Counter Espionage Course

Lesson 1 • Defining Espionage and Its Scope

Establishes precise definitions of espionage, intelligence collection, and counterintelligence. Grounds all subsequent investigation methods in shared terminology.

Lesson 2 • Intelligence Cycle and Collection Disciplines

Explains the planning-to-dissemination cycle and the major collection disciplines. Students map each discipline to real investigative scenarios.

Lesson 3 • Legal and Ethical Framework

Covers the legal boundaries governing espionage investigations and the ethical obligations of investigators. Establishes compliance as a non-negotiable baseline.

Lesson 1 • Protecting Sensitive Programmes and Assets

Addresses security measures for protecting classified programmes and human assets. Connects protection protocols to investigative findings.

Lesson 2 • CI Surveillance and Detection

Covers physical and technical surveillance methods used in CI investigations. Students practise detection and countersurveillance techniques.

Lesson 3 • Double Agent and Deception Operations

Examines the use of double agents and controlled deception to exploit adversary networks. Students evaluate operational risks and approval requirements.

Lesson 4 • Counterintelligence Doctrine and Mission

Defines the counterintelligence mission and its relationship to offensive and defensive operations. Positions CI as the investigative backbone of espionage response.

Lesson 1 • Source Protection and Exfiltration

Covers the legal and operational obligations to protect sources from exposure. Students plan exfiltration and resettlement contingencies.

Lesson 2 • Elicitation and Debriefing Techniques

Develops structured questioning and elicitation skills for extracting accurate intelligence. Students practise debriefing scenarios with coached role players.

Lesson 3 • Source Validation and Vetting

Teaches methods for verifying source reliability and detecting fabrication or hostile control. Reduces collection errors before dissemination.

Lesson 4 • Clandestine Communication Methods

Introduces secure communication systems used between handlers and sources. Students select appropriate methods based on operational environment.

Lesson 1 • Network and Infrastructure Mapping

Covers passive and active techniques for mapping adversary digital infrastructure. Students identify command-and-control nodes and attribution indicators.

Lesson 2 • Digital Footprint Analysis

Teaches analysis of digital artefacts to reconstruct subject activity and associations. Connects footprint mapping to threat actor profiling.

Lesson 3 • OSINT Collection Methodology

Establishes a repeatable OSINT collection process aligned with the intelligence cycle. Students apply structured search strategies to real-world targets.

Lesson 4 • OSINT Verification and Source Reliability

Addresses verification frameworks for assessing open-source accuracy and bias. Prevents analytical errors caused by disinformation or fabricated content.

Lesson 1 • Physical Surveillance Operations

Covers foot and vehicle surveillance planning, team roles, and execution. Students conduct practical exercises in controlled environments.

Lesson 2 • Surveillance Product Integration

Addresses how surveillance products are processed, analysed, and integrated into case files. Connects collection outputs to investigative reporting standards.

Lesson 3 • Communications Interception Basics

Covers lawful interception frameworks and technical methods for monitoring communications. Students apply interception data to investigative timelines.

Lesson 4 • Technical Surveillance Devices

Introduces audio, video, and tracking devices used in authorised investigations. Students assess device selection based on operational requirements.

Lesson 1 • Evidence Collection and Preservation

Teaches lawful evidence collection procedures and chain-of-custody requirements. Ensures investigative products meet evidential standards.

Lesson 2 • Analytical Tradecraft and Bias Mitigation

Introduces structured analytic techniques to reduce cognitive bias in espionage cases. Students apply ACH and red-team methods to contested hypotheses.

Lesson 3 • Case Initiation and Lead Development

Covers how espionage investigations are opened, predicated, and prioritised. Students apply lead development matrices to complex case scenarios.

Lesson 4 • Investigative Reporting and Dissemination

Covers formats and standards for producing investigative reports and intelligence products. Students draft case summaries and analytical assessments.

Lesson 1 • Intrusion Detection and Triage

Covers detection of espionage-related intrusions using log analysis and endpoint data. Students triage alerts to distinguish espionage from criminal activity.

Lesson 2 • Cyber Attribution Methods

Teaches technical and non-technical attribution frameworks for cyber espionage. Students weigh evidence quality and confidence levels in attribution assessments.

Lesson 3 • Incident Response and Containment

Covers coordinated response to active cyber espionage intrusions. Students balance containment speed against intelligence collection opportunities.

Lesson 4 • Digital Forensics for Espionage Cases

Applies forensic acquisition and analysis to espionage-related digital evidence. Students preserve forensic integrity throughout the investigative chain.

Lesson 1 • Strategic Intelligence Assessment

Develops skills for producing long-range assessments of espionage threats to organisations. Students integrate multi-source findings into coherent strategic products.

Lesson 2 • Briefing Decision-Makers on Espionage Threats

Teaches structured briefing techniques for communicating espionage findings to senior leaders. Students tailor products to decision-maker needs and risk tolerance.

Lesson 3 • Multi-Discipline Operation Planning

Covers coordination of HUMINT, SIGINT, and cyber collection in unified operations. Students develop integrated collection plans for complex espionage targets.

Lesson 4 • Programme Evaluation and Continuous Improvement

Addresses metrics and review processes for evaluating espionage investigation programmes. Students design after-action reviews and capability improvement plans.