Week 5 Lecture: Human Intelligence (HUMINT) and Counterintelligence (CI)

INMS 600 Week 5 Lecture: Human Intelligence (HUMINT) and Counterintelligence (CI) Introduction This week we will explore some of the management and policy issues of human intelligence and counter intelligence, the part of the intelligence business that has given Hollywood poetic license in regards to espionage and intrigue. It is portrayed as shadowy figures in disguise who make highly difficult drops in exotic locations. But simply, HUMINT and CI are operations and activities that deal with the human element of collection. HUMINT complements collection and can be bolstered by the other intelligence disciplines. HUMINT Operations HUMINT is information derived from human sources and relies on the collector who is working the sources. A human intelligence collector provides information to support intelligence requirements and tasked to collect information by screening human intelligence sources. The ability to speak multiple foreign languages is essential to be an HUMINT Collector Duties & Responsibilities Participate in human intelligence operations Screen human sources & documents including foreign material & captured documents Debrief & interrogate human sources Prepare information intelligence reports 1 effective HUMINT operator. Interpersonal skills are very important since it requires speaking and understanding foreign contacts and operatives. Traditionally, HUMINT operators work where these sources reside or operate. HUMINT collection techniques involve overt and clandestine means. Overt is open collection and has significant great value but is often overlooked and underappreciated. The vast majority of HUMINT collection is conducted overtly and openly. Overt collection is cost effective and efficient with easier access to sources such as diplomats, military personnel, and attaches around the world. Overt HUMINT collectors, such as a military attaché, who work in credentialed positions in host nations and build relationships with contacts at every level at low risk. They can provide a tipper identifying potential sources with Military Attaches unique access who could be recruited for clandestine access and collection. Overt collection is not illegal and engaged in by all governments. Overt techniques involve openly collecting data or information in plain sight, and are usually not considered illegal. HUMINT collection does not rely on technical means but the tradecraft does use devices and techniques to improve collection. 2 The value of clandestine HUMINT is paramount to the IC, has complementary value, but comes with higher risk. HUMINT collectors and agents can get into risky and dangerous situations if they are operating clandestinely. For example, clandestine efforts can cause embarrassing situations for the responsible government and lead to imprisonment or death for collectors and sources. Overt and clandestine should be complementary to penetrate difficult targets. The CIA ‘s Directorate of Operations (DO), previously known as the Clandestine Service, is the clandestine arm of the Central Intelligence Agency. It is the national authority for the coordination, de-confliction, and evaluation of clandestine operations for the IC. They conduct the worldwide clandestine collection of HUMINT and covert action that informs the President, senior policymakers, military, and law enforcement sectors. The Defense Intelligence Agency’s Defense Clandestine Service (DCS) also conducts global clandestine operations and under the DIA Directorate of Operations. It was formed after an organizational realignment of DIA’s defense HUMINT activities. It is intended to work in conjunction with the CIA Directorate of Operations. The DCS supports military intelligence requirements. 3 The DIA’s Defense Counterintelligence and Human Intelligence Center (DCHC) is responsible for DoD global CI and HUMINT activities. It handles oversight, doctrine, policy, planning and workforce management. When it comes to dealing with the threat from foreign HUMINT activities, that is the role of counterintelligence. CI is responsible for preventing the threat by adversaries to HUMINT & CI HUMINT is any information gathered from human sources & designed to obtain intelligence information using human beings as both sources and collectors. CI is designed to deceive, prevent sabotage & block an adversary’s access to political & military information or engaged in espionage, sabotage, subversion, or terrorism. collect information about the IC and thwart their intelligence collection activities and operations. The CI Threat The intelligence threat is posed from many countries and unaffiliated groups. For example. the Russian espionage threat has dominated U.S. politics and news. It is possible that Russian espionage within the U.S. today equals or exceeds in magnitude what it was during the height of the Cold War. For example, the Russian foreign intelligence service, the Sluzhba Vneshney Razvedki Rossii (SVRR), has remained highly engaged against the United States. For many years the Russians have shown a preference to steal Western technology to compensate for its lack of research and development capabilities. The first Soviet atomic 4 bomb was a replica of the U.S weapon developed and tested in the southwest United States, and constructed from the plans stolen by a Soviet spy ring. The first Soviet long-range bomber, the Tupolev Tu-4 was reversed engineered from the U.S. B-29 bomber. In the 1970s and 1980s, the Soviet Military-Industrial Commission (VPK) tasked both the Committee for State Security (KGB) and military intelligence (GRU) to collect Western technologies. The extent of the Soviet theft was discovered when KGB Colonel Vladimir Vetrov defected to the French. There are equal concerns about China. Some believe that the Chinese are presently more active than the Russians and pose a greater threat with its broad-based espionage activities. It is interesting to note that the targets include technology and defense companies, academia, and government laboratories of the U.S. and other governments. Note also that the methods used by the Chinese differ significantly from more traditional espionage approaches of the Soviets/Russians. In addition to traditional intelligence agents, the Chinese utilize businessmen, scientists, engineers, and academics visiting the U.S., as well as established residents in the U.S. who feel an ethnic loyalty to China. This is a practice that is shared by many countries. Cuba, Iran, Taiwan, Korea, India, and Japan are also active in trying to obtain classified, proprietary, trade secrets, or export restricted items from the U.S. Hackers (who may or may not have connections to their national intelligence services) are also active in espionage activities. The insider threat is the compromise of sensitive information from an employee who is 5 a major danger to any organization with information that is valuable to an adversary. The insider threat is a person who misuses or betrays their authorized access to any U.S. Government resource. This threat can include damage through espionage, terrorism, unauthorized disclosure of national security information, or through the loss or degradation of departmental resources or capabilities. The major national espionage cases of Aldridge Ames and Robert Hanssen are illustrations from recent history. The threat in industry for compromise of proprietary data, trade secrets, and competitively advantageous know-how is extensive. Why do employees do this? One of the findings in both the Ames and Hanssen cases were that those traitors’ managers long knew that both had problems but chose to do nothing. Thomas Waters, a security official with the chemical firm BASF, explains that the loss of data from a company often occurs piecemeal, a little bit at a time. An aggressive adversary will target different employees for information, who often give it willingly. This is not unusual. There has been much discussion about the damage to US interests, diplomatic and otherwise, from the documents that Manning leaked to Wikileaks. Manning's testimony indicates that he was trying to bring the "truth to light" about US practices, a theme that repeats in the Snowden case, though the latter case has had much greater impact on US security and diplomatic relationships. Espionage by an adversary is a threat to the success of any targeted organization. The number of countries collecting against the U.S. has grown, and with globalization of 6 business, many foreign companies (some largely government-owned) target U.S. enterprises for commercial advantage. This has led to Cyber espionage and the latest and deepest threat. The Russians, Chinese, Iranians, international criminals, and hackers are very aware. Cyber espionage has become a major vulnerability for the U.S. government and industry. We will cover this in later detail in week seven. It is the CI sector of the IC that is responsible for dealing with these threats. Counterintelligence The mission of counterintelligence and security is to keep an adversary from penetrating an organization. Controls on information management and access must be instituted to keep sensitive information classified and protected. Maintaining security becomes a difficult task if too much information is deemed confidential. It seems ironic that the more information that is restricted, the greater the number of individuals who need access in order to perform their jobs. Too much security can strangle an organization; too little risks loss of vital secrets. There are three CI categories – collective, defensive and offensive. Collective CI is learning about an adversary’s intelligence capabilities. Defensive CI is preventing hostile agency access. Offensive CI is manipulating an adversary’s intelligence activities and deceiving them with false information. The assessment of risk is an important task for managers. As everything cannot be protected at reasonable cost, a determination must be made as to what is essential to protect and what is not. The degree of risk depends on how information is handled. The 7 employment of security compartments is a technique that restricts information to selected individuals. Often information only needs to be restricted for a period. The IC takes CI very seriously and a large bureaucracy has been established. The potential for foreign intelligence organizations to gain access weapons technology through espionage presents enormous challenges for U.S. counterintelligence agencies. The National Counterintelligence and Security Center (NCSC) is part of the ODNI has the mission for insider threat, supply chain risk management, and personnel security. Associated with this is the National Insider Threat Task Force (NITTF) which was established after WikiLeaks released thousands of classified documents through the global media and internet. Its mission is NCSC Develops, coordinates, and produces: National Threat Identification and Prioritization Assessment (NTIPA) & analytic CI products; The National Counterintelligence Strategy Priorities for CI collection, investigations, and operations; CI program budgets and evaluations that reflect strategic priorities; In-depth espionage damage assessments; CI awareness, outreach, and training standards policies. to deter, detect, and mitigate insider threats from employees who may represent a threat to national security. The Office of the National Counterintelligence Executive (NCIX) was established to educate government organizations and expand the outreach to the private sector on the espionage threat and the need to maintain vigilance. 8 The FBI is the lead agency for exposing, preventing, and investigating foreign intelligence activities and espionage on U.S. soil. The theft of sensitive national security information by operatives of foreign governments remains a critical priority. The FBI’s Counterintelligence Division uses its investigative and intelligence capabilities to combat counterintelligence threats to U.S. advanced technologies and sensitive information. Their counterespionage division prevents the intrusion of foreign agents into secure U.S. facilities and information systems, and distribution of classified materials to foreign governments, companies or terrorist organizations. The DoD’s Defense Counterintelligence and Security Agency (DCSA) was activated in June 2019. DCSA is the primary Federal agency for conducting background investigations for the Federal Government. It also serves as the primary DoD for the National Industrial Security Program and oversees the protection of U.S. and foreign classified information and technologies in the hands of cleared industry under the National Industrial Security Program. Conclusion The IC has many diverse missions that need to be protected, and one of the most important are HUMINT and CI and neither are a separate step in the business of intelligence. Espionage has always been a dirty but necessary part of CI and HUMINT. The take away from this lesson is that the threat continues to increase and the stakes get higher. Understanding the significance and capabilities of these two disciplines as an intelligence manager is one of the most important lessons to be learned in INMS. 9 10