Skip to main content
HonestMOS
●InvestigationsCongress made VA disability claims free to file. An entire industry charges veterans anyway — and nobody can stop them.→
←Back to 35L Counter Intelligence Agent — overview, pay, training, civilian translation, reviews
35LE4

Counter Intelligence Agent

E-4 (Specialist/Corporal) · Army

E1–E3E-4E-5E-6E-7E8–E9
HEADS UP

You have the Basic CI Badge and you are accountable for every contact you make. The team chief is signing your legal-authority packages — but your name is on the case file. One undocumented decision in a CI operation is a federal-record problem, not a counseling-statement problem.

The Honest MOS Read
SPC in the 35L world is the rank where the apprentice phase ends and the certified-agent phase begins. The Basic CI Badge on your wall is not a decoration — it is the legal credential that authorizes you to conduct CI contacts, run source developmental operations, and execute preliminary investigations under the team chief's oversight. The team chief signs the authority package; you run the operation. That distinction is real and the legal exposure is yours. Your case file is your product. Every contact you make generates a documented authority, a contact report, and an entry in the team's operational log. The team chief reviews and approves, but the quality of that documentation is the daily test of whether you belong in the next operational phase. The SPC 35L who writes clean, fully sourced, legally precise reports is the agent the team chief sends to the next-harder problem. The SPC whose reports come back full of redlines is the agent who stays at the basic case load longer. Source handling is the most consequential skill at this level. You are not running fully independent source operations — the team chief retains approval authority at phase transitions — but you are developing contacts through early stages, learning to assess motives and access, and writing the contact reports that feed the source validation cycle. The emotional discipline to manage a human asset as a managed human asset — not a friend, not a project, not a personal achievement — is a skill the AIT cannot fully teach. You learn it by watching what happens when an agent loses that discipline. The source gets burned, the operation gets burned, and the agent's career follows. The promotion path to SGT runs through BLC (Basic Leader Course) — it is a hard STEP gate under AR 600-8-19. No BLC, no SGT pin, no exceptions. Get your name on the BLC roster at the brigade NCO Academy 12 months before your TIS/TIG hits the SGT window. The 35L SPC who arrives at the promotion board with BLC complete, a clean case-file record, and a documented operational history is the SPC who does not spend two extra cycles as a specialist. The SRB conversation at first re-enlistment is worth running the math on early. 35L is frequently on the bonus schedule because CI accession rates do not always match attrition. Pull the current HRC SRB MILPER message before you sit down with the career counselor — not after.
Career Arc
  • 01Basic CI Badge certified; first solo contacts run under team-chief oversight with documented authority at each phase.
  • 02First finished MIRs and CIREPs submitted in final form — team chief signing, not rewriting.
  • 03Source developmental contacts begin: initial assessment through documented contact report, team chief approves phase transitions.
  • 04BLC roster name entered 12 months before TIS/TIG SGT window; BLC graduate before SGT board.
  • 05First re-enlistment window — SRB math, cross-reclass options (35F, 35M, 35N, 17C), or ETS evaluated honestly.
  • 06CI force protection source operations (CFSO) for the supported unit — walk-in program, threat brief cycle, source file maintained.
  • 07CI badge credentialing review — additional qualification courses, polygraph referral if selected, advanced CI training pipeline.
Common Screwups
  • ×Running a contact or interview without documented authority from the team chief — a single unauthorized CI contact can trigger a DoD IG inquiry and taint the entire case file.
  • ×Fabricating or embellishing a source report to make the product look stronger than the actual reporting warrants — fabrication in intelligence reporting is a federal felony, not a counseling statement.
  • ×DUI or Article 15 at this rank — the security clearance reinvestigation that follows is an existential threat to the career, and the 35L community has zero tolerance for criminal conduct in certified agents.
  • ×Undisclosed foreign contact or financial problem on the SF-86 CE update — non-disclosure is worse than the underlying event in almost every adjudication scenario.
  • ×Using CI badge or database access for any non-official purpose — personal curiosity, helping a friend, checking on a family member — CI authority is government authority and private use is a federal crime.

A Day in the Life

  • 0530PT — unit formation or team PT plan. CI section PT often runs before the battalion formation. Runs and functional work; the team chief sets the plan.
  • 0700SIPR traffic review — overnight INSCOM tasking messages, CE flags from supported-unit security managers, any reportable events from the previous 24 hours. Flag anything to the team chief before 0800.
  • 0800Case file work — review active operations for today's scheduled contacts or reporting requirements. Authority documents current? Contact report from last week filed? Team chief briefed on today's planned activities?
  • 0930Scheduled CI contact or interview — pre-contact brief with team chief, execute with documented authority, contact report drafted by end of day. If no contact today, source background research or preliminary investigation work.
  • 1130Contact report draft submitted to team chief for review. Address redlines same afternoon.
  • 1200Lunch. Out of the team room if you are eating with non-need-to-know personnel.
  • 1300CI force protection work — threat brief for a deploying unit, CFSO program file update, walk-in contact processing if one arrived. Documentation concurrent with every activity.
  • 1430BLC prep or Foundry advanced training if an afternoon window is available. The SPC who has BLC and advanced CI training in the pipeline does not wait for the team chief to remind him.
  • 1600End-of-day security check — classified documents in the safe, systems logged out, case files indexed, team chief informed of any status changes on active operations.
  • 1700Released unless the team is in an active operational phase. SIPR on-call status if the team chief is running a time-sensitive activity.

Weekly Cadence

Monday through Wednesday carries the operational weight — contacts scheduled, reports due, threat briefs for supported units, liaison meetings. Tuesday is typically the team chief's G2 or S2 brief day; the SPC's job the prior afternoon is to make sure every product in the brief is current, attributed, and formatted for the audience's classification level. If a preliminary investigation is active, the weekly rhythm bends around its timeline requirements. Thursday and Friday shift toward case file maintenance, source validation currency checks, and SF-86 administrative tasks. The team chief typically runs a Friday-afternoon legal-authority review: every active operation documented, every source contact logged, every case file audit-ready. The SPC who can confirm clean status on every file they own without consulting notes has built the right habits. The one who has to dig through folders for the authority document has not.

Key Skills — How to Drill Each

  1. 01
    Conduct a CI source development contact from initial assessment through documented contact report.
    Rehearse the approach and the elicitation plan before every contact — not in your head, out loud with the team chief or a senior agent playing the role of the source. The contact report needs to be complete by end of day: what was said, what was observed, what the source's motive and access assessment looks like now, and what the recommended next phase is. The team chief should be able to read it and make the phase-transition decision without asking a single follow-up question.
  2. 02
    Write a finished Military Intelligence Report (MIR) to INSCOM / theater reporting standards.
    Pull every finished MIR the team chief has signed and read them for structure before you write your first one. The BLUF needs to lead with the CI-relevant finding, not the context. Reliability and credibility assessments go in the body, not the footnotes. The team chief should sign it, not rewrite it. If the first three MIRs come back with wholesale redlines, ask the team chief to walk through one with you line by line.
  3. 03
    Execute a preliminary CI investigation (PCI) under the team chief's legal authority — Article 31 rights administered correctly, interview documented, legal review obtained before adverse action.
    The legal framework for a PCI is specific: the authority is bounded, the subject's rights are real, and the documentation must capture every step. Read the applicable DoD 5240.1-R procedures before you run the first PCI, not during. Ask the team chief for the unit's PCI checklist and run it explicitly, not from memory.

Manuals & References — What Chapters Matter

  • FM 2-22.2 — Counterintelligence.
    At SPC you are citing FM 2-22.2 in operational products, not just reading it for the test. The chapters on source operations, CI interviews, and the legal authority framework are the ones you mark up. When the team chief asks why you ran a contact a certain way, the answer should include a doctrinal basis.
  • ATP 2-22.2-1 — Counterintelligence Techniques and ATP 2-22.2-2 — Counterintelligence Support to Force Protection.
    The how-to companion to FM 2-22.2. ATP 2-22.2-1 covers interview techniques and source development methodology in operational detail; ATP 2-22.2-2 covers the CFSO program and CI force protection mission you may run for a supported unit. Both are worth re-reading after the first year in the unit, because AIT familiarity is different from operational application.
  • ICD 304 — Human Intelligence.
    Source validation standards in the IC run through ICD 304. The 35L and 35M MOS missions both feed the same validation framework, and the SPC 35L who understands both the Army-side (AR 381-20) and the IC-side (ICD 304) standards is the SPC who writes validation reports the theater J2X does not have to reformat.

Standards — How to Hit Each

  • Basic CI Agent Badge awarded and operational before the SPC promotion board.
    The badge is the certification floor, not the competency ceiling. Once awarded, the next question is the advanced CI training pipeline. Ask the team chief what the unit has available — JCITA courses, advanced CI agent courses, polygraph examiner school if you are selected. The SPC with the badge plus one advanced qualification is materially stronger at the SGT board than the SPC with only the badge.
  • Zero unresolved legal-authority gaps on any active case under your name.
    Build the case-file checklist habit now: authority documented, team-chief review recorded, phase-transition approval noted. Run the checklist before every contact, not after. The team chief should never have to ask where the authority document is — it should be the first page in the case file.
  • Annual SF-86 CE update submitted on time, complete, with all reportable changes noted.
    Foreign contacts, significant financial changes, cohabitation with foreign nationals, employment changes for family members — anything that would have been reported on the initial SF-86 is reportable on the CE update. When in doubt, report it. The adjudicator decides what is significant; your job is completeness. Late or incomplete updates are the number one clearance issue the INSCOM security officer sees at the SPC level.

Technical Mistakes — Concrete Consequences

  • Running a contact that escalates beyond initial-assessment authority without calling the team chief.
    The legal authority phases in CI operations are hard stops, not soft guidelines. An unauthorized developmental-phase contact after an initial-assessment authority is an illegal operation under DoD 5240.1-R; the case file is tainted, the source relationship is legally questionable, and the team chief's authority package is retroactively invalid. The DoD IG does not distinguish between 'operational pressure' and 'deliberate violation' in this analysis.
  • Over-attributing to a source in a contact report — making the source's reporting sound more specific or reliable than it was.
    One embellished source report propagates through the intelligence system: it gets cited in the next INTSUM, briefed to the G2, and potentially used for an operational decision. When the inaccuracy surfaces at the validation review, every product built on that report is retroactively questioned and the agent's reporting credibility takes a permanent hit with INSCOM.
  • Treating a source as a friend — personal communication outside structured contacts, unreported contact logs, emotional investment in the source's wellbeing over the mission.
    Source validation lapses are the most common CI compromise vector at the SPC level. A source who is a friend rather than a managed asset is a source whose foreign contacts go unreported, whose access claims go unchallenged, and whose reliability assessment is based on personal loyalty rather than corroborated reporting. The 35L who learns this the hard way does so in the INSCOM debrief after the operation is suspended.

Career Decisions at This Rank

  • BLC timing — push for an early slot vs wait for the natural window.
    BLC is a hard STEP gate for SGT. The SPC who has BLC complete before the TIS/TIG window opens pins SGT on the first board they are eligible for; the SPC who has not done BLC misses that board entirely. Get your name on the roster 12 months before the window. NCO Academy seats are allocated by unit priority and fill quickly; the SPC who asks first is usually the SPC who gets the slot.
  • Cross-reclass at first re-enlistment vs staying 35L.
    The first re-enlistment window is the primary Army-funded reclass opportunity. Common 35L cross-reclass paths run toward 35F (all-source analysis — same legal/SCIF environment, analytic focus), 35M (HUMINT collector — adjacent source handling skill set, more collection-side work), 35N (SIGINT analyst — different discipline, national-agency career arc), and 17C (cyber operations — longer school pipeline but strong civilian market). The right answer depends on which part of the 35L job you actually like: the investigation and source handling, or the threat analysis and briefing. Talk to soldiers in the receiving MOS before signing.
  • Warrant Officer packet — begin building candidacy now or wait until SGT.
    The 350L CI Technician Warrant Officer path is the most capable CI track in the Army. The strongest CI agents start building the candidacy packet at SPC and submit at SGT or SSG. The team chief's recommendation is the most important line in the packet; the SPC who consistently produces clean case files and demonstrated legal discipline is the SPC the team chief recommends. Ask the team chief what the packet requires and start building the documentation now, even if submission is two years out.

How the Seat Varies by Unit Type

  • Brigade/division G2X CI section
    Broad CI mission set at the tactical level — force protection source operations, walk-in processing, OPSEC support, foreign-contact screening, threat briefing for deploying units. A SPC here is running real operations within 18 months. The team is small, the team chief is close, and the mission variety is high. Advancement is visible and quick if the work is clean.
  • INSCOM field element / 902nd MI Group
    More operationally complex, more compartmented, more exposure to the full legal authority framework and multi-agency coordination with FBI, DCSA, and DIA equities. The 902nd MI Group is the Army's CI enterprise — cases here are more sensitive and the documentation standard is higher. The SPC who spends a tour here understands the enterprise better than peers who did not.
  • Deployed CI team
    Garrison training compresses fast. Operations the SPC rehearsed in a controlled environment become real requirements under time pressure. The team chief may be 20 minutes away by SIPR rather than 20 feet away. Every case file decision has real intelligence consequences. The SPC who has internalized the legal authority framework before deployment does not need the team chief to make every call.
  • FBI/DIA/DCSA agency liaison
    Some SPC 35L assignments include embedded or liaison work with federal CI partners. This is unusual at SPC but not unheard of in specific theaters or commands. The SPC in this seat is working alongside GS-13/14 special agents who have been doing this work for a decade. The learning curve is steep and the tradecraft bar is high. The post-Army career pathway from this seat is unusually direct.

What Good Looks Like at This Rank

The good SPC 35L is the agent whose case files the team chief uses as the training example for the new PFCs. Not because they are impressive documents — because they are clean ones. Every authority documented. Every contact report filed same day. Every source reliability assessment honest, not optimistic. The intelligence report the team chief signs without redlines is the product the SPC sent, not a revision the team chief rebuilt. The source he is developing is being managed as a managed asset. The contact reports reflect access and motive assessment that gets more rigorous with each contact, not more comfortable. When the source's reporting changes character — goes quiet, starts reporting things that seem too convenient, has a new foreign contact they mentioned casually — the SPC notices and writes it into the next contact report rather than explaining it away. The team chief has started recommending him for the next operational phase and has his name on the BLC roster.

Preview — The Next Rank

SGT 35L is the rank where you stop being a certified agent and become an NCO who is also a certified agent — and the NCO part does not take a back seat. You will write counselings for SPCs and PFCs. You will own a portion of the team's operational case load with genuine accountability, not just documented authority. You will write NCOER bullets for soldiers whose careers depend on what you say. The first 90 days as an NCO in a CI team is the leadership learning curve that AIT did not prepare you for. The BLC you completed at SPC is the credential; the ALC packet you start building at SGT is the next STEP gate (ALC must be complete before you can pin SSG). The ALC slot competition at the regional NCO Academy is real — start the ATRRS coordination 12 months before you need the seat. The SGT 35L who has ALC scheduled, a clean operational record, and the team chief's endorsement for the WO program is on the track the senior CI NCO chain notices.
FAQ

35L E4 — Frequently Asked Questions

Q01What does a E4 35L (Counter Intelligence Agent) actually do?
As a certified CI agent you conduct supervised source operations, CI interviews, and preliminary investigations under the team chief's oversight.
Q02What's the most important thing to know as a E4 35L?
You have the Basic CI Badge and you are accountable for every contact you make.
Q03What does a typical day look like for a E4 35L?
Time-blocked day at the E4 35L rank tier: 0530 PT — unit formation or team PT plan. CI section PT often runs before the battalion formation. Runs and functional work; the team chief sets the plan, 0700 SIPR traffic review — overnight INSCOM tasking messages, CE flags from supported-unit security managers, any reportable events from the previous 24 hours. Flag anything to the team chief before 0800, 0800 Case file work — review active operations for today's scheduled contacts or reporting requirements.…
Q04What mistakes get E4 35L soldiers fired or relieved?
Running a contact or interview without documented authority from the team chief — a single unauthorized CI contact can trigger a DoD IG inquiry and taint the entire case file; Fabricating or embellishing a source report to make the product look stronger than the actual reporting warrants — fabrication in intelligence reporting is a federal felony, not a counseling statement;…
Q05What career decisions matter most at the E4 35L rank tier?
BLC timing — push for an early slot vs wait for the natural window — BLC is a hard STEP gate for SGT. The SPC who has BLC complete before the TIS/TIG window opens pins SGT on the first board they are eligible for; the SPC who has not done BLC misses that board entirely. Get your name on the roster 12 months before the window. NCO Academy seats are allocated by unit priority and fill quickly; the SPC who asks first is usually the SPC who gets the slot; Cross-reclass at first re-enlistment vs staying 35L — The first re-enlistment window is the primary Army-funded reclass opportunity.…
Q06What's next after E4 for a 35L (Counter Intelligence Agent) in the Army?
SGT 35L is the rank where you stop being a certified agent and become an NCO who is also a certified agent — and the NCO part does not take a back seat.
Q07What manuals and regulations does a E4 35L need to know cold?
FM 2-22.2 — Counterintelligence (the doctrinal backbone for every operation you run).; ATP 2-22.2-1 and ATP 2-22.2-2 — CI Techniques and CI Force Protection Support (you teach from these now, not just read them).; DoD 5240.1-R — Procedures Governing DoD Intelligence Components (every legal authority for your operations is grounded here).

This playbook has no tips yet. Be the first to share what you know.

Published by the Honest MOS Editorial DeskVerified against DoD/.gov sourcesUpdated May 2026Editorial standards