Counter-Intelligence Technician

You are the CI team's technical authority — the warrant officer who bridges the enlisted agents doing the work and the commissioned intelligence officer drawing the picture. You came up as one of the best 35L NCOs in your section; now you are accountable for the legal authority, the operational tradecraft, and the institutional decisions your agents cannot make alone.

You completed the Warrant Officer Basic Course (WOBC) and the CI Warrant Basic Course at the U.S. Army Intelligence Center of Excellence, Fort Huachuca, and arrived at your first 351L billet — typically a battalion-level CI team at an INSCOM unit (66th MI Brigade in Europe, 500th MI Brigade in the Pacific, 704th MI Brigade at Meade, 902nd MI Brigade CONUS counterintelligence, or a Theater Intelligence Brigade support element) or an embedded CI team supporting a BCT or SOF element. Day-to-day you run or supervise CI operations: initial and developmental CFSO (counterintelligence force protection source operations), preliminary credibility assessments, liaison operations with partner agencies (DCSA field office, FBI field office, NCIS, AFOSI), base support operations (BSO) that protect the installation's sensitive activities from foreign intelligence collection, and TARP (Threat Awareness and Reporting Program) support for the units you serve. You sign the operational authority package that your 35L agents cannot sign for themselves. You write and review CI investigative reports and CIIR submissions for the INSCOM / theater reporting chain. You carry a caseload, you manage source validation timelines, and you are simultaneously learning how to be a warrant officer — the officer authority that came with the designation is distinct from the CI tradecraft you already have, and the CW3 who reviews your first CFSO operational package will notice if you are confusing the two. You also manage the operational security for your team — the only people who know the full picture of your team's activity are the ones who need to know, and you enforce that standard down to the newest 35L PFC.

• 01Draft and submit a CI Investigative Report (CIIR) that meets the INSCOM / theater quality-control standard — factual, sourced, with the legal-authority citation correct and the counterintelligence significance clear to the G2 who reads it cold.
• 02Run a CFSO source operation from initial contact through developmental stages under the AR 381-10 authority framework — source file current, validation cycle on schedule, contact reports filed within the required window.
• 03Brief the supported unit commander on the CI threat picture — foreign intelligence threat, insider threat indicators, TARP reporting trends — in the 10-15 minute window they will give you without losing the room.
• 04Coordinate a liaison operation with a partner agency (DCSA, FBI, NCIS, AFOSI) — the initial liaison visit, the information-sharing framework, the formal MOU or coordination memo that protects your sources and methods going forward.
• 05Conduct a preliminary credibility assessment (PCA) — structure the interview, apply the legal-authority framework correctly, document the results, and route the package to the correct authority for disposition.
• 06Maintain full accountability of all classified materials, source files, and operational records to AR 380-5, AR 381-10, and your unit SOP — no gaps, no exceptions, and no loose ends that survive your relief-in-place.

• —FM 2-22.2 — Counterintelligence (the 351L doctrinal field manual; the authority document for CI operations, investigations, and collection).
• —AR 381-10 — U.S. Army Intelligence Activities (the legal authority and oversight framework for all Army CI operations, CFSO, and liaison activities).
• —AR 381-20 — Army Counterintelligence Program (the program policy that governs the Army CI mission — read it at WOBC and again at your first unit before you sign your first operational authority package).
• —AR 381-47 — U.S. Army Offensive Counterintelligence Operations (governs the specific activities that require the highest-level operational authority — know what is in here before you think you can do it without approval).
• —ATP 2-22.2-1 — Counterintelligence Techniques and ATP 2-22.2-2 — CI Support to Force Protection (the how-to manuals that fill in the tradecraft frame FM 2-22.2 builds).
• —ICD 304 — Human Intelligence (applicable Intelligence Community Directive for source validation standards that cross with HUMINT and govern your CFSO source validation requirements).

• —WOBC and CI Warrant Basic Course complete at Fort Huachuca — the entry credential. Without these you are not legally authorized to perform the operational functions the billet requires.
• —Active TS/SCI adjudicated and all special accesses current — a 351L operating with a lapsed or pending SCI is a 351L not doing their job, and the G2 who reviews your team's production will know it within a week.
• —CFSO source validation cycle current for every source in your team's file — no overdue validation, no pending annual review sitting past the due date, no source in active contact who has not been formally evaluated within the required period.
• —CIIR and CI reporting production quality passing INSCOM or theater QC review on the first submission — the 351L who has to rewrite every report is the 351L who does not get the sensitive tasking.
• —AR 381-10 operational authority packages for your team's active CFSO and liaison operations reviewed, signed at the correct approval authority, and current — no operations running without written authority.

• —Operating a CFSO source beyond the authority level your operational package covers. AR 381-10 is not administrative scaffolding — it is the line between a legal CI operation and a congressional notification event. Signing an authority package for a contact you had six weeks ago is not fixing the problem.
• —Letting a source file go stale — missing a contact, a validation, or a contact report — because the operational tempo picked up. The foreign intelligence officer waiting for your source to go quiet is not impressed by your training schedule.
• —Briefing a supported unit commander on a CI investigation or a source operation in a group setting because you wanted to make a strong impression. Operational security for CI operations is not optional, and the 351L who burned a source at a BUB is the 351L who gets that story told about them at every INSCOM professional development event for the next decade.
• —Routing a CI report through a command channel that does not have the appropriate clearance and access to receive it. Your CI reporting chain and your administrative chain are not the same thing — the CI Warrant who conflates them learns why in an INSCOM Inspector General visit.
• —Treating the partner-agency liaison relationship as your personal intelligence network. The FBI field office coordinator who gave you that tip did so under a specific information-sharing agreement and an implicit reciprocal expectation; the 351L who exploits that relationship without delivering anything back destroys it for the next warrant who sits the billet.

The good WO1 or CW2 351L is the warrant officer the team's 35L NCOs bring their hard cases to — not because the warrant makes it easier, but because the warrant makes it right. The CFSO file is current, the operational authority packages are signed before the first contact, and the CIIR that comes back from INSCOM QC the first time came back clean. The supported BCT G2 asked for this CI team specifically by name because the last rotation's threat reporting helped them catch the pattern before the adversary could work it. By CW2 they are developing the SSG team chief who will be the next Warrant board candidate.

You are the institutional memory and operational authority of the Army's counterintelligence enterprise. Where the junior warrant runs operations, you design them — and you carry the legal accountability, the program oversight, and the senior technical judgment that the CI mission cannot function without.

At CW3 through CW5 you are no longer primarily a team-level CI operator. You are a CI Staff Officer, an INSCOM battalion operations officer, a theater J2/G2 CI staff element lead, a DCSA liaison senior officer, or — at CW4 and CW5 — a Headquarters INSCOM program manager, a DIA CI element lead, a USCYBERCOM CI support function, a National Counterintelligence and Security Center (NCSC) detachment chief, or a senior technical advisor to a geographic combatant command (EUCOM, INDOPACOM, CENTCOM, SOCOM). You no longer personally run every CFSO source; you review the operational packages that come up the stack from CW2s and SSG team chiefs, approve or return them, and sign the authority packages that exceed junior warrant authority under AR 381-381-20 and AR 381-47. You advise the G2 or J2 on CI program health — source validation currency, investigative caseload, TARP program metrics, foreign travel reporting status, and the pattern of contact reports that, taken together, tell you whether a foreign intelligence service is running a collection program against your unit that nobody below you has stitched together yet. You build and defend the multi-year CI program for an INSCOM battalion, a theater MI brigade, or a component command — resource the teams, manage the sensitive compartmented relationships, maintain the external liaison architecture, and brief the commanding general. At CW5 you are one of a small cohort who set Army-wide CI program standards and testify technically on CI program issues to oversight bodies. You know which regulation has not been updated since before the threat changed, and you have the file trail to argue for the update. And you are actively building the next generation of 351L warrants — identifying the strongest CW2s for the senior training and program billets that will make them effective CW4s.

• 01Design and oversee a multi-team CI program covering source operations, investigations, liaison, TARP, and BSO across a brigade or theater footprint — resource the teams correctly, enforce the legal-authority framework, and brief the program to the commanding general without the staff having to soften it first.
• 02Review and approve operational authority packages under AR 381-10, AR 381-20, and AR 381-47 for activities requiring senior warrant or field-grade officer approval — including activities that cross service, agency, or national boundaries where the wrong approval breaks the joint relationship.
• 03Conduct a program oversight visit at a subordinate CI team — review the CFSO source files, the investigative case files, the operational authority packages, the TARP reporting metrics, and the partner-agency liaison documentation — and deliver a findings brief that is honest about what is broken and what needs to be fixed before the INSCOM IG gets there.
• 04Brief the theater J2, the INSCOM commanding general, or a geographic combatant command deputy chief of intelligence on the CI threat assessment — the foreign intelligence services operating against US forces, their targeting methods, their collection successes, and the program gaps that need to close.
• 05Manage the CI element's relationship with partner organizations — DCSA, NSA, FBI CI Division, NGA CI, CIA CI Center, foreign partner CI services under SOFA or bilateral security agreements — at the senior-level where the relationship is documented, reciprocal, and useful to both sides.
• 06Mentor CW2 and CW3 warrants through program billets, school assignments (Senior Warrant Officer Course, Senior Intelligence Officer Course, Joint Military Intelligence Training Center courses), and the professional development that builds the next generation of technically credible CI senior warrants.

• —AR 381-10 — U.S. Army Intelligence Activities; AR 381-20 — Army Counterintelligence Program; AR 381-47 — Offensive Counterintelligence Operations (you interpret these regulations for the Army now, not just follow them).
• —FM 2-22.2 — Counterintelligence; ATP 2-22.2-1 and ATP 2-22.2-2 — you advise on revision of these documents at the senior level and represent the deckplate perspective when doctrine lags the threat.
• —ICD 104 — National Intelligence Support to Military Operations; ICD 304 — Human Intelligence; ICD 503 — Intelligence Community Information Technology Systems Security Risk Management, Certification, and Accreditation (the IC directives framework you operate inside at theater and national echelons).
• —JP 2-01.2 — Counterintelligence and Human Intelligence in Joint Operations (joint doctrine that frames what you do when the CI team crosses into a SOCOM or joint task force mission set).
• —DA PAM 600-3 — Officer Professional Development, Warrant Officer chapters; DA PAM 600-25 — Warrant Officer Professional Development (your career development roadmap and the institutional framework you use to advise the CW2s in your element).
• —DoD 5240.02 — Counterintelligence (the DoD-level CI policy that your Army program implements; the document you cite when the Army program and the joint/national CI community are reading the same regulation differently).

• —Senior Warrant Officer Course (SWOC) complete at Fort Huachuca; ILE / WOILE consideration at CGSC for the senior billets that require it.
• —TS/SCI current and all program-required compartmented access current — at CW3 and above the access package you carry is not optional, and a lapsed compartment is a lapsed mission.
• —INSCOM or theater CI program oversight visit completed at subordinate units at least annually — the senior warrant who has not walked the floor at a subordinate team's operations room does not know what the program actually looks like at the team level.
• —Formal mentor relationship established with at least two CW2 warrants per billet cycle — the Army CI senior warrant community is small, the talent pipeline is narrow, and every senior warrant who fails to invest in the next generation makes the program weaker.
• —WO OER profile at top-block level consistent across senior billets — in the 351L community, the OER that says "select for INSCOM battalion operations officer" or "best technical advisor in the theater G2" is the one the Army Warrant Officer Selection Board reads as the candidate for the senior billet at Fort Meade, Fort Huachuca, or the combatant command.

• —Approving an operational authority package from a subordinate team because you trust the team chief rather than because you reviewed the package. The AR 381-10 audit does not care how experienced the CW2 is — it cares whether the approval signature matches the required approval authority level. If it does not, your name is on the finding.
• —Letting the partner-agency liaison architecture operate on personal relationships rather than documented agreements. The FBI CI division coordinator who retires in six months takes the relationship with them if you did not formalize it; the DCSA field office that was providing informal support stops when their supervisor asks for the MOU they do not have.
• —Providing a CI threat assessment to the commanding general that papers over a gap in your program. The two-star who makes a force protection decision based on an incomplete picture finds out the gap existed when the INSCOM IG publishes the annual report. The senior warrant whose program produced the incomplete picture is named in the finding.
• —Treating the IC-adjacent billets (NSA CI element, NGA CI, NCSC detachment) as staff jobs rather than technical credentialing opportunities. The 351L CW4 who spent three years at an IC component liaison billet and learned nothing about the national CI enterprise returns to an INSCOM program with no expanded frame of reference — and the commanding general and the G2 can tell within a quarter.
• —Failing to document the institutional lessons from a major CI investigation, a source validation failure, or a foreign intelligence success against a supported unit. The most valuable thing a senior 351L warrant can leave behind is a casebook that the next warrant who sits the billet can learn from without having to relearn the same lesson the hard way.

The good CW3 or CW4 351L is the warrant officer the INSCOM commanding general sends to the theater G2 when the combatant command's CI program has a problem the staff cannot diagnose — because this warrant will walk the subordinate team's operations room, read the source files and the authority packages, find the gap, and deliver the finding report before the commanding general has to ask twice. Their CW2s are running clean programs with current source files and signed operational authority packages because they reviewed them monthly and told the CW2 what was wrong in plain language before the IG did. The theater J2 trusts their threat assessments without asking for a second source because the senior warrant's track record over three rotations was never wrong about the FISS targeting pattern. The good CW5 sets Army CI program standards that outlast their tour. Their name is on doctrine revision inputs, their former CW2s are the CW4s running INSCOM battalion operations, and when the Senate Intelligence Committee staff asks the INSCOM IG what the Army's CI program actually looks like in practice, the answer the IG gives came from the documentation this warrant built. Post-Army: FBI CI Division supervisory special agent, DIA senior intelligence officer equivalent, defense contractor program manager for a CI support contract, or NCSC program director. Start building that bridge three years before the retirement date — the clearance, the relationships, and the institutional reputation travel with you, but only if you maintained all three.