What is Counterintelligence

It is a fusion discipline that blends security, law enforcement and intelligence into a single integrated function. No one leg of the triad can be removed without incapacitating the whole. It protects an organization or state against infiltration, inadvertent leakage and the compromise of installations and material.

Taxonomy of CI

Explained briefly later but they are two:

1. Defensive CI - This gathers activities that deter and detect adversaries.
2. Offensive CI - Compromises activities that detect, deceive, and neutralize them.

CI vs Counterespionage

They are all interdependent but distinct CI - Broadly concerned with deterrence and detection Counterespionage - Offensively oriented subset that detects, deceives and neutralizes an adversary intelligence service.

Mapping the Triad to Agencies and Missions

1. Security - Protects facilities and sensitive material i.e. CIA security elements
2. Law Enforcement - Investigates suspected breaches i.e. FBI
3. Intelligence - Uses CI-derived insights to illuminate adversary targeting and intent, feeding estimates and warning

CI is not only about malware and logs but about people, processes and protected knowledge.