# Counterintelligence **Entity class:** Intelligence and security discipline **Domain:** National security / military intelligence / threat protection **Maturity:** Developed ## Definition **Counterintelligence (CI)** comprises information gathered and activities conducted to identify, deceive, exploit, disrupt or protect against espionage, hostile intelligence activity, sabotage, assassinations and related threats conducted for or on behalf of foreign powers, organizations, persons or international terrorist organizations. It combines collection, analysis, investigation, defensive security and, under specific authorities, operational activity. Counterintelligence is distinct from general criminal investigation even when the same conduct creates a crime. Its focus is the adversarial intelligence relationship: who is attempting to penetrate, recruit, steal, manipulate, surveil or sabotage; what access and infrastructure are exposed; and how the hostile network can be detected or disrupted. ## Counterterrorism and Infrastructure The Department of Defense expressly connects counterintelligence with efforts to counter espionage, international terrorism and the CI insider threat. In [[wiki/Counterterrorism|counterterrorism]], CI protects personnel, installations, weapons, research, communications, identities, sources, methods and networks from hostile discovery or exploitation. In cyber operations, the discipline overlaps with threat hunting, insider-risk analysis, attribution, deception and the defense of identity and access systems. This is another reason “Army force” cannot be reduced to armed soldiers. [[wiki/United States Army Intelligence|Army intelligence]] and [[wiki/Army Counterintelligence Command|Army Counterintelligence Command]] operate through field offices, databases, secure communications, technical collection, analytical systems, liaison channels and trained personnel. That infrastructure can protect a domestic military or national-security target and support authorized interagency work without making the Army the general civilian police. ## Relationships - **Army enterprise:** [[wiki/United States Army Intelligence|United States Army Intelligence]] and [[wiki/Army Counterintelligence Command|Army Counterintelligence Command]]. - **reserve capability:** [[wiki/Military Intelligence Readiness Command|Military Intelligence Readiness Command]]. - **related disciplines:** [[wiki/Human Intelligence|Human Intelligence]], [[wiki/Signals Intelligence|Signals Intelligence]] and [[wiki/Identity Intelligence|Identity Intelligence]]. - **mission context:** [[wiki/Counterterrorism|Counterterrorism]], [[wiki/Cybersecurity|Cybersecurity]] and insider-threat protection. - **analytic methods:** [[wiki/Link Analysis|Link Analysis]], [[wiki/Entity Resolution|Entity Resolution]] and [[wiki/Pattern-of-Life Analysis|Pattern-of-Life Analysis]]. - **adversarial performance:** [[wiki/Expression Games|Expression Games]], [[wiki/Legend (Intelligence)|Legend]], and [[wiki/Backstopping|Backstopping]]. - **training architecture:** [[wiki/Counterintelligence Special Agent Course|CISAC]], [[wiki/Counterintelligence Officer Course|CIOC]], [[wiki/Role Player (Intelligence Training)|Role Players]], and [[wiki/White Cell|White Cells]]. - **source dossier:** [[research/The Producer Function in Intelligence Tradecraft and Dramaturgy|The Producer Function in Intelligence Tradecraft and Dramaturgy]]. ## Sources / Provenance - [Department of Defense Directive 5240.02 — Counterintelligence](https://www.esd.whs.mil/Portals/54/Documents/DD/issuances/dodd/524002p.pdf) - [Department of Defense Instruction 5240.26 — Countering Espionage, International Terrorism, and the Counterintelligence Insider Threat](https://www.esd.whs.mil/Portals/54/Documents/DD/issuances/dodi/524026p.pdf)