Department of Defense

INSTRUCTION

NUMBER 5240.18
November 17, 2009
Incorporating Change 1, Effective October 15, 2013

USD(I)

SUBJECT: Counterintelligence (CI) Analysis and Production

References: See Enclosure 1

1. PURPOSE. This Instruction:

a. Reissues and updates DoD Instruction (DoDI) 5240.18 (Reference (a)), in accordance
with the authority in DoD Directive (DoDD) 5143.01 (Reference (b)).

b. Establishes policy, assigns responsibilities, and prescribes procedures for the function of
CI analysis and production as prescribed in DoDD O-5240.02 (Reference (c)).

c. Modifies leadership of the DoD CI Analysis and Production Council (CIAPC).

2. APPLICABILITY. This Instruction applies to OSD, the Military Departments, the Office of
the Chairman of the Joint Chiefs of Staff and the Joint Staff, the Combatant Commands, the
Office of the Inspector General of the Department of Defense, the Defense Agencies, the DoD
Field Activities, and all other organizational entities within the Department of Defense (hereafter
referred to collectively as the “DoD Components”).

3. DEFINITIONS. See Glossary.

4. POLICY. It is DoD policy that:

a. The Defense CI Components shall produce analytic products to address the threat posed
by espionage, international terrorism, subversion, sabotage, assassination, and covert activities.
This includes other activities that have a foreign intelligence entity (FIE) nexus. DoD CI
analysis and production supports:
 DoDI 5240.18, November 17, 2009

(1) Strategic goals and priorities established by the Secretary of Defense and Director of
National Intelligence (DNI). CI analysis enhances understanding of the intentions of an FIE, a
foreign security service, an international terrorist entity, or other foreign actors and provides
indications of their limitations, plans, and warning intentions.

(2) CI collection, investigations, operations, and functional services. This includes, but
is not limited to, analysis for offensive CI operations, investigative lead development, threats to
personnel and property, threats to the security of DoD forces and operations, and foreign
intelligence collection against DoD technology, information systems, and infrastructure.

b. CI analysis and production activities shall conform to DoD 5240.1-R (Reference (d)).

5. RESPONSIBILITIES. See Enclosure 2.

6. PROCEDURES. See Enclosure 3.

7. RELEASABILITY. UNLIMITED. This Instruction is approved for public release and is

available on the Internet from the DoD Issuances Web Site at http://www.dtic.mil/whs/directives.

8. EFFECTIVE DATE. This Instruction is effective immediately. This instruction:

a. Is effective November 17, 2009.

b. Must be reissued, cancelled, or certified current within 5 years of its publication to be

considered current in accordance with DoD Instruction 5025.01 (Reference (s)).

c. Will expire effective November 17, 2019 and be removed from the DoD Issuances Website
if it hasn’t been reissued or cancelled in accordance with Reference (s).

Enclosures
1. References
2. Responsibilities
3. Procedures
Glossary

Change 1, 10/15/2013 2
 DoDI 5240.18, November 17, 2009

TABLE OF CONTENTS

REFERENCES ................................................................................................................................4

RESPONSIBILITIES ......................................................................................................................5

UNDER SECRETARY OF DEFENSE FOR INTELLIGENCE (USD(I)) ...............................5

DEPUTY UNDER SECRETARY OF DEFENSE FOR HUMAN INTELLIGENCE
(HUMINT), CI, AND SECURITY (DUSD(HCI&S)) ..........................................................5
DIRECTOR, DEFENSE INTELLIGENCE AGENCY (DIA) ..................................................5
DIRECTOR, DEFENSE CI AND HUMINT CENTER (DCHC) .............................................5
DIRECTOR, DEFENSE SECURITY SERVICE (DSS) ...........................................................7
HEADS OF DoD COMPONENTS WITH ORGANIC CI........................................................7
HEADS OF DoD COMPONENTS WITHOUT ORGANIC CI ...............................................8

PROCEDURES................................................................................................................................9

DoD CIAPC CHARTER .........................................................................................................12

CI ANALYSIS AND PRODUCTION CATEGORIES ..........................................................14

GLOSSARY ..................................................................................................................................18

ABBREVIATIONS AND ACRONYMS ................................................................................18

DEFINITIONS .........................................................................................................................18

Change 1, 10/15/2013 3 CONTENTS

 DoDI 5240.18, November 17, 2009

ENCLOSURE 1

REFERENCES

(a) DoD Instruction 5240.18, “Counterintelligence Analysis and Production,”

December 4, 2006 (hereby canceled)
(b) DoD Directive 5143.01, “Under Secretary of Defense for Intelligence (USD(I)),”
November 23, 2005
(c) DoD Directive O-5240.02, “Counterintelligence,” December 20, 2007
(d) DoD 5240.1-R, “Procedures Governing the Activities of DoD Intelligence Components
That Affect United States Persons,” December 7, 1982
(e) DoD Directive 5105.21, “Defense Intelligence Agency (DIA),” March 18, 2008
(f) DoD Instruction 5240.10, “Counterintelligence Support to Combatant Commands and
Defense Agencies,” May 14, 2004
(g) Intelligence Community Directive 501, “Discovery and Dissemination or Retrieval of
Information within the Intelligence Community,” January 21, 2009
(h) Intelligence Community Directive 203, “Analytic Standards,” June 21, 2007
(i) Intelligence Community Directive 206, “Sourcing Requirements for Disseminated Analytic
Products,” October 17, 2007
(j) Intelligence Community Directive 205, “Analytical Outreach,” July 16, 2008
(k) Section 485 of title 6, United States Code
(l) Defense Human Intelligence Executor – Manual 3301.001, “Defense Intelligence Agency
(DIA) Human Intelligence (HUMINT) Manual, Volume 1: Collection Requirements,
Reporting and Evaluation Procedures (U),” January 30, 2009 1
(m) National Intelligence Priorities Framework, Current Edition 2
(n) The National Threat Identification and Prioritization Assessment, May 2006 3
(o) DoD Instruction 5240.16, “DoD Counterintelligence Functional Services,” May 21, 2005
(p) Executive Order 12333, “United States Intelligence Activities,” as amended
(q) DoD Instruction O-5240.21, “Counterintelligence Inquiries,” May 14, 2009
(r) Joint Publication 1-02, “Department of Defense Dictionary of Military and Associated
Terms,” as amended
(s) DoD Instruction 5025.01, “DoD Directives Program,” September 26, 2012, as amended

1
This is a classified document. Authorized users may obtain a copy by contacting the Defense Intelligence Agency.
2
This is a classified document. Authorized users may obtain a copy by contacting the Office of the Director of
National Intelligence.
3
This is a classified document. Authorized users may obtain a copy by contacting the Office of the Director of
National Intelligence.

Change 1, 10/15/2013 4 ENCLOSURE 1

 DoDI 5240.18, November 17, 2009

ENCLOSURE 2

RESPONSIBILITIES

1. UNDER SECRETARY OF DEFENSE FOR INTELLIGENCE (USD(I)). The USD(I) shall:

a. Serve as the OSD Principal Staff Assistant and advisor to the Secretary of Defense
regarding CI analysis and production.

b. Authorize exceptions to this Instruction.

2. DEPUTY UNDER SECRETARY OF DEFENSE FOR HUMAN INTELLIGENCE

(HUMINT), CI, AND SECURITY (DUSD(HCI&S)). The DUSD(HCI&S), under the authority,
direction, and control of the USD(I), and in support of CI analysis and production, shall:

a. Serve as the advisor to the USD(I).

b. Oversee the development and management of CI analysis and production.

c. Develop and recommend policy to the USD(I).

d. Provide policy oversight.

e. Serve as the staff point-of-contact and represent the USD(I) during intelligence
community (IC) analysis and production forums.

3. DIRECTOR, DEFENSE INTELLIGENCE AGENCY (DIA). The Director, DIA, under the
authority, direction, and control of the USD(I), and in addition to the responsibilities in section 6
5 of this enclosure, shall:

a. Oversee DoD CI analysis and production.

b. Develop and conduct CI analysis and production training, education, and establish
certification standards. Evaluate external analytical courses and material for applicability to
DoD CI analysis and production.

4. DIRECTOR, DEFENSE CI AND HUMINT CENTER (DCHC). The Director, DCHC, under
the authority, direction, and control of the Director, DIA, shall:

ac. Conduct CI analysis and production activities to support the CI requirements of the DoD
Components, the DNI and, as appropriate, other U.S. Government departments and agencies.
Provide the Defense CI contribution to national products in accordance with Reference (c) and
DoDD 5105.21 (Reference (e)).

Change 1, 10/15/2013 5 ENCLOSURE 2

 DoDI 5240.18, November 17, 2009

bd. Research, develop, test, and deploy technologies and analytical tools that aid CI analysis,
production, collaboration, and information sharing.

ce. Represent the DoD CI analysis and production community at DoD and national analysis
and production councils, committees, and working groups.

df. Provide analytical support to the DoD strategic CI campaigns.

eg. Manage, provide fiscal guidance, and coordinate the activities of the Defense CI
Component analysis and production elements.

fh. Chair the CIAPC.

gi. Validate DoD CI analysis and production requirements. Coordinate and deconflict
requirements with the appropriate Defense CI Component analysis and production element.

hj. Establish and disseminate, in coordination with the DoD CI Collection Manager,
appropriate collection requirements for information and intelligence gaps identified in CI
analytic production.

ik. Establish common processes, procedures, and doctrine to implement applicable DNI
policies and appropriately incorporate National Intelligence Council guidance.

jl. Monitor CI analytical products for quality control, customer satisfaction, and analytic
integrity. Provide feedback and guidance to the CI analysis and production elements.

km. Coordinate DoD CI analysis and production requirements with appropriate Federal,
State, local, or tribal agencies in accordance with Reference (b), and serve as the entry portal and
validation authority for requirements received from non-DoD elements.

ln. Integrate CI analysis and production requirements into the Defense Intelligence Analysis
Program (DIAP).

mo. Establish joint production requirements for CI analytical products that are substantially
similar or recurring, designate a production lead, and task appropriate producers to provide input
into the product.

np. Establish performance measures and evaluate implementation by the Defense CI

Component analysis and production elements.

o. Develop, evaluate, and make recommendations regarding DoD CI analysis and production
policy and guidance to the Director, DCHC.

Change 1, 10/15/2013 6 ENCLOSURE 2

 DoDI 5240.18, November 17, 2009

54. DIRECTOR, DEFENSE SECURITY SERVICE (DSS). The Director, DSS, under the
authority, direction, and control of the USD(I) and in addition to the responsibilities in section 6
5 of this enclosure, shall:

a. When appropriate, provide CI analytical support to and produce CI analytical products for
cleared defense contractors (CDC). Support includes:

(1) The secure exchange of intelligence and CI threat awareness information,

intelligence, and CI analytical products.

(2) Analytic products that describe or illustrate the FIE or terrorist threats to a CDC.

b. Serve as the CDC sector advocate for CI analysis support. Notify the Director, DCHC
DIA, of gaps and requirements for CI analytical support.

65. HEADS OF DoD COMPONENTS WITH ORGANIC CI. The Heads of DoD Components
with organic CI, and within their authorities, shall:

a. Manage and oversee Component CI analysis and production activities.

b. Validate Component CI analysis and production requirements.

c. Identify analysis and production requirements to the Director, DCHC DIA.

d. Evaluate Component products and provide feedback to the generating production element,
as requested.

e. Participate in the CIAPC.

f. Respond to joint analysis and production requirements when established by the Director,
DCHC DIA.

g. Integrate CI analysis and production into planning and mission execution.

h. Provide analytical support to CI inquiries, investigations, operations, and functional

services.

i. Train and certify CI analysts in accordance with the standards established by the Director,
DIA.

j. Implement CI analysis and production performance measures established by the Director,

DCHC DIA.

Change 1, 10/15/2013 7 ENCLOSURE 2

 DoDI 5240.18, November 17, 2009

k. Provide CI analytical support to supported DoD Components that do not have organic CI,
if their Defense CI Component is designated as a CI Lead Agency in accordance with DoDI
5240.10 (Reference (f)).

76. HEADS OF DoD COMPONENTS WITHOUT ORGANIC CI. The Heads of DoD
Components without organic CI shall:

a. Provide CI analysis and production requirements to the Defense CI Component that is

designated as CI Lead Agency in accordance with Reference (f).

b. Integrate CI analysis and production into planning and mission execution.

c. Provide feedback on analytical products to the generating production element.

Change 1, 10/15/2013 8 ENCLOSURE 2

 DoDI 5240.18, November 17, 2009

ENCLOSURE 3

PROCEDURES

1. DoD CI analysis and production elements shall produce and disseminate products in response
to requirements generated by policy makers, military commanders, the Defense CI Components,
other DoD customers, and the IC. Although these requirements are the primary driver for CI
analysis and production, the process shall allow for innovative and creative initiatives by
individual CI analysts or the CI analysis and production elements.

2. CI analytical products, unless otherwise exempted by Intelligence Community Directive

(ICD) 501 (Reference (g)) shall be included in the Library of National Intelligence. The
producing Defense CI Component provides the product to the Director, DCHC DIA, for
inclusion into the library. All CI analytical products are subject to quality-of-analysis evaluation
and peer review under procedures established by the Director, DCHC DIA.

3. CI analytical products shall be written in a manner that maintains the integrity and security of
sources and methods while providing for the widest possible dissemination and retrieval
consistent with Reference (e). Products intended for release to foreign governments shall be
coordinated in accordance with applicable DoD policies, and consistent with DNI policies, for
disclosure of classified information and controlled unclassified information.

4. CI analytical products shall adhere to standards in a manner appropriate to the length,

purpose, classification, and production timeframe of each product consistent with ICD 203
(Reference (h)) and contain appropriate source references consistent with ICD 206 (Reference
(i)).

5. Defense CI Components shall coordinate with experts beyond the IC to support and enrich
analysis consistent with ICD 205 (Reference (j)).

6. CI analysis and production fuses all-source intelligence into products and analysis to the
maximum extent consistent with applicable law under section 485 of title 6, United States Code
(Reference (k)).

7. CI analysts evaluate Intelligence Information Reports (IIRs) according to Defense Human

Executor – Manual 3301.001 (Reference (l)).

Change 1, 10/15/2013 9 ENCLOSURE 3

 DoDI 5240.18, November 17, 2009

8. Collaboration and coordination of CI production requirements within the CI analysis and

production enterprise and with the IC shall be conducted to the maximum extent possible.

9. CI analysts supporting the Campaigns shall have access to information required to formulate
targeting, provide trends analysis, and be able to share information across the IC, as appropriate.

10. Defense CI Components shall use the CI-approved electronic archiving system to validate,
task, and disseminate production requirements for CI analysis. The approved system is the
primary method to communicate analysis and production requirements within the DoD CI
enterprise. Defense CI Components without access to the approved system may use the
Community On-Line Intelligence System for End-Users and Managers (COLISEUM).

11. DoD Components external to the Defense CI enterprise shall transmit production
requirements to the Defense CI Component’s analysis and production element by the most
expedient method. Production requirements not transmitted via an electronic archiving system
(COLISEUM) shall be in writing and be entered into the appropriate electronic archiving system
at the echelon received.

12. Non-DoD agencies shall provide production requirements in writing. The receiving Defense
CI Component validates the information and enters it into the appropriate electronic archiving
system in accordance with subparagraph 4.k. of Enclosure 2.

13. When Combatant Command production requirements exceed organic CI analysis and
production capabilities, the Combatant Command shall forward the requirements to the Director,
DCHC DIA, for validation and tasking. Combatant Commands without access to the approved
DoD CI system may forward the requirements via COLISEUM or in writing.

14. The Director, DCHC DIA, routes requirements for DIA combating terrorism analysis and
production through COLISEUM to the Joint Defense Intelligence Task Force-Combating
Terrorism (JDITF-CT). The Director, DCHC DIA, shall coordinate with the JDITF-CT
production manager on requirements, database compatibility, and guidance to the DoD
Components.

15. Organization home pages shall make CI analytical products available on Intelink and
Intelink-S using IC Metadata and Metadata Markup Standards. Digital notification of product
availability or other means may aid additional dissemination of products.

Change 1, 10/15/2013 10 ENCLOSURE 3

 DoDI 5240.18, November 17, 2009

16. Customer evaluations are vital to the success of CI analysis and production. The Director,
DCHC DIA, and DoD Component CI analysis and production elements shall establish processes
to provide feedback to the producing Defense CI Components. The Director, DCHC DIA, shall
establish criteria for formal evaluations.

17. Defense CI Component analysis and production elements unable to satisfy production
requirements shall notify the customer and the Director, DCHC DIA.

18. To reduce duplication of analytic efforts and as recognition of Component expertise,

Defense CI Component analysis and production elements may use existing relevant and
appropriate analytical products from other Components. The Defense CI Component analysis
and production element shall validate the product as current and supplement the product with
updated information as necessary.

Change 1, 10/15/2013 11 ENCLOSURE 3

 DoDI 5240.18, November 17, 2009

APPENDIX 1 TO ENCLOSURE 3

DoD CIAPC CHARTER

1. PURPOSE. The DoD CIAPC is the principal forum for coordinating CI analysis and
production requirements, discussing CI analysis and production priorities within the enterprise,
and discussing other IC issues.

2. MEMBERSHIP. The Director, DCHC DIA, appoints the Chair. Core membership includes
the analysis and production enterprise manager and the managers of the Defense CI Component
analysis and production elements. The Chair may expand membership, to include other full-time
or permanent part-time Federal employees.

3. MEETINGS. The CIAPC convenes at least quarterly to discuss community-wide issues. At

the discretion of the Chair, it may meet by video teleconference or other electronic media. The
Chair sets the agenda with input provided by the members.

4. ACTIVITIES. The CIAPC shall:

a. Seek to identify and reduce redundant CI production.

(1) Members report on recently completed production, production in progress, and

projected production.

(2) Members discuss requirements received from the Services, the Combatant
Commands, and the Defense Agencies to determine which production elements are best able to
satisfy different requirements.

(3) The CIAPC shall consider and recommend requirements that necessitate production
by multiple CIAPC members or external agencies.

b. Determine CI analysis and production priorities within the CI production community in

accordance with national and DoD strategies, the National Intelligence Priorities Framework
(Reference (m)), the Office of the National CI Executive National Threat Identification and
Prioritization Assessment (Reference (n)), and DoD Component requirements.

c. Establish procedures for ensuring appropriate coordination of production affecting the

equities of two or more member organizations.

d. Identify emerging trends affecting production and dissemination. These include:

(1) Electronic dissemination to analysts, policymakers, and field consumers.

Change 1, 10/15/2013 12 APPENDIX 1 TO ENCLOSURE 3

 DoDI 5240.18, November 17, 2009

(2) Improvements to business processes.

(3) Strategic initiatives by CI policymakers that affect CI production.

e. Discuss CI analysis and production management issues to include performance measures,

resources, enabling technologies, and training standards and requirements.

f. Serve as the principal advisory committee to the Director, DCHC DIA. The CIAPC shall
advise on CI analysis and production community-wide issues, identify gaps or issues with
current policy requirements, and provide a “sense of the community” statement to the Director,
DCHC DIA.

g. Promote information sharing and collaboration throughout the DoD CI analysis and
production enterprise.

Change 1, 10/15/2013 13 APPENDIX 1 TO ENCLOSURE 3

 DoDI 5240.18, November 17, 2009

APPENDIX 2 TO ENCLOSURE 3

CI ANALYSIS AND PRODUCTION CATEGORIES

1. GENERAL

a. Objectives of CI analytical products are to:

(1) Outline, describe, or illustrate the threat posed by an FIE to installations, personnel,
assets, operations, or resources.

(2) Identify opportunities to conduct offensive CI operations (OFCO) targeting a FIE.

(3) Identify CI investigative opportunities.

b. In the case of subparagraph 1.a.(1) of this appendix, the CI analytical product should
detail current targeting as well as the potential for future targeting and/or foreign action against
DoD assets. The product should identify the adversary’s methods of operation, capabilities,
history, and intent. The product helps the customer factor the probability of targeting and
collection into their risk mitigation strategy and implement appropriate countermeasures.

c. In the case of subparagraph 1.a.(3) of this appendix, CI analysis may identify patterns,
trends, or other anomalies that would indicate a CI inquiry or a CI investigation is warranted.
For instance, analysis of security and computer network incidents may develop information to
identify an insider threat.

d. CI analytical products seek to satisfy a core CI production requirement to identify people,

organizations, locations, activities, and resources associated with a FIE or a target of a FIE.

2. PURPOSE

a. CI analytical products are categorized based on the purpose of the product, analytical
effort, the production timeline, and other distinguishing characteristics. The characteristics for
each are detailed in this appendix, with definitions contained in the Glossary. The categories of
CI analytical products are:

(1) Assessment.

(2) Analysis report.

(3) Threat advisory.

(4) Functional support.

Change 1, 10/15/2013 14 APPENDIX 2 TO ENCLOSURE 3

 DoDI 5240.18, November 17, 2009

b. Categories of CI analysis and production allow the CI analysis and production elements to
structure production within the DoD Component. Consistency is achieved in both product and
presentation to decision makers, customers, and personnel performing CI duties.

c. DNI policies prescribe standards for intelligence-related production across the IC. CI
analytical products shall adhere to DNI standards, unless otherwise specified.

d. A CI analytical product shall avoid using the word “counterintelligence” in the title line of
the product (e.g., Counterintelligence Threat Assessment). CI analysis is conducted to assess
threats to the Department of Defense or in support of DoD HUMINT activities. The product title
shall accurately depict the content of the product (e.g., International Terrorist Threat to the U.S.
Army, or Foreign Intelligence Service Threat to Operation Golden Dragon (notional)).

3. ASSESSMENT

a. An assessment requires in-depth study and research. The production time-line ranges
from weeks to months. An assessment:

(1) Expresses analytical judgments and the degree of confidence in those judgments.

(2) Identifies underlying assumptions.

(3) Incorporates all-source information.

(4) Identifies gaps in information or intelligence that, if known, would contribute to the
usefulness of the product.

(5) Is organized in a format consistent with guidance issued by the DNI or Director,
DCHC DIA.

(6) Discusses the potential outlook.

(7) Was coordinated with at least one other member of the CI analysis and production
enterprise or the IC.

b. Products containing the elements specified in subparagraphs 3.a.(1) through (7) of this
appendix shall be disclosed to the Director, DCHC DIA.

4. ANALYSIS REPORT

a. An analysis report may require in-depth study and research, but generally is not as
involved as an assessment. An analysis report:

(1) Expresses analytical judgments and the degree of confidence in those judgments.

Change 1, 10/15/2013 15 APPENDIX 2 TO ENCLOSURE 3

 DoDI 5240.18, November 17, 2009

(2) Incorporates all-source information.

(3) Is organized in a format consistent with guidance issued by the Director, DCHC DIA.

(4) Discusses the potential outlook.

(5) Identifies gaps in information or intelligence that, if known, would contribute to the
usefulness of the product.

b. Products containing the elements specified in subparagraphs 4.a.(1) through (5) of this
appendix shall be disclosed to the Director, DCHC DIA.

5. THREAT ADVISORY

a. A threat advisory is distinguishable from assessments and analysis reports in that it is

prepared when there is an imminent or near-term intelligence or terrorist threat. A threat
advisory often contains perishable information with only limited study or research conducted
prior to publication.

b. Threat advisories shall be disclosed to the Director, DCHC DIA.

6. FUNCTIONAL SUPPORT

a. A functional support product supports the specific needs of a Defense CI Component. A

functional support product is related to the CI functions of collection, investigation, OFCO, and
functional services as described in DoDI 5240.16 (Reference (o)). The depth and
comprehensiveness varies depending on the requestor’s requirements. An investment in
analytical effort may be significant. The production timeline ranges from hours to weeks, but
can vary widely depending on the function the analysis supports.

b. The Director, DCHC DIA, in conjunction with the Defense CI Component, shall establish
a coordinated and secure procedure to review and evaluate products in this category for quality
of analysis and compliance with DNI policy.

c. CI analytical products that support the CI functions are defined in the Glossary. Products
in this category may take the form of an assessment, analysis report, or threat advisory. The
Defense CI Components shall disclose products produced in this category to the Director, DCHC
DIA, aligning the product to the supported function, and when appropriate to the applicable
analytical category.

Change 1, 10/15/2013 16 APPENDIX 2 TO ENCLOSURE 3

 DoDI 5240.18, November 17, 2009

7. OTHER CI ANALYSIS AND PRODUCTION SUPPORT

a. The CI analysis and production elements may receive requests for information, assistance,
or products that do not contain the characteristics associated with any of the categories. The
research and analytical effort is minimal; therefore, the timeline for a product can range from a
day to several weeks. Characteristics that distinguish efforts in this area from the other
categories are:

(1) Requests for information and background or white papers.

(2) Executive correspondence tailored to meet the specific needs of a senior decision
maker.

(3) Requests for analysts to conduct name checks, construct briefings, provide inserts
into briefings, or present a briefing.

(4) Input into another agency’s product, but the input is not the result of a joint
production requirement or in coordination with another CI analysis and production element.

(5) The CI analysis and production element is requested to peer review a product
produced by a Defense Intelligence Component or another DoD CI analysis and production
element.

b. The CI analysis and production elements shall report activity conducted to one of the five
types of activity; request for information, executive correspondence, analysis support, analytic
coordination, or peer review. Activity conducted under this category shall be disclosed to the
Director, DCHC DIA.

8. MODIFICATIONS. The Director, DCHC DIA in coordination with CIAPC members, may
modify any of the product categories described in this appendix. The Director, CI, under the
DUSD(HCI&S), approves permanent modifications.

Change 1, 10/15/2013 17 APPENDIX 2 TO ENCLOSURE 3

 DoDI 5240.18, November 17, 2009

GLOSSARY

PART I. ABBREVIATIONS AND ACRONYMS

CDC cleared defense contractor

CI counterintelligence
CIAPC CI Analysis and Production Council
COLISEUM Community On-Line Intelligence System for End-Users and Managers

DCHC Defense CI and HUMINT Center

DIA Defense Intelligence Agency
DIAP Defense Intelligence Analysis Program
DoDD DoD Directive
DoDI DoD Instruction
DNI Director of National Intelligence
DSS Defense Security Service
DUSD(HCI&S) Deputy Under Secretary of Defense for HUMINT, CI, Intelligence and
Security

FIE foreign intelligence entity

HUMINT human intelligence

ICD Intelligence Community Directive

IC intelligence community
IIR intelligence information report

JDITF-CT Joint Defense Intelligence Task Force-Combating Terrorism

OFCO offensive counterintelligence operation(s)

USD(I) Under Secretary of Defense for Intelligence

PART II. DEFINITIONS

Unless otherwise noted, the following terms and their definitions are for the purpose of this
Instruction.

assessment. A document produced by a CI analysis and production element stating the in-depth
and comprehensive results of analysis regarding a relevant CI topic, event, situation, or
development, and contains the characteristics outlined in subparagraphs 3.a.(1) through (7) of
Appendix 2 to Enclosure 3.

Change 1, 10/15/2013 18 GLOSSARY

 DoDI 5240.18, November 17, 2009

analysis report. A document produced by a CI analysis and production element stating the
results of analysis regarding a relevant CI topic, event, situation, or development, and containing
the characteristics outlined in subparagraphs 4.a.(1) through (5) of Appendix 2 to Enclosure 3.

CI. Defined in Executive Order 12333 (Reference (p)).

CI analysis. Defined in Reference (c).

CI analytical product. Any document that contains the work of, is supported by, collaborated on,
or produced by a CI analyst at any echelon within a Defense CI Component. It may or may not
include CI production.

CI analysis and production element. The element within a Defense CI Component that performs
CI analysis in any form; produces a CI analytical product in any of the categories of CI analysis;
or responds to requests for CI analysis from an internal organization and/or from organizations
external to the Defense CI Component.

CI collection. The systematic acquisition of intelligence information to answer CI collection

requirements. Associated CI analytical products are:

collection support brief. Provides near-comprehensive background detail on a collection

issue to guide and enhance collection efforts.

collection source evaluation. An evaluation of a source to determine if the information

provided is valuable and credible and to ascertain the reliability and veracity of the source.

collection emphasis. Supplements a standing collection requirement and identifies areas of

emphasis or information gaps to the CI collector.

source-directed requirement. Established by a CI analysts based on knowledge of a source’s

access and placement to necessary information.

IIR evaluation. An analyst’s evaluation of how well an IIR satisfied the intelligence
requirement for which it was collected.

CI inquiry. Defined in DoDI 5240.21 (Reference (q)).

CI investigation. Formal investigative activities undertaken to determine whether a particular

person is acting for or on behalf of, or an event is related to, a foreign power engaged in spying
or committing espionage, sabotage, treason, sedition, subversion, assassinations, or international
terrorist activities, and to determine actions required to neutralize such acts. Associated CI
analytical products are:

investigative analysis report. An evaluation of all available information obtained during a CI

inquiry to determine if an investigation is warranted; an evaluation of an on-going CI
investigation to develop leads, identify trends, patterns, or anomalies in furtherance of the

Change 1, 10/15/2013 19 GLOSSARY

 DoDI 5240.18, November 17, 2009

investigative effort; or produced at the conclusion of a CI investigation to identify previously

unknown methods of operation, describe lessons learned, and to support damage assessments
when initiated.

investigative source evaluation. An evaluation of a source to determine if the information

provided is valuable and credible, and to ascertain the reliability and veracity of the source.

investigative support package. An evaluation of all available information pertaining to an

unknown subject CI inquiry or investigation in an effort to identify a person, place, or thing of CI
interest based on analysis of the information.

COLISEUM. The management system for production requirements and requests for
information.

CI production. Defined in Reference (c).

Defense CI Component. Defined in Reference (b).

Defense Intelligence Component. Defined in Reference (e).

DIAP. The DoD intelligence analysis community’s resource allocation and prioritization
program. The DIAP establishes the policies, procedures, responsibilities, and levels of analytic
effort required to provide timely, objective, and cogent intelligence to warfighters, defense
planners, and policymakers.

DoD strategic CI campaign. Defined in Reference (c).

FIE. Any foreign organization, person, or group (public, private, governmental) that conducts
intelligence activities to acquire U.S. information, block or impair U.S. intelligence collection,
influence U.S. policy, or disrupt U.S. systems and programs. This term includes a foreign
intelligence and security service as defined in Joint Publication 1-02 (Reference (r)).

JITF-CT. A consolidated all-source intelligence fusion center focused on warning, threat

assessment, options development, and operational intelligence support to the DoD campaign
against international terrorism.

OFCO. A clandestine CI activity conducted for military, strategic, DoD, or national CI and
security purposes against a target having suspected or known affiliation with a FIE, international
terrorism, or other foreign persons or organizations to counter terrorism, espionage, or other
clandestine intelligence activities that threaten the security of the Department of Defense or the
United States. Associated CI analytical products are:

operational analysis report. An evaluation of information from a variety of sources to

determine if favorable conditions are present for initiation of a CI operation and the report may
offer suggestions as to the type of asset and/or the access and placement required to meet the
foreign essential elements of information requirements.

Change 1, 10/15/2013 20 GLOSSARY

 DoDI 5240.18, November 17, 2009

operational asset evaluation. Evaluates an asset’s reliability and veracity in a CI operation.

operational support package. Comprehensive analysis of all available intelligence on a target

of interest to a Defense CI Component or determined to be of interest to DoD CI. It details the
significance of the target, relates it to strategic objectives, identifies desired effects, and suggests
methods of engagement to achieve desired results.

production requirement. A customer's formal request for analytic support, identifying the topic
or issue of interest, type of information or analysis required, date required, preferred format, and
classification.

threat advisory. An advisory is a one-time product or produced on a recurring schedule – daily,

weekly, or monthly. The advisory informs authorized recipients of an immediate or the potential
for a foreign intelligence or terrorist threat. The advisory typically contains information of a
perishable nature.

Change 1, 10/15/2013 21 GLOSSARY