MIOG Part 1, Section 100: Terrorism Enterprise Investigations (Section 100 - 110.4)

inquiry in /miog/miog_partl/iniogpl s100.htm Page .1 of 17
Full Text HighLighted Hit Results Page
ALL T
Query inquiry on'document /iig&iiio.g. partihniog-p./s100.htm HEREIN IS UNCLASSIFIED.
DATE 12-03-2009 EY 6.5179DI.EH/iij:
You can navigate between the hits using the 6<<" and ">->" .tags around a, hit.
Clicking "<<" takes you to the previous hit, clicking 1!>->",takes you to the next hit:
Click to go to the first hit in the document. .
New Query
MIOG PARD1 SECTION 100 MIOG PART 1 SECTION 100. TERRORISM ENTERPRISE
INVESTIGATIONS
SENSITIVE
I (ALSO SEE MIOG, PART 1, 137-4 IAND 270-4(8) .)I
"EffDte: 02/02/2004 MCRT#: 1308 Div: CT Cav: SecCls:
100-1 GENERAL PROVISIONS
--7 E:rfbie: 12/10/1991 MdRT#: 0 DiVf
100-1.1 Investigative Jurisdiction
Investigations by the FBI under this section are based on
the Attorney General's Guidelines on General Crimes, Racketeering
EnterpriSe, andlTerrorism Enterpriselinvestigations (A'GG).
These Guidelines, which became effectiyelMay 30, 2002,Iresdind all
I previous versions ofithe General Crimes Guidelines.I The full text of
IthelGuidelines is set forth in the Introduction, 1-3 , of this manual.
Some sections of the Guidelines, such as the "General Principles,"
I"Preliminary Inquiries/the rules governing the. "Investigative
Techniques," and "Disseminationland Maintenancelof Information" have
general applicability to all investigations and should be consulted
I when appropriate. Section III, Part B, governingITerrorism
I Enterpriselinvestigations, togethef with a commentary on key
provisions relating to them, is set forth below in 100-1.2 and
100-1.2.1 :
• •••:::•:••
**EffDte: 04/04/2003 MCRT#: 1281 Div: CT Cav: SecCls:
100-1.2 Terrorism Enterprise InvestigationS (See MIOG, Introduction, 1-3 , and Part 1, 100-1.1 .)
• "This section focuses on investigations of enterprises
that seek to further political or social goals through activities that
involve force or violence, or that otherwise aim to engage in .
FBIO23965CBT
b2 • (yr a- n n9 /1 inc--1371T2M 9n ZnerrInnni)
DOJOIG013253
, inquiry in /miog/miogpartlimiogpls100.htm
' 11domesticiterrorism1(as defined in Title 18, USC, Section 2331 (5))1 .
I orldomesticiterrorism-related crimes. Like the section addressing .
racketeering enterprise investigations, it is concerned with the
investigation of entire enterprises, rather than just individual
participants and specific criminal acts, and authorizes investigations
to determine the structure and scope of the enterprise, as well as the
relationship of the members." (AGG III:B.)
'Commentary: However, all international terrorism investigations--to
include investigations of groups and organizations--shall be conducted
pursuant to the Attorney General's Guidelines for FBI National •
Security Investigations and Foreign Intelligence Collection (NSIG),
effective October 31, 2003, and within the 315 classification. See
Section 19 of the National Foreign Intelligence Program Manual
(NFIPM).1
"EffDte: 04/30/2004 MCRT#: 1338 Div: CT Cav: SecCls:
100-1.2.1 Commentary (See MIOG, Part 1, 100-1.1 .),
(1) These Guidelines provide guidance for general crimes
and criminal intelligence investigations.• The standards and
requirements set forth herein•overn the circumstances under which
such investigations may begin and the perinissible Scope, duration, , •
subject matters, and objectives of these investigations. They do not
limit activities carried oidu nd eilthelAttorneY berierioin"delides
'for FBI National Security Investigations.and Foreign Intelligence
. 1 Collection (NSIG), effective October 31, 2003; . which addressIstich •
matters as investigations and information collection •
relating to international terrorism, foreign counterintelligence, or
foreign intelligence.
(2) The rules governing Terrorism Enterprise
investigations allow the FBI to cross organizational lines without
regard to what a particular group or element of an organization might -
call itself: Thus, persons who provide safehouses, money, weapons, or
otherwise knowingly support the criminal activities of the terrorist
enterprise can be investigated as part of the same 'enterprise.
(3) Preliminary inquiries and investigations 'governed by
the Guidelines applicable to all criminal violations are conducted for
the purpose of preventing, detecting, or prosecuting violations of •
federal law. The FBI shall fully utilize the methods authorized by :
these Guidelines to maximize the realization of these objectives;
(a) The conduct of preliminary inquiries and
investigations may present choices between the use of, investigative
methods which are more or less intrusive, considering such factors as
the effect on the privacy of individuals and potential damage to
reputation. Inquiries and investigations shall be conducted with as
little intrusion as the needs of the situation permit. It is
Page 2 of 17
FBIO23966CBT
n7 /1 R in --pAiz=r. 1 nnarv,"41
b2
DOJOIG013254
• inquiry/miog/miog_part 1 /miogpl s100.htm Page 3 of 17 —
recognized, however, that the choice of techniques is a matter of
judgment. The FBI shall not hesitate to use any. lawful techniques
consistent with the Guidelines, even if intrusive, where the
intrusiveness is warranted in light of the seriousness of a crime or
the strength of the information indicating its commission or potential
future commission. This point is to be particularly observed in the
investigation of terrorist crimes and in the investigation of
enterprises that engage in terrorism. All preliminary inquiries shall
be conducted pursuant to the General Crimes Guidelines. There is no
separate provision for preliminary inquiries under the Criminal
Intelligence Guidelines because preliminary inquiries may be carried
ont not only to determine whether the. groUnds exist to commence .a
general crimes investigation, but alternatively or in addition to • •
determine whether the grounds : exist to commence terrorism enterprise
investigation. A preliminary << inquiry>> shall be promptly terminated
when it becomes apparent that a full investigation is not warranted.
If, on the basis of information discovered in the course of a
preliminary .<< inquiry>> , an investigation is warranted, it may be
conducted as a general crimes investigation, or a criminal
intelligence investigation, or both. All such investigations,
however, shall be based on a reasonable factual predicate and shall
have a valid law enforcement purpose.
(b) In its efforts to anticipate or prevent crime,
the FBI must at times initiate investigations in -advance of criminal
conduct. It is impOrtant that such 'investigations not be based
on activities protectedby the First Amendment or on the lawful
exercise of any other rights secured by the Constitution or laws of
the United States. When, however, statements advocate criminal
activity or indicate an apparent intent to engage in crime,
particularly crimes of violence, an investigation May be warranted.
unless it is apparent, from the circumstances or the context in which
the' statements are made, that there . is no prospect of'harm.
(c) Nothing prohibits the FBI from ascertaining the
general scope and nature of criminal activity in a particular location
or sector of the economy, or from collecting and maintaining publicly
available information consistent With the Privacy Act. Criminal
intelligence investigations shall be terminated when all logical leads
have been exhausted and no legitimate law enforcement interest
justifies continuance.
**EffDte: 04/30/2004 MCRT#: 1338 Div: CT Cav: SecCls:
100-1.2.2 General Authority (See MIOG, Introduction, 1-3' .)
"a. A terrorism enterprise investigation may be
initiated when the facts or circumstances reasonably indicate that two
or more persons are engaged in an enterprise for the purpose of:
(i) furthering political or social goals, wholly or in part, through
activities that involve force or violence, and a violation of FBIO23967CBT
b2
• • .0y4-1R1.7.0 n9 /1 Rinc PAPP 7 n 1111 n • •
DOJOIG013255
.. inquiry m imiogimiog_partipuogp s I uu.ntm "'age 4 or l'/
federal criminal law, (ii) . engaging in terrorism as defined in
•18 U.S.C. 2331(1) or (5) that involVes a violation of
federal criminal law, or (iii) 'committing any offense described in -
18 U.S.C. 2332b(g)(5)(B). A terrorism enterprise investigation may
also be initiated when facts or circumstances reasonably indicate that
two or more persons are engaged in a pattern of racketeering activity
as defined in the RICO statute, 18 U.S.C. 1961(5), that involves an
offense or offenses described in 18 U.S.C. 2332b(g)(5)(B). Thestandard
of 'reasonable indication' is identical to that governing the
initiation of a general crimes investigation under Part II. In .
determining• whether an investigation should be conducted, the FBI
shall•consider all of the circumstances including: (i) the magnitude
of the threatened harin, (ii) the likelihood it will occur, (iii) the
immediacy of the threat, and (iv) any danger to privacy or free
expression posed by an investigation." (AGG III.B.1.a) (See MIOG,
Part 1, 100-2.3 .)
"b. Authority to conduct terrorism enterprise ,
investigations is in addition to general crimes investigative
authority under Part II, racketeering enterprise investigative
authority under Subpart A of the AGG Guidelines on General Crimes,
Racketeering Enterprise and Terrorism Enterprise Investigations, and
activities under other Attorney General guidelines addressing such
Matters as investigations and information collection relating to
international terrorism, foreign counterintelligence, or foreign
InEdnation warranting nifiation-of a terrorism
enterprise investigation may be obtained during the course of a .
general crimes << ii/quiry>> or investigation, a racketeering enterprise
investigation, or an investigation under other Attorney General'
guidelines. Conversely, a terrorism enterprise investigation may
yield information warranting a general crimes << inquiry>> or
investigation, a racketeering enterprise investigation, or an
investigation under other Attorney General guidelines." (AGG
III.B.l.b)
(ComMentary: However, all international terrorism investigations--
to include investigations of groups and organizations--shall be
conducted pursuant to the Attorney General's Guidelines for FBI .
National Security Investigations and Foreign Intelligence Collection
(NSIG), effective October 31, 2003, and within the 315 classification.
See Section 19 of the National Foreign Intelligence Program Manual
(NFIPM),I
"c. Mere speculation.thattorce or violence
might occur during the course of an otherwise peaceable demonstration
is not sufficient grounds for initiation of an investigation under .
the terrorism enterprise investigation subpart of the AG Guidelines, -
but where facts or circumstances reasonably indicate that a group or •
enterprise has engaged or aims to engage in activities involving force
or violence or other criminal conduct described in paragraph a. above
in a demonstration, an investigation may be initiated in conformity .
FBIO23968CBT
' • OIG—Rv.r) -07 /1R inc -PART ii n zatrr n rt n nos
b2
DOJOIG013256
.uziuuy 111 /-1111ulry1111Vg_pa111 11111Vbj)LJ IVV.11u11 , _rage, J 01 1 /
with the standards of that paragraph. For alternative authorities see
Part II of the AG Guidelines on General Crimes, Racketeering
Enterprise and Terrorism Enterprise Investigations relating to . General
Crimes.Investigations and the Attorney General's Guidelines on
'Reporting on Civil Disorders and Demonstrations Involving a Federal
Interest.' This does not limit the collection of information about
public demonstrations by enterprises that are under active
investigation pursuant to paragraph a. above." (AGG,III.B.1.c)
**EffDte: 04/30/2004 MCRT#: 133. Div: CT Cal. ,: SecCls:
100-1.2.31Checking of Leads and Preliminary Inquiries (See MIOG, Introduction; 1-3 .)
. 1(1) The lowest level of investigative activity is the
"prompt and extremely limited checking out of initial leads," which
should be undertaken whenever information is received of such a nature
that some follow-up as to the possibility of criminal activity is
warranted. This limited activity should be conducted with an eye
toward promptly determining whether further investigation (either a
preliminary << inquiry>> or a full investigation) should be conducted.!
(2) Preliminary Inquiries
(a)All preliminary inqUirieS•will be conducted . -
pursuant to the General- Crimes Guidelines. There is no separate
" provision for a preliminary <<-121qiiiry>> in the Racketeering Enterprise or
Terrorism Enterprise! Sections of the GuidelinesIbecause preliminary
inquiries under Part II may be carried out not only to determine
whether ground's exist to- commence. a general crimes investigation under
Part II of the General Crimes Guidelines, but alternatively or in'
addition to determine whether.the grounds exist to commence a
racketeering enterprise investigation or terrorism enterprise
investigation under Part III of the General Crimes Guidelines.!
You must rely on the authority in the General Crimes Preliminary
Inquiries Section to follow up on information or allegations that do
not warrant 4111 Terrorism Enterprise investigation. A preliminary
«inquiry» shall be promptly terminated when it becomes apparent that a
full investigation is not warranted. If,-on the basis of information
discovered in the course of a preliminary << inquiry>> , an investigation is
warranted, it may be conducted as a general crimes investigation, or a
criminal intelligence investigation; or both. All such
investigations, however, shall be based on a reasonable factual
predicate and shall have a valid law enforcement purpose. (See AGG
Introduction, Part A, and AGO, Part II, B contained in MIOG,
Introduction 1-3 .)j
(b) preliminary << inquiry>> should be undertaken when
there is information or aii allegation which indicates the possibility
of criminal activity .and whose responsible handling requires some
further scrutiny beyond checking initial leads. This authority allows
FBI Agents to respond to information that is ambiguous or incomplete.
FBIO23969CBT
-01 nnr nn /9 el I t• oS. b2
DOJOIG013257
JILL/ uny L1/11llVbp1J 1 VV.111.111
Even where the available information meets Only this threshold, the
range of available investigative techniques is broad. Only mail
openings and nonconsensual electronic surveillance are prohibited at
the preliminary -<< inquiry>> stage. Other methods, including the
development Of sources and informants and undercover activities and
operations, are permitted. The tools lawfully available to develop
information sufficient for the commencement of a full investigation,
. or determining that one is not merited--the purpose of a preliminary
inquiry>> -'-should be fully employed in preliminary investigations with a
view towards preventing terrorist activities.'
"EffDte: 04/04/200 MCRT#: 1281 DiV: CT Cav: SecCls:
100-2 (FULL-FIELD TERRORISM EICITERPRISEIINVESTIGATIONS
'Per Title 18, USC, Section 2331,Domestic Terrorism means
activities occurring primarily within the territorial jurisdiction of
the United States that involve acts dangerous to human life that are a
violation of the criminal laws of the United States or any state and
appear to be intended to intimidate. or coerce a civilian population,
influence the policy of a government by intimidation or coercion, or
affect the conduct of a government by mass destruction, assassination,
or kidnapping,' •
'Eff•Dte:.04/04%2003 MCRT#: 1281 Div: CT Cav: SecCls:
100-2.1 Purpose (See MIOG, Introduction, 1-3 .)
"The immediate purpose of alterrorism enterpriser
investigation is to obtnin information concerning the nature and
structure of the enterprise, as specifically delineated in paragraph
lb.lbelow, with a view to the longer range objectives of detection,'
prevention, and prosecution of the criminal activities of the
enterprise." (AGG III.B.2) (Also see 100-2.2 .) - •
**EffDte: 04/04/2003 MCRT#: 1281 Div: CT Cav: SecCls:
100-2.2 Scope (See MIOG, Part 1, 100-2.1 .)
"a. A terrorism enterprise investigation may collect such
information as:
"(i) the members of the enterprise and other persons...
likely to be knowingly•acting in furtherance of its criminal
objectives provided that the information concerns such persons'
activities on behalf or in furtherance of the enterprise; •
"(ii)the finances of the enterprise;
"(iii)the geographical dimensions of the enterprise; and
olf--orn Iv) /1 o in= -TYR 71M ft
a8c v VL J. /
FB1023970CBT
.r..sr-s °I° A A A ft nit .1 I b2
DOJOIG013258
inquiry in /miog/miog_partlimiogpls100.htm Page 7 of 17
"(iv) past and future activities and goal 's of the
enterprise.
"b. In obtaining the foregoing information, any lawful . .
investigative technique may be used in accordance with requirements of
Part IV." (AGO III.B.3)
1(1) Factors-that may support the initiation of a
terrorism enterprise investigation (TED, include:
(a)Direct Evidence of an enterprise's involvement
in or planning for the commission of a federal offense involving the
use of force or violence to fUrther political or social goals;
(b)Terrorism as defined in Title 18, USC, Section
2331 (1) or (5); or
(c)A crime described in Title 18, USC, Section
2332b(g)(5)(B).
. Such as direct infoimation about statements made in furtherance 'of the
enterprise's Objective's which show a purpose of committing such crimes
or securing their commission hy others..,
(d)The nature of the conduct eriagain by an .
enterprise will justify an inference that the standard is satisfied,
even if there are no known statements by participants that advocate or
indicate planning for violence or other prohibited acts.
Such activities as attempting to obtain dangerous biological agents,
toxic chemicals, or nuclear materials, or stockpiling explosives or
"weapons, with no discernible lawful purpose, may be sufficient to
reasonably indicate that an enterprise aims to engage in terrorism.
(e)A group's activities and the statements of its
members may properly be considered in conjunction with each other. A
combination of statements and activities may justify a determination
that the threshold standard for a TEI is satisfied, even if the .
statements alone or the activities alone would not warrant such a
determination.1
"EffDte: 07/09/2003 MCRT#: 1286 Div: CT Cav: SecCls:
100-2.3 Authorization and Renewal (See MIOG, Introduction, 1-3 .)
(1) Under the revisions approved by the Attorney General,
terrorism•enterprise investigations may be authorized by an SAC, with
notification to FBIHQ, and a written recommendation setting Torth the
facts and circumstances reasonably indicating the existence of an
enterprise.
FB1023971 CBT
WO^ ev, IAG T, r,m ra 1-11S.r. nn " rk A A n
b2
1
DOJOIG013259
, inquiry in innogimiog_parcimuogp i s i vu.mm rage 25 of 1 /
'However, all international terrorism investigations--to include
investigations of groups and organizations--shall be conducted
pursuant to the Attorney General's Guidelines for.FBI National
Security Investigations and Foreign Intelligence Collection (NSIG),
effective October 31, 2003, and within the 315 classification. See .
Section 19 of the National Foreign Inteligence Program Manual
(NFIPM).1
(2) 'With regardlto terrorism enterprise investigation
preliminary inquiries (PI), it is hereby the policy of the .
Counterterrorism Division (CTD) that, consistent with the revised AGG,
a terrorism enterprise investigation preliminary <.< inquity>> may be
authorized by an SAC for a period not to,exceed 180 days, with the
ability to renew or extend the term of the terrorism enterprise
investigation preliminary << inquiry>> an additional 180 days, for a total
of 360 days. If the field division intends to operate the terrorism .
enterprise investigation preliminary << inquily>> longer than 360 days
without converting the preliminary << iiiquiry>> to a full-field
investigation, the SAC must articulate to CTD the justification for
continued operation of the investigation as a preliminary -<< inqUiry>> .
Ultimately, FBIHQ will approve or disapprove the continued operation
of the terrorism enterprise investigation preliminary << inquiry>> .
(3) With regardIto fullLfield terrorism enterprise
inVeStigationSIof doniaticTerroiiSm,lit is hereby the-policy .Of the
CTD that, consistent withithe AGG on General-Crimes, Racketeering
Enterprise and Terrorism Enterprise Investigations",la
terrorism enterprise investigation may be authorized by ,an SAC only
I with concurrence ofithe Section Chief of the Domestic Terrorism
I Operations Section in CTD, FBIHQ.I FBIHQ concurrence `shall be obtained
by routing a preapproved copy of the LHM and opening electronic
I communication (EC) to FBIHQ. The EC will contain the name of]the
Section Chief of the Domestic Terrorism Operations Section, CTD,Iin
the approval field.
(4) All written submissions to FBIHQ providing notice of
the initiation of a terrorism enterprise. investigation preliminary
inquiry or notice and request for concurrence for the initiation of a
full-field terrorism enterprise investigation shall be
submitted by an LHM 14 daYs prior to conducting any significant
investigation and include a written recommendation setting forth. the
facts and circumstances reasonably indicating the existence of an
enterprise.
(5) Full-field terrorism enterprise investigations shall be
I concurrently authorized by the SAC andIthe Section Chief of the
I Domestic Terrorism Operations Section, CTD,Iat FBIHQ for a period of
up to one year, With renewal periods each not to exceed one year.
There are no restrictions on the number of renewals for full-field
terrorism enterprise investigationS. In addition to the SAC, the
FBIO23972CBT
b2
117 /1 0 / r -rvA tem I' AAAA/ A "
DOJOIG013260
. inquiry m fnuogimiog_parturruogpisiuu.ntm Page 9 of 17
Director; and any Assistant Director or senior headquarters official '
designated by the Director, may authorize, 'renew, review, and reopen
terrorism enterprise investigations. .
(6) Once the terrorism enterprise investigation has been
initiated and notice provided to FBIHQ, then FBIHQ shall notify the.
Office of Counterterrorism of the Criminal Division, Department of
Justice (DOJ), and the Office of Intelligence, Policy and Review and
any affected United States Attorney's Office. Further notice to be
immediately provided by TVCS to the AG and Deputy AG.
. (7) To facilitate coordination of terrorism enterprise
investigations, CTD requests field division cooperation by first
coordinating the initiationof any terrorism enterprise investigation .
preliminary << inquity>> or full-field investigation with the appropriate
CTD personnel. Further, field divisions should provide notification
of the initiation of all full-field terrorism enterprise •
investigations via LHM/EC within 14 days of conducting any significant
investigation so that the Dar can be•promptly notified. Field
divisions are requested to conduct logical queries of ACS to ensure
that a full-field terrorism enterprise investigation has not aiready -
been initiated on the enterprise of interest. If afull:field
terrorism enterprise investigation does already- exist, the field .
division should contribute intelligence information to the existing
terrorism enterprise investigation's universal file. CTD will not •
proVide Concurrence for the initiatii5ii.ofiiiultiPle full-field •
terrorism enterprise investigations on the same group.unless the
supporting field division can distinguish the proposed full-field
terrorism enterprise investigation from an existing full-field'
terrorism enterprise investigation.
"EffDte: 04/30/2004 MCRT#: 1338 Div: CT Cav: Seeds:
.100-2.3.1 Commentary
I • There has been a tendency in the past tolclose •
investigationsland terminate informant coverage when the . .
I violent activity of the group has been dormant for a period ontime.
TheIAGGI(Part III.B.4.c)Ipermits the FBI to monitor organizations that
may be temporarily inactive, but whose prior record or stated
objectives indicate a need for continuing federal interest, so long as
the threshold standard for investigation is satisfied. Under those
circumstances, the investigation may remain in a pending status,
and informant coverage can be maintained to the extent necessary to
determine whether there is any change in the criminal objectives of •
the enterprise;The ability to.continue an investigation, despite
temporary inactivity of acts of violence or lack of immediate threat,
is often referred to as the "dormancy provision" of the AGG and is a
I significant advantage thatiTerrorism Enterprisel(100) investigations
afford over AOT (266) cases.
FBIO23973CBT
b2
DOJOIG013261
. inquiry in inuoginuog_partlinuogpislUO.htm Page 10 of 17
**EffDte: 04/04/2003 MCRT#: 1281 Div: CT Cav: SecCls:
100-3 RESULTS OF INVESTIGATION
**EffDte: 12/10/1991 MCRT#: 0 Div: CT Cav: SecCis:
100-3.1 Reporting
(1) The contents of communications which report the
[ results of]Terrorism Enterprise'investigations should be
limited to information about the criminal enterprise under
investigation. Recommendations, opinions, and conclusions of the FBI
should be included in the administrative portion of the communication,.
or in the case of letterhead memoranda (LHM), in the cover electronic
I communicationI(EC).1In preparing LHMs which are disseminated to the
I Terrorism and ViolentICrimelSectiondOffice.of Intelligence Policy
I and Review,pepartment of Justice, and to 'other agencies on a
need-to-know basis, emphasis should be placed on factual accuracy. .
1 (2) In all communications submitted under alTerrorism
Enterpriselcaption, a statement indicating the authorized
period of investigation should be set forth. This statement should be
placed after the case caption and after referencing previous
communications. For example:
"XYZ ORGANIZATION;
. ITERRORISM ENTERPRISE;I
00: NEW YORK";
I "Reference New YorklECItO DireCtor,IDATE.I
I I"Terrorism Enterpriselinvestigation authorizedIDATEIto
I expireIDATE."I
**Effbte: 04/04/2003 MCRT#: 1281 Div: CT Cav: SecCls:
100-3.1.1 Deadlines (See MAOP, Part 2, 10-9(23) .)
. . (1) [When a terrorism enterprise investigation
preliminary << inquiry>> and/or a full-field terrorism enterprise
investigation is completed or nearing expiration, the results of the
investigation are to be furnished to FBIHQ in.an LHM with a cover EC
recommending an extension or closing of.the matter. This report is •
due no later than 180 days after the initiation of a preliminary
inquiry and 365 days for a full-field investigation.[ These reports
should be presented in a summary, narrative fowl, ,containing specific
and articulable facts adequate to Meet the "reasonable indication"
standard of the Attorney General's Guidelines for renewal, or
sufficient information which warrants the investigation being placed
in a closed status. Any recommendations, opinions or conclusions of
the FBI should be included in the cover EC, but not in the LHM. The
FBIO23974CBT b2
Car --R•Rn n2 /1 R / nc-1721-Pril 1 n TVVV7 ri El A 01 A r '
DOJOIG013262
inquiry inimiog/miog_partl/miogpls100.htm Page 11. of 17 ..„;
cover EC shOuld also include a paragraph which sets forth future
investigative and prosecutive goals.and a paragraph which 'sets forth
the investigative strategy to be implemented in order to attain these
goals. The investigative goals paragraph may include objectives which
relate to`the improvement of the intelligence base, use of technical
or undercover techniques, or any other vulnerability which can be
exploited. The investigative strategy paragraph(s) should describe -
how these goals and objectives will be reached.during the next year. •
The LHM and cover EC (hard copy) should be submitted to arrive at
FBIHQ at least ten workdays prior to the expiration of the current
authorization period and should be organized as follows:
(a) Predication - This should include a paragraph(s)
relating the circumstances which caused a full investigation of
the captioned group or individuals to be initiated.
• . (b) Background Information on Group - In addition to
a desCription of the group under investigation, this section should
include, but not be limited to, the following: '
1. Specific criminal acts the group has
committed, or is advocating, to achieve its political or social 'goals.
2: Key leaders and members -of the. group.
•
3. Finances Oft& group.
4. Geographical dimensions of the group.
5. Planned activities and goals of the group.
6. Association with other organizations/groups.
'which are subjects of an FBI terrorism enterpriseinvestigation.
(c) Activities during the last year ' - This
section should include a summary of investigative results of the
office of origin and all lead offices.
(d) Justification for Continuation of Investigation
- This segment should set forth in succinct detail how, the facts of
this investigation conform with the Attorney General's Guidelines for
terrorism enterprise investigations. It should contain a paragraph(s)
which reasonably indicates that two or more persons are continuing to
engage in an enterprise, for the purpose of 1) furthering political or
social goals, wholly or in part, through activities which involve
force or violence and a violation of federal criminal law; 2) engaging
in terrorism as defined in Title 18, USC, Section 2331(1) or (5) that
involves a violation of federal criminal law, or 3) committing any •
offense described in Title 18, USC, Section 2332b(g)(5)(B). A
terrorism. enterprise investigation may also be initiated when facts or
circumstances reasonably indicate that two or more persons are engaged
FB1023975CBT
b2
• • soIci—Pwca- 112,./ I Aft% 21•P 1ft_ _ •cst-4,- 11/111"A I •
DOJOIG013263
. inquiry m innogrmiog_parcin:mogpisiuv.mm rage 12 of 17.
in a pattern of racketeering activity as defined in the RICO statute
(Title 18, USC, Section 1961(5)), that involves an- offense(s)
described in Title 18, USC, Section 2332b(g)(5)(B).
(2) The due date of this report is calculated from the
date the terrorism enterprise investigation was approved by the
I SACIfor a preliminary << inquity>> and FBIHQ for a full-field
investigation.I After] 180 days (for a preliminary << inquiry>>)
I and the first year (for a full-field inyestigation),Ithe office of
I origin should continue to submit reports in ongoinglinvestfg,ations.1 -
These reporting deadlines allow for compliance with the
requirements of the -Attorney General Guidelines and do not preclude,
nor should they discourage, the reporting of results of investigation
by EC, telephone, or other form of communication to FBIHQ and
pertinent field offices during the course of the investigation.
Significant data developed during the Year which requires notification
to FBIHQ or dissemination to other agencies ; should be submitted by
EC, LHM, or telephone, depending on the exigencies of the situation.
Communications containing information of interest for other agencies
should be prepared in a foini suitable for dissemination. Significant •
information furnished on an interim basis should also be included in
the next regularly scheduled report.
• (3) Communications (hard copies) approving an
extension of Terrorism Enterprise investigations should be received at
FBIHQ no than ten workday's prior to the expiration ofsnch t -
matters.
(4) Deleted
**EffiDte: 07/09/2003 MCRVI: 1286 Div: CT Cav: SecC1S:
100-3.1.2 Predications
IniTerrorism Enterpriselinyestigations, the basis
•for the investigation shall be set forth as the first paragraph in the
detailS of the initial LHM. Formal predications arelnotIrequired. A •
statement including pertinent portions of the Attorney General
Guidelines is sufficient. •
"EffDte: 04/04/2003 MCRT#: 1281 Div: CT Cav: SecCls:
100-3.1.3 Documentation of Information
All communications should be limited to documented
information relevant to the scope of the investigation. No
information should be reported concerning an individual's social or
personal habits or other background data which is not relevant to an ,
assessment of his/her activities or affiliation with the enterprise
under investigation.
FB1023976CBT
b2
• 0 0.2./1.1:1/11c-paprp 1 n Yalu -r n n n A v7
DOJOIG013264
inquiry in imiogmiog_partitmiogpis.100.htm Page 13 of 17
"EffDte: 12/10/1991 MCRT#: Opiv:.CT Cav: SecCis:
100-3.1.4 Undisclosed Sources
(1) Where the identity of the source of information is
not disclosed in ajTerrorism Enterpriselreport, an assessment
- of the reliability of the source shall be provided..
(2) In all communications, the source of the inforination
'should be identified by symbol number or name in either the cover
pages or adMinistrative section. of the communication.
"EffDte: 04/04/2003 MCRT#: 1281 Div: CT Cav: SecCis:
" 100-3.1.5 Characterizations
(1) A characterization of the group should be included as
part of the initial LHM submitted. Characterizations should be
outlined as the first paragraph of the LHM or as an appendix to the
LHM.
(2) This instruction eliminates the previous reporting;
requirement of providing characterizations of subversive'
organizations: All characterizations should include a statement
regarding -the political or social goals which the group hopes to .
achieve through violetio-e; its gographic area ofliperation, and 4
summary of the violence or criminal activity it either has been
involved in oris advocating in the future. In instances where only
advocacy of violence is preSent, a statement should also be included
regarding the ability of group members-to carry it out and the
likelihood of the harm intended. (For further instructions on the
preparation of characterizations, see Part II, 10-17.13 , of the Manual
of Administrative Operations and Procedures.)
**EffDte: 12/10/1991 MCRT#: 0 Div: CT Cav: SecCis:
100-3.1.6 Character'
The designationl"Terrorism Enterprise"Ishould be
used in all cases, e.g., "(Name of Organization);ITerrorism
I Enterprise.", If a subsidiary or front group is involved,
include the name or abbreviation of the parent organization, e.g.;
f "(Name of Organization);ITerrorism Enterprise,- (Name of
Subsidiary Organization)."
**EffDte: 04/04/2003 MCRT#: 1281 Div: CT Cav: SecCls:
1 100-3.1.7 Copies -(Annual and Renewal Reports
Five•copies ofireportsishould be submitted tolDomestic •
Terrdrism Section,fFBIHQ,unless instructed otherwise in specific
FBIO23977CBT
b2
oirz-pizn fl!, /1Q /i1M 1 n •Aloa•AAAA At A A
DOJOIG013265
, inquiry in /miog/miogpartlimiogpls100.htm Page 14 of 17
cages, The office of origin should also provide information copies of
these reports to involved field offices.
"EffDte: 04/04/2003 MCRT#: 1281 Div: CT Cav: SecCls:
100-3.1.8 Informant Coverage
Cover'electronic communicationsIshould include a brief
• summary of informant coverage available wit •respect to a group or
enterprise, identifying informants who report on the group's
activities by symbol number, and showing specifically which informants
are members of the group.
"EffDte: 06/23/1997 MCRT#: 692 Div: CT Cav: SecCls:
100-3.1.9 Office of Origin
The field office wherein the criminal enterprise is
headquartered, orlwhere terrorismiactivities largelyloccur,lor impact
upon, should be designated as origin. In unusual circumstances where
there is doubt which office should be origin, a request should be made
to FBIHQ to designate an office of origin. In cases where the office
of origin receives information that a criminal enterprise has changed
its area of operation to the territory of another division, and --
justification to investigate exists based on the crirriinal enterprise's
current activities, the office of origin shoiild request Verification
of this information to be completed within 30 dayS. If the new area
of operation is confirmed, the office of origin will be transferred.
The level of investigation being conducted by the previous office of
origin should be continued by the new office of origin unless facts,
in addition to the criminal' enterprise's relocation, indicate that
another form of investigation is more appropriate. Reporting
deadlines applicable to the former office of origin are to be folloWed•
by the new office of origin. .
"EffDte: 04/04/2003 MCRT#: 1281 Div: CT Cav: SecCls: .
10-3.2.Aditional Reporting Requirements
The following repOrting requirements are separate from,
I and in addition to, thelbiannuallyearlylreports requesting renewal
authorization or recommending the closing of an investigation outlined
above:
(1) BASIS FOR ADDITIONAL REPORTING - Past investigation
of domestic terrorist organizations has demonstrated that in order to
achieve success in these cases the primary thrust must be prosecutive;
however, experience has also shown that a successful prosecution
against a terrorist enterprise does not necessarily mean its demise.
(a) During the course of a criminal intelligence
FBIO23978CBT b2
• OfG-RED 02/1 R/05-PART l n 'MC 'T 11 fle II A
DOJOIG013266
• inquiry in /ming/miog_partl
I
/rruogplslUU.htm Page 15 of 17 —
investigation, specific articulable criminal violations
may be identified which would reasonably indicate enforcement
activity or court proceedings (e.g., arrest, discovery hearings,
etc.) will occur. At that time, a general criminal investigation
(266 case) should be opened to focus upon the specific criminal -
activity. The criminal intelligence investigation (100 - case) would
continue to focus on the entire enterprise, as the scope of the AOT
case may be limited to a relatively small portion of the total
activity of that enterprise.
(b) While it may be appropriate for all
investigative results generated from an AOT (266) case to be placed
in the corresponding 100 file, the converse is not true. Only those
details in the 100 case which specifically pertain to the -subjects of
the AOT case should be placed in the 266 file. •
(2) ADDITIONAL REPORTING PROCEDURES - In order to mandate •
the essential analysis of these groups and to provide for a more
adequate and efficient intelligence basd in terrorism enterprise
investigations, the following reporting procedures shall be followed. ,
(a) In addition to the submission of a
ibiannual/annuallreport requesting renewal authorization or closing of
an investigation, the office .of origin will also submit separate
-investigative inserts on individual members of the enterprise, and
-other persons likely fo- be knowingly acting' infUrtherance Of its
'criminal objectives, using the following format: .
1.Name and known aliases of subject;
2. Biographical data to include: date of
birth, place of birth,• height, weight, eye and hair color, social •
security account number, distinguishing marks or characteristics,
build, past and current addresses, past and current phone numbers, •
educational background, employment (past and present), and criminal
record to include dates, offense, location, disposition' , and FBI, .
state and local agency identifying numbers. Also include Henry and
NCIC fingerprint classifications.
• 3. Short narrative explaining the role or
position of the subject in the group or enterpriSe, including any
knoWn or suspected criminal activity in which the subject is or has
been involved.
4. Summary of subject's travel, domestic and
foreign, including dates and points of travel, Also, detail nature of
contacts that subject has had with other groups or enterprises under
investigation.
•
if known.
5. Statement of subject's source of finances,
FBIO23979CBT b2
-- crrr rmn n9 t:/ c DA-orri n mia-rnrinevsmn
DOJOIG013267
1
inquiry in aniogimiog_partiqmogp 1 s i vv.= rage. 10 or 1
6. Glossy 3-by 5-inch photograph of member, if
available. If not available, efforts should be made to obtain one. -
(b) In cases where a subject(s) resides within'a
lead office territory,-the lead office will prepare inserts as above,
•.and forward them to the office of origin 30 days prior to the
expiration of the current authorization. This will be incorporated
into the office of origin's submission to FBIHQ.
(c) Following the initial submission of these
inserts, follow-up inserts should contain only informatiOn which has
changed since the last reporting. Photographs of subjects should be
updated at least annually.
(d) To facilitate the preparation of these inserts,
subfileS for each subject-should be created which will provide
appropriate documentation and retrieval capability., •
**EffDte: 07/09/2003 MCRT#: 1286.Div:.CT Cav: SecCls:
100-4 PUBLICATIONS OFITERRORISM ENTERPRISEIORGANIZATIONS; COLLECTION OF
PUBLICLY AVAILABLE INFORMATION •
(1) The Attorney General Guidelines on General Crimes, :-
1Racketeering Enterprise, andlTericitismtnterprisalInvestigatioligullow
the FBI to colleCt publicly available information subject to the ,
constraints of the.federal Privacy Act of .1974. This Act prohibits J`
the collection, maintenance and dissemination- of any record .
describing how an individual exercises First Amendment Rights; except
when authorized by statute, or when pertinent to and within the- -
scope of an authorized law enforcement activity. •
• (2) The FBI, in this regard, is authorized to collect :
general information which is available to every citizen even thou
there is no active investigation. Examples of information we may
collect is that which is obtainable through the printed-news media
data banks, e.g., The NEW YORK TIMES Data Bank, public libraries,
newspapers, magazines, and publicly available databases.' This type
of material is collected as library material, and should not be
indexed asto particular individuals or placed in'FBI files.
(3) Publications issued by a group which is the subject
I °flan investigationIcan be collected. This type of material can be'
indexed as to particular individuals and can be made a part of the
investigative file.
(4) All information received- or made available to the FBI
during the course of an investigation should be evaluated for its
pertinence to the investigation. This is particularly true when the
information concerns the exercise of an individual's or group's First
FB1023980CBT
119 /.1.s2 Inc—pawn II n 1-rnAnn ,r3=1
I
b2
DOJOIG013268
inquiry in in-uoginuog_partiipuogpislUULUtm • Page 17 of 17 .
Amendment rights. In such cases, the information concerning the
• exercise of First Amendment rights should be made a matter of record
only if it is.pertinent to and within the scope of an authorized law
enforcement activity. (See MIOG, Introduction, 1-4 ; Part 1, 190-5.1 ;
MAOP, Part 2, 9-4.4.2(2) .)
(5)When public-source prihted material concerning the
exercise of First Amendment rights is obtained and a decision made to
retain such material ; a notation must be placed on the material
describing the reason(s) it was collected.and retained. The notation
. must clearly indicate the specific -investigative interest(s) which led
to the decision to retain the item.
. .
(6) Certain 'tinted public source material may contain a
characterization of a group, individual or activity. When such
information is disseminated to FBIHQ, FBI field offices or outside the
FBI, the transmitting communication should state.that the •
characterization has not been made by the FBI, but by a third party.
However, if the characterization comports in whole or in part with the
results of independent FBI investigation, the transmitting
communication may so state.
**EffDte• 04/04/2003 MCRT#: 1281 Div: CT Cav: SecCls:
I 100-5 'DELETED (SEE MIOG, PART 1, SECTION 294 .)I
"EffDte: 06715/2000 MCRT#: 992 Div: CT Cav: SecCls-:
Top of ,Page
SENSITIVE
1996 Microsoft Corporation .
FBIO23981CBT
b2
Z. • 0
DOJOIG013269