Counterintelligence Investigations For Threat Identification And Neutralisation Training

Objectives:
• Define counterintelligence and its role in national security.
• Explain the legal and regulatory framework governing counterintelligence in South Africa.
• Identify key stakeholders and their responsibilities.
• Understand ethical considerations and the importance of confidentiality.

Topics:
• Overview of counterintelligence concepts.
• Historical context and current threats.
• SAQA unit standard 117369 alignment.
• Relevant South African legislation (e.g., Intelligence Services Act, NCA).
• Ethics and professionalism in counterintelligence.
• Roles of SAPS, SANDF, and private sector.

Objectives:
• Describe the intelligence cycle: planning, collection, processing, analysis, dissemination.
• Distinguish between threats, risks, and vulnerabilities.
• Apply the cycle to counterintelligence scenarios.

Topics:
• Phases of the intelligence cycle.
• Threat identification methodologies.
• Risk assessment frameworks.
• Case studies: real-world threat examples.
• Practical exercise: mapping a threat scenario.

Objectives:
• Identify open-source (OSINT) and human intelligence (HUMINT) sources.
• Understand signals intelligence (SIGINT) and imagery intelligence (IMINT) basics.
• Apply collection planning and source validation.

Topics:
• OSINT: tools and techniques.
• HUMINT: recruitment and handling.
• SIGINT and IMINT overview.
• Source reliability and credibility.
• Practical exercise: OSINT collection on a simulated target.

Objectives:
• Develop an investigation plan based on threat assessment.
• Allocate resources and define scope.
• Establish legal authority and documentation requirements.

Topics:
• Investigation planning process.
• Resource management.
• Legal warrants and authorisations.
• Documentation and case file management.
• Practical exercise: drafting an investigation plan.

Objectives:
• Describe surveillance methods (static, mobile, technical).
• Apply counter-surveillance measures to detect monitoring.
• Use surveillance logs and evidence preservation.

Topics:
• Types of surveillance.
• Counter-surveillance tactics.
• Technical surveillance detection.
• Practical exercise: conducting a mobile surveillance operation.
• Report writing for surveillance.

Objectives:
• Conduct structured interviews for intelligence gathering.
• Apply elicitation techniques without revealing intent.
• Recognise deception and verify information.

Topics:
• Interview planning and questioning strategies.
• Elicitation methods (e.g., assumption, opinion, ignorance).
• Detecting deception: verbal and non-verbal cues.
• Practical exercise: elicitation role-play.
• Ethical boundaries in interviews.

Objectives:
• Identify indicators of insider threats.
• Understand behavioural and technical red flags.
• Implement mitigation strategies and reporting mechanisms.

Topics:
• Insider threat categories (malicious, negligent, compromised).
• Behavioural indicators and profiling.
• Technical monitoring (access logs, data exfiltration).
• Mitigation policies and employee awareness.
• Case study: insider threat incident analysis.

Objectives:
• Understand cyber threats to national security.
• Apply basic digital forensics principles.
• Use cyber counterintelligence to detect espionage.

Topics:
• Cyber threat landscape.
• Digital forensics: acquisition, preservation, analysis.
• Network monitoring and intrusion detection.
• Cyber counterintelligence techniques.
• Practical exercise: analysing a phishing attack.

Objectives:
• Analyse collected intelligence to produce threat assessments.
• Apply analytical techniques (e.g., link analysis, pattern analysis).
• Write clear and concise intelligence reports.

Topics:
• Analytical methodologies.
• Link analysis and visualisation.
• Threat assessment reports.
• Briefing skills.
• Practical exercise: producing a threat assessment from raw data.

Objectives:
• Recognise deception operations and disinformation campaigns.
• Use counter-deception strategies.
• Evaluate impact of disinformation on investigations.

Topics:
• Deception techniques (e.g., cover stories, false flags).
• Disinformation detection and verification.
• Counter-deception measures.
• Case studies: historical deception operations.
• Practical exercise: identifying disinformation in a scenario.

Objectives:
• Apply counterintelligence principles to corporate security.
• Protect intellectual property and trade secrets.
• Collaborate with law enforcement and government agencies.

Topics:
• Corporate espionage threats.
• Intellectual property protection.
• Private-public partnerships.
• Security clearance and vetting.
• Case study: industrial espionage investigation.

Objectives:
• Understand rules of evidence in South African law.
• Handle evidence to maintain chain of custody.
• Prepare for testimony in court or tribunals.

Topics:
• Law of evidence: admissibility, relevance.
• Chain of custody procedures.
• Witness preparation and testimony.
• Practical exercise: mock court testimony.
• Legal pitfalls in investigations.

Objectives:
• Describe the roles of South African intelligence agencies.
• Understand interagency coordination mechanisms.
• Manage information sharing and security classifications.

Topics:
• SSA, NIA, SAPS, SANDF roles.
• Interagency task forces.
• Information sharing protocols.
• Security classifications (confidential, secret, top secret).
• Practical exercise: interagency coordination scenario.

Objectives:
• Use advanced surveillance equipment (e.g., GPS trackers, cameras).
• Conduct technical surveillance countermeasures (TSCM).
• Understand legal restrictions on technical operations.

Topics:
• Advanced surveillance tools.
• TSCM: bug sweeping and detection.
• Legal authorisations for technical ops.
• Practical exercise: TSCM sweep.
• Ethics of technical surveillance.

Objectives:
• Conduct risk assessments for organisations.
• Develop security plans incorporating counterintelligence.
• Implement physical and personnel security measures.

Topics:
• Risk management frameworks.
• Security plan components.
• Physical security: access control, perimeters.
• Personnel security: vetting, briefings.
• Practical exercise: developing a security plan.

Objectives:
• Use social media for intelligence gathering.
• Identify threats from social engineering and online deception.
• Apply OPSEC (operations security) principles.

Topics:
• Social media intelligence (SOCMINT).
• Social engineering tactics.
• OPSEC and digital footprint reduction.
• Practical exercise: social media investigation.
• Ethical considerations in online collection.

Objectives:
• Manage multiple cases and prioritise resources.
• Write comprehensive investigation reports.
• Present findings to decision-makers.

Topics:
• Case management systems.
• Report writing standards.
• Executive briefings.
• Practical exercise: writing a case report.
• Lessons learned documentation.

Objectives:
• Respond to counterintelligence incidents under crisis conditions.
• Implement emergency protocols and continuity of operations.
• Coordinate with emergency services and command centres.

Topics:
• Crisis management frameworks.
• Incident response plans.
• Communication during crises.
• Practical exercise: simulated counterintelligence crisis.
• After-action review.

Objectives:
• Apply all skills in a complex, multi-day investigation scenario.
• Demonstrate threat identification, collection, analysis, and neutralisation.
• Produce final report and brief stakeholders.

Topics:
• Scenario introduction and team assignments.
• Investigation phase: planning, collection.
• Analysis and assessment.
• Neutralisation recommendations.
• Final report and presentation.

Objectives:
• Consolidate learning through review and feedback.
• Complete summative assessment (written and practical).
• Develop personal action plan for continued professional growth.

Topics:
• Key concepts review.
• Written assessment.
• Practical assessment (scenario-based).
• Feedback and debrief.
• Professional development resources.
• Certification and next steps.