Counterintelligence          Printer Friendly


Counterintelligence

Note:  Each topic in bold face type in the Table of Contents is a separate file, so you cannot scroll to these topics. They need to be accessed from the Table of Contents. The Printer Friendly version includes all topics.

Our cleared personnel are primary targets of foreign intelligence services. They are the keepers of the nation’s secrets and are often working in exposed and vulnerable positions overseas or working with foreign nationals. The background investigation process is designed to provide assurance that personnel are reliable, trustworthy, loyal to the United States, and not vulnerable to foreign manipulation or coercion.

While procedures vary among agencies, the adjudicator of security clearances is in a unique position to look at the completed background investigation from a counterintelligence perspective and, in fact, may be the only person who is actually trained to do so. Knowledge of the threats posed by foreign intelligence services and the techniques they use to recruit and run spies is crucial to proper evaluation of potential indicators of counterintelligence risk that may be identified during the initial background investigation or periodic reinvestigation.

This module provides information that will allow personnel security investigators, adjudicators, and managers to recognize vulnerabilities that can be exploited by foreign intelligence collectors and understand how they do so. It provides a comprehensive list of counterintelligence risk indicators. It also discusses the vulnerabilities in espionage tradecraft that create opportunities for espionage to be detected by a knowledgeable observer.

The National Security Act of 1947 defines counterintelligence as “information gathered and activities conducted to protect against espionage, other intelligence activities, sabotage, or assassinations conducted by or on behalf of foreign governments or elements thereof, foreign organizations or foreign persons or international terrorist activities.”1 This definition has held up well over the past 60 years. While counterintelligence is concerned with all intelligence threats, including foreign collection of information from technical sources and open sources, this Counterintelligence module deals only with the insider threat -- the threat of espionage, terrorism, sabotage, or subversion by Americans with access to classified or other controlled or protected information.

Human Intelligence Threat

What is Human Intelligence?

Human intelligence, often called HUMINT, is simply the use of human beings as sources of intelligence information. It is the traditional spy, as well as the interrogation of detainees, and elicitation of information from unwitting persons. Despite the great advances that have been made in technical means of intelligence collection with satellites and communications intercepts, HUMINT remains uniquely valuable.

In the information age, human sources have access to vast quantities of information that can be carried out of a secure facility on devices smaller than a ball point pen. Transmittal of that information can be accomplished instantaneously, and it can be used to cause the death of our citizens and allies. Information about our weapons systems, technology, plans, and intelligence collection systems can negate the expenditure of many billions of dollars and seriously damage our ability to accomplish military missions, economic objectives, or foreign policy goals. To help counter this threat, personnel charged with security responsibilities need to understand that threat and their role in protecting against it.

Who is Targeting the United States?

America's role as the dominant political, economic, and military force in the world makes it the number one target for foreign espionage. As the largest economy in the world, the United States is seen as a competitor as well as a valuable market. We spend large sums on a broad range of research and development projects that are not available to the rest of the world. The results of that effort are very attractive to both foreign governments and foreign companies, because copying this research and development can save them millions of dollars and provide economic and military advantages. In addition to the intelligence services of friendly as well as unfriendly countries, sources of the threat to classified and other protected information include:

Individuals in both government and industry in almost 100 countries were involved in legal and illegal efforts to collect intelligence in the United States during 2004 .2  In addition, literally dozens of terrorist and criminal organizations are also engaged in intelligence collection efforts directed at the United States. The bulk of the activity, however, originates in a relatively small number of key countries. The National Counterintelligence Executive estimates that the top 10 collectors probably account for 60 percent of the suspicious foreign collection efforts against U.S. cleared defense contractors. 2

The U.S. Government, as a matter of policy, does not identify publicly which foreign countries represent the greatest intelligence threat. To do so would create a false sense of security when dealing with any of the unnamed countries, and such a list would soon be out of date. The key countries include friends and allies as well as strategic competitors. They conduct espionage against the United States for one or more of the following reasons:

What Are They After?

What are the spies and other intelligence collectors after? Everything that will help another country, organization, corporation, research institute, or individual achieve its political, military, economic, or scientific goals. It is important to realize that the scope of foreign intelligence interest in the United States is virtually unlimited. The most critical areas include future military and political intentions, military capabilities and vulnerabilities, economic and commercial policies, and foreign policy initiatives. Increasingly, however, technology ranks high in foreign collection priorities.

Technology that is critical to the protection of national security, including U.S. military superiority and qualitative advantage, is subject to U.S. security and export controls. These technologies, plus proprietary information that can provide economic advantages, are principal targets of foreign intelligence collectors.

Areas of technological interest change rapidly and can be very broad, but those of military concern are periodically collected and published as the Militarily Critical Technologies List (MCTL). As of 2004, the technologies on the MCTL that were most sought after by foreign intelligence collectors included: information systems (software and hardware), sensors (the eyes and ears of many military systems, including high-speed cameras, night vision equipment, and sensor platforms placed on unmanned aerial vehicles), aeronautics (unmanned aerial vehicles, composite materials, onboard computer management systems, experimental aerospace platforms), and electronics (used in virtually every weapons system to enhance performance and reliability while reducing size and increasing power.) 2

A current MCTL is available at http://www.dtic.mil/mctl. There is detailed information on each technology that is subject to export control and other regulations, as well as a general discussion of how this technology is used by the military.

Why Are We Vulnerable?

At the same time that the United States is increasingly a target of intelligence collection, we are in many ways becoming increasingly vulnerable to intelligence attack. This is discussed in greater detail in a separate file called Insider Espionage Is a Growing Threat. The head of the National Counterintelligence Executive, Michelle Van Cleave, listed some of our vulnerabilities as follows in September 2005 testimony to Congress: 3

In addition, the global war on terror has led to the deployment of many thousand U.S. military, government and contractor personnel to high-risk areas overseas. This war has also tested the loyalties of some U.S. citizens.

How Is Human Intelligence Conducted?

In theory, intelligence collection is a carefully planned enterprise that follows these steps:

As in most complex activities, however, there is often a gap between theory and actual practice. It is difficult for foreign intelligence collectors to identify Americans who are willing to spy for a foreign country. If a foreign intelligence officer is operating within the United States, he or she has to do it without getting caught, and this imposes many constraints on what they can do.

Although much intelligence collection against softer targets, such as defense industry and the scientific community, follows this theoretical model, intelligence collection against the harder targets is much more opportunistic. The intelligence collector grasps whatever opportunities become available. Indeed, most Americans who became spies during the Cold War volunteered their services to a communist country. They were not the product of a deliberate process of spotting, assessment, and recruitment. The current global environment is now much more conducive to the systematic assessment and recruitment of Americans by foreign intelligence services.

Spotting and Assessing Potential Targets

Once a collection requirement has been identified, the first step undertaken by a foreign intelligence service or agent is to determine where the desired information is located. This could be a specific government office, company, academic or scientific institution, or geographic location. The next step is to identify specific persons with access to the desired information and then to start collecting information on those persons.

This is commonly accomplished through open sources to the extent possible. The Internet provides an abundance of avenues for helping foreign intelligence collectors identify and assess intelligence targets. This includes searching the Internet for references to a target company in newspaper accounts, blogs, and Internet chat rooms, and identifying individuals who have published articles on a topic of interest. Information can often be elicited at conferences or meetings or during official visits to an installation. Acquisition of an organization's internal phone book is a common goal.

A foreign intelligence or security service will also identify people or organizations in its own country that have contact with the target organization. People who are familiar with target organizations or individuals will be interviewed. Visa or border control records will be checked to see if a target individual has traveled to his or her country. An organization or individuals within the organization may be put on a watch list for communications intercepts.

The next steps are assessment and recruitment. There are significant differences between how foreign intelligence services operate in the United States, where they are at risk of being detected, and how they operate on their home turf where risk is low and they have all the national resources available for their use.

Operations in the United States

Countries with an active intelligence collection program in the United States generally have several different types of assets here. They have professional intelligence officers whose job is to spot, assess, recruit, and handle agents or to support such activities in various ways. These operate under cover in an effort to conceal their role as intelligence officers. This means their cover job ties up most of their time. Some are in their embassy, a consulate, or an international organization that provides diplomatic immunity in case they are caught. Some have cover positions in a trade mission, as a newspaper correspondent, or as a businessman. These do not have diplomatic immunity and are subject to arrest if caught.

Others are sent to this country as agents rather than as professional intelligence officers. Their task is to penetrate a specific organization, identify or cultivate targets for recruitment, collect a specific type of information, or arrange for the illegal export of controlled technology. To achieve these goals, they come here for various ostensibly legal purposes, such as to open a business, participate in exchange programs or joint research projects, to monitor contracts for the manufacture and purchase of U.S. military equipment, or as visiting scientists or doctoral students.

For example, if a foreign intelligence service is targeting a highly specialized topic, such as high energy physics, the service might identify one of its own nationals who is an expert in this field. This individual will then be given intelligence training and inserted into a position that provides access to the needed information, or access to the foreign nationals who have this information. The tasking might be limited to cultivating selected attendees at international conferences, or the agent may be dispatched to the United States on one of the many exchange programs.

The professional intelligence officer will operate by developing as wide a circle of contacts as possible through membership in organizations, attendance at conferences, symposia, etc., and by exploiting all the possibilities inherent in his or her cover position. Different cover positions offer access to different groups of people. Many intelligence officers under cover in an embassy or as journalists work the diplomatic cocktail circuit and Capitol Hill. Others under cover in a consulate or trade mission work the émigré community or the business community.

Finding some means to establish personal contact with a target, either directly or through an intermediary, may involve an imaginative cover story. Some of the known ploys are various versions of the unsolicited email request for assistance and the ostensible headhunter interview to assess the target's interest in and qualifications for a job vacancy at another company. If the target is an emigrant from the intelligence officer's country, it may be possible to arrange a contact through émigré connections.

Once the initial contact is made, there is a process for assessing and developing targets for recruitment that is followed by most intelligence services. It is sometimes called the "road to recruitment." The first goal is to find or create some basis for further meetings. The intelligence officer then tries to become a friend, learning what makes a person tick, sympathizing with their problems, and feeding their ego. The rituals of espionage like secret meetings and dead drops are avoided, at least at the beginning. The goal is to make it easy for the target to become a friend. Developing some type of personal bond of common interests is much easier if the intelligence officer and the target share the same national, ethnic, or religious background.

If the target can be maneuvered into talking about things like the high cost of putting his two sons through college, the medical bills for his daughter's leukemia, disagreements with U.S. Government policy, or the unfairness of his boss, this is noted as a possible source of motivation for cooperation. If the target seems amenable, the intelligence officer will talk about topics of intelligence interest that are easy for the target to rationalize talking about, looking for ways to gain one small step of cooperation at a time. To gain sympathy, the intelligence officer may talk about his country's need for economic development or the threat from his country's enemies.

As this cultivation proceeds, the intelligence officer will try to create some basis for the target to feel obligated to the intelligence officer. The sense of obligation might be created by a prospective business deal, invitation to a foreign conference or seminar in the intelligence officer's country, information provided by the intelligence officer or access to influential people arranged by the intelligence officer, loans or grants, or assistance to relatives in the foreign country. If this is done right, the target may not know this is a spy operation until he or she is so far down the road to recruitment that he or she is either afraid to turn back or does not want to turn back.

Of particular interest from a personnel security perspective are those intelligence officers assigned to work their country's émigré community in the United States. These officers are often under cover in a consulate, rather than the embassy, where their overt functions include assisting emigrants in the United States who have problems with the home country or the U.S. Government, encouraging and facilitating travel to the home country, and promoting the culture of their home country. For example, intelligence officers under cover in the consulate are likely to handle the dealings with émigrés who contact the consulate to surrender their passport or renounce their citizenship.

Those intelligence officers who specialize in the émigré community have two goals: (1) to penetrate and monitor the activities of dissident groups who are opposed to the intelligence officer's current government, and (2) to spot, assess, and recruit émigrés who have access to information of value to the home country. For some developing countries, the legal or illegal acquisition of foreign technology to support the country's economic development and military strength is viewed as a national mission, not just an intelligence collection program.

Some countries with sizable émigré communities in the United States maintain detailed records with background information on their émigrés, their technical or scientific specialties, and where they are currently employed. These countries use such records to support open programs to recruit experienced engineers and scientists to return to their home country to contribute to the home country's economic development. These same programs are used to assess and recruit individuals to provide sought-after classified or other controlled information while remaining in the United States. One such program is discussed in detail in a separate file in this module entitled One Country's Program to Obtain U.S. S&T Secrets.

When a relationship is established that involves repeated meetings, this creates a security dilemma for the intelligence officer. He does not want the target to talk about the meetings or for the meetings to be observed and reported. However, if he asks the target to keep the meetings secret, the target may become frightened and withdraw from the relationship. When a relationship progresses to the point where the target agrees it is advisable to meet discreetly so they will not be observed, this marks a significant step forward on the road to recruitment.

Foreign intelligence operatives in the United States are careful to avoid being caught committing any offense for which they can be arrested or, if they have diplomatic immunity, be expelled from the United States. Even those with diplomatic immunity want to avoid being expelled, as that limits their future foreign assignments and is not career-enhancing. They also need to be careful to avoid traps laid by the FBI. To avoid or minimize the potential adverse consequences of an unsuccessful recruitment approach, arrangements are often made for the target to travel to the intelligence officer's home country for some reason, and the recruitment is done there.

Operations Outside the U.S.

When foreign intelligence services are operating at home, the operational environment and their capabilities are very different than in the United States. They can operate aggressively on their home turf because there is no risk of being caught. They have access to all the resources of the local government including police, customs and border control authorities, financial organizations, universities, and businesses. Therefore, they can monitor and, to some extent, control the environment in which an American living in or visiting their country lives, plays, and works. Americans, by contrast, are at a disadvantage, because they are in unfamiliar territory.

In many cases, the foreign intelligence service will know in advance that a target of interest is coming to their country. The forthcoming trip will have been reported, and in some cases arranged, by one of their intelligence officers or agents in the United States.

Others are identified as targets only as a consequence of their trip to that country. American visitors draw the intelligence or security service's attention when they:

Operations against Americans visiting or residing in the foreign country are of two types. One is to simply steal or elicit information of value without trying to recruit the American, while the other is the traditional effort to assess and recruit Americans as spies.

Exploitation Without Recruitment: In many countries, U.S. Government officials, scientists, engineers, and businesspersons who are known to have valuable information are targets even if there is no hope of recruiting them as agents. Information can be obtained from them in other ways. This includes Americans who come for discussions or negotiations with the government or other major organizations or corporations. The intelligence service seeks to obtain from them information to help its country gain the best possible outcome from these discussions. U.S. intelligence does not conduct intelligence operations for the benefit of U.S. corporations, but other countries with aggressive intelligence services do, especially for corporations that are controlled by their government.

The tools for obtaining information are surreptitious entry into laptop computers, briefcases, and suitcases left in the visitor's hotel room; secret monitoring or recording of phone conversations that take place in hotel rooms, offices, meeting areas, and sometimes restaurants; intercepting phone, fax, and e-mail communications when feasible; and sophisticated elicitation techniques. These kinds of operations are all commonplace in a number of countries, including some countries who are friends and allies of the United States. A separate file entitled, In the Line of Fire: American Travelers Abroad, has twenty anecdotes reported by American scientists about their experiences during travel overseas on official business to attend meetings and conferences and to perform research.

In some countries, the security service has its own offices in the principal hotels used for large conferences. It takes only a minute or two for someone to enter a hotel room and bug the telephone so that all room conversations can be monitored from a line connected to the hotel switchboard.

Office communications are also vulnerable to monitoring. Many foreign telecommunications companies are owned or controlled by the government. Even those not government-owned or controlled are regulated by the government and will normally cooperate when their government requests assistance in monitoring specific lines. Under such controlled circumstances, it is easy to intercept any form of electronic communications. Legal restrictions governing technical surveillance that apply in the United States have not been adopted by most other countries with which we have close trading ties.

Elicitation of valuable information during a seemingly normal professional or social conversation is also surprisingly effective, as most of us want to be polite and helpful, appear well-informed about our professional specialty, and be appreciated for our work. We also don't want to be suspicious of other people's motives and are uncomfortable telling lies. Trained intelligence operatives take advantage of these good qualities to get us to tell them things about ourselves, our colleagues, or our work that ought to be kept to ourselves.

Assessment and Recruitment: The process for assessing and developing a target for recruitment differs somewhat from how it is done when operating in the United States, as far more resources are available to the intelligence officer. It may also be greatly accelerated if the target is visiting the country and accessible for only a short time. When operating in the home country, the approach is more likely to include efforts to entangle the target in sexual or other activities which are questionable morally or legally, and more likely to combine persuasion and incentives with pressure and coercion if that becomes necessary to achieve the goal.

Relatives, business contacts, sexual partners, tour guides, taxi drivers, and anyone else having contact with a potential target can be asked about the target, and some will be recruited as informants. An intelligence officer can use a variety of ruses and covers such as a journalist, researcher, businessman, tourist board representative, public opinion pollster, or policeman to establish direct contact with the target in order to assess reactions to various questions or circumstances. Operationally useful information may be available from searching the target's hotel room, monitoring the target's phone conversations, or other technical sources. 

Depending upon the results, the target may be dropped, the intelligence service may move forward with a recruitment approach, or arrangements may be made for continuing assessment. If the target is returning to the United States, some guise may be found to maintain contact to discuss a possible business proposition or research assistance or to discuss any other common interest, or a pretext may be found to introduce the target to another intelligence officer in the United States.

Motivation and Recruitment

Many years ago, the conventional wisdom was that the only Americans who would spy against their country were communists or persons coerced against their will. In more recent years, the conventional wisdom has been that most Americans who betray their country's secrets do it for money -- either financial need or greed. It is true that most spies are paid for their services, but motivation is often more complex than that. Most Americans are in need of money, or want more money for whatever reason, but very few are willing to commit espionage to get it. So need and greed are relevant factors, but these factors alone are not predictive of willingness to commit espionage.

Broadly defined, motivation is a state of mind that influences one's choices. Motivation for espionage generally results from a complex interaction between personal characteristics and the situation in which the person finds himself or herself. The separate file on Behavior Patterns and Personality Characteristics Associated with Espionage discusses some of the relevant personal characteristics.

The intelligence officer's goal when assessing a target is to figure out what is so important to that person that it can move him or her to action. Money is certainly one possible motivator, but it moves a person to action such as espionage only if other personal beliefs, character weaknesses, or emotional needs are present as well.

Weaknesses or vulnerabilities that a foreign intelligence officer will try to identify and exploit include the following:

How the foreign intelligence service structures the recruitment approach varies greatly depending upon the assessment of what might motivate the target to agree. One common practice is to proceed gradually, starting with requests for small favors that seem innocuous and building up gradually to more sensitive tasks. This recognizes that it takes time for many people to adjust to the fact that they are becoming a spy and to reconcile this with their own self-image. If the target balks at some point, the intelligence officer can point out that he or she has already been cooperating with an intelligence service for a long time and has been paid for this service, so there is no turning back now.

Life after Recruitment

Once a new agent is formally recruited, the asset is trained first in security, then in a plan for maintaining communications, and finally in what information to collect and how to collect it.

Information Collection

The targeted information may come from access the agent has by virtue of his or her position, from the agent's association with other people with access to sensitive information, or occasionally just by virtue of the agent's ability to enter a certain area and observe. Some agents provide support to other agents or report on other persons who might be recruitable. Still others might be recruited to use their influence in ways beneficial to the country sponsoring the espionage.

The most valuable agents are usually those with direct access to information sought by the foreign intelligence service. If they do not initially have such access, many foreign services will devote considerable time and effort to working them into positions where they do have direct access. Many low-paying, low-prestige jobs such as mail clerks, maintenance personnel, and janitors are attractive to an intelligence service. They have physical access to protected documents or sensitive meeting rooms, and these jobs have high personnel turnover which makes it easier to plant an already-recruited agent in such jobs.

Once in a position with access, the agent collects information either by observation or by taking documents or electronic media out of the facility where the agent works. Physical security controls when exiting buildings have proven to be only a limited deterrent to removing information from secure facilities. If necessary, most intelligence services can provide their agents with technical equipment such as photo and recording devices or concealment devices. Modern information technology allows the transfer of huge amounts of data to very small devices.

Intelligence services prefer to receive copies of original documents rather than an agent's oral or written report on a conversation or personal evaluation of events, because documents are far more authoritative. An agent may be under considerable pressure to collect large amounts of material, often in areas he or she would not normally have a need to see or use, and payment will often depend upon the value of the information provided.

Collecting and copying protected information and removing it from a secure facility can be a source of danger for the agent in an office where effective document controls and computer audits are in place. Pressure to meet the foreign intelligence officer's requirements for more documentary data on specific subjects or a desire to earn more money can cause an agent to take greater risks that can sometimes lead to the agent's detection. There are a number of observable indicators of such information collection that coworkers are supposed to report to their supervisor or to security when they are observed. These indicators are discussed in a separate file, Potential CI Risk Indicators.

Communications

The method of communications that is selected depends upon the amount and format of material to be communicated, the urgency or timeliness of the information, the ability of the agent to travel to meetings outside the United States, how much handholding is required to guide the agent's collection of information or maintain the agent's motivation, and the technical capabilities of both the intelligence service and the agent. There is a host of possibilities, all of which entail a different level or type of risk. Communication is of two types: personal communications, where there is face-to-face contact, and impersonal communication where there is no personal contact.

Personal Communications: Personal communications can vary from a several-day training session to a "brush pass" where a packet is passed surreptitiously between the agent and the intelligence officer as they cross paths. Personal meetings are the most risky as the intelligence officer or the agent may have been identified by a security service and be under surveillance. Though risky, personal meetings are sometimes necessary for training or to keep the agent motivated.

Personal meetings are particularly useful for training and for monitoring an agent's motivation, which may change over time. Personal problems that led the agent to become involved in espionage may improve or get worse. Motivation may be affected by the stress of leading a double life or by changes in world affairs. The intelligence officer needs to be sensitive to such changes.

Foreign intelligence services have favored overseas locations for personal meetings since there is less risk to the intelligence officer. This is particularly true for longer meetings when a new agent is trained. The time between meetings varies as needed. Meetings with a new agent may be held monthly while several years may pass without a need to meet an established agent. Some intelligence services have supplied their agents with false passports for operational travel so that no pattern of travel is apparent to security services. Agents with dual citizenship will sometimes travel for operational purposes on their foreign passports. Weekend and holiday travel is often favored so that the agent does not have to request time off from work.

Impersonal Communications: Impersonal communications do not involve any direct contact between the agent and the intelligence officer. The dead drop is the traditional means of impersonal communications. One or more locations are selected where either the agent or the intelligence officer can securely hide material without being observed. A schedule may be established for loading or unloading dead drops together with signals for communicating when a drop has been loaded and when it has been successfully unloaded. A signal may consist of a chalk mark on a building, telephone pole, or street sign that the agent passes daily on the way to and from work. For additional security, the dead drop may include use of a concealment device such as a fake rock or an old can.

Use of letters from the agent to the intelligence officer and radio transmissions from the intelligence officer to the agent have been common in the past. The letters are addressed to what is referred to as an accommodation address which is not openly associated with a foreign intelligence service, and the agent does not use his or her real return address. The letters can contain information written in invisible ink, a concealed microdot photo, or open text messages where a seemingly innocuous phrase will have a previously agreed meaning. The radio transmissions are coded messages with instructions sent on the short wave bands.

Today, electronic communications are common. Information is only of value if it can be communicated to the users in a timely manner, and electronic media are the only practical means of communicating the large quantity of material that can now be downloaded from or copied off of large, automated information systems. Messages will usually be encrypted prior to transmission. Information may be communicated via the Internet almost instantaneously to virtually anywhere on the globe.

How Are Spies Caught?

Most Americans arrested and convicted of espionage or attempted espionage since the beginning of the Cold War were caught as a result of information provided by defectors from the foreign intelligence service or by American agents within the foreign intelligence service. The arrest of many others was the result of routine FBI surveillance of foreign embassies, surveillance of known foreign intelligence officers, and other standard counterintelligence practices. About 27% of those who succeeded in passing classified information to a foreign intelligence service were caught in less than one year. However, many of the most damaging spies betrayed their country for 10 or 15 years or more before being caught. 4

Some American spies have also been caught as a result of observations of suspicious or unusual activity reported to a supervisor or to appropriate authorities by a coworker, friend, or former spouse. Many others went undetected for long periods because observations were not reported, or inadequate action was taken after they were reported.

Observation of Espionage Indicators

Being a spy requires that one engage in certain observable behaviors. There is usually some personal contact with a foreign intelligence operative who recruits the spy or to whom the spy volunteers his or her services. The spy must obtain information, often information to which the spy does not have normal or regular access. This information usually needs to be copied and then removed from the office. The information is then communicated to the foreign intelligence service, and this often requires keeping or preparing materials at home and traveling to signal sites or secret meetings at unusual times and places. The spy may receive large sums of money which then may be deposited, spent, or hidden. Periods of high stress sometimes affect the spy’s behavior.

These behaviors associated with espionage or terrorism sometimes deviate from the norm in such a way that they come to the attention of other people who become suspicious and pass their suspicions on to others. This information occasionally comes out during a security clearance reinvestigation. A separate file on Reporting Espionage Indicators provides brief summaries of cases in which spies were caught because someone observed and reported suspicious activity, or were not caught because someone failed to report such activity. Another file on Potential CI Risk Indicators has a comprehensive list of espionage indicators.

Probably the single most observable change in a spy's behavior relates to money and how it is spent. Even spies who are not particularly well paid will usually find themselves with some disposable income. In this modern age, money almost always leaves a trail. This trail can be seen and followed, whether it is in the form of paid off debts or purchase of a new house, car, or boat. Neighbors notice, friends notice and, above all spouses notice. The new spy is forced to come up with explanations which usually will not stand close scrutiny. This is discussed further in the separate module on Finances - Affluence. In the course of a background investigation, subject's explanation for his or her affluence should always be confirmed by documentary evidence provided to either the investigator or the adjudicator.

The Spy's Own Mistakes

Spying is a lonely business. To explain the changes in behavior, or because of a need to confide in someone else, spies sometimes tell a spouse or try to enlist the help of a friend. The friend or spouse in whom the spy confides often does not remain a friend or loyal spouse after he or she realizes what is going on.

Many people who betray their country are not thinking clearly, or they would not be involved in such a self-destructive activity. They are driven by emotional needs to feel important, successful, or powerful, to prove how smart they are, or to take risks or to get revenge. Some, in desperation, have sought through espionage to find a solution to severe financial problems. The same emotional needs that lead them to betray also cause them to flaunt their sudden affluence or to brag about their involvement in some mysterious activity. There is not much ego gratification if no one knows how affluent or important they have become, how they have gotten revenge on the employer who wronged them, or how they have cleverly outsmarted the system and gotten away with it.

When spies are driven by these out-of-control ego needs, they sometimes make mistakes that lead to their getting caught. The most common example of this is unexplained affluence. It is often asked why spies endanger their security by conspicuous expenditures beyond what they could afford with their salary. It is because, in many cases, hiding the money would defeat the purpose for which they committed the crime. In most crimes motivated by greed rather than financial need, the money is sought because of its symbolic value. Money is a means to achieve or to measure social prestige, power or control, or to buy affection or gain self-esteem. The same compelling emotional needs that drive an individual to commit a crime like espionage often drive that person to spend the illegal income rather than save it or hide it.

Note: Additional files in this CI module are accessible only from the Table of Contents. Each item in bold face type in the Table of Contents is a separate file.

Footnotes

1. 50 U.S.C. 401, National Security Act of 1947, enacted July 26, 1947.

2. Office of the National Counterintelligence Executive, Annual Report to Congress on Foreign Economic Collection and Industrial Espionage - 2005. NCIX 2005-10006, April 2005.

3. Statement for the Record, National Counterintelligence Executive, The Honorable Michelle Van Cleave before the House Judiciary Subcommittee on Immigration, Border Security and Claims, September 15, 2005, page 2.

4. Herbig, K.L., & Wiskoff, M.F. (2002). Espionage against the United States by American citizens 1947 – 2001 (Tech. Rep. 02-5). Monterey, CA: Defense Personnel Security Research Center.