Skip to main content
HonestMOS
●InvestigationsCongress made VA disability claims free to file. An entire industry charges veterans anyway — and nobody can stop them.→
←Back to 35L Counter Intelligence Agent — overview, pay, training, civilian translation, reviews
35LE1-E3

Counter Intelligence Agent

E-1 to E-3 (Junior Enlisted) · Army

E1–E3E-4E-5E-6E-7E8–E9
HEADS UP

You just graduated the 35L AIT at Fort Huachuca and you do not have a CI badge yet. That badge is the operational credential — without it you are a trained apprentice, not a running agent. Every hour between now and certification is practice for the moment you will need to get it exactly right.

The Honest MOS Read
You completed Basic Combat Training, then shipped to the United States Army Intelligence Center of Excellence (USAICoE) at Fort Huachuca, Arizona for the 35L10 Counterintelligence Agent course — a roughly 18-week pipeline that covers CI law, interview techniques, source handling fundamentals, report writing to INSCOM standards, database operations, and the legal authority framework that governs every action a CI agent takes. The curriculum is grounded in AR 381-20 and FM 2-22.2, and the cadre at Fort Huachuca will stop you cold if your interview technique shows you watching TV interrogation scenes instead of the doctrine. After AIT you arrive at your first unit — an INSCOM battalion, a G2 CI team at a brigade or division, a theater special operations CI element, or a Defense Counterintelligence and Security Agency (DCSA) field office — without the Basic CI Badge in your pocket. The badge comes after supervised field operations that meet the certification standard; the timeline varies by unit and operational tempo, but a year is a reasonable expectation. Until then, you are the junior agent in the room. You support. You observe. You take notes. You prepare packages under a senior agent's review. You do not run contacts solo and you do not improvise legal authority. What makes the PFC and PV2 35L seat different from a line-MOS junior enlisted billet is that your errors have federal-level consequences. A mishandled CI contact can trigger a Fourth Amendment or FISA violation. A source detail shared outside need-to-know can end an operation and a career simultaneously. An undisclosed foreign contact on your SF-86 is a criminal exposure, not an administrative one. The senior agent mentoring you is not being dramatic when he says these things — he has seen the damage. The fastest path to your badge and your first solo operation is to internalize the legal authority framework before anything else and treat the senior agent's oversight as a feature, not a restriction. In garrison you are spending a meaningful portion of your day in front of CI-relevant databases — DCGS-A, SIPR-based IC systems, law-enforcement coordination portals — running queries that support active operations. You are preparing CI Spot Report (CIREP) drafts for the senior agent to review and finalize. You are sitting in on interviews and debriefs, where your job is clean documentation and a single well-timed follow-up question at most. You are learning that the tradecraft starts with what you say at the team room BBQ: your MOS, your unit, your current operations — none of it belongs in casual conversation. The TS/SCI clearance and your SCI access are more valuable than your rank. Protect them like the career-defining assets they are.
Career Arc
  • 01Arrive at first unit, begin supervised operations under senior agent; target Basic CI Badge within 12 months.
  • 02First CIREPs and database support products submitted under team chief review — clean documentation is the metric.
  • 03Sit in on first CI interviews and liaison meetings; documentation role, not lead role.
  • 04SF-86 continuous evaluation (CE) updates begin — foreign contacts, financial changes, anything reportable goes in.
  • 05ACFT 540+ maintained; no adverse conduct, financial, or personal-history flags on the CE.
  • 06First re-enlistment window opens — pull the HRC SRB MILPER before deciding; 35L is frequently on the bonus schedule.
  • 07Basic CI Badge certification completes the apprentice phase; you are now a running agent under supervision.
Common Screwups
  • ×Any unauthorized disclosure of source identity, case detail, or operational information outside the need-to-know chain — this is a federal investigation, not a counseling statement.
  • ×Undisclosed foreign contact, financial problem, or personal conduct issue on the SF-86 CE update — adjudication is the government's job; your job is to report everything and let them decide.
  • ×UCMJ Article 15 or DUI: in a community where your security clearance is your career, an adverse action is an existential threat, not a speed bump.
  • ×Accessing a CI database without documented authorization or running a contact without team-chief approval — the audit trail is real, the legal exposure is real, and the INSCOM security officer reads both.
  • ×Discussing your MOS, unit, or any operational detail outside a need-to-know context — tradecraft begins with what you say to the barista.

A Day in the Life

  • 0500Wake, personal PT if the unit runs individual morning sessions — CI teams often have flex PT windows before the 0630 formation.
  • 0630Unit PT formation. CI sections are typically small enough that the team chief runs the PT plan directly. Runs, rucks, and functional strength depending on the week's plan.
  • 0800Team room open. Review overnight traffic on SIPR — threat reports, INSCOM tasking messages, any CE flags referred by the supported unit's security manager. Flag anything reportable to the team chief.
  • 0900Case file support work — database queries assigned by the senior agent, background research on a contact target, organizing documentation for an active operation. Everything documented before it goes anywhere.
  • 1000Watch or assist on a scheduled CI debrief or interview. Your role: documentation and a single clarifying question if the team chief nods. Notes legible, contemporaneous, complete.
  • 1200Lunch. Eat away from the team room if you are eating with people who do not have a need-to-know for anything on your desk. Tradecraft is not dramatic — it is habitual.
  • 1300CIREP draft or MIR support work — take the morning's events, draft the report to INSCOM standards, submit to team chief for review. Expect redlines; implement them without ego.
  • 1430Administrative tasks — SF-86 CE update if one is due, Foundry course work if a seat is available, case file indexing for the team chief's source validation cycle.
  • 1600End-of-day file security check — every classified document accounted for, every system logged out, every case file in the safe. This is not optional and the team chief checks.
  • 1700Released unless there is an active operation requiring extended support. On-call by SIPR if the team chief is running a time-sensitive contact.

Weekly Cadence

Monday through Wednesday carries the bulk of the operational support load — database research, CIREP drafts, debrief documentation. The team chief typically briefs the G2 or S2 on Tuesdays; the PFC's job the day before is to make sure every product the team chief is pulling from is current, sourced, and formatted. If a debrief or contact is scheduled, the prep package (background, authority documentation, reporting plan) is built the day prior. Thursday and Friday tend toward administrative work — case file maintenance, SF-86 CE review if anything reportable happened during the week, Foundry training if the unit has an available seat. Friday afternoons the team chief runs a quick legal-authority review: is every active operation properly documented? Is every source contact logged? Is the case file audit-ready if INSCOM walks in Monday? The PFC who can answer "yes" on every file they touched is the PFC who goes home early on Friday.

Key Skills — How to Drill Each

  1. 01
    Run a CI database query in DCGS-A and SIPR-based IC systems to support an active threat review.
    Learn the query syntax and access protocols the first week — do not wait for someone to walk you through it twice. Every query requires documented authorization; build the habit of noting the authority in the case file before you run the search. The senior agent should never have to ask why you ran a query.
  2. 02
    Prepare a CI Spot Report (CIREP) draft to INSCOM reporting standards — event, time, location, CI relevance, reporting unit.
    Read every finished CIREP the team chief will let you see. The format is learnable in a week; the standard — specific, sourced, no embellishment, no inference presented as fact — takes months of redlines to internalize. Write a draft for every reportable event, even the ones that do not go anywhere. The volume builds the discipline.
  3. 03
    Document a CI debrief or interview accurately and contemporaneously while seated as the junior agent.
    Practice shorthand before you are in the room. Your documentation is the legal record; gaps, paraphrases, and after-the-fact reconstruction are all problems. If you are unsure whether something was said, flag it as 'approximate' in the notes rather than presenting reconstruction as verbatim. The team chief should be able to read your notes and reconstruct the interview.

Manuals & References — What Chapters Matter

  • AR 381-20 — The Army Counterintelligence Program.
    The governing regulation for everything the Army CI program does — what it authorizes, what it prohibits, and what requires higher-level approval. Read it cover to cover in the first 30 days. The sections on CI force protection activities, source operations authority, and the boundaries between Army CI and FBI / NSA equities are the ones you will live in.
  • FM 2-22.2 — Counterintelligence.
    The doctrinal field manual that defines the CI mission, the collection disciplines, and the operational framework. Your AIT was built on it; your first assignment will test whether you actually understood it or just passed the test. Chapters on CI interviews, source operations, and force protection are the first to re-read when you arrive at the unit.
  • DoD 5240.1-R — Procedures Governing the Activities of DoD Intelligence Components.
    The legal authority document behind everything CI does. Every CI contact, investigation, and collection activity is authorized under a specific procedure in this document. The PFC who can cite the applicable procedure by number is the PFC the team chief trusts to run the contact correctly.

Standards — How to Hit Each

  • TS/SCI in adjudication complete and SCI access granted before operational assignment.
    The clearance is not your achievement — it is your baseline. Protecting it is the achievement. Every lifestyle decision from the moment you signed the NdA is part of your clearance picture. Foreign contacts, financial stress, social media, relationships — the adjudicator sees the pattern; make sure the pattern is clean.
  • First CI Report (CIREP) submitted within 90 days of arrival at unit.
    You are collecting and reporting from day one, even as an apprentice. Work with the team chief to identify the first reportable event or threat indicator you can draft against. The CIREP does not have to be high-impact — it has to be accurate, formatted correctly, and submitted through the proper chain. The discipline of early reporting is more important than the content of the first report.
  • ACFT 540+ maintained through the full PV1-PFC phase.
    CI agents deploy to austere environments and austere conditions. The team chief who has to carry a struggling PFC on a CI mission writes about it. Train the ACFT events specifically — the 3-rep max deadlift and the two-mile run are the ones that pull scores down. Hit the gym with the same discipline you bring to the case file.

Technical Mistakes — Concrete Consequences

  • Sharing case details or source information with a peer outside the need-to-know chain.
    A single conversation in the wrong room can end a multi-year source operation, trigger a federal investigation into the disclosure, and remove you from the program permanently — with a federal record that follows the civilian career.
  • Accessing a CI database without documented authorization for the specific query.
    The audit trail in every CI system is permanent and reviewed. An unauthorized query shows up in the next INSCOM security audit; the explanation you give had better match the documented authority or you are explaining yourself to the INSCOM security officer and potentially the DoD IG.
  • Conducting an unsupervised contact or interview before receiving authorization from the team chief.
    An unauthorized CI contact can constitute an unlawful search under the Fourth Amendment or a violation of the FISA framework, depending on the subject. The legal exposure is not limited to you — it taints the entire case file and can result in the operation being shut down and the team chief facing a relief-for-cause review.

Career Decisions at This Rank

  • First re-enlistment — stay 35L vs reclass vs ETS.
    The first re-enlistment window opens 12-18 months before your contract end. 35L is frequently on the Selective Reenlistment Bonus (SRB) schedule per the current HRC MILPER message — pull the message before the career counselor brief, not after. If you genuinely like CI work — the investigative patience, the legal framework, the source handling — re-enlist. If you enlisted for an adventure and found bureaucratic case files, the reclass list (35F analyst, 35M HUMINT, 35N SIGINT, 17C cyber) is the honest exit. ETS to federal civilian is a longer arc than most PFCs realize; the GS-scale CI pipeline requires investigative experience you do not yet have.
  • Basic CI Badge certification timeline — push it or let the team chief set the pace.
    The badge is the operational credential and the signal to the team chief that you are ready for supervised solo operations. Do not nag for it, but do not be passive either. Ask the team chief specifically what they need to see before they sign the certification package. Run the checklist explicitly, not implicitly. The PFC who earns the badge at 10 months is the SPC who gets on the SGT board first.
  • Language training — volunteer for DLPT testing or DLI pipeline.
    The Foreign Language Proficiency Bonus (FLPB) per DoDI 1340.27 pays monthly for soldiers who carry a current DLPT score on a controlled language. CI work — particularly liaison operations, source handling, and foreign-contact investigations — is materially easier with a language. If you grew up bilingual or have a heritage language at working proficiency, get tested now. If you have genuine aptitude for languages, the DLI pipeline is worth considering at re-enlistment. The CI community values language capability; it shows up in assignment preference and WO packet strength.

How the Seat Varies by Unit Type

  • Brigade/division G2X CI section
    Small team — 2 to 6 agents — supporting a BCT or division's force protection and CI mission. High contact with the supported unit's officers and NCOs. The CI picture is tactical: foreign-contact screening, OPSEC support, walk-in processing, CFSO program. A PFC here gets broad exposure to the CI mission set but limited depth on any one operation. The team chief is close by and the oversight is tight.
  • INSCOM field element / 902nd MI Group
    The 902nd MI Group is Army Counterintelligence — the home of Army-level CI investigations and the CFSO program for the Army as a whole. A PFC assigned here is in the building where the enterprise runs. The operational tempo is higher, the access requirements are stricter, and the case files are more complex. Less direct line-unit exposure, more exposure to the full legal authority framework and multi-agency coordination.
  • Deployed CI team
    The garrison training schedule compresses rapidly when the team is deployed. Operations that were supervised exercises become real reporting requirements. A PFC on a deployed team may be the only junior agent available for overnight watch or a time-sensitive database query. The team chief's oversight is still present but less physical. Every case file decision carries real consequences.
  • DCSA field office support element
    DCSA (Defense Counterintelligence and Security Agency) runs the personnel security investigation and CI programs for the DoD enterprise. An Army 35L assigned to a DCSA field activity works alongside GS-13/14 special agents and sees the civilian-IC side of the CI world early. The work is more administrative and investigative than operational; the exposure to federal CI tradecraft and the post-Army career pathway is significant.

What Good Looks Like at This Rank

The good PFC 35L is the one the team chief puts in the debrief room — not because the PFC is impressive, but because the documentation that comes out is clean. No gaps, no reconstruction, no inference presented as fact. The CIREP draft that lands on the team chief's desk at 0800 has every field filled, every event attributed correctly, and confidence language that honestly names what was observed versus what was inferred. The team chief edits the phrasing, not the substance. By month 12, the senior agent has stopped re-doing the database queries and started reviewing the PFC's output for quality rather than completeness. The SF-86 CE updates are submitted on time with zero omissions. The case files the PFC has touched are organized, indexed, and audit-ready. The team chief is already running the Basic CI Badge checklist and telling the SFC that this one is on track.

Preview — The Next Rank

SPC 35L is the rank where the Basic CI Badge is on the wall and the team chief starts treating you as a running agent rather than an apprentice. The shift is not cosmetic — it means your name is on the case file, not just the support documentation. You are writing finished intelligence reports in final form, not draft. You are conducting contacts and interviews under team-chief oversight, not just sitting in the room. The legal-authority burden moves from "watch and learn" to "know and execute." The SPC phase is also the window where the promotion-points math for SGT begins to matter. BLC is the hard STEP gate — no BLC, no SGT pin. Get your name on the BLC roster before the TIS/TIG window opens, not after. The SPC 35L who arrives at the SGT board with BLC complete, a clean case-file record, and a Basic CI Badge certification is the SPC who does not wait on a cutoff.
FAQ

35L E1-E3 — Frequently Asked Questions

Q01What does a E1-E3 35L (Counter Intelligence Agent) actually do?
After graduating AIT at the USA Intelligence Center of Excellence (USAICoE) at Fort Huachuca, you report to a CI team at an INSCOM unit, a G2 section at a brigade or division, a theater special operations CI element, or a Defense Counterintelligence and Security Agency (DCSA) field office.
Q02What's the most important thing to know as a E1-E3 35L?
You just graduated the 35L AIT at Fort Huachuca and you do not have a CI badge yet.
Q03What does a typical day look like for a E1-E3 35L?
Time-blocked day at the E1-E3 35L rank tier: 0500 Wake, personal PT if the unit runs individual morning sessions — CI teams often have flex PT windows before the 0630 formation, 0630 Unit PT formation. CI sections are typically small enough that the team chief runs the PT plan directly. Runs, rucks, and functional strength depending on the week's plan, 0800 Team room open. Review overnight traffic on SIPR — threat reports, INSCOM tasking messages, any CE flags referred by the supported unit's security manager. Flag anything reportable to the team chief,…
Q04What mistakes get E1-E3 35L soldiers fired or relieved?
Any unauthorized disclosure of source identity, case detail, or operational information outside the need-to-know chain — this is a federal investigation, not a counseling statement; Undisclosed foreign contact, financial problem, or personal conduct issue on the SF-86 CE update — adjudication is the government's job; your job is to report everything and let them decide; UCMJ Article 15 or DUI: in a community where your security clearance is your career,…
Q05What career decisions matter most at the E1-E3 35L rank tier?
First re-enlistment — stay 35L vs reclass vs ETS — The first re-enlistment window opens 12-18 months before your contract end. 35L is frequently on the Selective Reenlistment Bonus (SRB) schedule per the current HRC MILPER message — pull the message before the career counselor brief, not after. If you genuinely like CI work — the investigative patience, the legal framework, the source handling — re-enlist. If you enlisted for an adventure and found bureaucratic case files, the reclass list (35F analyst, 35M HUMINT, 35N SIGINT, 17C cyber) is the honest exit.…
Q06What's next after E1-E3 for a 35L (Counter Intelligence Agent) in the Army?
SPC 35L is the rank where the Basic CI Badge is on the wall and the team chief starts treating you as a running agent rather than an apprentice.
Q07What manuals and regulations does a E1-E3 35L need to know cold?
AR 381-20 — The Army Counterintelligence Program (the governing regulation; know what it authorizes and what it prohibits).; FM 2-22.2 — Counterintelligence (the 35L doctrinal field manual; read it cover to cover before the first assignment).; ATP 2-22.2-1 and ATP 2-22.2-2 — CI Techniques and CI Support to Force Protection (the how-to manuals that fill in what FM 2-22.2 frames).

This playbook has no tips yet. Be the first to share what you know.

Published by the Honest MOS Editorial DeskVerified against DoD/.gov sourcesUpdated May 2026Editorial standards