a route constitutes “data laundering” requires evidence that partner tasking or exchange was used to evade a domestic legal restriction; ordinary liaison and shared collection establish the route, not the evasion. ## Cyber and Counterterrorism Convergence INSCOM's history connects intelligence, terrorism and cyber operations well before current “convergence” language. Its Land Information Warfare Activity was created in 1994 to defend Army data systems and develop offensive and defensive cyberspace capability. The official history describes terrorism, weapons proliferation and cyber war as linked post-Cold War threats. Current subordinate structures support [[wiki/Army Cyber Command|Army Cyber Command]] and national cyber missions. ## Capability Transfer [[wiki/Saturn Arch|Saturn Arch]] supplies a concrete national-to-service capability transfer. The aerial IED-detection mission moved from NGA to INSCOM and [[wiki/Task Force ODIN|Task Force ODIN]]-East in 2013–2014, showing how specialized sensors, processing and analytic methods can migrate between organizational authorities. ## Fort Huachuca Consolidation The [[wiki/Intelligence Consolidated Mission Facility|Intelligence Consolidated Mission Facility]] at [[wiki/Fort Huachuca|Fort Huachuca]] makes the infrastructure argument tangible. Before consolidation, INSCOM elements there worked from dispersed legacy buildings with inadequate 24/7 secure operational areas and insufficient Sensitive Compartmented Information workspace. The Army renovated two buildings into a 16,300-square-foot intelligence hub, dedicated on June 25, 2026 as the **Major General Gary W. Johnston Consolidated Mission Facility**. Consolidation changes what the enterprise can continuously share, analyze, protect, and act upon; it is not merely a real-estate improvement. ## Fort Bliss Aerial-Intelligence Layer INSCOM's [[wiki/116th Military Intelligence Brigade|116th Military Intelligence Brigade]] includes the [[wiki/204th Military Intelligence Battalion|204th MI Battalion]] at Fort Bliss for aerial reconnaissance, ISR, and target acquisition. The Army's first [[wiki/Virtual Aerial Systems Trainer|VAST]] classroom was placed there to support [[wiki/ATHENA Aerial ISR|ATHENA]] and [[wiki/HADES|HADES]] training. This places an operational aerial-intelligence formation inside the wider El Paso/Fort Bliss convergence node while preserving the evidentiary boundary between documented co-location and an unproven data-center workload connection. ## Relationships - **part of:** [[wiki/United States Army Intelligence|United States Army Intelligence]] and the [[wiki/Army Intelligence and Security Enterprise|Army Intelligence and Security Enterprise]]. - **reports through:** [[wiki/Deputy Chief of Staff G-2|Deputy Chief of Staff, G-2]]. - **major elements include:** [[wiki/Army Counterintelligence Command|Army Counterintelligence Command]], [[wiki/National Ground Intelligence Center|National Ground Intelligence Center]], theater intelligence brigades, aerial intelligence, cryptologic, cyber and HUMINT organizations. - **partners with:** [[wiki/National Security Agency|NSA]], [[wiki/Defense Intelligence Agency|DIA]], combatant commands, service components and law-enforcement agencies within applicable authorities. - **counterterrorism mission:** [[wiki/Counterterrorism|Counterterrorism]] and [[wiki/Counterterrorism Intelligence|Counterterrorism Intelligence]]. - **domestic interface:** [[wiki/Military Support to Civilian Counterterrorism|Military Support to Civilian Counterterrorism]]. - **capability-transfer case:** [[wiki/Saturn Arch|Saturn Arch]] and [[wiki/Task Force ODIN|Task Force ODIN]]. - **Fort Huachuca hub:** [[wiki/Intelligence Consolidated Mission Facility|Intelligence Consolidated Mission Facility]], named for [[wiki/Gary W. Johnston|Gary W. Johnston]]. - **aerial intelligence formation:** [[wiki/116th Military Intelligence Brigade|116th MI Brigade]] and [[wiki/204th Military Intelligence Battalion|204th MI Battalion]]. - **training and systems:** [[wiki/Virtual Aerial Systems Trainer|VAST]], [[wiki/ATHENA Aerial ISR|ATHENA]], and [[wiki/HADES|HADES]]. ## Sources / Provenance - [U.S. Intelligence Community Careers — Army Intelligence and Security Enterprise](https://www.intelligencecareers.gov/usa/about-usa) - [U.S. Army — INSCOM mission and history](https://www.army.mil/inscom) - [U.S. Army — Fort Huachuca dedicates intelligence facility, July 6, 2026](https://www.army.mil/article/293720/fort_huachuca_dedicates_intelligence_facility_in_honor_of_the_late_maj_gen_gary_w_johnston) - [INSCOM — Major Subordinate Commands](https://www.usainscom.army.mil/MSCs/The-470th-MI/Command/) - [U.S. Army — first VAST classroom, May 19, 2025](https://www.army.mil/article/285641/pd_sai_delivers_first_virtual_aerial_systems_trainer_classroom_to_the_army) - [[research/The Austin Executable Loop|The Austin Executable Loop]]