Skip to main content
HonestMOS
●InvestigationsCongress made VA disability claims free to file. An entire industry charges veterans anyway — and nobody can stop them.→
←Back to 351L Counter-Intelligence Technician — overview, pay, training, civilian translation, reviews
351LWO1-CW2

Counter-Intelligence Technician

WO1 to CW2 (Junior Warrant) · Army

WO1–CW2CW3–CW5
HEADS UP

The WO1 351L's first 90 days are almost entirely about learning what you cannot do yet — the legal authority framework is precise, the operational approval chain is real, and the CW3 reviewing your first CFSO package will know immediately whether you read AR 381-10 before you drafted it or whether you assumed the 35L tradecraft you already own covers the warrant functions. It does not. Read the regulation.

The Honest MOS Read
You came up as one of the best 35L agents in your section — the team chief who submitted your warrant packet said so in writing, and the CI Warrant Basic Course at Fort Huachuca confirmed you understood the technical work. What the Basic Course cannot fully prepare you for is the transition from being the person who runs a CI operation to being the person who is legally accountable for whether the operation was authorized in the first place. The 351L warrant officer is the operational authority node in the Army CI team. Your 35L NCOs can conduct a preliminary credibility assessment, run a source contact, and write a CI investigative report — but they cannot sign the operational authority package that makes the CFSO source operation legal under AR 381-10. They cannot approve a source for the developmental phase. They cannot authorize a liaison operation with an FBI field office or a DCSA counterintelligence field activity. Those functions sit with you, and the regulations are not ambiguous about it. At a typical first 351L billet you will be assigned to an INSCOM element — a 66th MI Brigade team in Germany, a 500th MI Brigade element in the Pacific, a 704th MI Brigade team at Fort Meade, a 902nd MI Brigade CONUS CI team at a major Army installation, or a theater special operations support element. The days look different depending on the assignment but the core cycle is the same: you manage source files and validation timelines for the CFSOs your team is running, you review and approve the operational authority packages before any contact happens, you sign the CIIRs before they go up the reporting chain, you coordinate the liaison relationship with your partner agencies, and you do the operational security math on every piece of your team's business every day. The unglamorous part: source validation cycles slip when the operational tempo picks up, and a lapsed validation on an active source is not a paperwork problem — it is a program integrity problem that your INSCOM supervisor will address in your OER. The classified material accountability posture is your name on the line, not your senior 35L NCO's. The partner-agency relationship that your predecessor built over three years of careful reciprocal sharing will evaporate inside six months if you show up at the FBI field office asking for more than you are delivering. You are managing a credibility that was loaned to you by the warrant who sat the billet before you, and you will pass it on — or burn it down — before you rotate. What the billet gives you that the enlisted side never does: genuine operational authority over a CI program, direct relationships with counterpart agency officers who take you seriously as a technical peer, and the cases that the senior warrant or the G2 sends to your team specifically because you are the asset they trust. The 351L who earns that trust in the first 18 months gets the hard tasking. The 351L who confuses the badge with the competence gets the routine work until the OER cycle ends.
Career Arc
  • 01WOBC and CI Warrant Basic Course at Fort Huachuca — roughly 4-6 months of instruction covering the legal authority framework, CI operations, investigative procedures, and the program management functions that distinguish the warrant's role from the 35L NCO's role. The Basic Course is where you learn what you are now authorized to do; the first unit is where you learn how difficult it actually is to do it right.
  • 02First 351L billet (WO1) — typically an INSCOM team at a major Army installation, a BCT-embedded CI team, or a theater intelligence brigade support element. You carry a caseload, manage source validation, approve operational authority packages, and build the partner-agency liaison relationships. The 35L SSG team chief who has six more years in the seat than you will be your most important peer for the first 18 months.
  • 03Promotion to CW2 — the first internal review of whether you are producing clean operational authority packages, current source files, quality-controlled CIIR submissions, and a partner-agency relationship your predecessor would recognize. CW2 is still a learning seat; the program oversight functions expand and the CW3 who reviews your work is calibrating whether you are ready for a more independent billet.
  • 04Intermediate assignment (CW2) — a more autonomous operational billet, a staff assignment at an INSCOM battalion, or a theater element. You begin mentoring WO1s and strong 35L NCOs toward the warrant board. The 351L community is small; your reputation inside INSCOM and the theater MI brigade starts being spoken before you arrive at a new billet.
  • 05School window — senior warrant professional development courses (Senior Warrant Officer Course at Fort Huachuca, Joint Military Intelligence Training Center CI and HUMINT courses). The CW2 who defers professional military education for operational reasons and then arrives at the CW3 board without the schooling is the one who competes from behind.
  • 06Transition to CW3 billet — the programmatic leadership seat. You stop running most of your own sources and start reviewing the programs run by CW2s and NCO team chiefs. This is the inflection point where the tradecraft you built as a 35L and the institutional judgment you developed as a junior warrant come together into something the senior warrants and the G2 actually call a CI program officer.
Common Screwups
  • ×Conducting any CI activity — CFSO source contact, liaison visit, preliminary credibility assessment — without an approved operational authority package in place. AR 381-10 is not a post-hoc documentation standard. The contact that happened before the approval happened is an unauthorized intelligence activity. One congressional notification later, the CI Warrant's career in sensitive work is done.
  • ×Using personal relationships with partner-agency officers (FBI, NCIS, DCSA) to exchange information outside the formal liaison framework. The informal tip that was useful once becomes a compromise waiting to happen when either side changes personnel. The 351L who gets caught running an unofficial intelligence exchange with a partner agency will never work a sensitive billet again.
  • ×A security violation — classified material left unsecured, a source file accessed by someone without need-to-know, a CI investigative report transmitted on an unclassified system — that triggers an AR 380-5 or ICD 503 incident report. The 351L community is small. The IG knows everyone by name. A security violation at this level is career-ending, not career-interrupting.
  • ×An OER that reads 'satisfactory' in the senior rater narrative. In a community where the billets are few and the competition is made up entirely of people who were the best 35L agents in their sections, 'satisfactory' means you are not being recommended for advancement. The 351L who receives a mid-block OER at the WO1/CW2 level is being told something; the ones who ignore the signal do not make the CW3 board.
  • ×Burning a source through operational security failure — discussing active operations in a non-secure environment, over-briefing a supported unit commander, or filing a report that is precise enough to identify the source to a counterintelligence-aware adversary. The source who burns is a person. The operational security failure that burned them is documented forever in the case file, and the warrant who signed the authority package for that operation signed their name to it.

A Day in the Life

  • 0530-0630PT — unit formation then individual or small-group training. CI units vary widely on the PT regime; some INSCOM elements have lighter institutional formations and you own your own fitness standard more than a line unit does. That is not a dispensation — it is a test.
  • 0630-0700Shower, uniform, and the first check of SIPR email before the building opens. Operational messages from partner agencies, tasking from the INSCOM reporting chain, and overnight contact reports from your team's sources all land here.
  • 0700-0800Team morning standup — review the day's operational calendar, confirm that operational authority packages are in place for any contacts scheduled today, confirm source file status and any validation deadlines approaching within 30 days.
  • 0800-1000Case file and source file review — pull the active operational files, confirm contact reports are filed within the required post-contact window, check validation dates, and review any new intelligence reporting from partner agencies that is relevant to your CFSOs.
  • 1000-1130Operational activity — today it is a liaison visit to the DCSA counterintelligence field activity. You bring the last 90 days of CI threat reporting relevant to the contractor workforce on post; they bring the results of a recent PERSEC investigation that crossed into your area of interest. The formal coordination memo covers what you can share and what you cannot.
  • 1130-1230Lunch — in the SCIF building or off post depending on the day's schedule. If you are near Fort Meade, Huachuca, or an INSCOM hub installation, you eat with other MI warrants and the conversations are the informal professional education the basic course does not offer.
  • 1230-1400CIIR drafting — working the report from last week's CFSO contact. The reporting standard requires factual precision, legal-authority citation, and a CI significance statement that is actionable for the G2 reading it. The first draft is not ready to sign; you will review it again tomorrow morning before it goes up the chain.
  • 1400-1500Operational authority package preparation for next week's scheduled source contact — review the authority level required, confirm the source's current developmental status, draft the package, and send it to the INSCOM supervisor for review and approval. No contact happens without a signed package.
  • 1500-1600Administrative work — classified material accountability, source file organization, continuous evaluation reportable event review (any foreign travel notifications or financial disclosures to send to the Security Officer), and the team's training calendar.
  • 1600-1700End-of-day SIPR check, debrief with the senior 35L NCO on any operational activity that happened while you were in administrative status, and the close of business physical security check.
  • 1700+Off — in garrison and non-operational status. But your personal phone is on. The source who made contact outside the scheduled window, the partner-agency officer who needs a response before 0800, and the operational anomaly that shows up at 2100 do not wait for duty hours.

Weekly Cadence

The week in a garrison 351L CI billet is built around the operational calendar — the scheduled source contacts, the liaison visits, and the reporting windows — and around the program management functions that keep the legal-authority framework intact. Monday and Tuesday are typically administrative: SIPR correspondence, source file review, CIIR drafting, and the coordination calls with partner agencies. The mid-week block is when most operational contacts are scheduled — sources meet during business hours, liaison visits get scheduled when both parties are in the office, and the team's TARP briefing schedule for supported units runs on Wednesdays. Friday is the accountability day. The team reviews the week's operational log against the source file contacts due, checks the validation calendar, and confirms that every authority package for the following week's contacts is drafted and routed. The 351L who walks out on Friday with an unsigned authority package for a Monday contact has a problem — because the INSCOM supervisor who needs to sign it is already gone, and you either cancel the contact or you conduct it without authority. When the unit is in a deployed or field-exercise posture, the rhythm shifts to the operational environment. Source contacts move to field-expedient methods; the authority package approval chain compresses to SIPR message traffic; and the liaison relationships go on hold unless you are operating in a joint environment where your FBI or DCSA counterpart is forward-deployed with you. The garrison paperwork does not disappear — the source validation deadline does not move because you are at NTC.

Key Skills — How to Drill Each

  1. 01
    Draft and submit a CI Investigative Report (CIIR) meeting the INSCOM / theater QC standard — factual, sourced, legal-authority citation correct.
    Read the QC feedback comments on the last three CIIRs your unit submitted before you write your first one. The INSCOM QC reviewer is not grading grammar — they are checking that every factual assertion has a supporting source, the legal authority citation matches the specific activity conducted, and the CI significance statement connects the dots the reporting consumer needs connected. The 351L who reads the feedback before drafting runs three times as many clean reports as the one who starts from scratch.
  2. 02
    Run a CFSO source operation from initial contact through developmental stages under the AR 381-10 authority framework, with source file and validation cycle current.
    Build a source file management calendar on day one and run it like an appointment book, not a back-burner task. The AR 381-10 validation timelines are not suggestions — they are the legal boundary of your operational authority. Miss a validation deadline, and the source contact that happened after the deadline is an unauthorized activity. The 35L team chief who has been running sources for eight years can tell you the exact date each source's validation is due without looking at the calendar; match that standard before your first year is out.
  3. 03
    Brief the supported unit commander on the CI threat picture in the 10-15 minute window they will give you.
    The BCT G2 or the battalion commander does not want your CIIR — they want the two things they need to know to make a force protection decision and the one thing they need to do before the next rotation. Rehearse the brief cold with your team chief before you walk into the S2/G2 office. If the brief needs more than two slides to deliver, it is not a brief yet. The CI warrant who can brief the threat in plain operational language without hedging every statement into uselessness is the one who gets invited back.
  4. 04
    Coordinate a liaison operation with a partner agency (DCSA, FBI, NCIS, AFOSI) — the initial visit, the information-sharing framework, the formal coordination memo.
    Bring something to the first meeting. The FBI field intelligence group coordinator you are meeting has been doing this for ten years and has been pitched by every new Army warrant officer who rotated through the billet. The liaison relationship that lasts is the one where both sides are getting something — start by understanding what your partner agency actually needs from your CI program, and show up the second time with something responsive. The formal coordination memo comes after the relationship is functional, not before.
  5. 05
    Maintain full accountability of classified materials, source files, and operational records to AR 380-5, AR 381-10, and unit SOP.
    Run a self-inspection at 60 days in — pull every source file, every authority package, every classified material accountability document, and reconcile it against your hand receipt and your operational log before your INSCOM supervisor does it for you. The 351L who self-identifies the gap and fixes it is the one who gets credit for program management discipline. The one who gets surprised by the IG is the one the IG writes up.

Manuals & References — What Chapters Matter

  • FM 2-22.2 — Counterintelligence
    The doctrinal foundation for the CI mission — organization, functions, operations, investigations, collection, and reporting. Read it as the enlisted 35L, re-read it as the WO1, and read it again after your first major operational authority package comes back from the INSCOM supervisor with a discrepancy. The regulation you thought it covered and the regulation it actually covers are not always the same paragraph.
  • AR 381-10 — U.S. Army Intelligence Activities
    The legal authority framework for everything you will do as a 351L. The activities listed in AR 381-10 with their required approval authorities are not suggestions — the approval level listed is the minimum level required. The junior warrant who reads this regulation slowly and carefully before drafting the first operational authority package will write better packages than the one who reads it quickly and assumes the tradecraft they learned as an NCO covers the legal standard.
  • AR 381-20 — Army Counterintelligence Program
    The program policy that governs how the Army CI mission is organized, resourced, and overseen. Less directly operational than AR 381-10, but critical for understanding the program accountability framework your program oversight visits, annual source validations, and reporting chain all live inside.
  • AR 381-47 — U.S. Army Offensive Counterintelligence Operations
    Governs the most sensitive activities in the CI mission set — the ones that require the highest-level approval authority and carry the greatest risk of a congressional notification if conducted improperly. Know what is in here before you assume any operation falls under your personal approval authority.
  • ATP 2-22.2-1 — Counterintelligence Techniques and ATP 2-22.2-2 — CI Support to Force Protection
    The how-to manuals that fill in the tradecraft frame FM 2-22.2 builds. As a 351L warrant you are not using these to learn CI tradecraft — you already know it. You are using them to ensure that the techniques your 35L NCOs are applying in the field match the doctrinal standard you are accountable for approving.

Standards — How to Hit Each

  • WOBC and CI Warrant Basic Course complete at Fort Huachuca.
    The Basic Course is not optional and it is not a formality — it is the first institutional checkpoint where the Army calibrates whether the strong 35L NCO who was selected for warrant can shift from agent to program officer. Show up having re-read FM 2-22.2 and AR 381-10. The instructors who are fellow 351L warrants will notice the difference between the student who already knew the authority framework and the one who is learning it for the first time in the classroom.
  • Active TS/SCI with all required program accesses current.
    Build a personal clearance and access calendar before you arrive at your first billet. Continuous evaluation (CE) under the 2019 SEAD-7 framework means your SF-86 is not a once-every-five-years event anymore — it is a living record. Foreign contact, foreign travel, financial changes, and reportable personal conduct need to hit your Security Officer the same week they happen. A 351L with a pending access action cannot sign certain operational authority packages, and the program does not pause for paperwork.
  • CFSO source validation cycle current for every source in the team file.
    Own this metric personally and brief it to your supervisor at every check-in. A source who is overdue for validation is a source who may have been compromised, may be operating under external pressure, or may have reported a false contact — you will not know which until you validate. The INSCOM QC reviewer pulls source file dates; make sure yours are never a conversation.

Technical Mistakes — Concrete Consequences

  • Operating a CFSO source beyond the authority level the signed operational package covers.
    The AR 381-10 audit flags the operational gap, the activity is reported as an unauthorized intelligence activity (UIA), and the INSCOM IG opens a review. The 351L who signed the authority package — or who conducted the contact without signing one — receives a formal reprimand and is permanently removed from CI-sensitive billets. One contact.
  • Letting a source file go stale — missing a contact, a validation, or a required contact report.
    A missed validation on an active source is a program integrity failure visible to every level of the oversight chain. The INSCOM supervisor who reviews your file will stop the source operation pending re-validation, the CIIR you submitted based on that source is now in question, and the OER for the current rating period now has a documented program management failure in it.
  • Briefing a CI investigation or source operation in a non-secure group setting.
    If the operation is active and the subject has any connection to the unit members present, the operation is compromised and your warrant career in sensitive work is functionally over. If the subject has no such connection, the operational security failure is still documented, still reportable, and still the kind of thing that follows a 351L through every future billet's personnel screening.
  • Routing a CI report through a command channel that does not hold the required accesses.
    A classified document transmitted to a recipient without the appropriate clearance and access is a security violation under AR 380-5 and ICD 503. The incident report goes to INSCOM G2 and the servicing Special Security Officer simultaneously. The 351L who made the routing error is the one who explains to the IG how the authority chain for CI reporting and the administrative chain of command differ — if they still have a billet to explain it from.

Career Decisions at This Rank

  • Stay at the team level versus request a staff billet at INSCOM battalion or theater G2.
    The team billet is where the operational credibility is built — the CIIRs with your name on them, the CFSO sources you validated, the partner-agency relationships you developed. Leaving the team too early for a staff seat is the 351L version of a 25A LT trying to skip company command. But the staff billet — INSCOM battalion S3, theater G2 CI element — is where you learn the program management and resource functions that define the senior warrant's role. The right answer depends on where you are in the developmental sequence: if your CIIR production and source management track record is solid, the staff billet at CW2 is career-building. If it is not solid yet, stay on the team until it is.
  • Apply for a joint assignment (USCYBERCOM CI element, SOCOM CI support, combatant command J2 CI) versus stay in the Army CI enterprise.
    The 351L community is small and the joint CI billets are visible. A SOCOM CI support assignment or a EUCOM J2 CI element billet gives you tradecraft exposure, partner-nation relationships, and an OER narrative that the CW4 board reads as a senior warrant who can operate outside the INSCOM framework. The honest risk: you will spend 12-18 months building access and institutional knowledge in the joint environment and then rotate back to an Army seat. If the Army CI program is your long-term career, the joint tour is investment. If you are building toward a post-service career in the IC civilian world, the joint exposure is almost mandatory.
  • Pursue a program school billet (Senior Warrant Officer Course, Joint Military Intelligence Training Center CI courses) now versus defer for operational continuity.
    Take the school when the Army offers it. The 351L who defers Senior Warrant Officer Course for operational reasons and then competes for CW3 without the PME is competing on the operational record alone against warrants who have both. The program schools are not a break from the career — they are the career checkpoint that signals to the promotion board that you are investing in the warrant officer professional development track the Army built. The INSCOM supervisor who tells you the team cannot afford your absence for a school is giving you information about the program's staffing health, not information about the right career decision.

How the Seat Varies by Unit Type

  • INSCOM MI Brigade (66th, 500th, 704th, 902nd)
    This is where most 351L warrants start and where the senior program billets live. The 902nd MI Brigade is the CONUS-focused force protection CI mission; the theater brigades (66th in Europe, 500th in the Pacific) run the foreign intelligence service collection assessment and theater CFSO program. The 704th at Fort Meade operates in the cyber and signals-adjacent CI space. Each INSCOM MI Brigade has a different threat picture, a different partner-agency constellation, and a different relationship with the supported geographic combatant command. The warrant who understands which brigade's mission best matches their tradecraft preferences will perform better and be more competitive for senior billets in that theater.
  • BCT-Embedded CI Team
    The most operationally austere 351L environment. A two- to four-person CI team embedded in a brigade combat team means you are the only warrant officer, you may be the only commissioned intelligence officer in the CI function, and your relationship with the BCT G2 and the brigade S2 is the entire institutional context of your program. The administrative chain for AR 381-10 approval packages runs to the INSCOM parent element, not to the BCT chain of command — and the BCT G2 who does not understand this will create pressure to shortcut the authority framework. The 351L in this seat needs to know the regulations better than everyone else in the building, because they are alone in enforcing them.
  • SOCOM / Special Operations Support
    A 351L warrant assigned in support of SOCOM — whether attached to a SFOD-A supported TF, a Ranger battalion, or a JSOC CI element — operates in a joint environment with a different classification framework, a different partner-agency tempo, and a different pace of operational decision-making than a garrison INSCOM billet. The authority framework is the same — AR 381-10 travels with you — but the operational rhythm is compressed and the OPSEC posture for CI operations in a SOCOM environment is more intense. The 351L who has run clean programs in both INSCOM and SOCOM environments has a career profile that the Army CI senior warrant community recognizes as elite.
  • DCSA Liaison / Federal Agency Coordination Billet
    Some 351L warrants rotate through billets that are primarily liaison and coordination functions with the Defense Counterintelligence and Security Agency, the FBI CI Division, or a combatant command's CI staff. These billets are relationship-building and program-bridging in nature — less direct CFSO operational production, more institutional architecture work. The 351L who maximizes a liaison billet leaves it with formal coordination agreements, a documented contact network, and a set of reciprocal intelligence-sharing relationships that the next warrant can actually use. The one who treats it as a staff tour leaves it with business cards.

What Good Looks Like at This Rank

The good WO1 or CW2 351L is the warrant officer who walked into a billet, read every source file in the operation log before they signed anything, and found the one validation that was 30 days past due before the INSCOM supervisor found it. They fixed it, documented the fix, and briefed the supervisor on what they found in the first week's status call. That is the signal. Not the cases they ran; the program they inherited and cleaned up before it became a finding. By CW2 the good 351L has a CIIR quality record the INSCOM QC reviewer recognizes. The reports come back clean the first time. The operational authority packages are complete before the first contact. The partner-agency liaison relationships are documented in formal coordination memos, not oral agreements that live in someone's memory. The supported BCT G2 asked for this CI team by name for the next rotation. And the good CW2 is already having the honest conversation with the strongest 35L SSG in the section about the warrant board. Not because the section can afford to lose them — it cannot — but because the 351L who came up through that conversation remembers who had it with them, and the Army CI program is too small and too important to let the pipeline narrow because a junior warrant wanted to hold onto their best people.

Preview — The Next Rank

The CW3 billet is where the 351L transitions from running a CI program to overseeing programs that other warrants and NCOs run. The technical production work — the CFSO source contacts, the CIIR drafting, the preliminary credibility assessments — moves to your CW2s and your 35L NCO team chiefs. Your work becomes the review layer: the operational authority packages that require the CW3 approval signature, the INSCOM QC submissions that your name sits on as the approving officer, the program oversight visits to subordinate teams that tell the theater G2 whether the program is healthy before the IG does. The biggest adjustment at CW3 is the shift from being the most technically proficient person in your operational area to being the person accountable for the technical proficiency of the people who work for you. The CW3 whose source file management is perfect but whose CW2's source files are consistently problematic has a management problem, not a tradecraft problem. Learning to see the program through the quality of the work it produces — rather than through the quality of the work you personally produce — is the senior warrant's cognitive shift, and it is harder than it sounds. At CW4 and CW5 the program becomes policy. The senior 351L warrant at that level is not reviewing case files on a regular basis — they are setting the standards that determine what a clean case file looks like, advising the INSCOM commanding general on program health, and representing the Army CI enterprise in conversations with the IC-wide CI community. The post-service transition is also on the table at CW4: the FBI CI Division supervisory special agent path, the DIA senior officer equivalent, the NCSC program director billets all prefer candidates with the documented CI program leadership the senior 351L warrant carries. Three years out from retirement is when to start building the bridge seriously.
FAQ

351L WO1-CW2 — Frequently Asked Questions

Q01What does a WO1-CW2 351L (Counter-Intelligence Technician) actually do?
You completed the Warrant Officer Basic Course (WOBC) and the CI Warrant Basic Course at the U.S. Army Intelligence Center of Excellence, Fort Huachuca, and arrived at your first 351L billet — typically a battalion-level CI team at an INSCOM unit (66th MI Brigade in Europe, 500th MI Brigade in the Pacific, 704th MI Brigade at Meade, 902nd MI Brigade CONUS counterintelligence, or a Theater Intelligence Brigade support element) or an embedded CI team supporting a BCT or SOF element.
Q02What's the most important thing to know as a WO1-CW2 351L?
The WO1 351L's first 90 days are almost entirely about learning what you cannot do yet — the legal authority framework is precise, the operational approval chain is real, and the CW3 reviewing your first CFSO package will know immediately whether you read AR 381-10 before you drafted it or whether you assumed the 35L tradecraft you already own covers the warrant functions.
Q03What does a typical day look like for a WO1-CW2 351L?
Time-blocked day at the WO1-CW2 351L rank tier: 0530-0630 PT — unit formation then individual or small-group training. CI units vary widely on the PT regime; some INSCOM elements have lighter institutional formations and you own your own fitness standard more than a line unit does. That is not a dispensation — it is a test, 0630-0700 Shower, uniform, and the first check of SIPR email before the building opens. Operational messages from partner agencies, tasking from the INSCOM reporting chain, and overnight contact reports from your team's sources all land here,…
Q04What mistakes get WO1-CW2 351L soldiers fired or relieved?
Conducting any CI activity — CFSO source contact, liaison visit, preliminary credibility assessment — without an approved operational authority package in place. AR 381-10 is not a post-hoc documentation standard. The contact that happened before the approval happened is an unauthorized intelligence activity. One congressional notification later, the CI Warrant's career in sensitive work is done; Using personal relationships with partner-agency officers (FBI, NCIS,…
Q05What career decisions matter most at the WO1-CW2 351L rank tier?
Stay at the team level versus request a staff billet at INSCOM battalion or theater G2 — The team billet is where the operational credibility is built — the CIIRs with your name on them, the CFSO sources you validated, the partner-agency relationships you developed. Leaving the team too early for a staff seat is the 351L version of a 25A LT trying to skip company command. But the staff billet — INSCOM battalion S3, theater G2 CI element — is where you learn the program management and resource functions that define the senior warrant's role.…
Q06What's next after WO1-CW2 for a 351L (Counter-Intelligence Technician) in the Army?
The CW3 billet is where the 351L transitions from running a CI program to overseeing programs that other warrants and NCOs run.
Q07What manuals and regulations does a WO1-CW2 351L need to know cold?
FM 2-22.2 — Counterintelligence (the 351L doctrinal field manual; the authority document for CI operations, investigations, and collection).; AR 381-10 — U.S. Army Intelligence Activities (the legal authority and oversight framework for all Army CI operations, CFSO, and liaison activities).; AR 381-20 — Army Counterintelligence Program (the program policy that governs the Army CI mission — read it at WOBC and again at your first unit before you sign your first operational authority package).

This playbook has no tips yet. Be the first to share what you know.

Published by the Honest MOS Editorial DeskVerified against DoD/.gov sourcesUpdated May 2026Editorial standards