Military reference books and manuals (2009-2023, Volume 2)

UNCLASSIFIED

138

attachment)

Manufacturer

Model Number

TSG Number

(if applicable)

2. CNSS 5006 approved disconnect device?

□

Yes

□

N/A

a) Line disconnect

□

Yes

□

N/A

b) Ringer protection

□

Yes

□

N/A

Manufacturer

Model Number

TSG Number

(if applicable)

3) CNSS 5002 (TSG-2) configured computerized telephone
system (CTS)?

□

Yes

□

N/A

a) If yes, please provide the following information about the CTS

Manufacturer

Model

b) If yes, please provide specific location of the CTS

c) How is the facility protecting the CTS physically controlled?

d) If yes, what is the clearance level (if any) of facility or area where the switch is located and
how is area controlled?

e) Are all cables, signal lines and intermediate wiring frames
between the SCIF telephones and the CTS physically protected
within a physically controlled space?

□

Yes

□

If no, please explain

f) Are all program media, such as tapes and/or disks, from the CTS
afforded physical protection from unauthorized alterations?

□

Yes

□

g) Is an up-to-date master copy of the CTS software program
maintained for confirmation and/or reloading of the operating
system?

□

Yes

□

h) Does the CTS have the capability to force or hold a telephone
station off-hook?

□

Yes

□

i) Does the CTS use remote maintenance and diagnostic procedures
or other remote access features?

□

Yes

□

If yes, explain maintenance procedures

j) Do the CTS installers and programmers have security clearances?

□

Yes

□

If yes, at what access level (minimum established by CSA)

If no, are escorts provided?

□

Yes

□

UNCLASSIFIED

139

4) Is it Voice over Internet Protocol (VoIP) phone system
?

□

Yes

□

N/A

a) If yes, please provide the following information about the IPS

Manufacturer

Model

IPS Location

b) Do all unclassified telephones within the facility have a
hold, mute and/or push-to-talk [handset] capability, (for
off-hook audio protection)?

□

Yes

□

N/A

If no, please explain

c) Is access to the facility housing the IPS physically controlled?

□

Yes

□

d) If yes, what is the clearance level (if any) of facility or area where the switch is located at
and how is the area controlled?

e) Are all cables, signal lines and intermediate wiring frames
between the SCIF telephones and the IPS physically protected or
contained within a physically controlled space?

□

Yes

□

If no, please explain

f) Are all program media, such as tapes and/or disks, from the IPS
afforded physical protection from unauthorized alterations?

□

Yes

□

g) Is an up-to-date master copy of the IPS software program
maintained for confirmation and/or reloading of the operating
system?

□

Yes

□

h) Does the IPS have the capability to force or hold a telephone
station off-hook?

□

Yes

□

i) Does the IPS use remote maintenance and diagnostic procedures or
other remote access features?

□

Yes

□

j) Do the IPS installers and programmers have security clearances?

□

Yes

□

If yes, at what access level (minimum established by CSA?

If no, are escorts provided?

□

Yes

□

Automatic telephone call answering

Are there any automatic call answering devices for the telephones in
the SCIF?

□

Yes

□

1) If yes, please identify the type

a. Voice mail/unified message service

□

Yes

□

b. Standalone telephone answering device (TAD)

□

Yes

□

UNCLASSIFIED

140

2) Provide manufacturer and model number of the equipment

Manufacturer

Model Number

Are speakerphones/microphones enabled?

□

Yes

□

N/A

If yes, has the remote room monitoring capability been disabled?

□

Yes

□

Has this been approved for use by the CSA?

□

Yes

□

N/A

Provide detailed configuration procedures

If applicable, is the voice mail or unified messaging services
configured to prevent unauthorized access from remote diagnostic
ports or internal dial tone?

□

Yes

□

Are any Multi-Function Office Machines (M-FOMs) used within
the SCIF (M-FOMs are electronic equipment that can be used as
network or standalone printers, facsimiles, and copiers)

□

Yes

□

If yes, please identify the device to include (Please identify all M-FOM devices in use,
either below or as an attachment (include a manufacture Volatile statement for each M-
FOM)

Make

Model

Serial Number

If yes, please identify all features and information processing level of each M-FOM

1) Copier

□

Yes

□

N/A

If yes, level(s) of information

2) Facsimile

□

Yes

□

N/A

If yes, level(s) of information

3) Printer (connected to a standalone computer or
network

□

Yes

□

N/A

If yes, please explain and identify the system(s) and the level(s) of information)

Does the M-FOM have memory storage capability?

□

Yes

□

If yes, what kind?

□

Volatile (information in

memory clears/erases when
powered off?

□

Non-volatile (information in

memory that remains when
powered off)

Does the M-FOM have a digital hard drive?

□

Yes

□

N/A

Have maintenance and disposition procedures been
established?

□

Yes

□

N/A

If reproduction of classified/sensitive materials take place outside the SCIF, describe

UNCLASSIFIED

141

equipment and security procedures used to reproduce documents

Does the M-FOM have voice transmission capability
and/or a telephone handset?

□

Yes

□

N/A

If yes, how is this features protected? Please describe

Are there any video teleconference (VTC) systems installed?

□

Yes

□

If yes, what level(s) of information is the VTC system processing?

Are all telecommunications systems, devices, features, and
software documented?

(Attached telecommunication baseline)

□

Yes

□

Sound Powered Telephones

Have all sound powered telephones been eliminated from the SCIF?

□

Yes

□

If no, answer the following questions

Are there sound powered or other telephone systems
in the facility which cannot connect to locations
outside the SCIF?

□

Yes

□

How
Many?

Are they installed and protected IAW ICS 705-1, Section E?

□

Yes

□

Remarks

General Announcing System

Do general announcing system loudspeakers have an audio amplifier
and are the output signal line installed within the SCIF?

□

Yes

□

Remarks

SCI Intercommunications Announcing Systems

Do any intercommunication type announcing systems that process
SCI pass through areas outside the SCIF?

□

Yes

□

If yes, list type, manufacturer and model

Type

Manufacturer

Model

Remarks

10. Commercial Interconnection Equipment

Are any commercial intercommunications equipment installed
within the SCIF?

□

Yes

□

Remarks

11. Pneumatic Tube Systems

Are there any pneumatic tube systems installed in the SCIF?

□

Yes

□

Are they installed IAWICS 705-1, Section E??

□

Yes

□

UNCLASSIFIED

142

Remarks

Section E: Classified Destruction Methods

Destruction methods

Describe the method and equipment used for destruction of classified/sensitive
material (if more than one method or device, use Remarks to describe. (If more than
one device, use remarks to list all manufacturer and model)

Method

Device Manufacturer

Model

Is a secondary method of destruction available?

□

Yes

□

Describe the location of destruction site(s) in relation to the secure facility:

Describe method or procedure used for handling non-soluble classified/sensitive
material at this facility:

Do you have a written Emergency Action Plan
(EAP) approved by CSA (if required)?

□

Yes

□

N/A

Remarks

Section F: TEMPEST/Technical Security

Does the facility electronically process classified information?

□

Yes

□

If yes, what is the highest level of information processed?

For the last TEMPEST Accreditation (if applicable), provide the following information

Accreditation granted by:

Has the CSA’s Certified TEMPEST Technical
Authority (CTTA) required any TEMPEST
countermeasures?

□

Yes

□

N/A

If yes, please identify the countermeasures that have been installed (i.e. non-conductive
sections, Radio Frequency (RF) shielding, power/signal line filters, window film, etc.)

Are there any other systems installed within or in close proximity
to the SCIF that have RF capability (e.g., fire alarm, ground-to-air-
radio, cellular tower, RF networks, etc)?

□

Yes

□

If yes, please explain

UNCLASSIFIED

145

CHECK Applicable blocks

□

Initial Accreditation

□

Re- Accreditation

□

Modified Facility

□

Pre-construction

□

New Facility

□

Page Change

Checklist Contents

Section A: General information

Section B:

Physical Security

Section C: Intrusion Detection Systems (IDS)

Section D: Classified Destruction Methods

Section E:

TEMPEST/Technical Security

List of Attachments

(Diagrams must be submitted on 8 ½” x 11” or 11” x 17” format)

UNCLASSIFIED

146

Section A: General Information

1. SCIF Data

Organization/Company Name

Type of Aircraft and Tail Number

Home Station

SCIF ID Number

Contract Number and Expiration
Date

(if applicable)

Concept Approval Date

Cognizant Security Authority (CSA)

Defense Special Security Communication System Information

(if applicable)

DSSCS Message Address

DSSCS INFO Address

If no DSSCS Message Address, please
provide passing instructions

Complete Mailing Address

E-Mail Address

Classified

(Network/System Name & Level)

Unclassified

(Network/System Name)

Additional

(Network/System Name)

Responsible Security Personnel

PRIMARY

ALTERNATE

Name

Commercial
Telephone

DSN
Telephone

Secure
Telephone

STE Telephone

Other
Telephone

Home
Telephone

UNCLASSIFIED

147

(Optional)

FAX #

Classified

Unclassified

Command or Regional Special Security Office/Name (SSO):

(if applicable)

Commercial

Other
Telephone

PRIMARY

ALTERNATE

Information System Security Officer Name:

Commercial

Secure

Accreditation Data

a. Category/Compartments of SCI Requested:

b. Existing Accreditation Information

(if applicable)

(1) Category/Compartments of SCI:

(2) Accreditation granted by:

On:

(3) Co-Use Agreements

□

Yes

□

If yes, provide sponsor/compartment:

c. Is there a SAP(s) co-located within the aircraft?

□

Yes

□

SAP Classification Level

(check all that apply)

□

SCI

□

Top Secret

□

Secret

□

Confidential

d. Has CSA requested
any waivers?

□

Yes

□

N/A If yes, attach a copy of the approved

waiver

Construction/Modification

Is construction or
modification complete?

□

Yes

□

N/A

If no, enter the expected date of
completion

Inspections

a. Last physical security
inspection performed by

On ______________

(Attach a copy of report)

Were deficiencies
corrected?

□

Yes

□

N/A If no, explain

REMARKS:

UNCLASSIFIED

148

Section B: Physical Security

Stationary Aircraft/UAV

a. Is the aircraft located within a controlled area?

□

Yes

□

N/A

If no, explain:

b. When not performing a SCI mission is all SCI
removed from the aircraft and stored in an accredited
SCIF?

□

Yes

□

N/A

If yes, SCIF ID:

If no, explain how SCI is protected when the aircraft is
unoccupied:

Access Control:

How is access to the aircraft controlled?

a. By Guard Force

□

Yes

□

If yes, what is their security clearance level?

b. Is Guard Force Armed?

□

Yes

□

c. By Assigned Personnel:

□

Yes

□

If Yes, do personnel have visual control of the entrance
door?

□

Yes

□

N/A

d. When processing SCI, are all personnel aboard the aircraft
cleared for all the SCI compartments that the aircraft is accredited
for?

□

Yes

□

If not, what are the procedures for segregating/protecting SCI compartments from
unauthorized disclosure?

Hatches and Doors Leading Inside the Aircraft:

a. Are doors equipped with GSA approved locks?

□

Yes

□

Manufacturer

Model

Group

b. Are tamper serialized seals used when aircraft is unoccupied?

□

Yes

□

If yes, are seals installed and a log book maintained by SCI cleared
personnel?

□

Yes

□

c. Remarks

Acoustical Isolation

a. Is a physical perimeter established around the aircraft at a
distance so as to prevent inadvertent disclosure of SCI discussions

□

Yes

□

UNCLASSIFIED

149

or briefings from within the aircraft

b. In instances where the physical perimeter barrier is not sufficient
to control voices or sounds, are sound countermeasure devices or
sound generating devices used?

□

Yes

□

c. Remarks

Visual Isolation

a. Are doors or other openings in the aircraft through which the
interior may be viewed screened or curtained?

□

Yes

□

Yes

b. Remarks

Procedures For Protecting SCI When The Aircraft Is Parked In Friendly/Unfriendly
Territories

Section C: Intrusion Detection Systems (IDS)

Is the aircraft equipped or located within a structure or area that
has an IDS?

□

Yes

□

If yes, please provide the following:

a. IDS Company provider name

(if applicable)

b. Premise Control Unit (PCU)

Manufacturer

Model Number

Tamper

Protection

□

Yes

□

c. Where is the PCU located?

d. Location of interior motion detection protection: Accessible
points of entry/perimeter?

□

Yes

□

e. Has the IDS Alarm Monitor Station been installed to
Underwriters Laboratories certified standards?

□

Yes

□

If yes, please provide certification number and expiration date of UL certification

Certification Number

Expiration Date

f. Has the IDS passed CSA or UL 2050 installation and acceptance
tests?

□

Yes

□

If yes, please attach a copy of certificate and skip to question 2 below. (Non-commercial
proprietary system must answer all questions)

UNCLASSIFIED

150

g. Motion Sensors (Indicate sensor placement on a legible floor plan; 8.5” x 11” or 11” x 17”
paper

Manufacturer

Model Number

Tamper

Protection

□

Yes

□

h. Are motion sensors installed above the false ceiling?

□

Yes

□

N/A

i. Are motion sensors installed below the false floors?

□

Yes

□

N/A

j. Are there any other intrusion detection equipment
sensors/detectors in use?

□

Yes

□

If yes, please identify make, model, and manufacturer and function (indicate on floor plan)

Make

Model

Manufacturer

Function

k. Does the IDS extend beyond the SCIF perimeter?

□

Yes

□

Can the status of PCU be changed from outside IDS protection?

□

Yes

□

If yes, is an audit conducted daily?

□

Yes

□

Has the IDS configuration been approved by the CSA?

□

Yes

□

l. Do any intrusion detection equipment components have audio or
video capabilities?

□

Yes

□

If yes, please explain:

Has the CSA mitigated this capability?

□

Yes

□

m. IDS Administrator SCI indoctrinated?

□

Yes

□

n. External Transmission Line Security: What is the method of line
security? Meets NIST; FIPS AES Encryption?

□

Yes

□

If yes, has the encryption been certified by National Institute of
Standards and Technology (NIST) or another independent testing
laboratory?

□

Yes

□

If not NIST FIPS AES, is there an alternate?

□

Yes

□

If yes, please explain:

Does the alternate line utilize any cellular or other Radio Frequency
(RF) capability?

□

Yes

□

If yes, provide manufacturer and model

Manufacturer

Model

UNCLASSIFIED

151

o. Does any part of the IDS use a local or Wide Are
Network?

□

Yes

□

N/A

(1) Is the Network Intrusion Detection Software (NIDS)
administrator at least Top Secret (collateral) cleared?

□

Yes

□

N/A

(2) Is the host computer dedicated solely for security
purposes?

□

Yes

□

N/A

(3) Is the host computer secured within an alarmed
area controlled at the Secret or higher level?

□

Yes

□

N/A

(4) Is the host computer protected through firewalls or
similar devices?

□

Yes

□

N/A

Are the firewalls/devices configured to only allow data
transfers between IDS components?

□

Yes

□

N/A

(5) Is the password for the host computer unique for
each user and at least 8 characters long?

□

Yes

□

N/A

(6) Is the password changed semi-annually?

□

Yes

□

(7) Are remote security terminals protected the same of
the host computer?

□

Yes

□

N/A

If no, please explain:

p. Was the IDS installed by U.S. citizens:

□

Yes

□

N/A

If no, please explain:

q. Is emergency power available for the IDS?

□

Yes

□

N/A

What type? Generator

□

Yes

□

If yes, how many hours? _______

What type? Battery

□

Yes

□

If yes, how many hours? _______

r. If applicable, describe the method of ventilation and duct work protection:

s. Where is the IDS Alarm Monitor Station located?

t. Does the Monitor Station have any remote
capabilities (i.e., resetting alarms, issuing PINs,
accessing/securing alarms, etc)?

□

Yes

□

N/A

If yes, please explain:

u. Does the IDS have any automatic features (i.e., timed
auto-secure, auto-access capabilities)?

□

Yes

□

N/A

v. Does the PCU/keypad have dial out capabilities?

□

Yes

□

UNCLASSIFIED

152

w. IDS Response Personnel

(1) Who provides initial alarm response?

(2) Does the response force have a security clearance?

□

Yes

□

If yes, what is the clearance level:

(3) Do you have a written agreement for external response force?

□

Yes

□

(4) Emergency procedures documented?

□

Yes

□

(5) Reserve security force available?

□

Yes

□

(6) Response to an alarm condition

________ minutes

x. Are response procedures tested and records maintained?

□

Yes

□

If no, please explain:

y. If required, has a Catastrophic Failure Plan been approved by the
CSA?

□

Yes

□

z. Does the IDS undergo semiannual testing?

□

Yes

□

aa. Have IDS records been maintained:

□

Yes

□

bb. Remarks

Section D: Classified Destruction Methods

For home station, describe the method and equipment used for destruction of
classified/sensitive material (if more than one method or device, use Remarks section to
describe (if more than one, use Remarks section to list all manufacturer and model)

Method

Device Manufacturer

Model

Is a secondary method of destruction available

□

Yes

□

Describe the location of destruction site(s) in relation to the aircraft?

Describe the method or procedure used for handling non-soluble classified/sensitive
material at your facility?

Do you have a written Emergency Action Plan (EAP) approved by
CSA?

□

Yes

□

Describe procedures for in-flight emergency destruction:

Remarks

UNCLASSIFIED

154

SCIF Co-Use Request and MOA

1. To: Addressee Government CSA:

2. From: Requesting Government CSA:

Requesting Agency:

Date:

POC:

Name/Title:

Telephone:

3. Facility where co-use is desired

Company/Department Name:

Complete SCIF Address: (street)

(city, state, and zip code)

______________________________________________________________________________

SCIF ID:

SCIF Room Numbers:

Site POC (Name/Title):

Telephone:

4. Classification:

(Provide classification level, SCI compartments, and storage requirements for Co-Use)

Highest Classification: Confidential

Secret

Top Secret

SCI compartments:

Storage requirements:

open

closed

UNCLASSIFIED

155

5. Information System (IS) processing requested:

(

Provide POC for IS coordination if Co-Use or Joint -Use

Information System Processing Not Required

Co-Use:

Use a system that will

not be

connected to system(s) for which the agency with

cognizance for the SCIF is the accreditor or,

use

for period processing only

an existing system for which the agency

with cognizance for the SCIF is the accreditor

Joint-Use:

Use an existing system for which the agency with cognizance for the

SCIF is the accreditor

Such use will consist of: Logical separation of data (via software) or

co-mingle data (no separation). Detailed justification required in Item 9.

IS POC (Name/Title):

Telephone:

6. Duration:

A. Contractor Facility:

RFP Date:

(if applicable)

Expiration date of Contract:

(enter

date

or “Indefinite”)

Contract Number:

B. Government Facility: Expiration Date of

Agreement:

(enter

date

or “Indefinite”)

UNCLASSIFIED

156

7. Type Effort:

Intel Related

Other

(If other, describe)

8. Does this facility have waivers?

Yes

(If yes, list waivers)

Comments/Justification:

CONCUR:

(

Name and Title)

(

Date)

* Notice:

Email or other exchange and receipt of this form, completed and concurred, constitutes a formal

Memorandum of

Agreement

(MOA). Co-Use means two or more organizations sharing the same SCIF. All personnel involved with

Co-Use SCIFs must be approved to ICD 704 standards.

UNCLASSIFIED

157

Construction Security Plan (CSP)

Definition:

A plan outlining security protective measures that will be applied to each

phase of the construction project. The requirements set forth in this plan provide the
baseline for construction security activities and may be supplemented as required but
may not be reduced without coordination and approval from the Accrediting Official
(AO).

The contents below are suggested topics. The plan format and content shall be
developed by the element accrediting official (AO) based upon the size, purpose and
location of the SCIF.

Site Security Manager:

(identify the SSM and contact information)

Statement of Construction Project:

(provide a description of the proposed work)

Existing SCIF ID

(if project is associated with currently accredited SCIF)

Cognizant Security Authority/ Accrediting Official:

(element)

Location of Work:

(address/location)

Estimated Start Date:

(estimated date construction will begin)

Estimated Completion Date: (

estimated date construction will end)

UNCLASSIFIED

158

Has a Risk Assessment Been Completed:

(if yes attach copy)

Security in Depth (SID) Documentation

: (Document the layers of protection

offered at the site, such as security fencing or walls, roving guards, marine
security guards, CCTV coverage, and controlled and/or limited access buffers to
facility)

Adjacencies to Consider

: (include a description of adjacent facilities to include

other classified agencies, activities, and presence of foreign nationals operating in
adjacent spaces on all six sides of the proposed SCIF)

Control of Construction Plans and Documents

: (Describe how c

onstruction plans

and all related documents shall be handled and protected)

Control of Operations if a Renovation Project (

describe barriers that will be

installed to segregate construction workers from operational activities

)

Procurement, Shipping and Storage of Building/Finishing Material:

(If

required by AO, describe security measures to ensure integrity of building
materials and/or finishing materials.)

Construction Workers

(Depending upon the standards required (within U.S.,

outside U.S., etc), for construction workers, provide information to verify worker
status, clearances if required, and/or mitigations employed.)

Site Security

(Identify plans to secure construction site, to include any proposed

fences, guards, CSTs, escorts, etc.)

Security Administration:

(list security documentation and retention

requirements that shall be maintained by the SSM (i.e. visitor logs, names of
construction workers, security incidents, etc.)

FOR OFFICIAL USE ONLY

FMI 2-22.9

Distribution Restriction:

Distribution authorized to U.S. Government agencies and their contractors. This

determination was made on 10 July 2006. Other requests for this document must be referred to Directorate of
Doctrine, ATTN: ATZS-CDI-D, 550 Cibeque Street, Fort Huachuca, AZ 85613-7017.

Destruction Notice

: Destroy by any method that will prevent disclosure of contents or reconstruction of the

document.

FOR OFFICIAL USE ONLY

Field Manual Interim

No. 2-22.9

Headquarters

Department of the Army

Washington, DC, 5 December 2006

Expires 5 December 2008

Open Source Intelligence

Contents

Page

PREFACE ..............................................................................................................v

Chapter 1

INTRODUCTION ................................................................................................ 1-1

Chapter 2

FUNDAMENTALS.............................................................................................. 2-1

Definition............................................................................................................. 2-1

Open Source Intelligence Discipline .................................................................. 2-1

Characteristics of Open Source Intelligence ...................................................... 2-2

Open Sources and Information .......................................................................... 2-3

Open Source Media............................................................................................ 2-3

Public Speaking Forums .................................................................................... 2-5

Open Source Intelligence Organizations............................................................ 2-6

Open Source Intelligence Considerations.......................................................... 2-7

Chapter 3

PLAN AND PREPARE FOR OPERATIONS..................................................... 3-1

Plan Operations.................................................................................................. 3-2

Prepare for Operations ..................................................................................... 3-11

Task Organize Assets ...................................................................................... 3-14

Assess Operations ........................................................................................... 3-16

Chapter 4

PRODUCE INTELLIGENCE .............................................................................. 4-1

Intelligence Categories ....................................................................................... 4-1

Conduct Research.............................................................................................. 4-2

Evaluate Information........................................................................................... 4-8

FOR OFFICIAL USE ONLY

Contents

FMI 2-22.9

5 December 2006

FOR OFFICIAL USE ONLY

Analyze Information ..........................................................................................4-11

Interpret Information..........................................................................................4-18

Report Results ..................................................................................................4-20

Chapter 5

COLLECT AND PROCESS INFORMATION ..................................................... 5-1

Conduct Target Development ............................................................................. 5-1

Collect Information .............................................................................................. 5-2

Process Information ............................................................................................ 5-8

Report Information ............................................................................................5-11

Appendix A

ASIAN STUDIES DETACHMENT ..................................................................... A-1

Appendix B

INTELLIGENCE OVERSIGHT .......................................................................... B-1

Appendix C

OPEN SOURCE INTELLIGENCE AND HOMELAND SECURITY................... C-1

Appendix D

COPYRIGHT BASICS ....................................................................................... D-1

Appendix E

DIRECTOR OF NATIONAL INTELLIGENCE OPEN SOURCE CENTER ....... E-1

Appendix F

INTELINK-SBU SYSTEM...................................................................................F-1

Appendix G

LANGUAGE PROFICIENCY LEVELS.............................................................. G-1

Appendix H

OPEN SOURCE RESOURCES......................................................................... H-1

Appendix I

BASIC INTERNET SEARCH TECHNIQUES...................................................... I-1

Appendix J

OPERATIONAL ENVIRONMENT ASSESSMENT ............................................ J-1

Appendix K

MEDIA ANALYSIS ............................................................................................ K-1

GLOSSARY .......................................................................................... Glossary-1

REFERENCES.................................................................................. References-1

INDEX ......................................................................................................... Index-1

Figures

Figure 2-1. Relationship of publicly available information to relevant information................ 2-2

Figure 2-2. Example - 500th Military Intelligence Brigade in US Army Pacific

Command ........................................................................................................... 2-6

Figure 3-1. Operations and intelligence................................................................................ 3-1

Figure 3-2. Military decisionmaking process......................................................................... 3-3

Figure 3-3. Open source research, requests, tasks, and reports ......................................... 3-4

Figure 3-4. Example of open source intelligence information exchange.............................. 3-6

Figure 3-5. Networks supporting open source intelligence operations .............................. 3-12

Figure 3-6. Possible open source analysis task organization ............................................ 3-14

Figure 3-7. Possible open source collection and processing organization ........................ 3-15

FOR OFFICIAL USE ONLY

Contents

5 December 2006

FMI 2-22.9

iii

FOR OFFICIAL USE ONLY

Figure 4-1. Practical and field research ................................................................................ 4-4

Figure 4-2. Research and the intelligence process............................................................... 4-5

Figure 4-3. Example of an association matrix ..................................................................... 4-12

Figure 4-4. Example of a bar graph.....................................................................................4-13

Figure 4-5. Example of a logistics sustainability overlay...................................................... 4-14

Figure 4-6. Example of a link diagram.................................................................................4-15

Figure 4-7. Population status overlay................................................................................... 4-17

Figure 4-8. Examples of timelines of key dates .................................................................. 4-18

Figure 4-9. Example of a web-based open source intelligence report................................ 4-22

Figure 5-1. Collect and process information .......................................................................... 5-3

Figure A-1. Asian Studies Detachment .................................................................................A-1

Figure F-1. Intelligence Community Enterprise architecture.................................................F-1

Figure J-1. Critical variables of the operational environment................................................ J-2

Figure J-2. Example of possible links between dependent and independent variables ........ J-5

Tables

Table 2-1. Primary open source media ................................................................................. 2-3

Table 2-2. Open source intelligence classification considerations ........................................ 2-9

Table 3-1. Interagency language roundtable proficiency levels........................................... 3-11

Table 4-1. Types of sources ................................................................................................... 4-9

Table 4-2. Source reliability ..................................................................................................4-10

Table 4-3. Information credibility .......................................................................................... 4-11

Table 4-4. Example of perception assessment matrix ......................................................... 4-16

Table 4-5. Reporting methods and products........................................................................4-20

Table 5-1. Target development .............................................................................................. 5-2

Table 5-2. Basic collection procedures .................................................................................. 5-4

Table 5-3. Broadcast reconnaissance and surveillance techniques...................................... 5-7

Table 5-4. Internet search techniques and procedures ......................................................... 5-9

Table G-1. Listening proficiency levels 2 to 5 ....................................................................... G-1

Table G-2. Reading proficiency levels 2 to 5 ........................................................................ G-1

Table G-3. Speaking proficiency levels 2 to 5....................................................................... G-1

Table G-3. Speaking proficiency levels 2 to 5....................................................................... G-2

Table G-4. Writing proficiency levels 2 to 5........................................................................... G-2

Table G-5. Translation proficiency levels 2 to 5 .................................................................... G-2

Table H-1. Open source research resources ....................................................................... H-3

Table I-1. Internet search techniques and procedures ........................................................... I-2

Table I-2. Boolean and math logic operators .......................................................................... I-5

FOR OFFICIAL USE ONLY

5 December 2006

FMI 2-22.9

FOR OFFICIAL USE ONLY

Preface

This manual expedites delivery of doctrine that the proponent has approved for immediate use in training and
operations. The manual facilitates a common understanding of Army open source intelligence (OSINT)
operations. As interim doctrine, it serves as a catalyst for analysis and development of Army OSINT training,
concepts, materiel, and force structure. It brings Army intelligence doctrine in line with the characterization of
OSINT as an intelligence discipline in Joint Publication 2-0.

This manual supersedes the definition and the description of OSINT in FM 2-0.

This manual provides fundamental principles; initial tactics, techniques, and procedures (TTP); and
terminology for Army OSINT operations.

•

Chapter 1 provides an introduction to OSINT.

•

Chapter 2 describes the fundamentals of Army OSINT, its operations, and organizations.

•

Chapters 3 through 5 provide initial TTP of OSINT operations.

•

Appendixes provide information that supports or expands upon the information in the chapters.

This manual applies to all Active Army, the Army National Guard/Army National Guard of the United States,
and the United States Army Reserve unless otherwise stated. It serves as a reference for personnel who are
developing doctrine and TTP; materiel and force structure; and training for intelligence operations. It is also a
reference for intelligence personnel at National, Joint, Interagency, other Service, and multinational or coalition
partners.

United States Army Training and Doctrine Command is the proponent for this publication. The preparing
agency is the Directorate of Doctrine, US Army Intelligence Center. Send written comments and
recommendations on Department of the Army (DA) Form 2028 (Recommended Changes to Publications and
Blank Forms) directly to Commander, ATTN: ATZS-FDD-D (FMI 2-22.9), U.S. Army Intelligence Center and
Fort Huachuca, 550 Cibeque Street, Fort Huachuca, AZ 85613-7017. Follow the DA Form 2028 format or
submit an electronic DA Form 2028.

Unless otherwise stated, masculine nouns and pronouns do not refer exclusively to men.

Terms that have Joint or Army definitions are identified in both the glossary and the text. The glossary lists
most terms used in this manual that have Joint or Army definitions. Terms for which this manual is the
proponent manual (the authority) are indicated with an asterisk in the Glossary. These terms and their
definitions will be incorporated into the next revision of FM 1-02. For other definitions in the text, the term is
italicized, and the number of the proponent manual follows the definition.

FOR OFFICIAL USE ONLY

5 December 2006

FMI 2-22.9

1-1

FOR OFFICIAL USE ONLY

Chapter 1

Introduction

American military professionals have collected, translated, and studied articles, books, and periodicals to gain
knowledge and understanding of foreign lands and armies for over 200 years. The value of publicly available
information as a source of intelligence has, however, often been overlooked in Army intelligence operations.
This manual provides a catalyst for renewing the Army’s awareness of the value of open sources; establishing a
common understanding of OSINT; and developing systematic approaches to collection, processing, and
analysis of publicly available information.

Though always available, the exponential growth in computer technology and the Internet over the past two
decades has placed more public information and processing power at the finger tips of soldiers than at any time
in our past. A body of knowledge on culture, economics, geography, military affairs, and politics that was once
the domain of grey-beard scholars now rest in the hands of high school graduates. For intelligence personnel,
this combination of technology and information enables them to access a large body of information that they
need to answer their unit’s intelligence requirements. As the following quote illustrates, our reliance on
classified databases and external support has, however, often left our soldiers uninformed and ill-prepared to
capitalize on the huge reservoir of unclassified information available from open sources.

I am deploying to El Salvador in a few months, and will be serving as the S2
Noncommissioned Officer in Charge for the task force there. I need to put together some
information for the Task Force Commander on the country and the situation there.
Although I have served in Operation IRAQI FREEDOM I, I have no idea how to go
about this, for when we deployed to Iraq the country brief was pretty much handed to us.

––Sergeant, S2 Noncommissioned Officer in Charge, Engineer Group

From El Salvador to Iraq, the US Army operates in diverse operational environments around the World. These
diverse operational environments mean the development and use of OSINT is not a luxury but a necessity.
Open sources possess much of the information that we need to understand the physical and human factors of
the operational environments in which we conduct or may conduct military operations. In truth, much of our
understanding of these environments, our World, is based on publicly available information that we learned
from educators, journalists, news anchors, and scholars.

The US Army Intelligence and Security Command’s (INSCOM) Asian Studies Detachment demonstrates the
characteristics and the power of sustained OSINT operations. Since 1947, the Detachment has collected,
processed, and analyzed publicly available information on capabilities, disposition, and readiness of military
forces of China, North Korea, and other potential adversaries. It has also reported on the economic,
environmental, political, and social conditions within the region.

In recent years, the Asian Studies Detachment has reported on elevated tensions between China and Taiwan
during the Taiwan presidential elections in 2004; security threats to US, allied forces conducting humanitarian
relief operations in Indonesia following the December 2004 tsunami devastation; and strategy and tactics
employed during the August 2005 Sino-Russian combined counterterrorism Exercise PEACE MISSION 2005.

As testimony to the high value of OSINT analysis and reporting, Asian Studies Detachment’s intelligence
information reports since 2003 have received 28 "Major Significance" evaluations from the Defense
Intelligence Agency (DIA), National Ground Intelligence Center (NGIC), and the US Air Force's National Air
and Space Intelligence Center (NASIC) on topics ranging from North Korean underground facilities to Chinese
Peoples Liberation Army Air Force air and space science and technology (S&T) developments.

FOR OFFICIAL USE ONLY

Chapter 1

1-2

FMI 2-22.9

5 December 2006

FOR OFFICIAL USE ONLY

At the tactical level, some units are task organizing their assets into OSINT organizations. The following is an
example from the 3d Infantry Division’s deployment to Iraq in 2005. It illustrates how intelligence personnel
adapt to and succeed at new missions. In the example, the company commander task organized his common
ground station (CGS) team into an OSINT team.

With their four to five interpreters (two of which are American citizens) and a steady flow
of radio, television and newspaper reports, the open source intelligence team produced a
daily rollup with analysis. Their office consisted of one television with local and
international cable, one laptop connected to the nonsecure internet protocol router
network, an amplitude and frequency modulated radio and the daily newspapers, usually
ten to fifteen papers per day. Also, the team acquired a video camera recorder and
digital video device player to study confiscated propaganda and other media. They
understand the importance of local reporting to the success of the brigade combat team
campaign and have made it a point to conduct thorough research on topics of local
importance. Their product was studied and further analyzed by the intelligence,
surveillance, and reconnaissance analysis team at the brigade combat team tactical
operations center prior to submission to the brigade combat team S2 and dissemination
to battalions or division.

–– Captain, MI Company Commander, Brigade Combat Team

This manual serves as a catalyst for defining and describing Army OSINT operations. During its 2-year
lifecycle, the TTP in this manual will evolve as the Army and the other members of the US Intelligence
Community work to integrate and synchronize OSINT operations between echelons. This evolution will occur
in part as the Assistant Deputy Director of National Intelligence (DNI) for Open Source establishes the
National Open Source Enterprise which is envisioned as a distributed yet collaborative enterprise.

In the end, the US Intelligence Community will reach consensus about the who, what, where, when, why, and
how of OSINT operations. This consensus will take form in future Army and Joint intelligence doctrinal
literature as well as DNI guidance in the form of Intelligence Community Directive 301, The National Open
Source Enterprise, which will replace Director of Central Intelligence Directive 1/7.

FOR OFFICIAL USE ONLY

5 December 2006

FMI 2-22.9

2-1

FOR OFFICIAL USE ONLY

Chapter 2

Fundamentals

2-1.

OSINT operations are integral to Army intelligence operations. Directly or indirectly, publicly

available information forms the basis of all intelligence operations and intelligence products. The
availability, depth, and range of publicly available information enable intelligence organizations to satisfy
many intelligence requirements without the use of specialized human or technical means of collection.
OSINT operations support other intelligence, surveillance, and reconnaissance (ISR) efforts by providing
foundational information that enhances collection and production. As part of a multidiscipline intelligence
effort, the use and integration of OSINT ensures decisionmakers have the benefit of all available
information.

DEFINITION

2-2.

The

National Defense Authorization Act for Fiscal Year 2006

states, “Open source intelligence is

produced from publicly available information that is collected, exploited, and disseminated in a timely
manner to an appropriate audience for the purpose of addressing a specific intelligence requirement.”
Expressed in terms of the Army intelligence process, OSINT is relevant information derived from the
systematic collection, processing, and analysis of publicly available information in response to intelligence
requirements. Two important terms in these complementary definitions are––

Open Source,

which is any person or group that provides information without the expectation

of privacy––the information, the relationship, or both is not protected against public disclosure.

Publicly Available Information,

which is data, facts, instructions, or other material published

or broadcast for general public consumption; available on request to a member of the general
public; lawfully seen or heard by any casual observer; or made available at a meeting open to
the general public.

OPEN SOURCE INTELLIGENCE DISCIPLINE

2-3.

The source, the information, and the collection means rather than a specific category of technical or

human resources distinguish OSINT from other intelligence disciplines (see Figure 2-1). Open sources
broadcast, publish, or otherwise distribute unclassified information for public use. The collection means
(techniques) for gathering publicly available information from these media of communications are
unintrusive. Other intelligence disciplines use confidential sources or intrusive techniques to collect
private information. Confidential sources and private information are––

Confidential Source

, which is any person, group, or system that provides information with the

expectation that the information, relationship, or both, are protected against public disclosure.

Private Information,

which is data, facts, instructions, or other material intended for or

restricted to a particular person, group, or organization. There are two subcategories of private
information: classified information and controlled unclassified information.

Classified information requires protection against unauthorized disclosure and is marked to
indicate its classified status when in documentary or readable form.

Controlled unclassified information requires the application of controls and protective
measures, for a variety of reasons (that is, sensitive but unclassified, or for official use
only), not to include those that qualify for formal classification.

FOR OFFICIAL USE ONLY

Chapter 2

2-2

FMI 2-22.9

5 December 2006

FOR OFFICIAL USE ONLY

Figure 2-1. Relationship of publicly available information to relevant information

CHARACTERISTICS OF OPEN SOURCE INTELLIGENCE

2-4.

The following characteristics address the role of publicly available information and OSINT in Army

operations.

Provides the Foundation.

Directly or indirectly, publicly available information forms the basis

of intelligence and non-intelligence operations. The US social structures, education system,
news services, and entertainment industry shape our World view, awareness of international
events, and perceptions of non-US societies.

Answers Requirements.

The availability, depth, and range of public information enable

intelligence and non-intelligence organizations to satisfy many of the commander’s critical
information requirements (CCIRs) and their own information needs without the use of
specialized human or technical means of collection (see Figure 2-1). Given the volume, scope,
and quality of publicly available information, OSINT operations can often proceed directly from
the planning phase to the production phase of the intelligence process.

Enhances Collection.

Open source research and collection support other surveillance and

reconnaissance activities by answering requirements and providing foundational information
(biographies, cultural information, geospatial information, technical data) that optimizes the
employment and performance of sensitive human and technical means of collection.

Enhances Production.

As part of single and multidiscipline intelligence production, the use

and integration of publicly available information and OSINT ensures decisionmakers have the
benefit of all-sources of available information.

FOR OFFICIAL USE ONLY

Fundamentals

5 December 2006

FMI 2-22.9

2-3

FOR OFFICIAL USE ONLY

OPEN SOURCES AND INFORMATION

2-5.

Open sources and publicly available information may include but are not limited to––

Academia.

Courseware, dissertations, lectures, presentations, research papers, and studies in

both hardcopy and softcopy on economics, geography (physical, cultural, and political-military),
international relations, regional security, science, and technology.

Governmental, Intergovernmental, and Nongovernmental Organizations (NGOs)

Databases, posted information, and printed reports on a wide variety of economic,
environmental, geographic, humanitarian, security, science, and technology issues.

Commercial and Public Information Services.

Broadcasted, posted, and printed news on

current international, regional, and local topics.

Libraries and Research Centers.

Printed documents and digital databases on a range of topics

as well as knowledge and skills in information retrieval.

Individuals and Groups.

Handwritten, painted, posted, printed, and broadcasted information

(for example, art, graffiti, leaflets, posters, and websites).

OPEN SOURCE MEDIA

2-6.

A simple communications model consists of a sender, a message, a medium, and a receiver. The

medium is the access point to publicly available information for open source research and collection. The
primary media that open sources use to communicate information to the general public are shown in
Table 2-1 and discussed below.

Table 2-1. Primary open source media

SYSTEM COMPONENTS

ELEMENTS

SPEAKER

•

Sponsor

•

Relationship

•

Message

FORMAT

•

Conference

•

Debate

•

Demonstration

•

Lecture

•

Rally

PUBLIC SPEAKING

AUDIENCE

•

Location

•

Composition

GRAPHIC

•

Drawing

•

Engraving

•

Painting

•

Photograph

•

PUBLIC DOCUMENTS

RECORDED

•

Compact Data Storage Device

•

Digital Video Disk

•

Hard

Disk

•

Tape

Military reference books and manuals (2009-2023, Volume 2) - page 20