LN324-91
CHAPTER XV
INSURRECTION AND ESPIONAGE INTERVIEWS AGAINST
THE ARMED FORCES (SEAAF)
INTRODUCTION:
In criminal cases, the identity and the capture of the person is the
main objective. In espionage cases the identity of the person is only the
first step. The most important thing is the knowledge of his contacts,
objectives, information sources and communication methods. The capture and
public news of the incident must be the last resource used by the counter
intelligence agencies. It is better to identify these persons, what they are
doing, and stop the movement of their efforts than to expose them to the
public and then try to find out who are their successors.
GENERAL FACTS:
A. Receiving the source.
1. The counter intelligence agent must be professional and courteous
with the source.
2. Identify yourself and show your badge.
3. Obtain identification facts about the source.
NOTE: Establish harmony, be friendly and alert, this will help the source to
feel confident. Once the harmony has been established with the source, you
must be able to hold this confidence during the interview.
4. Determine the purpose and intention of the source.
a. An unscheduled source is a person who comes to a counter
intelligence agency to offer information he believes is of interest to
military intelligence.
b. The information the source provides must fall within the
intentions of SEAAF.
5. Once you obtain the identify data from the source you must start
the review of files to:
128
LN324-91
a. Determine if the source appears in the nuisance files.
b. Determine if the Military Police or other agencies have
information about the source.
6. If the review of files reveal that the source is in the nuisance
files you must:
a. Thank the source for the information.
b. Close the interview and say goodbye to the source.
7. If the files do not have information about the source, continue
the interview.
B. Carry out the interview.
1. First ask permission to the source to use a tape recorder to
record the content of the interview. Explain that the tape recorder will help
you to prepare the final report as a verbal transcription which the source
will have the opportunity to review, correct and sign.
2. Turn on the tape recorder "only" if the source agrees to let you
use it.
3. Give the source the oath of truth.
4. Have the source tell you the incident.
a. Encourage the source to tell you the incident in their own words.
b. Be alert and listen to the source and take mental notes of
important points to explore these points during the review of the incident
with the source.
c. DO NOT write notes while the story of the incident is told.
d. DO NOT interrupt the source while telling the incident.
NOTE: If the source goes of f the incident theme he is telling, tactfully
make the source return to the main theme.
129
LN324-91
NOTE: If during the interview the source tells you information outside your
jurisdiction, ask the source to go to the appropriate agency. If the source
does not wish to go to that agency, continue the interview and collect the
information and send it to the proper agency.
C. Carrying out the review of the incident.
1. Assure the source that the information will be kept in strict
confidentiality.
2. Review the incident with the source point by point to clarify
discrepancies, contradictions, and holes in the information.
3. Write with precision the additional sources.
D. Obtain history information about the source to help you evaluate
the information of the source. The history information must include:
1. Identify
2. Date and place of birth
3. Citizenship
4. Addresses (past and present)
5. Occupation
6. Reasons that motivated the source to provide information
E. Develop secondary information. Frequently the information and the
source's history could indicate that he could have more significant
information and it could be of value or interest to military intelligence.
F. Obtain a sworn declaration.
G. Advice the source that the interview has an official nature and
that he must not tell about the incident or nature of the incident to any
other person.
130
LN324-91
H. Closing the interview.
1. Notify the source that the investigation could require a
subsequent interview and new contacts with him.
2. Make arrangements to have new contact with the source.
3. Again notify the source about the official nature of the
interview.
4. Close the interview in a friendly note.
5. Exit or say goodbye to the source.
I. Start the evaluation of the incident to make sure that it is in
your jurisdiction.
J. Prepare the appropriate reports.
1. Prepare an initial report for SEAAF.
NOTE: Make an effort to send a detailed complete report. If a detailed report
takes much time, submit an intermediate report with the available information.
Afterwards submit the complete report.
2. Classify the SEAAF report according to the Normal Operation
Procedures.
NOTE: All SEAAF reports will receive limited distribution.
3. Write down the unit that will receive the SEAAF report.
4. Write down the unit that sent the report.
5. Write down the instructions to send the report.
NOTE: All the SEAAF reports require one of the following sending
instructions: "Required Night Actions" or "Hand during the first hours of the
day".
6. Complete paragraph A and 1-6 of the SEAAF report.
131
LN324-91
a. Write down the references in A.
b. Write down the date of the incident in paragraph 1.
c. Write down the place of the incident in paragraph 2.
d. Write down the following information from all the involved persons
in paragraph 3:
1. Complete name (father's last name, mother's last name, first name
and initial)
2. Date of birth
3. Place of birth
4. Identity card
5. Unit assignation
6. Position
7. Day when separated from the Armed Forces
8. Type of access to classified information
e. Write down in the subsequent paragraphs to paragraph 3:
1. All the sources
2. All the witnesses
3. All persons who have knowledge about the SEAAF incident.
NOTE: If there is more than one person written down in any of the categories
mentioned above, write down as #1, #2, etc. (Example: Source 1, Source 2).
NOTE: If the data identification from the witnesses or suspects are not
known, write down a physical description available.
132
LN324-91
4. The description must include:
a. Age
b. Sex
c. Nationality/citizenship
d. Complexion
f. Height
g. Weight
i. Hair color
j. Eye color
k. Appearance
1. Physical built
m. Outstanding characteristics.
f. Write down in paragraph 4, a detailed description of the incident
as described by the source(s). Start the paragraph with details in regard to
as how the source came to the attention of your agency.
g. In paragraph 5, write down all actions taken, such as review of
files or interviews.
NOTE: You will not carry out more actions except as directed by a proper
higher agency.
h. In paragraph 8, write down any commentary or pertinent
recommendation about the source, suspect or the incident.
K. If applicable prepare the Agent Report with the appropriate
exhibits.
1. Send copy or the original and a copy directly to the appropriate
higher agency.
2. Send copy of the information, when instructed by the higher
investigation elements to the chain of command.
3. Do not do anything else, nor spread information unless it is
addressed to the appropriate higher agency.
133
LN324-91
CLASSIFICATION
REPORT ABOUT INCIDENTS
____________________________________________________________________
PAGE______FROM_____ DATE AND TIME_______PRECEDENT_______________________
___________________________________________________
FROM:
TO:
INFO:
INSTRUCTIONS FOR SENDING:
(CLASSIFICATION)
TITLE OF REPORT:
REFERENCES:
1. ( ) DATE OF INCIDENT:
2. ( ) PLACE OF INCIDENT:
3. ( ) PERSON(S) INVOLVED:
A. ( ) SOURCE(S):
B. ( ) WITNESS(SES):
C. ( ) OTHERS WHO HAVE KNOWLEDGE:
D. ( ) SUSPECT(S):
4. ( ) NARRATION:
5. ( ) ACTIONS TO BE TAKEN:
6. ( ) COMMENTARIES:
7. ( ) POINT OF CONTACT:
____________________________________________________________________NAME,
ORGANIZATION SPECIAL INSTRUCTIONS
AND TITLE OF ORIGINATOR
_____________________________________________________________
NAME, ORG., REVIEWER'S TITLE, TELEPHONE NUMBER
_____________________________________________________________
SIGNATURE OF REVIEWER REVIEW DATE
_____________________________________________________________
134
LN324-91
CLASSIFICATION
135
LN324-91
( )
REPORT ABOUT INCIDENTS
____________________________________________________________________
PAGE______FROM______ DATE AND TIME__________PRECEDENT_______________
____________________________________________________________________
FROM:
TO:
INFO:
___________________________________________________________________NAME,
ORGANIZATION SPECIAL INSTRUCTIONS
AND TITLE OF ORIGINATOR
_____________________________________________________________NAME, ORG.,
REVIEWER'S TITLE, TELEPHONE NUMBER
_____________________________________________________________
SIGNATURE OF REVIEWER REVIEW DATE
_____________________________________________________________
( )
136
LN324-91
CHAPTER XVI
ESPIONAGE INVESTIGATIONS
INTRODUCTION:
As counter intelligence special agent you must have specific knowledge
of the aspects of an espionage investigation to get security information for a
Commander of the Armed Forces responsible for the safety of his command. You
as espionage agent must always have in mind that all information must be
developed in detail, even though the information is favorable or unfavorable
for the SUBJECT.
GENERAL FACTS:
A. Preliminary Sheet (Figure 1).
1. Review the preliminary sheet (PS), found in the control office for
the investigation requirements. The PS has specific leads or leads that must
be investigated.
a. A PS has collected information during an investigation and could:
(1) Require a development of more investigative leads.
(2) Identify a source that will provide additional information about
the case or leads about additional sources that could have information.
b. Areas of interest in the PS are: (Figure 2)
(1) Block 1, SUBJECT: Contains information about the identity of the
SUBJECT of the investigation.
(2) Block 4, TYPE AND REASON FOR THE INVESTIGATION: Contains the
specific leads or the leads that must be developed. This block also contains
information of history and special instructions that will help the special
agent in the requirements to develop the leads.
137
LN324-91
(c) SIGNATURE BLOCK: Make sure that each PS is signed with the
signature of the official in charge of the case or authorized person.
(d) BLOCK 8, CONVINCING DOCUMENTS: Identify all convincing documents
that are not considered necessary to the development of the required leads.
2. Review the initial report prepared by the personnel of the Armed
Forces (AF) involved or who have knowledge of the incident or situation.
NOTE: With the exception of obtaining the initial details of the incident and
submitting the priority report, only elements of counter intelligence are
authorized to investigate SEAAF cases without the approval of the higher
department.
3. Start the espionage investigation when you have the approval from
the higher control office, based on the leads originated from various
information sources, including:
a. Reports from confidential sources.
b. Reports from other intelligence agencies, security, or police
agencies or national guard.
c. OPSEC evaluations, CI technical inspections or reviews.
d. The review of refugees, border crossers, displaced persons, PGE
and other similar groups.
e. Routine security personnel investigations.
B. Identify the type of security investigation that you will conduct.
1. Incident investigations
a. These are activities or specific actions.
b. Implications are suspected from acts of espionage.
138
LN324-91
c. This case will be kept as Type of Incident during the
investigation, although, the identity of the person implied will be
established at a later date.
2. The Personal SUBJECT investigations.
a. Imply one or more known person.
b. They originate allegations about the specific activities of the
person.
c. This case will be kept as personal SUBJECT investigation, although
information has developed about an act or specific activity.
3. Investigative jurisdiction. The jurisdiction for the CI section
will take place according to the SOP laws.
C. Review of legal statutes which applied to the espionage acts.
1. Espionage - Is the act of obtaining, giving, transmitting,
communicating or receiving information regarding the national defense with the
intention or reason to believe that the information is going to be used to
harm a national government or for the benefit or advantage of a foreign
country.
a. Any person or persons with legal or illegal possession, access,
control over, has been given confidential information regarding the national
defense, which the person in possession has reason to believe the information
could be used to harm the national defense and for the benefit or advantage of
a foreign country, voluntarily communicates, transmits, or tries to
communicate, or transmit this information, to any person who is not authorized
to receive it, is guilty of an espionage act.
b. Any person or persons in charge, or in legal possession and
control over national defense information, who by negligence allows the same
to be lost, stolen, displaced, destroyed, or removed from the place of
safekeeping, or gives this information in violation of faith and trust, is
guilty of a espionage act.
139
LN324-91
D. Review the operative methods (OM) of the hostile intelligence
agents regarding the activities of the espionage acts.
1. Review the types of hostile operations.
a. Legal Operations. Involve espionage networks which are controlled
by a representative from the foreign country who is official charge and is
sanctioned by the host country. Frequently, the person possibly has diplomatic
immunity, and is not subject to inspections, detentions, or trials for ilegal
activities committed.
b. Ilegal Operations. Involve espionage networks that are not in
direct contact or relations with the foreign country. Most of these persons
are native of the country or of another country. Ilegal operations are more
difficult to detect and have the advantage that the operation is continued
during war time or in countries that do not have diplomatic relations.
2. Review the control methods of the hostile intelligence.
a. The centralized control procedures require approval from the
central headquarters from all the espionage activities. Many countries for
security reason regarding the espionage activities have a central control
point.
b. The internal control method. Involve operations conducted totally
within the host country. All hostile agents are controlled by a general
headquarter or by a residence that has been established in the same country.
This method is the most outstanding in the external method.
c. The external control method. Involve operations conducted within
the host country controlled by another country. This is the safest method to
control personnel.
3. Review the type of hostile agents used in a hostile operation.
a. Penetrating Agents have direct access to the information required
by the hostile country.
140
LN324-91
b. Recruited agents in massive form are badly trained and belong to
echelon of low category; these agents are infiltrated within the country in
great numbers when there are favorable opportunities within that country.
c. Confusion agents are used to deceive the intelligence agencies to
waste their efforts in useless investigations.
d. Provoking agents are used to provoke the intelligence agencies to
take inappropriate actions for their disadvantage.
e. Sleeping agents are kept inactive for a long time until the
hostile country has a mission for them.
4. Review the espionage network used by the hostile country.
a. The single system of agents involves collective intelligence
efforts from a person. These agents operate only with the support of the
administrative personnel, but only one person is involved in the collective
operations.
b. The echelon system are networks that provide security when great
number of agents are being used in operation. Only the leader of the network
knows the identities of all the members of the network. Contact is initiated
only by the higher echelon and code names are normally used. There is no
lateral contact because the members of the network do not know each other.
c. The cell system could be simple or complex depending in the number
of agents that each cell has. The members of a cell know the identities and
the places of each member involved in espionage acts. They have the liberty of
coming in contact with each other and as minimum a member of a cell keeps
contact with the supervisor. It may or may not be that they have arrangements
for unilateral contacts.
d. The echelon network could degenerate in emergencies in a cell type
system. Unilateral contact could develop and a member of a segment could be
instructed to establish contact with members of another segment.
141
LN324-91
NOTE: Most of the hostile intelligence services use more than one espionage
network to cover or operate in the same area.
5. Review the hostile recruitment methods
a. Acquisition techniques are used to find a person who has been
coerced or made to accept recruitment by force.
b. The analysis of sources/potential recruits makes a detailed study
of the files and information of past history to identify the potential the
person has as agent and his reactions to contacts or possible methods of
contact. The motivation of the recruitment also is determined (ideology,
money, coercion and selfishness).
c. The recruitment by contact is used to obtain contact with the
person and through him obtain his cooperation and involve him in espionage
acts. The contact could occur in the person's own country or while the person
is traveling in a communist country. The customary way of hostile agents is to
allow another person to make the contact and not to involve the agents that
did the consecutive process and the analytical steps.
NOTE: The "Small Hook" is the favorite method used by the hostile
intelligence service to prepare the potential agent. In this method, the
subject is requested to provide innocent information and material of no value
to intelligence or classification.
6. Review of the hostile camouflage method.
a. The natural camouflage is the way of legal residence or entry to a
country, the use of a real name frequently, occupation or legal ways. The
local persons who are recruited normally operate under the natural camouflage
because they have established in the community and are employed in the
country.
b. The artificial camouflage involves the fabrication of history and
position of an agent and the falsification of identification documents in a
way that matches the fabrication of history and camouflage history.
142
LN324-91
7. Review the hostile communication method.
a. Conferences are normally kept to the minimum, but when used, these
conferences take place in public areas so as not to arouse the public
curiosity.
b. Official messengers are used to transport information to the
control official. Diplomatic bags are considered as the safest method to carry
material obtained for espionage acts.
c. The post is used to carry information, using codes, secret writing
and microfiche.
d. Radios or communications systems are mainly used during operations
in war time, but instructions could be transmitted to agents using lateral
communication systems at any time such as CB radios or Motorola. The
communications through cryptographic systems are used to transmit messages in
a safe way.
e. "Mail drops" are hidden secret places used to transmit or safekeep
information and material. Most of the services of hostile intelligence put
considerable emphasis in the use of "mail drops".
NOTE: Always keep in mind that mail drops could be done by a middlemen and
moved to another mail drop to provide necessary security to the controlling
officer.
8. Review the Financing Method for espionage activities.
a. Limited or unlimited resources are normally available for
espionage operations to the hostile agent.
b. The financial resources will come from the hostile country.
c. The financial resources will be obtained by organizations or
hidden business.
d. The financial resources will we obtained by ilegal activities
(black market, drugs, etc).
143
LN324-91
e. The financial resources or money of the target country are
transferred to the country by diplomatic bags, official messengers, or by
hostile agents.
f. Bank accounts are established in the target country for the access
of the agent.
E. Prepare an interrogatory plan (Figure 2)
NOTE: Depending on the type of investigation that will be conducted, the
available time, the investigation plan could require only a mental study, or
could be a written formal document requiring approval previous to the
continuation of the investigation.
1. Plan an investigative agenda detailed for each step of the
operation to:
a. Define the requirements of the information.
b. Define the pertinent aspects to be considered.
c. Prevent unnecessary investigative efforts.
2. When the plan develops, consider:
a. The reason or purpose for the investigation.
b. The assigned phases of investigation.
c. The investigation type (open, covered).
d. Priority and suspension time.
e. The restrictions or special instructions.
f. A definition of the problem.
g. The methods and sources that could be used (review of files,
interviews, etc.)
144
LN324-91
NOTE: There is no fixed procedure that could be recommended for treatment of
an espionage investigation. One must determine the specific method to each
individual case based upon the circumstances of the case.
h. The coordination requirements.
3. Update the investigation plan.
a. When new data is discovered.
b. As a result of continuous analysis.
F. Conduct an investigation of the incident based upon the
type, if appropriate.
1. Go to the incident's place.
2. Protect and safeguard the incident place giving appropriate orders
and isolating the place physically. All non-authorized persons must be taken
out of the place.
3. Find out the circumstances of the incident by visual observation
to determine the investigative approach that will be most appropriate.
4. Identify and segregate the witnesses.
5. Obtain photographs of the place, if required, provide a series of
photographs to give the maximum amount of useful information and to help the
reviewer to understand what had happened.
6. Search the place and collect evidence, if appropriate. Evidence is
defined as articles or material found in connection with the investigation or
that could help establish the identity of the person or circumstances that
caused the incident, in general, facts that will help uncover the events.
7. Control the evidence obtained.
G. Coordinate and conduct ties with other investigation
agencies. Coordination is a continuous activity during many of the espionage
cases.
H. Interview the witnesses.
1. Conduct interviews of witnesses in the place, if appropriate, to
obtain all the pertinent information.
145
LN324-91
2. During investigations of the subject, conduct interviews of all
the witnesses who could have pertinent information or knowledge of the case.
NOTE: The most time-consuming part of the investigation is the interview,
because through the interview we obtain the greatest part of the information
sources.
I. Conduct the review of files.
J. During investigations of incident type, it will be desirable
to make contact with the confidential sources for any information that comes
to your attention.
NOTE: Information regarding the espionage incidents or the present espionage
investigations will be limited only to few persons and only to persons who
need to know the information.
K. Conduct the investigative analysis of the facts of the case.
Although, an investigation is basically a collection of facts, the secondary
function is also important; the analysis of the facts. The analysis is
established in the review and comparison of facts from the case to develop a
hypothesis and come up with conclusions regarding the identity of the
suspects, circumstances surrounding the incident, and future actions.
NOTE: There are no established procedures to analyze the information from the
case to come up with a solution. One method could work as well as another
method. All must include the basic function of review, comparison, and
hypothesis.
1. Review all information available of the case.
a. Placement and correlation of all information.
b. Examine the information to identify the pertinent facts.
c. Determine the dependability of the information.
d. Determine the truth of the information.
2. Compare the information already known. (Figure 6)
a. Compare the available information with the legal espionage
elements.
(1) Identify the information that supports or show the legal espionage
elements.
(2) Identify the holes in the information that could be completed with
further investigations.
146
LN324-91
b. Compare the information obtained from witnesses to the information
from other witnesses or sources.
c. Identify the possible suspects by comparison of the information.
(1) Identify persons with connection to the incident.
(2) Identify the "opportunity" forpossible suspects.
("Opportunity"--the physical possibility that a suspects has of committing
espionage acts).
(3) Develop information to prove the motive of each suspect.
(4) Develop information that proves the intent of each suspect.
(5) Develop all the circumstantial evidences and associations of
each suspect.
NOTE: In cases of personal subject, the suspect, or possible suspect, is
identified therefore. Therefore all efforts are directed to identify his
connections in espionage acts, his opportunities, motives, and intents. Show
all information and evidence in terms of elements of required evidences to
support the charges.
3. Show one or more hypotheses. Hypotheses are theories that explain
the facts and that could be examined in later investigations. The best
hypotheses are selected to resolve the problem between the information
available.
a. Apply inductive or deductive reasoning to show the hypotheses.
147
LN324-91
(1) Inductive reasoning involves moving the specific and the
general. Develop generalities, from observations that explain the relationship
between events under examination.
(2) Deductive reasoning involves procedures from general to
specific. Starting with the general theory and applying it to the particular
incident to determine the truth contained in the theory of the incident.
NOTE: In both processes, the steps must follow a logical manner point by
point.
b. If you come to a point where the deductive reasoning is not
productive, consider using the intuition. Intuition is the quick, unexpected
act which clarifies a problem when the logical process and experimentation has
stopped. Intuition must not be ignored, particularly in difficult cases where
little progress is evident.
c. Put your hypothesis to a test of considerations of probability,
additional information of the witnesses and other known facts.
d. Eliminate various possibilities systematically considering each
hypothesis between:
(1) The opportunity
(2) The motive
(3) Observed activities
(4) Corroboration of the alibi.
e. Select the best hypothesis based in the consistency with the known
facts and the high degree of probability.
f. Examine the hypothesis objectively.
g. Modify and refute the hypothesis if contradictions to the evidence
are discovered.
4. Determine the direction of the future investigation
activities.
148
LN324-91
a. Identify future actions that will examine or verify the selection
of the hypothesis.
b. Ask approval from the higher control office to complete the
identified actions.
L. Conduct vigilance, if appropriate.
M. Conduct interviews of the SUBJECT, if appropriate.
N. Conduct interrogations of the SUBJECT, if appropriate.
0. Prepare the appropriate reports.
P. Consider an investigation successful when:
1. All information and pertinent material or allegations from the
case are discovered.
2. The physical evidence available is completely handled.
3. All witnesses were appropriately interviewed.
4. The suspect, if he allows, is interrogated in an effective way.
5. The report of the case was understood, clear and detailed.
149
LN324-91
EXAMPLE #1
PRELIMINARY SHEET
_____________________________________________________________________
PRELIMINARY SHEET DATE/START OF INVESTIGATION
_____________________________________________________________________
1. SUBJECT 2. DATE
NAME: RANK, RANK NUMBER
IDENTITY BADGE: 3. CONTROL NUMBER:
PLACE/DATE OF BIRTH:
_____________________________________________________________________
4. TYPE AND PURPOSE OF INVESTIGATION:
5. LEADS TO BE VERIFIED:
6. INFORMATION FROM HISTORY:
7. SPECIAL INSTRUCTIONS:
______________________________________________________________7.AGENCY
REQUESTING INFORMATION AGENCY PREPARING REPORT
______________________________________________________________
OFFICE OFFICE
______________________________________________________________
SIGNATURE (AUTHORIZATION) SIGNATURE (AUTHORIZATION)
______________________________________________________________
PERSON'S NAME NAME OF AUTHORIZED PERSON
______________________________________________________________
ADDITIONAL DOCUMENTS ENCLOSED ADDITIONAL DOCUMENTS ENCLOSED
______________________________________________________________
150
LN324-91
EXAMPLE #2
INVESTIGATIVE PLAN
1. REASON FOR INVESTIGATION:
2. TYPE OF INVESTIGATION: LIMITED
3. INVESTIGATION WILL BE CONDUCTED: DISCRETELY (Safety will be t h e
main
factor
during
the
invest
igatio
n).
4. PRIORITY:
5. SPECIAL INSTRUCTIONS:
a.
b.
6. INFORMATION GIVEN:
7. SEQUENCE OF INVESTIGATION:
a. Conduct review of local files.
b. Examine the subject's military and medical files.
c. Interview the following persons:
(1) Carry out the review the neighborhoods
(2) Carry out the review of the financial or credit reports.
NOTE: The plan mentioned above must have flexibility, it is only a guide.
Each case must be treated individually. Your plan could be similar, shorter or
longer, but this will depend upon the requirements dictated in the Preliminary
sheet.
151
Chapter 17
[Back to SOAW Home
Page] [Send email to
SOAW] [SOA Manuals]