Counter Intelligence Course

Lesson 1 • Defining Counterintelligence

CI is defined through its mission, scope, and distinction from related disciplines. This baseline anchors all subsequent threat analysis and protective frameworks.

Lesson 2 • The Intelligence Threat Landscape

Maps the categories of adversarial actors and their motivations. Understanding actor types enables accurate threat prioritization throughout the course.

Lesson 3 • Legal and Ethical Framework

Establishes the regulatory and ethical boundaries governing CI activities. Compliance with lawful authority and privacy standards is integrated into every CI function.

Lesson 1 • Analytic Frameworks and Structured Techniques

Applies structured analytic techniques to reduce cognitive bias in threat evaluation. These methods produce defensible, repeatable analytical products.

Lesson 2 • Producing Threat Assessment Reports

Covers structure, language, and dissemination of written threat assessments. Well-crafted reports drive decision-making by leadership and security teams.

Lesson 3 • Adversary Capability and Intent Analysis

Examines how to assess an adversary's ability and willingness to act against a target. Capability-intent matrices guide prioritization of CI countermeasures.

Lesson 1 • Surveillance Detection Routes

Teaches the design and execution of surveillance detection routes (SDRs). SDRs create controlled conditions that expose surveillance activity.

Lesson 2 • Countersurveillance Operations

Develops active measures to disrupt or defeat adversary surveillance efforts. Students integrate detection findings into protective action plans.

Lesson 3 • Principles of Surveillance

Explains how surveillance operations are planned and executed by adversaries. Understanding adversary methods is the foundation for effective detection.

Lesson 4 • Technical Surveillance Countermeasures

Covers detection and neutralization of electronic eavesdropping devices. TSCM skills protect sensitive communications and meeting environments.

Lesson 1 • Insider Threat Typology

Categorizes insider threats by motivation, method, and access level. Accurate typology enables targeted detection and response strategies.

Lesson 2 • Insider Threat Program Design

Guides construction of a structured insider threat program with governance and response procedures. Program design balances security with employee rights.

Lesson 3 • Technical Detection Methods

Applies user activity monitoring and data loss prevention tools to detect insider activity. Technical controls complement behavioral observation programs.

Lesson 1 • Elicitation Recognition and Defense

Identifies elicitation techniques used to extract sensitive information without detection. Defensive awareness prevents inadvertent disclosure to adversary collectors.

Lesson 2 • Handling Adversary Recruitment Approaches

Prepares personnel to recognize and respond to adversary recruitment attempts. Proper response procedures protect both the individual and the organization.

Lesson 3 • HUMINT Tradecraft Fundamentals

Covers the principles governing human source recruitment and handling. Tradecraft knowledge enables CI professionals to recognize and counter adversary HUMINT.

Lesson 1 • Cyber CI Integration with Security Operations

Connects CI analytic products with security operations center (SOC) workflows. Integration ensures intelligence drives detection priorities and incident response.

Lesson 2 • Cyber Deception and Denial

Applies deception techniques to mislead adversary cyber operators and protect assets. Denial and deception extend the value of defensive cyber operations.

Lesson 3 • Detecting Cyber Espionage Operations

Identifies indicators of compromise associated with espionage-focused intrusions. Early detection limits adversary dwell time and data exfiltration.

Lesson 4 • Cyber Threat Actor Profiling

Profiles nation-state and criminal cyber actors using CI analytic methods. Actor attribution informs targeted defensive and investigative responses.

Lesson 1 • Lead Development and Source Exploitation

Develops investigative leads from raw information using structured analytic methods. Systematic lead development prevents premature closure or missed connections.

Lesson 2 • Case Resolution and Reporting

Guides investigators through case closure, referral, and final reporting requirements. Thorough reporting supports prosecution, administrative action, or policy change.

Lesson 3 • Interviews and Interrogation in CI

Applies lawful interview techniques to elicit accurate information from subjects and witnesses. Effective interviewing is central to resolving CI cases.

Lesson 4 • Evidence Collection and Handling

Covers lawful collection, preservation, and chain-of-custody procedures for CI evidence. Proper handling ensures evidence integrity for administrative or legal action.

Lesson 1 • CI Risk Management Integration

Embeds CI threat data into enterprise risk management frameworks. Integration ensures CI findings directly influence organizational risk decisions.

Lesson 2 • Collection Planning and Tasking

Develops systematic collection plans to address priority intelligence requirements. Disciplined tasking maximizes collection efficiency and reduces gaps.

Lesson 3 • CI Program Architecture

Defines the structural components of a comprehensive CI program. Sound architecture ensures all CI functions are coordinated and resource-efficient.

Lesson 4 • Interagency and Partner Coordination

Manages information sharing and joint operations with external CI partners. Effective coordination multiplies organizational CI capability and reach.