DOMEX: the Birth of a New Intelligence Discipline by Colonel Joseph M

DOMEX: The Birth of a New Intelligence Discipline by Colonel Joseph M. Cox

The views expressed in this article are those of the author and do not necessarily reflect the official policy or position of the Army, Department of Defense, or the U.S. Government. Introduction Prior to 9/11, Document and Media Exploitation and what steps can be taken to enhance operations, (DOMEX) capabilities were neither well defined and then offer recommendations on how the IC and nor sufficiently developed or understood to ad- the Department of Defense (DOD) can better orga- equately support combat operations. Despite les- nize, train, man, and equip itself to meet DOMEX sons learned from previous conflicts, U.S. forces challenges in the future. entered the War of Terror without mechanisms Historical Context to properly collect, process, and disseminate in- The U.S. military and other branches of our govern- telligence derived from DOMEX. In the past 18 ment relied on what was originally titled Document months, the volume of captured digital information Exploitation (DOCEX) for as long as we have prac- from law enforcement, intelligence, and civil court ticed the art of intelligence. Discovering the enemy’s cases has exploded. Recent investigations of Umar intentions through examination and exploitation Farouk Abdulmutallab, the alleged terrorist who of captured documents was nothing new. In war- attempted to detonate plastic explosives on board fare, exploitation of adversary documents normally a commercial airliner, and U.S. Army Major Nidal begins at the point of capture and progressively Malik Hasan, the man accused of killing Soldiers becomes more detailed and sophisticated as the at Fort Hood, rely extensively on close examination document moves through a process of triage, trans- of personal computer data by federal law enforce- lation, and promulgation.2 ment agencies. These are just two cases amid an The Civil War provides many examples of troops avalanche of harvested digital media that create a capturing and attempting to exploit enemy doc- national security issue which merits a system that uments. The assassination of President Lincoln can reliably sift intelligence and quickly share it in caused a detailed review of captured Confederate order to protect lives and preserve security. documents once thought trivial or of little value for In response to a recent congressional inquiry, two military operations, seeking proof that Southern respected leaders of the Intelligence Community (IC) leaders were linked to the assassination plot.3 commented that “there is no doubt that “DOMEX By 1920, the U.S. Army War Department intelli- provides critical intelligence unavailable through any gence regulation emphasized the value of DOCEX: other discipline.”1 Without question, our DOMEX ca- “Experience has shown that the information derived pabilities have evolved into an increasingly special- from documents is second in value only to that seized full-time mission that requires a professional cured by the actual examination of prisoners. Too force, advanced automation and communications much stress cannot be laid upon the importance of support, analytical rigor, expert translators, and the rapid and systematic examination of every doc- proper discipline to process valuable information ument captured.”4 into intelligence. Unfortunately, DOCEX was never a high priority This article will examine the historical roots of in terms of training and resources as the Army en- DOMEX operations to present day activities, explain tered World War II. In Europe, the 1st Army had a to- why DOMEX should be an intelligence discipline, tal of five personnel assigned to their DOCEX team review how the Army improved DOMEX capabilities, for combat operations from January 1944 to May

22 Military Intelligence 1945.5 This team would disseminate intelligence manpower at our level to conduct any type of ex- reports after documents were reviewed and trans- tensive DOCEX.”9 From the outset of Operations lated, usually 48 hours after capture. But with the Enduring Freedom/Iraqi Freedom (OEF/OIF), capture of between 250 to 1,000 pounds of docu- there was a shortage of trained HUMINT collec- ments each day, the organization was of marginal tors and they were a precious resource. Major assistance to tactical operations. General Barbara Fast, the Multi-National Corps- Iraq C2, stated that “it became imperative once we 1st Army reached several conclusions about were in Iraq to establish a strong HUMINT capa- DOCEX intelligence: “documents arrived too late for bility to understand the situation on the ground, operational exploitation” and “sufficient personnel but we lacked the number and some of the skills were not trained to help Corps and Division levels”.6 required to be as successful as we needed to be.”10 Through the Korean War and into Vietnam, DOCEX Predictably, the scant numbers of HUMINT collec- remained relevant and necessary to gain intelligence tors were in high demand just for their core mis- on the enemy, but it was viewed as something tem- sion sets: tactical questioning, debriefings, source porary in nature. When we needed it, we built or- operations, and interrogation of detainees. DOCEX ganizations to meet the demand, then forgot about wasn’t a priority. lessons learned after conflicts ended. DOMEX Goes National Why was U.S. Army DOMEX Not As the military struggled with DOMEX activities Prepared for 9/11? between 2001 and 2003, the first tangible effort to The first problem was that after Vietnam, U.S. institutionalize DOMEX at the National and strategic Army DOCEX missions and functions were doc- level came with the creation of Defense Intelligence trinally pinned to interrogators: “the first intel- Agency’s (DIA) National Media Exploitation Center ligence specialists who could examine or exploit (NMEC) in 2003.11 The NMEC was created to serve captured documents, in addition to interrogating as the lead government agency for the rapid pro- prisoners of war, and will scan documents and ex- cessing, exploitation, dissemination and sharing of tract information.”7 Accordingly, DOCEX proce- all acquired documents and media between strate- dures became firmly rooted within the interrogator gic/national through tactical/local levels across the Field Manual (FM) under the human intelligence Intelligence, Counterintelligence (CI), military, and (HUMINT) discipline. Law Enforcement (LE) communities to enhance the The second problem was the direct result of plac- safety and security of the Nation.12 ing DOCEX responsibilities on interrogators within The swift expansion of DOMEX enterprise created HUMINT. There simply weren’t enough collectors (CI many different efforts across the IC and DOD which and interrogators) to accomplish the DOCEX mis- required significant funding from congress. In 2005, sion. As the Army reduced its force size in the early the U.S. Senate Select Committee on Intelligence 70s under a transformation initiative called “Army of (SSCI) conducted an audit to review the practices Excellence (AOE),” it became apparent that an inter- of collecting, processing, translating, and reporting rogation force would not be a large one. Close study intelligence obtained from overtly captured and/or of the AOE with respect to interrogator strength re- clandestinely acquired paper documents and elec- vealed early concerns that there weren’t enough in- tronic media.13 The SSCI wanted to analyze and terrogators in Army inventories to conduct HUMINT evaluate the intelligence value of DOMEX efforts 8 missions and equally support DOCEX missions. and assess the budget implications for sustaining What Were the Consequences of Not DOMEX over the long term. The SSCI audit findings Being Prepared? concluded that: One intelligence leader stated: “DOCEX didn’t ÊÊ DOMEX had become an integral source of valuable work; we did our own DOCEX when we could. intelligence information supporting both tactical Otherwise, it was sent to some CJTF-76 DOCEX operations in OEF/OIF and Iraq and strategic anal- section for processing that was virtually a black ysis in national intelligence agencies,14 but there hole because I never received any feedback from was a perception of slight duplication of effort and anything we sent forward. We just didn’t have the redundancy in terms of reporting intelligence.

April - June 2010 23 ÊÊ The IC allowed the DOMEX expertise to atrophy Doctrine–DOCEX incorrectly resided under HUMINT after each major conflict which caused a rou- with interrogators as lead. tine “reinvention of the wheel” phenomenon. Organizations–No Army units, to include intelligence This proved insufficient, and allowed for an in- units, were structured to conduct the function. formation vacuum to exist during periods when policy makers and military planners most need Training–Training was never formalized. Theaters DOMEX data. established their own procedures and training. No ÊÊ IC leadership needs to make tough decisions in effective blueprint existed for standardized DOCEX the near term in order to improve the efficiency instruction. 15 and effectiveness of DOMEX activities. Materiel–There was no family of systems to cover a The Office of the Director of National Intelligence DOCEX end-to-end approach. (ODNI), as the head of the IC, oversees and directs Leadership–HUMINT staff directorates were the implementation of the National Intelligence overwhelmed. Program and, by extension, provides oversight to ersonnel–No professionalized force to accomplish DOMEX intelligence activities. The ODNI published P the mission. Intelligence Community Directive (ICD) 302 in July 2007 assigning national DOMEX oversight to the Facilities–Not applicable. DOMEX shortfalls were Assistant Deputy Director of National Intelligence for not caused by inadequate infrastructure. Open Source Intelligence (ADDNI/OS), the NMEC, The 2008 U.S. Army Training and Doctrine and the IC agencies. Command (TRADOC) and 2007-2009 Office of the One item within ICD 302 represents the center of Secretary of Defense overlapping studies assessed gravity for the publication–NMEC became the DNI conventional and special operations forces and de- center for the national DOMEX enterprise and be- termined that a relatively small number of core and came chartered to: enabling capabilities was essential to sustaining an intelligence campaign against a networked adver- ÊÊ Support the development of the ODNI’s sary. The studies revealed one of the driving capa- DOMEX strategy, policy, and programmatic bilities of the “find, fix, finish, exploit, access, and recommendations. disseminate” cycle was DOMEX.16 ÊÊ Ensure prompt and responsive DOMEX support to meet the needs of intelligence, defense, home- Here are some thoughts and recommendations land security, law enforcement, and other U.S. within the DOTMLPF framework which require im- Government consumer, to include provision of mediate attention from the U.S. Army, and which timely and accurate collection, processing, ex- other military services can digest, to capitalize on ploitation, and dissemination of DOMEX. critical momentum generated by DOMEX over a rel- ÊÊ Implement policies and guidance on DOMEX in- atively short period of time: cluding handling and dissemination polices. Doctrine. Figure 1 highlights that DOMEX spans ÊÊ Develop training and tradecraft programs all five steps of the Joint intelligence cycle and that expose all IC personnel to the benefits of should be viewed as an intelligence discipline. JP DOMEX. 1-02 states that an intelligence discipline is “a well What the U.S. Army Fixed in DOMEX, defined area of intelligence collection, processing, exploitation, and reporting using a specific cate- What Can Be Improved, and What Can 17 Other Services Learn? gory of technical or human resources.” Without a doubt, DOMEX meets the doctrinal specifica- For over 50 years, and until recently, U.S. Army in- tions outlined in the joint publication. telligence doctrine preserved the DOMEX function within the HUMINT discipline and failed to main- It’s also noteworthy to point out that ICD 302 tain sufficient capability to conduct the mission. A states that “DOMEX activities support a wide range post-mortem appraisal of the U.S. Army’s OEF/OIF of intelligence activities, including all source anal- DOMEX experiences along the DOTMLPF framework ysis, Open Source Intelligence (OSINT), HUMINT, offers lessons learned for other services: Signals Intelligence (SIGINT), Geospatial Intelligence

24 Military Intelligence the core HUMINT missions of tactical questioning, debriefing, source operations, and interrogation.21 This must be changed immediately. We already know that Army DOMEX operations were not successful in the early stages of OEF/OIF because we expected interrogators to conduct the mission based on our doctrine. Recommendation: Publish an interim change to the FM and clarify DOMEX functions and responsibilities. 4. The U.S. Army Intelligence Center of Excellence (USAICoE) diligently worked the timely release of Training Circular (TC) 2-91.8 DOMEX Enabled Intelligence.22 The publication codifies DOMEX Figure 1. doctrine and general tactics, techniques, and pro- (GEOINT), and Measurements and Signatures cedures from tactical to strategic environments. Intelligence (MASINT)–DOMEX reporting and anal- Unfortunately, based on restrictions on the num- ysis are considered intelligence products”.18 Aside ber of FMs, the TRADOC Commander limits MI from correct recognition of DOMEX as an intelli- Doctrine to only four FMs. A DOMEX FM could gence discipline, the U.S. Army must also correct better serve as a blueprint for other military ser- several doctrinal disconnects to set a better course vices to follow as they develop their organization for the future. Below are four key doctrinal items and training models. Recommendation: The U.S. that Army intelligence leaders must address: Army should convert the TC into an FM and ti- tle the FM “DOMEX Operations” not DOMEX– 1. The most recent final draft of FM 2-0 Intelligence Enabled Intelligence. Saying that there is incorrectly states that DOMEX is “an emerging DOMEX–enabled intelligence is akin to stat- capability” but goes into profound detail spell- ing there is bullet-enabled infantry. ing out the fundamentals of all other intelligence Organization. The need for tactical DOMEX disciplines.19 The FM misses a tremendous op- capabilities across the services has never been portunity to devote a short chapter to DOMEX greater; the services must address this organi- and bring together the central thoughts and zational gap immediately. The Army learned that themes thinly spread throughout the document designating HUMINT Collection Teams (HCTs) into a single, concise framework that reinforces for DOMEX missions was a poor strategy.23 The what DOMEX actually is–an intelligence disci- Department of the Army (DA) G2 quickly recog- pline. Recommendation: Use FM 2-0 to state that nized this and established Multi-Functional Teams DOMEX is an intelligence discipline. (MFTs) within the Army’s Battlefield Surveillance 2. TRADOC’s Concept Capability Plan (CCP) for Brigade. The MFT task organization uses four Intelligence, Surveillance, and Reconnaissance intelligence military occupational specialty (ISR) for 2015-2024 fails to clearly articulate Army DOMEX capabilities required to suc- ceed as we face future threats. The CCP barely mentions the term DOMEX and incorrectly states that DOMEX capabilities are required with HUMINT.20 This doctrinal miscue makes it look as though TRADOC is out of step with current Army intelligence and ISR doctrine. Recommendation: TRADOC must develop a com- prehensive DOMEX capabilities list in the CCP. 3. FM 2-22.3 HUMINT Collector Operations incorrectly maintains that “DOCEX” vice DOMEX is a HUMINT collection function and mixes DOMEX in

April - June 2010 25 (MOS) career fields: 35L CI Agent; 35M HUMINT force that is responsive to global demands, not Collector; 35N SIGINT Analyst; 35P Cryptologic just the urgent needs in Iraq and Afghanistan. Communications Interceptor/Locator, and 35S DOMEX collection is not a task limited to intelli- Signals Collector/Analyst.24 gence Soldiers. Any Soldier can collect materials which require exploitation. Just as all Soldiers Each MFT fields sufficient personnel and equip- must be prepared to fight as infantry, they must ment to exploit captured enemy materials (doc- also serve as information collectors. This is the uments, media, and personal electronic devices), premise for the “Every Soldier is a Sensor” model. link biometrics data within the collection effort, Tactical collection skills are taught to Soldiers in and fuse tactical all source intelligence efforts all MOSs under the umbrella of Site Exploitation for battalion and brigade S2s. Recommendation: (SE) training. In SE, Soldiers enter and actively Other military services should develop a similar observe details at a site, use their cognitive skills approach as the MFT model within their intelli- to recognize information, materials, and per- gence organizations in order to provide a trained, sonnel at the site that may help to answer the tactically oriented, professionalized force to con- commanders’ information requirements.25 The duct DOMEX below National levels. graphic below portrays the relationship of the Training. The Army and other services must SE functional capabilities within levels of com- bring order and discipline to our DOMEX train- mand and highlights the use of the Distributed ing approaches to professionalize a DOMEX Common Ground System-Army.

26 Military Intelligence With respect to U.S. Army intelligence train- integrate across existing core, collection, processing, I recommend that a new MOS be designated ing, and dissemination intelligence systems.29 that specifically covers DOMEX (exploitation of Leadership. From a tactical and operational staff documents, media, and personal electronic de- perspective, G2/J2/C2 (HUMINT) staffs are in posi- vices) or at a minimum, an additional skill identi- tion to supervise DOMEX. The 2X staff directorates fier (ASI). Currently, USAICoE provides baseline are fully engaged in coordinating and managing nu- intelligence skills training for eight enlisted in- merous HUMINT and CI collection activities across telligence MOS career fields, the five MOSs men- the areas of operation; they cannot be responsible tioned in the MFT organization and MOSs 35F for the management and integration of DOMEX Intelligence Analyst and 35G/H Imagery/Common assets on the battlefield. I believe that we should 26 Ground Station Analyst. Only MOSs 35M and closely examine the pilot strategy, underway in U.S. 35T Military Intelligence Systems Maintainer/ Forces Afghanistan, which created a J2E–the “E” Integrator receive some DOMEX training. This is standing for exploitation. By separating DOMEX a start but it’s not enough. Recommendation: At a from the HUMINT organization and assigning an in- minimum, I recommend that the MOSs 35F, 35M, telligence officer to manage the DOMEX intelligence 35L receive DOMEX training as well. Mobile train- cycle, we are better postured to provide quality con- ing teams from the Defense Cyber Investigations trol of the entire DOMEX system. We can also look Training Academy (DCITA) and National Ground at methods to fuse science and technology (biomet- Intelligence Center (NGIC) could also assist rics, crime scene forensics, etc.) along the DOMEX USAICoE to provide specialized computer forensic path to leverage opportunities to positively link in- 27 training to Soldiers. dividuals to networks. I expect lessons learned from Materiel. Because DOMEX functions were the J2E concept will make a solid case for keeping historically linked to HUMINT as a function, a DOMEX out of direct HUMINT management. HUMINT reporting system Personnel. Each service must determine which was the only Program of personnel in their force will be the primary opera- Record (POR) to support tors of DOMEX equipment and assess what support DOMEX. The CI/HUMINT personnel are required to maintain their programs. Automated Tool Set pro- Support personnel are required to cover mainte- vided an HCT with a ca- nance requirements and operate across the five pability to collect, process functions of the Joint intelligence cycle. It’s also im- and disseminate infor- portant that the services track their DOMEX trained mation obtained through personnel with an ASI or separate MOS. Military of- document exploitation.28 ficer and enlisted personnel management systems It wasn’t nearly capable need to recognize and codify the new skill sets. enough to satisfy a broad Perhaps now is the time to develop and codify the range of DOMEX equipment and software re- multi-functional intelligence staff officer that has quirements to fully exploit information within training in DOMEX tasks. These leaders will help computers, portable storage devices, video imag- intelligence manage three additional tasks (analyze, ery, and a host of other items. disseminate, and assess) that continually occur. Today’s the Army’s DOMEX equipment suite of- Thoughts on the Future of DOMEX fers significant advances over what was available The true significance of DOMEX lies in the fact to theater forces three years ago. The U.S. Army that terrorists, criminals, and other adversaries Intelligence and Security Command, DA G2, and never expected their material to be captured. The the Army DOMEX program manager worked hard to intelligence produced from exploitation is not field a standardized set of DOMEX equipment that marked with deception, exaggeration, and mis- met operational needs in support of OIF/OEF across direction that routinely appear during live ques- the Army and ensure that the equipment was com- tioning of suspects.30 As our adversaries continue patible with inter-agency standards. The Army must to move from paper to digital-based technologies, align these QRC efforts into PORs which seamlessly the exploitation of digital media, personal elec-

April - June 2010 27 tronic devices, and video will require even more a representative to the DOMEXCOM if the U.S. Navy, personnel and resources to maintain decision U.S. Marine Corps, and U.S. Air Force desire success- advantage. The ODNI has outlined six DOMEX ful DOMEX programs. priorities for the IC in order to create, mature, Development of NMEC as our National DOMEX and sustain an efficient national DOMEX capa- Enterprise CoE. I recommend that the DOD/USD-I 31 bility with a global reach. Within the framework convert the NMEC into a National DOMEX Agency of these priorities, I offer some thoughts and (NDA) to become the Program and Mission Manager recommendations: for the IC. By converting NMEC to the NDA to govern Effective Governance. I recommend that the DOMEX, we would then follow the same approach ODNI establish DOMEX as an intelligence discipline used in the creation of the National Geospatial- via an ICD. ICD 302 states that DOMEX activities Intelligence Agency (NGA) to produce GEOINT; NSA will support a wide range of intelligence activities.32 to produce SIGINT,35 and CIA to be the center of Making DOMEX an intelligence discipline would be gravity for HUMINT.36 If there is no NDA, then NMEC fully in line with the Under Secretary of Defense for will fail to meet its responsibilities as detailed in Intelligence (USD-I) draft DOD DOMEX Directive.33 ICD 302 and not be in a position to “advise and as- Collaborative and Integrated Planning/ sist the ODNI in identifying requirements, develop- Programming/Execution. If you search the ing budgets, managing finances, and evaluating the Internet for the term “DOMEX,” a web page from IC’s performance.”37 the U.S. Department of Justice’s National Drug Intelligence Center (NDIC) will appear and read- ers can learn how the center supports National level policymakers and the IC by preparing strategic analytical studies on the trafficking of ille- gal drugs. NDIC provides real-time support to LE and ICs by conducting DOMEX associated with counterdrug and counterterrorism investigations. Like NDIC, the Central Intelligence Agency (CIA), the Federal Bureau of Investigation (FBI), and the DOD run their own DOMEX programs to support the missions and requirements of their unique organizations. Unfortunately, these organizations have many cultural and security firewalls which limit their ability to provide access to their intelligence holdings to the IC stakeholders. We must con- tinuously work to open these barriers through If we don’t commit ourselves to long overdue orga- improved cooperative arrangements that provide nizational changes, make DOMEX an intelligence the right information to a wider audience in or- discipline, and expand NMEC resources then the der to reduce our intelligence gaps. IC will not be able to achieve DOMEX goals and ICD 302 created the DOMEX Executive Committee missions established by ODNI. One noteworthy (DOMEXCOM)34 which includes senior mem- bers from the DIA, CIA, FBI, Defense Cyber Crime Center (DC3), U.S. Army, National Security Agency (NSA), Department of Homeland Security (DHS), and the Drug Enforcement Administration. The DOMEXCOM is great forum to hammer out agree- ments and roadmap strategies to enhance effectiveness of DOMEX across the IC. I recommend that the ADDNI/OS request that each military service provide

28 Military Intelligence data point reveals that since Fiscal Year 2005, ing of Army tactical DOMEX teams. In this capacity, DOMEX data at NMEC has witnessed nearly a the NGIC/DOMEX PM worked closely with NMEC tenfold increase while government employees as- over the past three years to field and sustain an signed to manage one of the most challenging in- Army tactical DOMEX presence in OIF/OEF. To telligence missions in the IC has remained fairly better support strategic through tactical DOMEX flat (around 50 employees). research, development, test and evaluation appro- priation initiatives, the ADO should serve as the With the ever increasing demands for DOMEX, DOD lead and action arm for the NDA. The ADO flowing from homelandsecurity LE activities (FBI, would be for DOMEX what the Army Cryptologic DHS, etc.), we are now at a critical junction to ei- Office is for SIGINT, placing it in an ideal position to ther make a change to improve capacity to handle assist the other services reach their DOMEX equip- the volume of expected data or continue on course ment and standardization goals. and risk not being in a position to thwart terrorist acts while in the early stages of planning. Deployment of a Federated DOMEX IT Infrastructure. I recommend that the NMEC and The FBI’s National Virtual Translation Center ADO publish collection and processing standards (NVTC) should be realigned within the newly cre- to industry in order to select the best solutions for ated NDA to gain more efficiency on the manage- our DOMEX architecture. Clearly an advanced IT ment of translation resources not only for timely infrastructure is required at the National level to and accurate translations of foreign intelligence, help quickly organize, process, and disseminate but for DOMEX as well. The NVTC is currently the captured information in virtually all formats in clearinghouse for facilitating interagency use of many languages. If the National DOMEX architec- translators, partnering with elements of the U.S. ture is to truly be a “single, dynamic, integrated, Government, academia, and private industry to and federated system, with cutting edge auto- identify translator resources and engage their ser- mation using the best-of-breed tools,”39 then our vices. NVTC is a DNI Center, and the FBI is its collection and processing systems must tackle Executive Agent. 38 two distinct problems that Dr. Simon Garfinkel 40 The USD-I should direct the establishment of a labels “deep” and “broad”. Military Support Branch in the NDA under the lead- The deep DOMEX problem covers the kind of doc- ership of a one-star general. The military support ument or data-storage device (a hard drive, DVD, or branch should include liaison officers from each personal electronic device) that is captured and be- combatant command (COCOM) in order to improve comes available for analysis. The analytical goal is global mission management of DOMEX activities. to find out everything possible about the data stor- The support branch could help COCOMs link their age device. The DOMEX operators and analysts who DOMEX priorities into the NDA and better harness receive a laptop, for example, want to know every- national DOMEX holdings to consumers support- thing possible about it; not just the content, but the ing host nation counterterrorist efforts. Creation application programs, the configuration settings, of a military support branch at NDA would fol- the other computers with which these machines low similar constructs already in place at NSA and had come into contact, and so on.41 NGA. The lack of a military support branch assist- The broad DOMEX problem is the reverse. ing NDA prevents traction to fully synchronize and Instead of having unlimited resources to spend leverage DOMEX collection capabilities across the on a particular item, analysts are given a large services and align large-scale DOMEX procure- number of digital objects and a limited amount ments and solutions for the services as research of time to find something useful to their mission. and development drives change. In recent years the volume of captured digital in- The USD-I should direct that the U.S. Army desig- formation seized on the battlefield or within LE nate the Army DOMEX Office (ADO) as DOD lead for investigations has exploded. The landslide of digi- service DOMEX program procurement. DA G2 des- tal media makes the broad problem quite compel- ignated NGIC as the dedicated DOMEX Program ling from both a national security and commercial Manager responsible for the development and train- perspective, a system that can reliably find the

April - June 2010 29 “good stuff” can save money, time, and perhaps their needs and culture. Inconsistency in content, even lives.42 quantity, and quality of training across the DOMEX community persists through varied processes for developing training requirements and standards. The result is costly duplication of effort, uneven performance during deployments, and significant un- met training requirements, particularly with regard to DOMEX analysis and technology integration. The military services and IC must maintain a professionalized DOMEX force that follows a standardized and certifiable training program. We also lack Future DOMEX collection systems (hardware and a single set of standards or roadmap that outlines software) must provide solutions to cover the deep which DOMEX skills are required to meet basic, in- and broad DOMEX problems and minimize the termediate, and advanced DOMEX requirements at number of stand-alone systems the operators must every level (tactical through strategic). learn, use, and maintain. We should take advantage of equipment already fielded rather than providing There are numerous training venues which are more “boxes.” This is not to say that there will not be considered “accredited” to meet DOMEX mission some need for unique stand-alone systems to ensure requirements but there is no published commu- needed capabilities. Each military service must en- nity directive or message that aligns the total IC. sure their DOMEX systems (hardware) fit within their Successful DOMEX operations hinge on proper Command, Control, Communications, Computers, collection; all military services must be organized and Intelligence construct and integrate into a cohe- to conduct tactical collection in land or maritime sive and seamless entity within the national system. operations. Most im- Global Presence. Global presence starts by link- portantly, the IC and ing state and federal LE entities through Homeland DOD must be pre- Defense mechanisms and into our National ICs (CIA, pared to assist other DOD, and other government agencies). For example, nations in under- we must be able to share and connect intelligence standing the value of from a captured computer in Kuala Lumpur, Malaysia DOMEX and aid in to our federal LE efforts to opportunities for our adver- training their forces saries to conduct successful attacks. as well. The proper inventory and col- NOTE: All DOMEX operations conducted by Army lection of captured intelligence personnel must comply with the legal materials is no lon- restrictions in AR 381-10, and be conducted within ger confined to intelligence personnel, anyone can the guidelines of U.S. law and applicable policies. collect. That cultural shift is based on lessons DOMEX practitioners who posses linguistic skills learned from combat operations. “It became clear or provide access to linguists, must be strategi- that the existing intelligence gathering, analysis, cally positioned (forward based) throughout our and evidence collection methods were all inade- COCOMs to capitalize on opportunities as the pres- quate for countering an insurgency, our ability to ent themselves. Ideally, the NDA could provide fly- successfully prosecute intelligence operations was away teams who are trained to operate in austere directly linked to the ability of our Soldiers to col- environments and have ready access worldwide to lect, preserve, and exploit evidence.”44 The organi- essential equipment, communications, and imme- zational requirements above tactical collection are 43 diate reachback to the IC. primarily intelligence-based and make up the pro- Professional Skills and Training. Despite heavy cessing, exploitation, and dissemination process. investment in DOMEX training programs since This is the layer that includes personnel from the 9/11, there has been uneven emphasis across or- Army’s Multifunctional Teams, the Marine Corps ganizational and training programs as ICs focus on HUMINT Exploitation Teams, U.S. Air Force Office

30 Military Intelligence of Special Investigations, or sailors from the Office 6. Ibid., 84. of Naval Intelligence. 7. FM 30-15, Intelligence Interrogation, March 1969, 3-7.

One thing is certain–all military services must 8. Mark S. Partridge, “Asking Questions: Will Army Tactical identify DOMEX training requirements for their Interrogation Be Ready For War?” School of Advanced Military forces and develop an appropriate communica- Studies Monograph, 17 December, 1986, 37. tions infrastructure to relay DOMEX intelligence 9. Operational Leadership Experiences Project, Combat Studies laterally and upward into the national intelli- Institute, Fort Leavenworth, Kansas, Interview with CW3 Kenneth gence system. I recommend that the ADDNI/OS Kilbourne, February 2009, 8. or USD-I designate the Navy and Marine Corps 10. Donald P. Wright and Timothy R. Reese, On Point II, Transition Intelligence Training Center, and USAICoE as the to the New Campaign: Operation Iraqi Freedom, June 2008, 195. (Interview with MG Fast, CJTF-7 C2) primary DOMEX institutional training bases for the military services. The roles and functions of the 11. ODNI, 2009 DOMEX Annual Report. Joint Military Intelligence Training Center and the 12. NMEC Mission Statement, 2009. DCITA as authorized training venues need to be 13. U.S Senate, Select Committee on Intelligence. Report Number clearly spelled out within an ICD or USD-I mes- 111-16, Period Covered–4 January 2007 to 2 January 2009, 42. sage to clarify their interaction with the IC and 14. SSCI Audit of IC Domex, April 2007. DOD DOMEX education system. 15. Dan Butler, Paula Briscoe, Roy Apselloff, ODNI, National We must take several additional steps to strengthen Document and Media Exploitation Enterprise Vision Pamphlet, each of the six ODNI priorities in order to achieve Message from DOMEX Seniors, April 2009. an enduring DOMEX capability across the national, 16. Richard P. Zahner, “Rebalancing the Army Military Intelligence military, intelligence, homeland security, and law Force,” AUSA Green Book, October 2009, 186. enforcement communities, at all levels–strategic, 17. JP 1-02, Department of Defense Dictionary of Military and operational, and tactical. Associated Terms, 31 August 2005.

Conclusion 18. ODNI Intelligence Community Directive 302, Document and We have reached the point where a national deci- Media Exploitation, 6 July 2007. sion is required to designate DOMEX as an intel- 19. FM 2-0, Intelligence (Final Draft), March 2009, 1-30. ligence discipline and to create a National DOMEX 20. TRADOC Pam 525-7-9, Version 1.0, 12 August 2008, 40. Agency. Similar conditions and decisions were made over 50 years ago as our government created agen- 21. FM 2-22.3, Human Intelligence Collector Operations, September 2006, 1-6. cies for HUMINT and SIGINT. If the strategic objec- tives are to extend intelligence to all who need it 22. TC 2-91.8, Document and Media Exploitation Enabled Intelligence (Final Draft), 25 July 2008. and to facilitate Homeland Defense through exten- sive collaboration, then if we fail to create a National 23. FM 2-22.3, 2-6. DOMEX Agency, then I believe DOMEX will return 24. U.S. Army MI BN (BFSB) MTOE, DOCNO 34105GFC18, Para to its previous condition of atrophy across the IC 206, Lines 02-17. and DOD and our nation will not be in a position to 25. U.S. Army Combined Arms Center, Site Exploitation Concept of effectively safeguard itself from multiple threats. Operations (CONOPS), 2010-2016. 26. Army Enlisted Job Descriptions, About.com: US Military at Endnotes http://usmilitary.about.com/od/enlistedjo2/a/35.-xiW.htm. 1 Response to Congressionally Directed Action, LTG Maples and Dr. 27. DOD Cyber Crime Center at http://www.dc3.mil/dcita/ Briscoe, 1 March 2009. dcitaAbout.php. 2 Kevin M. Woods, Captured Records–Lessons from the Civil War 28.CHATS AN/PYQ-3(V)3 at http://chams.it.northropgrumman. through World War II, Institute for Defense Analysis, 2009. com/brochures/CHATS%20V3%20Factsheet.pdf. 3. Ibid. 29. Intelligence Programs and Systems, at http://www.globalsecurity. 4. Intelligence Regulations, U.S. War Department, Washington, DC, org/intell/systems/index.html. 1920, 39-40. 30. NMEC, 2009 Resource Management Plan, 5. 5. Jared B. Schopper, “The Collection and Processing of Combat 31. ODNI, National DOMEX Enterprise Vision Pamphlet. Intelligence During Operations in Northern Europe,” Command and General Staff College Monograph, June 1964, 82. 32. ICD 302, DOMEX.

April - June 2010 31 33. USD(I), DOD Directive 3300.aa, Document and Media 41. Ibid. Exploitation (DOMEX), Draft. 42. Ibid. 34. ICD 302, DOMEX. 43. ODNI, National Document and Media Exploitation Enterprise 35. Mission statement at http://www.nsa.gov/about/mission/ Vision Pamphlet. index.shtml. 44. Ralph O. Baker, “Developing Actionable Intelligence in the Urban 36. Establishment of the National Clandestine Service, CIA, 13 COIN Environment,” Military Review, March-April 2007. October 2005 at https://www.cia.gov/news-information/press- releases-statements/press-release-archive-2005/pr10132005. html.

37. Deputy Director of National Intelligence for Policy, Plans, and Colonel Joseph Cox served as Commander, 519th MI Requirements, 2009 National Intelligence: A Consumer’s Guide. Battalion (BfSB) during OIF 07-09 between September 2007 and December 2008. He is a 1987 graduate of OCS 38. Ibid and has also served in the 525th MI Brigade; 82d Airborne 39. ODNI, National Document and Media Exploitation Enterprise Division; 75th Ranger Regiment; 205th MI Brigade, and Vision Pamphlet, the 525th BfSB. He recently completed a U.S. Army Senior 40. Simson L. Garfinkle, “Document and Media Exploitation,” Service College Fellowship Program in Washington, D.C. Association for Computer Machinery, accessed at http://queue. and is now the Commander, 501st MI Brigade, Korea. acm.org/detail.cfm?id=1331294. Colonel Cox may be reached at [email protected].

32 Military Intelligence