UNCLASSIFIED (U)

12 FAM 220

INVESTIGATIONS

(CT:DS-321; 05-24-2019)
(Office of Origin: DS/DSS)

12 FAM 221 SCOPE AND RESPONSIBILITY

(CT:DS-273; 05-19-2017)

The Bureau of Diplomatic Security (DS) provides a broad range of investigative services through its Directorates for Domestic Operations (DS/DSS/DO), Threat Investigations and Analysis (DS/DSS/TIA), and Security Infrastructure (DS/DSS/SI). Regional security officers (RSOs) and assistant RSO investigators (ARSO-Is) work with these investigative offices to conduct and complete investigations overseas.

12 FAM 221.1 Types of Investigative Services

12 FAM 221.1-1 Security-Related Investigations

(CT:DS-273; 05-19-2017)

DS/DO, DS/SI and DS/DSS/TIA investigate all security-related matters pertaining to personnel and operations of the Department and the Foreign Service. Investigations range from security clearance background investigations of applicants, damage assessments of successful network penetrations, unauthorized disclosures of classified information, protective intelligence and threats, and review of conduct that might reflect adversely on the integrity or trustworthiness of Department personnel.

12 FAM 221.1-2 Investigations for Other Department Elements

(CT:DS-273; 05-19-2017)

The Office of Investigations and Counterintelligence (DS/DO/ICI), Office of Protective Intelligence and Investigations (DS/TIA/PII), and the Office of Special Investigations (DS/DO/OSI) provide investigative support for other Department elements such as the Bureau of Human Resources (DGHR), the Office of Inspector General (OIG), the Bureau of Consular Affairs (CA), the Bureau of Medical Services (MED), and U.S. Diplomatic posts, as requested by a chief of mission (COM).

12 FAM 221.1-3 Investigations for Other U.S. Government Departments and Agencies

(CT:DS-273; 05-19-2017)

DS may honor requests for investigative assistance abroad on behalf of other departments or agencies of the Federal Government pursuant to 22 U.S.C. 3904(3). Criminal investigative assistance abroad must be coordinated through the Criminal Investigative Liaison Branch (DS/CR/CIL).

12 FAM 221.1-4 Criminal Investigations Abroad

(CT:DS-273; 05-19-2017)

Outside of the United States, DS conducts criminal investigations for the Department related to illegal passport or visa issuance or use (to include terrorism, human smuggling/trafficking, and other types of transnational organized crime), protective intelligence and threats, other investigations as defined in 12 FAM 226 as authorized by law.

12 FAM 221.2 Bureau of Diplomatic Security Support Agreements with Other Agencies

(CT:DS-273; 05-19-2017)

DS has a number of memoranda of agreement, memoranda of understanding, and exchanges of letters with the investigative, law enforcement, and security offices of other U.S. Government agencies. In some instances, DS may have more than one agreement with an agency depending on the subjects involved. These agreements establish the parameters of cooperation and jurisdiction between the two agencies in specified areas relating to security matters. The Policy and Planning Division (DS/MGT/PPD) coordinates all such agreements for DS and maintains files of all current agreements (see 12 FAM 053.)

12 FAM 221.3 International Criminal Police Organization (INTERPOL) Relationships

(CT:DS-273; 05-19-2017)

As part of its law enforcement duties, DS/CR/CIL serves as the Departments representative to INTERPOL. INTERPOL is a liaison channel with foreign law enforcement organizations and provides an avenue for exchange of information and file checks on behalf of the Department.

12 FAM 221.4 DS Personnel Authorized to Conduct Investigations

(CT:DS-273; 05-19-2017)

a. Special agents of the Diplomatic Security Service, credentialed security specialists assigned to the Programs Application Division (DS/IS/APD), and credentialed special investigators assigned to the Office of Personnel Security and Suitability (DS/SI/PSS) conduct investigations as authorized by statute or other authority. DS authorizes special agents in the field offices and RSOs abroad to open investigations and provides direction and guidance for conducting those investigations. In some investigations at posts, limited checks and inquiries may be made by Foreign Service national investigators (FSNIs) and criminal fraud investigators (CFIs) upon the instructions and guidance of the responsible RSOs or ARSO-Is.

b. The Criminal Investigations Division (DS/ICI/CR), the Overseas Criminal Investigations Division (DS/ICI/OCI), the Office of Protective Intelligence and Investigations (DS/TIA/PII), and the Office of Special Investigations (DS/DO/OSI) as applicable, instruct and provide guidance to all special agents and RSOs for the conduct of investigations.

c. In some investigations, RSOs may instruct post security officers within their geographic region of their responsibility to conduct limited checks and inquiries on specific cases.

12 FAM 221.5 Authorities

(CT:DS-273; 05-19-2017)

a. Statutes, Executive Orders, and regulations contain the authority for DS to provide investigative services, including:

(1) 22 U.S.C. 4802;

(2) 22 U.S.C. 2709; and

(3) E.O. 13526, Chapter 4.

NOTE: Subchapters 12 FAM 220, 12 FAM 550, 12 FAM 590, and 12 FAM 230 provide citations that explain specific types of investigations.

b. Criminal violations: DS is authorized to conduct investigations relating to protection of foreign officials and diplomatic personnel and foreign missions in the United States, suitability for employment, employee security, illegal passport and visa issuance or use, identity theft or document fraud affecting or relating to the programs, functions, or authorities of the Department of State; Federal offenses committed within the special maritime and territorial jurisdiction of the United States (as defined in section 7(9) of title 18), except as such jurisdiction relates to the premises of United States military missions and related residences; and other investigations, as authorized by law. Such investigations may involve allegations of criminal misconduct.

c. Administrative violations: Most administrative investigations involve violations of Department regulations or the failure to perform duties required by these regulations. The 3 FAM contains the Departments employee relations policies, while 7 FAM and 9 FAM contain the Departments visa, passport, and consular services policies for posts.

d. The System of Records Notice, STATE-36, Security Records, was published in accordance with the Privacy Act, allowing for the collection of the information. The Notice was published December 26, 2007, in the Federal Register, 72 FR 73057 (originally published September 2, 1975, 40 FR 40482).

e. Authority for maintenance of the security records system is found in E.O. 13467, as amended, and E.O. 13526.

12 FAM 221.6 Related Offenses

(CT:DS-273; 05-19-2017)

Fraud charges may arise from related offenses uncovered in the course of a criminal investigation concerning passport and visa issuance and use. The following list includes the most common related offenses:

(1) False claim to U.S. citizenship (18 U.S.C. 911);

(2) False statements generally (18 U.S.C. 1001);

(3) Fraud and related activity in connection with identification documents (18 U.S.C. 1028);

(4) Conspiracy to commit offenses or to defraud the United States (18 U.S.C. 371);

(5) Accessory after the fact (18 U.S.C. 3);

(6) Misprision of a felony (18 U.S.C. 4); and

(7) Bribery of a public official (18 U.S.C. 201).

12 FAM 221.7 Investigative Method

12 FAM 221.7-1 Fairness, Objectivity, and Impartiality

(CT:DS-273; 05-19-2017)

a. All investigations and interviews must be conducted in a fair and impartial manner, to ensure fairness both to the individual being investigated or interviewed and to the Department. Any investigator who knows of circumstances about a given case that might adversely affect his or her fairness, impartiality, or objectivity or may give the perception that the circumstances could adversely affect the quality of the investigation, must make those circumstances known to the immediate supervisor before initiating the investigation.

b. Investigators conducting personnel investigations must not employ any techniques in violation of law.

c. Investigators must not investigate persons or incidents without authority. Moreover, they must be particularly careful not to investigate persons other than the subject of the inquiry, or to create the impression that they are doing so. Occasionally, in background investigations, interest may legitimately focus on persons other than the main subject under investigation, but there must be direct and reasonable relevance of the other persons activity to the subjects general suitability, fitness, or loyalty (see 12 FAM 232).

12 FAM 221.7-2 Accuracy and Completeness

(CT:DS-273; 05-19-2017)

a. Reports of investigation must be complete and accurate. Unsupported conclusions, conflicting statements, or unverified allegations must be investigated further and either corroborated or refuted whenever possible. Investigators must investigate any incomplete record of criminal activity to obtain specific details and to determine final disposition of the matter.

b. When information of a potentially disqualifying nature surfaces, an investigator must probe further to acquire sufficient details to permit a reasonable evaluation. Investigators may seek guidance from their immediate superiors, when necessary, in furtherance of a complete and objective investigation.

c. To obtain maximum effectiveness, investigations must be well planned, carefully executed, and properly reported in a timely manner. Upon receipt of a request for a personnel investigation or collateral lead, the investigators must:

(1) Study the basic material, including any special instructions;

(2) Identify the objectives of the investigation and essential issues involved; and

(3) Determine the facts required to resolve them.

d. Investigators must abide by and follow any legal constraints relevant to an investigation. This includes any criminal or administrative due process safeguards with respect to either subjects or sources.

12 FAM 222 CRIMINAL INVESTIGATIONS DIVISION

12 FAM 222.1 Criminal Investigative Liaison Branch (DS/CR/CIL)

(CT:DS-273; 05-19-2017)

DS/CR/CIL coordinates within DS criminal investigations requested by:

(1) The Departments Office of Inspector General (OIG);

(2) The Inspector General (IG) of any executive department having personnel at U.S. posts abroad;

(3) Other Federal, State, and local law enforcement agencies, which have primary investigative jurisdiction, but for which investigative activity is required outside the United States;

(4) A Federal agency or department having primary investigative responsibility for other criminal violations (including waste, fraud, and mismanagement cases, which fall under OIG jurisdiction); and

(5) The Department of Justice (DOJ).

12 FAM 222.2 Diplomatic Security (DS) and Inspector General Relationship

(CT:DS-273; 05-19-2017)

a. Under 1 FAM 053.2-5, DS and other Department personnel shall provide assistance and information requested by the OIG.

b. In accordance with 22 U.S.C. 3929(c)(6), the Assistant Secretary for DS is required to submit to the Inspector General a report of the following allegations, within 5 business days of learning of the allegation:

(1) Waste, fraud, or abuse in a Department program or operation;

(2) Criminal or serious misconduct on the part of a Department employee at the FS-1, GS-15, GM-15 level, or higher;

(3) Criminal misconduct on the part of a Department employee; and

(4) Serious, noncriminal misconduct on the part of a Department employee who is authorized to carry a weapon, make arrests, or conduct searches, such as conduct that, if proved, would constitute perjury or material dishonesty, warrant suspension as discipline for a first offense, or result in loss of law enforcement authority.

12 FAM 222.3 Inquiry at Post Regarding Counterfeit Currency

(CT:DS-273; 05-19-2017)

a. The RSO should conduct a preliminary inquiry to establish, at a minimum:

(1) Who initially reported the counterfeit notes;

(2) Under what circumstances (to include when and where) the counterfeit notes were discovered; and

(3) If possible, the identity of the person or institution initially attempting to pass the counterfeit notes.

b. If appropriate, the RSO may conduct relevant interviews.

c. The RSO should report the results of interviews to the U.S. Secret Service (USSS) by providing a copy of the case report from the Investigative Management System (IMS) or by cable, if there are no attachments. The following information describing the counterfeit notes should be included:

(1) Denomination;

(2) Type of note: For example, a Federal Reserve note that has a green seal and serial number; a U.S. note that has a red seal and serial number; or a silver certificate that has a blue seal and serial number;

(3) Series;

(4) Serial number;

(5) Check letter;

(6) Face plate number;

(7) Back plate number; and

(8) For Federal Reserve notes, the name of the issuing bank.

d. In exigent circumstances, the RSO should address telegraphic traffic to the USSS for immediate action.

e. USSS requests for additional investigative activities to the RSO should be directed to DS/CR/CIL for coordination. RSO should not initiate investigations for USSS without coordinating and receiving approval from DS/CR/CIL. RSOs should coordinate any questions or concerns to their International Programs (DS/DSS/IP) or High Threat Programs (DS/HTP) desk officer and DS/CR/CIL.

f. The Criminal Investigations (DS/ICI/CR) division chief, or designee, will acknowledge receipt of the information and forward it to the appropriate authority.

12 FAM 222.4 Lookouts

12 FAM 222.4-1 Treasury Enforcement Communications System (TECS) Lookouts

(CT:DS-273; 05-19-2017)

a. The TECS database system is used by DS, the Bureau of Immigration and Customs Enforcement (ICE), the Bureau of Customs and Border Protection (CBP), U.S. Secret Service (USSS), and other Federal agencies to post lookouts and share law enforcement information pertinent to border security and public safety.

b. Upon finding probable cause that a passport or visa felony has occurred, and after getting supervisory approval, DS special agents and analysts will create TECS lookouts on offenders. Whether or not the case was prosecuted does not affect this requirement. The TECS lookout may be delayed for special circumstances such as a sealed indictment or undercover operations. Exemptions may be granted by DS/ICI/CR.

c. TECS lookouts help other agencies interdict offenders and connect DS cases with other investigations. DS analysts and special agents will list names, aliases, dates of birth, Social Security numbers, email addresses, passport numbers, addresses, phone numbers, business names, and other available details. Providing detailed biographic information will, among other things, assist with identity resolution. Every TECS lookout will list the IMS case number. The completed TECS lookout will be recorded as an attachment in the IMS case. The IMS case will have a concise synopsis, a case report, and necessary attachments to enable DS to swiftly respond to inquiries regarding the TECS lookout.

12 FAM 222.4-2 CLASS Lookouts

(CT:DS-273; 05-19-2017)

On the basis of the results of investigative information provided by DS/ICI/CR, DS can create lookouts that are displayed in the Consular Lookout and Support System (CLASS) with lookout code DSR. DSR lookouts recorded in CLASS can be used by adjudicators in the Bureau of Consular Affairs, Visa Services (CA/VO), and DS/DSS/DO to determine whether visa and passport ineligibilities apply to a particular applicant.

12 FAM 222.4-3 Fingerprints in the National Crime Information Center (NCIC) Interstate Identification Index (III) on all DS Arrestees

(CT:DS-273; 05-19-2017)

a. Criminal arrest records maintained by the Federal Bureau of Investigation (FBI) in NCIC III are used by local, State, tribal, military, and Federal agencies to identify and capture criminals and terrorists, track crime statistics, and as an investigative tool to research suspects' booking information. Law enforcement cases are often solved from records contributed to III by police agencies.

b. For all DS arrests, fingerprints and booking information from the defendant will be electronically submitted to NCIC by the DS office that made the arrest. This submission makes the arrest information and biometrics available to thousands of other police departments and other U.S. Government agencies.

c. After making the submission, the sending DS office will confirm that the fingerprints and booking facts were accurately recorded in the defendant's criminal history by NCIC.

d. For all DS-assisted arrests (both foreign and domestic), DS will not submit booking information to NCIC, since DS is not the primary arresting police agency in those instances.

12 FAM 222.4-4 DS Records to NICS to Prevent Unlawful Firearms Possession

(CT:DS-273; 05-19-2017)

a. The Department of Justice (DOJ) National Instant Criminal Background Check System (NICS) is a database of individuals prohibited from receiving firearms. Firearms dealers rely on NICS to determine whether a potential buyer is prohibited from purchasing a firearm under Federal firearms law.

b. Federal firearms law prevents ten categories of individuals from possessing, receiving, shipping, or transporting firearms. Most of the records that DS creates or possesses pertinent to NICS are provided by DOJ to NICS without any action required by DS employees. Some records DS creates or acquires will require proactive sharing with NICS. Following are the 10 categories of prohibited individuals, and whether DS must take any action:

(1) Felons: For DS cases prosecuted by any U.S. Attorneys Office (USAO) or other DOJ component that result in Federal felony convictions, DOJ will furnish those judgment and commitment orders to NICS. For DS felony prosecutions not handled by any DOJ agency, DS must furnish to NICS the judgment order from the court;

(2) Fugitives from justice: All Federal felony cases DS works in collaboration with the USAO or other DOJ components that result in a felony warrant, indictment, or information, DOJ provides that information to NICS without DS action required. If any DS office secures any misdemeanor warrant or obtains any felony charging document without the collaboration of the USAO, DS shall report that warrant or charging document to NICS;

(3) Persons unlawfully using or addicted to any controlled substance: DOJ will report to NICS any drug-related Federal convictions, but not arrests. Although rare, if DS achieves any arrests for drug offenses or otherwise uncovers evidence of current or recent drug use, that information should be provided to NICS;

(4) Persons adjudicated as mentally defective or committed to a mental institution: If during the course of a DS investigation, there is a judgment and commitment order, sentencing order, or DS record of an adjudication of an individuals inability to manage his or her own affairs if such adjudication is based on marked subnormal intelligence or mental illness, incompetency, condition or disease, DS shall report that to NICS;

(5) Illegal/unlawful aliens, and aliens admitted on a nonimmigrant visa: No action required by DS;

(6) Persons dishonorably discharged from the military: The Department of Defense (DOD) provides to NICS information on discharge records, court-martial records, and disciplinary orders. No action required by DS;

(7) Citizen renunciation: The Bureau of Consular Affairs (CA) provides information from certificates of loss of nationality to NICS. No action required by DS;

(8) Persons subject to a domestic violence restraining order: DS will provide to NICS details on protective orders if, pursuant to a DS investigation, a court issued an order restraining the subject from harassing, stalking, or threatening an intimate partner of such person or child of such intimate partner or person, or engaging in other conduct that would place an intimate partner in reasonable fear of bodily injury to the partner or child. The courts order must include a finding that such person represents a credible threat to the physical safety of such intimate partner or child, or by its terms expressly prohibits the use, attempted use, or threatened use of physical force against such intimate partner or child that would reasonably be expected to cause bodily injury;

(9) Persons convicted of a misdemeanor crime of domestic violence: Should any DS investigation result in a Federal misdemeanor conviction for domestic violence, and that prosecution was handled by the USAO or other DOJ component, DS will not take further action; DOJ reports the conviction to NICS. Domestic violence prosecutions in which DS is the lead agency, and the prosecution was not handled by any DOJ component, DS must report the conviction to NICS; and

(10) Persons under indictment: For a DS investigation that results in a Federal indictment or information and the case was prosecuted in cooperation with any USAO or other DOJ component, no further action is required by DS. DOJ handles reporting the facts to NICS. For a DS case that results in an indictment or information but were not prosecuted by a DOJ component, DS must furnish to NICS the indictment or information.

c. During the course of any DS investigation, DS employees may uncover, receive, or possess records pertinent to the above 10 categories, although the records were not created by DS. In general, DS need not focus on providing records it merely possesses but did not create, as DS cannot necessarily vouch for the reliability of records created elsewhere and because those records should be submitted to the NICS by their original creator. However, if DS possesses relevant and reliable records created by a state or subdivision thereof, DS may make those records available to NICS, and specialists at NICS will assess the records to determine if a NICS lookout file is necessary.

d. NICS also relies on arrest records in the III to assess an individuals eligibility to have a firearm. DS shall make accurate and timely fingerprint submissions of all DS Arrest details to III. Use of that information has broad benefit to police agencies for a variety of purposes. DS offices should be cognizant that NICS depends on accuracy in DS submissions to III on names, aliases, dates of birth, citizenship, Social Security numbers, and other facts about arrestees so NICS can make effective verifications on potential firearms buyers.

12 FAM 223 OVERSEAS CRIMINAL INVESTIGATIONS DIVISION (DS/ICI/OCI)

12 FAM 223.1 Responsibilities

(CT:DS-273; 05-19-2017)

The Overseas Criminal Investigations Division (DS/ICI/OCI) is responsible for managing the efforts of assistant regional security officer investigators (ARSO-Is). DS/ICI/OCI provides policy, investigative, and budgetary guidance to ARSO-Is and advises regional security officers (RSOs) and consular chiefs on ARSO-I related matters. DS/ICI/OCI works closely with the Bureau of Consular Affairs (CA) Office of Fraud Prevention Programs (CA/FPP) and other bureaus, offices, and agencies on international investigative matters. DS/ICI/OCI monitors the progress and accomplishments of each ARSO-I at post and reports the results to the Office of Investigations and Counterintelligence (DS/DO/ICI).

12 FAM 223.2 Policy and Programs

12 FAM 223.2-1 ARSO-I Program

(CT:DS-273; 05-19-2017)

The primary task of the ARSO-I is to protect the integrity of the international passport and visa systems and disrupt criminal and terrorist mobility by working with host-nation law enforcement to combat the production and use of fraudulent travel and identity documents. While this critical border security function is expected to take up most of the ARSO-Is work hours, the special agent may spend up to 20 percent of his or her time performing RSO programmatic duties. Therefore, the ARSO-I should become familiar with various aspects of the RSO program. The RSO (or DRSO-I) will serve as the ARSO-Is rating officer and the consular section chief will serve as the reviewing official.

12 FAM 223.2-2 ARSO-I Investigations

(CT:DS-273; 05-19-2017)

a. The ARSO-I, in regular consultation with the consular chief and the RSO, initiates, plans, and coordinates investigations relating to visa and passport fraud and prepares cases for presentation to U.S. or foreign law enforcement authorities for criminal prosecution or administrative proceedings. The ARSO-I may also assist the RSO, as needed, in other high priority investigations. The senior RSO is ultimately responsible for all ARSO-I investigative activities.

b. The ARSO-Is investigative efforts should focus on high priority cases that have or might have links to terrorism, large scale alien smuggling or human trafficking, other transnational organized crime, or the production of high quality fraudulent documents. The ARSO-I may also develop confidential informants (12 FAH-4 H-610) to assist in the process of gathering and disseminating criminal intelligence as it relates to U.S. border security.

c. Coordination with DS/ICI/CR regarding sensitive and complex investigations is required. The ARSO-I will coordinate through with the Criminal Fraud Investigations Branch (DS/CR/CFI) on internal visa/passport fraud investigations involving local and/or American staff. The ARSO-I may also coordinate with the Office of Special Investigations (DS/DO/OSI) on an OSI investigation at post as outlined in 12 FAM 226.

d. The ARSO-I is responsible for managing and maintaining the inventory of expendable investigative materials and equipment.

12 FAM 223.2-3 Liaison between ARSO-I and Consular Sections

(CT:DS-273; 05-19-2017)

a. The ARSO-I is expected to establish and maintain effective liaison with the consular sections fraud prevention manager (FPM), as well as other consular staff. This is vital to deterring and detecting criminal conduct in the passport and visa process. Pursuant to post-specific standard operating procedures (SOPs), the FPM refers all cases that have the potential to involve criminal activity to the ARSO-I. Cooperation between the ARSO-I and the FPM includes, but is not limited to, the following:

(1) Participating, as requested, in regular fraud prevention training sessions and briefings for consular officers, locally hired staff, and local authorities;

(2) Developing and sharing intelligence on fraud trends and vulnerabilities with consular staff and other appropriate audiences; and

(3) Establishing and maintaining effective liaison with local police, immigration, and airline officials.

b. The ARSO-I and the FPM are expected to work collaboratively to develop, maintain, and routinely share information. An effective two-way exchange of information is critical to the success of fraud prevention and investigative efforts. This does not, however, pertain to DS-registered confidential informants, the management of whom will not be intermingled with consular functions.

c. Where possible and/or appropriate, the ARSO-I, in consultation with the RSO, may manage security and access control measures for the consular section.

12 FAM 223.3 Reporting Requirements

(CT:DS-273; 05-19-2017)

a. The ARSO-I will send a monthly status report (MSR) to DS/ICI/OCI, which details various aspects of his or her workload. DS/ICI/OCI then compiles the reports for the purpose of program-wide statistical analyses. Activities documented in the MSR include, but are not limited to, the following:

(1) The number of ARSO-I hours worked and the number of hours spent on traditional RSO work;

(2) The number of local arrests made based on ARSO-I investigations;

(3) The number of passport and visa refusals/revocations resulting from ARSO-I investigations;

(4) The number of training sessions conducted by ARSO-I staff;

(5) The number of personnel trained by ARSO-I staff; and

(6) The number of requests for ARSO-I assistance.

b. The ARSO-I will send a detailed investigative incident report (IIR) to DS/ICI/OCI whenever an investigation results in a host government arrest, extradition, deportation, or raid, as well as when the ARSO-I conducts training or significant liaison activity. The report will also indicate if the investigation is being conducted jointly with host-country law enforcement or with other U.S. Government agencies.

c. The ARSO-I will inform DS/ICI/OCI of all investigative operations conducted within the host country. Undercover funds received/spent must be recorded and tracked in accordance with DS/ICI/OCI direction and 12 FAH-4.

d. Except in exigent circumstances, the ARSO-I will inform DS/ICI/OCI of any travel required outside of post (i.e., to a different part of the country, the United States, etc.).

12 FAM 223.4 Budgeting and Funding

(CT:DS-273; 05-19-2017)

DS/ICI/OCI works closely with the Office of the Chief Financial Officer (DS/EX/CFO) to ensure that all ARSO-I funding is spent appropriately. Accordingly, all funding requests from post will be processed through DS/ICI/OCI. Certain posts are funded by H and L work visa fees. The efforts of an ARSO-I and a Foreign Service national investigator (FSN-I) funded by H and L work visa fees must be focused primarily on preventing, detecting, and investigating H and L visa fraud.

12 FAM 224 CONSULAR AFFAIRS-RELATED INVESTIGATIONS: PASSPORT, VISA AND ISSUANCE FRAUD

12 FAM 224.1 Passport Fraud Investigations

12 FAM 224.1-1 Liaison Between Bureaus of Diplomatic Security (DS) and Consular Affairs (CA)

12 FAM 224.1-1(A) Program Ownership

(CT:DS-273; 05-19-2017)

a. The Bureau of Consular Affairs (CA) Office of Fraud Prevention Programs (CA/FPP) is responsible for the implementation of the consular anti-fraud program, which includes the detection and prevention of passport fraud.

b. The Criminal Investigations Division (DS/ICI/CR) and the Overseas Criminal Investigations Division (DS/ICI/OCI), as applicable, are responsible for the criminal investigation and enforcement functions relating to the passport fraud aspects of this program, as authorized in 22 U.S.C. 2709. To further support these efforts, DS/ICI/CR and DS/ICI/OCI consult, as appropriate, with CAs Directorate of Passport Services (CA/PPT) and CA/FPP.

c. See 7 FAH-1 H-932, Office of Fraud Prevention Programs (CA/FPP), for information regarding CA/FPPs role in coordinating the development of programs and fraud training courses for domestic and overseas consular operations, to detect and prevent passport, visa, and other types of consular fraud.

d. See 7 FAH-1 H-932 for information on how CA/PPT headquarters offices and CA/FPP collaborate to support the domestic fraud prevention program, primarily through fraud program managers (FPMs) who are part of the passport agency/center management structure.

e. DS/ICI/CR and DS/ICI/OCI coordinate with CA/FPP as the primary liaison with CA on consular fraud issues.

12 FAM 224.1-1(B) Other Referrals of Passport Fraud Offenses

(CT:DS-273; 05-19-2017)

a. The Domestic Operations Directorate (DS/DSS/DO), RSOs, and ARSO-Is investigate passport fraud cases and carry out related enforcement functions for the Department.

b. Although many domestic referrals of passport fraud offenses originate from CA/PPT, information concerning possible passport violations also come to the attention of DS/DSS/DO, RSOs, ARSO-Is, and/or DS/ICI/OCI, as applicable, from other Department offices, posts, other Federal, State, and local agencies, or private citizens.

12 FAM 224.1-2 Diplomatic Security (DS) Responsibilities

12 FAM 224.1-2(A) General

(CT:DS-273; 05-19-2017)

For the purpose of conducting passport fraud investigations, special agents may:

(1) Obtain and execute search and arrest warrants;

(2) Make arrests without warrant for any offense concerning passport or visa issuance or use, if the special agent has reasonable grounds to believe that the person has committed or is committing such an offense;

(3) Obtain and serve subpoenas and summonses issued under the authority of the United States; and

(4) Carry firearms for the purpose of performing these duties authorized by this section in accordance with the firearms policy (12 FAM Exhibit 023).

12 FAM 224.1-2(B) Criminal Investigations Division (DS/ICI/CR) Responsibility

(CT:DS-273; 05-19-2017)

DS/ICI/CR is responsible for administrative case control, policy, and provides procedural policy guidance for all passport fraud cases. Responsibilities include:

(1) Creates and updates criminal investigative policy and procedure;

(2) Provides guidance on investigative procedures, criminal law, investigative resources, statistical trends, and policy;

(3) Oversees strategic case management of passport and visa crime investigations;

(4) Coordinates, supports, or conducts investigations of visa and passport crime;

(5) Serves as the principal point of contact between DS and CA on passport and visa crime issues or inter-bureau agreements;

(6) Receives crime allegations and routes them to the DS unit with responsibility to conduct the preliminary inquiry;

(7) Manages and supports DS representatives assigned at other agencies to advance passport and visa crime investigations;

(8) Coordinates or completes requests to DS for investigative assistance from Federal, State, local, military, tribal, or foreign agencies;

(9) Provides investigative assistance to other bureaus or agencies pursuant to interagency agreements or memoranda of understanding;

(10) Coordinates with Federal, State, local, military, tribal, or foreign agencies when DS investigations reveal suspected violations of law for which they have investigative authority;

(11) Investigates allegations of any U.S. Government employee, including overseas personnel under chief of mission authority, suspected of visa or passport crime;

(12) Investigates allegations of foreign diplomats suspected of visa or passport crime perpetrated against the United States; and

(13) Supports the Training Directorate (DS/DSS/T) and other bureaus to plan or execute course content pertaining to criminal investigations.

12 FAM 224.1-2(C) Overseas Criminal Investigations Division (DS/ICI/OCI) Responsibility

(CT:DS-273; 05-19-2017)

DS/ICI/OCI provides policy guidance for passport fraud cases involving an ARSO-I. Typically, these cases will have an interconnection to international criminal and terrorist networks.

12 FAM 224.1-2(D) Role of DS Field Offices and RSOs

(CT:DS-273; 05-19-2017)

a. RSOs and DS field offices will record all passport crime allegations and investigative activity in the DS Investigative Management System (IMS). New allegations reported to DS must be recorded in IMS within 1 workday. This includes but is not limited to:

(1) Crime allegations from walk-in complainants;

(2) Referrals from CA/FPP or fraud program managers;

(3) Duty telephone calls;

(4) Write-in complaint letters;

(5) Faxed messages;

(6) Email tips;

(7) Referrals from other agencies; and

(8) DS self-initiated preliminary inquiries.

b. RSOs and special agents in charge (SACs), or his/her designee(s), will review all preliminary inquiries opened in his/her area of responsibility.

c. The RSO or field office SAC assigns a case agent who has primary operational responsibility to:

(1) Interview sources;

(2) Gather evidence;

(3) Obtain and execute search warrants;

(4) Obtain and execute arrest warrants;

(5) Make warrantless arrests; and

(6) Ensure that the investigation is conducted in accordance with Federal Rules of Criminal Procedure and DS Guidelines.

d. While a passport fraud referral originating from CA/PPT remains under investigation, the RSO, or field office SAC, ensures that case agents update the referring agency or centers FPM on the status of the investigation within 90 days from the date of the referral, and every 30 days thereafter.

e. Once a domestic case agent determines reasonable grounds exist to believe that a Federal crime has been committed, the information will be promptly brought to attention of the appropriate U.S. attorney. The U.S. attorney or his/her designee may request additional investigation by the case agent prior to accepting or declining prosecution of the case. Special agents will respond to these requests by conducting further investigation and continue to work with the assistant U.S. attorney (AUSA) through the trial of the case in Federal court. If the AUSA declines a case, the special agent must communicate the declination to the appropriate CA/PPT referring office.

f. Any passport fraud referral where a DS agent is the subject of the investigation must be coordinated with DS/DO/OSI.

12 FAM 224.1-3 Coordination with the Bureau of Consular Affairs (CA)

(CT:DS-273; 05-19-2017)

a. DS coordinates with CA through the Office of Fraud Prevention Programs (CA/FPP) on matters related to passport and visa fraud. DS has been advised that CA/FPP, in collaboration with CA/PPT, is responsible for the implementation of the consular anti-fraud program, including detection and deterrence of passport fraud, as stated in 1 FAM 252.2-1.

b. The success of the passport fraud prevention programs depends in large measure upon the active cooperation between DS and CA. DS investigative efforts require CA cooperation to:

(1) Ensure that requests for investigative assistance are made in a timely manner, that is, as soon as possible once the violation is established;

(2) Apprise DS/ICI/CR and/or DS/ICI/OCI, as applicable, of all pertinent information developed by fraud coordinators and consular officers prior to cases being referred for investigation, and furnish to DS/ICI/CR and/or DS/ICI/OCI copies of any additional information received by CA/FPP, after a case has been referred;

(3) If necessary, provide DS/ICI/CR and/or DS/ICI/OCI, as applicable, with the original documentation associated with a request for an investigation;

(4) Alert DS/ICI/CR and/or DS/ICI/OCI prior to sending a letter denying a passport to an applicant under investigation by DS (see 7 FAH-1 H-942.8, Working with Diplomatic Security);

(5) Advise DS/ICI/CR and/or DS/ICI/OCI, as applicable, if any other agency is inquiring about or is interested in a case referred to DS/ICI/CR for investigation; and

(6) Designate a single contact point in CA/FPP and CA/PPT to serve as continuing liaison with DS/ICI/CR or DS/ICI/OCI in all passport fraud-related matters.

c. In support of the basic CA/FPP responsibility for the detection and deterrence of passport fraud, DS will:

(1) Investigate all cases of alleged passport fraud referred to it by CA/FPP and CA/PPT, and coordinate with the Office of Inspector General (OIG) on cases of mutual interest;

(2) Notify CA/FPP and CA/PPT early in the process of expanded investigations, such as any other investigation undertaken in pursuit of a referred case;

(3) Notify CA/FPP and CA/PPT within 1 week of initiating an investigation in cases of alleged passport fraud detected and referred by other Federal, State, or local agencies or other sources. The notice may be delayed if necessary to not conflict with sensitive investigative steps;

(4) Pursue, in a timely manner, investigations for the purpose of determining applicants bona fides, or if fraud was perpetrated by one individual, or were there affiliated individuals;

(5) Present, with the cooperation of CA/FPP and CA/PPT, cases of substantial passport fraud, or related violations of other Federal statutes, to the Department of Justice (DOJ), U.S. Attorneys Office (USAO) for possible prosecution;

(6) Ensure that original documentation is handled in such a manner as to preserve its evidentiary value, and return such passport records, including all attachments, as expeditiously as possible to CA/FPP and CA/PPT. The disclosure of information on passport records, or release of such records, must comply with the Privacy Act, Freedom of Information Act, and Department policy;

(7) Provide CA/FPP and CA/PPT with copies of all related pending and closed reports of investigations and final orders pertaining to prosecutions, and ensure that these reports of investigation contain enough detail for the CA/FPP and CA/PPT to take appropriate action to issue or deny the passport application; and

(8) Designate contact points in DS/ICI/CR and DS/ICI/OCI to serve as the continuing liaison with CA/FPP and CA/PPT in all passport fraud-related matters.

12 FAM 224.1-4 Authorities: Passport Fraud Investigations

(CT:DS-273; 05-19-2017)

a. DS special agents investigate the following offenses:

(1) Issuance without Authority (18 U.S.C. 1541);

(2) False Statement in Application and Use of Passports (18 U.S.C. 1542);

(3) Forgery or False Use of Passports (18 U.S.C. 1543);

(4) Misuse of Passports (18 U.S.C. 1544); and

(5) Safe Conduct Violation (18 U.S.C. 1545).

b. DS special agents must be aware of the following pertinent regulations and procedures, which relate to the conduct of passport fraud investigations. CA/PPTs Office of Legal Affairs and Law Enforcement Liaison (CA/PPT/S/L) exercises the Secretarys authority to revoke or deny any U.S. passport:

(1) Passport U.S. Government Property (22 CFR 51.7);

(2) Surrender of Passport (22 CFR 51.66);

(3) Denial of Passports (22 CFR 51.60); and

(4) Revocation or Restriction of Passports (22 CFR 51.62).

12 FAM 224.1-5 Revocation and Recovery of Passports

(CT:DS-273; 05-19-2017)

a. 22 CFR 51.7(a) states that a passport at all times remains the property of the United States and must be returned to the U.S. Government upon demand.

b. CA/FPP or CA/PPT may request that DS recover a passport that CA/PPT has issued. See 12 FAH-4 H-124.2.

c. The Departments authorized representative (usually the case agent) is authorized to demand the surrender of a revoked passport. If the bearer refuses to do so, CA/PPT may invalidate the passport by notifying the bearer in writing of the invalidation (22 CFR 51.66).

d. Department employees should typically only retain a passport if there are reasonable grounds to believe that there is sufficient unclassified evidence to support revocation, and revocation is pursued expeditiously. To revoke a passport, the Department must establish by a preponderance of the evidence that the individual is not entitled to a passport.

e. Only CA/PPT/S/L may revoke or deny U.S. passports whether the passport is within the United States or abroad. DS agents are not authorized to revoke passports. DS agents should typically only retain a passport, either pursuant to a lawful warrantless seizure or a search warrant, when probable cause exists that the passport itself is evidence of a crime, sufficient evidence exists to revoke the passport, and the agent intends to submit a revocation request to CA/PPT/S/L within a reasonably expeditious period of time. Agents should also notify the consular section at post of the retention of the passport. Consular personnel will assess, in consultation with others at the Department, whether the individual is eligible for a limited validity passport (LVP). In addition, DS agents should contact the U.S. Department of Justice for possible prosecution of the passport holder. If the case is not accepted for prosecution and CA/PPT/S/L chooses not to revoke the passport in question, the passport must be returned to the holder. If the passport is seized pursuant to an arrest in the United States, it will be handled in the same manner as the arrestee's other seized items, unless the DS agent determines it should be referred to CA/PPT/S/L as described herein.

f. For more information on passport revocations, including how to submit revocation requests and procedures regarding retention when a law enforcement hit is being resolved, see 7 FAM 1380, Passport Denial, Revocation, Limitation, Restriction, and Surrender.

g. DS may receive recovered U.S. passports from different sources, such as local law enforcement, local governments, airlines, and transportation centers. To maintain the integrity of the U.S. passport as a secure travel document, CA/PPT makes every effort to account for the final disposition of all U.S. passports. Therefore, DS should mail all recovered U.S. passports to CA/PPT at:

NOTE: In instances where fraud is suspected or has been established, DS special agents should coordinate with CA/FPP (see 7 FAM 1386.4 and 7 FAM 1375).

12 FAM 224.1-6 DS Arrest Warrants in the National Crime Information Center (NCIC)

(CT:DS-273; 05-19-2017)

If a Federal arrest warrant is issued on the basis of a DS investigation, the special agent must immediately enter it into the National Crime Information Center (NCIC) database if the warrant will not be served immediately and the timing of the NCIC input would not compromise other criminal investigative priorities. Arrest warrants sealed by the courts will not be put into NCIC.

12 FAM 224.2 VISA FRAUD

12 FAM 224.2-1 General

(CT:DS-273; 05-19-2017)

DS/DSS/DO, RSOs, ARSO-Is investigate visa fraud cases and carry out related enforcement functions for the Department. DS has primary responsibility for administrative and operational case control and investigation of all such cases referred to them by the CA Office of Fraud Prevention Programs (CA/FPP), State and local agencies, other Federal agencies, and other sources.

12 FAM 224.2-2 Authority

(CT:DS-273; 05-19-2017)

a. Investigative and arrest authority for visa fraud and consular issuance fraud are set forth in 22 U.S.C. 2709 (the offenses are contained in 18 U.S.C. 1546). Special agents may conduct investigations concerning the issuance, production, or use of fraudulent visas. For the purpose of conducting such investigations, DS special agents may:

(1) Obtain and execute search and arrest warrants;

(2) Make arrests without warrant for any offense concerning illegal passport or visa issuance or use if the special agent has reasonable grounds to believe that the person has committed or is committing such offense;

(3) Obtain and serve subpoenas and summonses issued under the authority of the United States; and

(4) Carry firearms for the purpose of performing these duties authorized by this section in accordance with the firearms policy (12 FAM Exhibit 023).

b. Statute of limitations: An indictment must be found or the information must be instituted within 5 years next [sic] after such offense shall have been committed (18 U.S.C. 3282).

12 FAM 224.2-3 Responsibilities

(CT:DS-273; 05-19-2017)

a. The Criminal Investigations Division (DS/ICI/CR) and the Overseas Criminal Investigations Division (DS/ICI/OCI), as applicable, provide investigative assistance on visa fraud matters at the request of CA/FPP. Investigations are undertaken to determine the nature, scope, or validity of visa fraud allegations. Investigative and arrest authority relating to enforcement of visa fraud fall under 22 U.S.C. 2709.

b. DS/ICI/CR and DS/ICI/OCI, as applicable, will transmit such information to CA/FPP with a request for background information as appropriate. DS/ICI/CR and DS/ICI/OCI have access to and can obtain information from visa records:

(1) From CA/FPP following a check of appropriate files;

(2) That are maintained in the Consular Consolidated Database (CCD); and

(3) Collected by RSOs at posts abroad.

c. All records will be requested and handled consistent with the visa record confidentiality provisions of:

(1) Section 222(f) of the Immigration and Nationality Act;

(2) In accordance with the terms and conditions of the information sharing memorandum of understanding (MOU) between DS and CAs Directorate of Visa Services (CA/VO); and

(3) 9 FAM 603.2-4.

d. At posts, consular officers are primarily concerned with the verification of the bona fides of a visa applicants supporting documentation. If a consular officer suspects fraud or develops information to indicate that visa fraud activities are being carried out within the host country, the consular officer may seek the assistance of the RSO to provide investigative support. This support could take many forms, including seeking the cooperation of local authorities to investigate and prosecute visa fraud suspects.

e. DS/ICI/CR provides policy and procedural guidance to special agents.

f. RSOs and DS field offices will record all visa crime allegations and investigative activity in the Investigative Management System (IMS). New allegations reported to DS must be recorded in IMS within one workday. This includes but is not limited to:

(1) Criminal allegations from walk-in complainants;

(2) Duty telephone calls;

(3) Write-in complaint letters;

(4) Faxed messages, email tips;

(5) Referrals from other agencies; and

(6) DS self-initiated preliminary inquiries.

g. RSOs and specials agents in charge (SACs), or his/her designee(s), will review all preliminary inquiries opened in his/her area of responsibility.

h. Domestically, special agents are authorized to:

(1) Interview sources;

(2) Gather evidence;

(3) Make arrests;

(4) Issue warrants; and

(5) Serve as liaison with other agencies, as appropriate.

i. A case agent will have primary operational responsibility to present evidence to the assistant U.S. attorney (AUSA), who will determine whether sufficient evidence exists to warrant prosecution and to ensure that the investigation is conducted in accordance with applicable criminal law and procedure standards.

j. The Department of Homeland Security (DHS) Bureau of Immigration and Customs Enforcement (ICE) has the primary responsibility for immigration fraud that occurs in the United States. DS may conduct its own investigation of immigration-related facts if pertinent to a DS investigation of illegal visa issuance or use. Such investigations may be done jointly with ICE or independently. These investigations frequently deal with verification of U.S.-based organizations, schools, businesses, persons, etc.

k. Once a domestic case agent determines reasonable grounds exist that a Federal crime has been committed, sufficient evidence then exists to warrant prosecution. The information will be promptly brought to the attention a DS special agent for a basic determination. The facts and circumstances of the case will them be shared with the appropriate U.S. attorney. The U.S. attorney or his/her designee assistant U.S. attorney (AUSA) may request additional investigation by the case agent prior to accepting or declining prosecution of the case. Special agents will respond to these requests by conducting further investigations and will continue to work with the AUSA throughout the trial of the case in Federal court.

l. CAs Advisory Opinions Division (CA/VO/L/A) coordinates requests for Visa Services (CA/VO) employees to testify at trials and assists in preparing evidence.

m. RSOs may respond to requests for investigative assistance received from their resident and constituent posts, and they may request assistance from the DS/ICI/OCI chief, as applicable, to seek assistance from a domestic investigative office.

n. Any visa fraud or malfeasance referral where a DS agent is the subject of the investigation must be coordinated with DS/DO/OSI.

12 FAM 224.3 CONSULAR MALFEASANCE INVESTIGATIONS

12 FAM 224.3-1 General

(CT:DS-273; 05-19-2017)

a. Investigation of allegations of consular malfeasance by Department employees falls within the purview of the Criminal Investigations Division (DS/ICI/CR) and the Overseas Criminal Investigations Division (DS/ICI/OCI).

b. Some activities that fall within this area are violations of Federal criminal law whereas others constitute violations of Federal regulations and/or Department administrative and procedural policy.

12 FAM 224.3-2 Consular Malfeasance Investigations Assignment and Control

(CT:DS-273; 05-19-2017)

DS/ICI/CR and DS/ICI/OCI, as applicable, have responsibility for initiating, directing, and closing all investigations of cases of consular malfeasance. Special agents should rely on guidance and direction from DS/ICI/CR and/or DS/ICI/OCI in the conduct of investigations.

12 FAM 224.3-3 Controls and Administrative Guidance

12 FAM 224.3-3(A) Need to Know Policy

(CT:DS-273; 05-19-2017)

Because consular malfeasance cases may involve allegations of criminal activity or other misconduct by Department employees, special agents should limit dissemination of the information. Limit knowledge of the initial allegations and subsequent investigative efforts only to individuals with a need to know. This policy protects both the integrity of the investigation and the privacy of the employee concerned.

12 FAM 224.3-3(B) Release of Case Documents

(CT:DS-273; 05-19-2017)

DS/ICI/CR, must specifically approve the release of any documentation pertaining to a consular malfeasance investigation, except release to DS special agents with a need to know.

12 FAM 224.3-3(C) Report Allegations

(CT:DS-273; 05-19-2017)

a. All DS offices must report every allegation of consular malfeasance directly to DS/ICI/CR, which is responsible for notifying, when appropriate, CAs Consular Integrity Division (CA/FPP/CID).

b. RSOs must immediately report by DSX Channel message or through the passport and visa fraud inbox (PassportVisaFraud@State.Gov) to DS/ICI/CR all cases of suspected consular malfeasance that are brought to their attention. All taskings for RSOs must be coordinated with and channeled through DS/ICI/CR.

12 FAM 224.3-3(D) Foreign Passports Obtained for Evidentiary Purposes

(CT:DS-273; 05-19-2017)

Foreign passports are normally the property of the government that issued them, and they should not be confiscated at a preliminary stage of the investigation. If an individual agrees to surrender his or her passport, the special agent must explain that the surrender of the passport is voluntary and that the passport can be returned to the bearer at any time. However, if the identity on the foreign passport is fraudulent, it can be confiscated. In such instances, DS special agents must treat the passport as evidence.

12 FAM 225 PERSONNEL INVESTIGATIONS

12 FAM 225.1 Objective

(CT:DS-273; 05-19-2017)

The main objective of a personnel security investigation is to establish the individuals general character, integrity, and trustworthiness, as demonstrated by past conduct and acceptance of responsibility. This will permit an assessment of the probability that the individual will perform his or her duties faithfully and responsibly, and will hold in confidence, even under adverse circumstances, matters of official business which require discretion (see 12 FAM 321.3, Policy).

12 FAM 225.2 Scope

(CT:DS-273; 05-19-2017)

All U.S. Government positions are designated in terms of their national security sensitivity to assure appropriate screening under E.O. 10450 (see 12 FAM 230, Personnel Security). A full-field background investigation is required for sensitive positions in which an individual, either deliberately or through negligence, could adversely affect the security interests of the United States. Because of the potential risk to national security, it is essential that sensitive positions be filled only by persons of demonstrated loyalty and trustworthiness. The absence of disqualifying information about an individual is insufficient to make a positive determination about a persons eligibility for a sensitive position; enough positive information must be known about the individual to lead a reasonable person to conclude that the individual under investigation can be trusted with responsibility for matters of more than routine consequence to the nation, and the individual will maintain that trust in the face of unusual pressures or hazards. The purpose of the background investigation is to acquire the information necessary and relevant for such a determination (see 12 FAM 233, Eligibility for Security Clearance).

12 FAM 225.3 Authority

(CT:DS-273; 05-19-2017)

Authorities:

(1) Executive Order 10450 Security Requirements for Government Employees;

(2) Executive Order 12968 Access to Classified Information;

(3) Executive Order 12829 National Industrial Security Program;

(4) Executive Order 13467 - Reforming Processes Related to Suitability for Government Employment, Fitness for Contractor Employees, and Eligibility for Access to Classified National Security Information;

(5) Executive Order 13488 - Granting Reciprocity on Excepted Service and Federal Contractor Employee Fitness and Reinvestigating Individuals in Positions of Public Trust

(6) Executive Order 13526 - Classified National Security Information;

(7) Executive Order 13587 - Structural Reforms to Improve the Security of Classified Networks and the Responsible Sharing and Safeguarding of Classified Information;

(8) Adjudicative Guidelines for Determining Eligibility for Access to Classified Information issued pursuant to E.O. 12968;

(9) Homeland Security Presidential Directive 12 (HSPD-12) Policy for a Common Identification Standard for Federal Employees and Contractors;

(10) Presidential Policy Directive (PPD-19) Protecting Whistleblowers with Access to Classified Information;

(11) Office of Management and Budget (OMB) Memo on Reciprocity, December 12, 2005;

(12) 5 CFR 731 OPM part 731, Suitability; and

(13) 5 U.S.C. 1104(a)(2) Delegation of Authority for Personnel Management.

12 FAM 225.4 Responsibilities

(CT:DS-273; 05-19-2017)

The Office of Personnel Security and Suitability (DS/SI/PSS) directs the conduct of personnel security investigations of employees, applicants, certain contractors, and others seeking access to Department information and/or facilities. It also assists in conducting or directing the conduct of such civilian investigations abroad for other Federal agencies.

12 FAM 225.4-1 Other Agency Requests for Personnel Investigations

(CT:DS-273; 05-19-2017)

DS/SI/PSS is the central authorizing office for requests by other agencies for personnel investigations requiring field inquiries, employment verification, and source interviews by regional security officers (RSOs). DS/SI/PSS does not usually consider routine requests for record checks, such as police, embassy, credit, telephone subscriber information, etc., as constituting a personnel investigation (see 12 FAM 231.4). By mutual agreement, requests from other Federal law enforcement agencies for record checks on employees may be made directly to RSOs.

12 FAM 225.4-2 Investigations for Local Guard Programs

(CT:DS-273; 05-19-2017)

As a matter of policy, RSOs are responsible for conducting background checks of prospective guard personnel. In some cases, the RSO has tasked commercial contractors to conduct portions of the investigation. The RSO must in all cases be satisfied with the effectiveness of the contractor investigation. RSOs themselves must complete local police checks and must review files of appropriate agencies at post. The RSO must keep the results of these investigations for subsequent inspection by DS supervisory personnel (see 12 FAH-7 H-130, Types of Local Guard Programs).

12 FAM 225.4-3 DS Personnel Authorized to Conduct Personnel Investigations

(CT:DS-273; 05-19-2017)

DS special agents and contract special investigators may conduct investigations domestically. RSOs and special investigators may conduct investigations abroad. Post security officers, with the instruction and guidance of RSOs, may also conduct limited checks and inquiries in some applicant-type investigations.

12 FAM 226 Office of SPECIAL INVESTIGATIONS (DS/DO/OSI)

12 FAM 226.1 Scope and Authority

(CT:DS-293; 04-10-2018)

a. The Office of Special Investigations (DS/DO/OSI) has the primary responsibility within the Department for administrative and operational case control of non-routine investigations that do not fall within the purview of other DS investigative offices and divisions. OSI is specifically charged with conducting and/or coordinating the following investigations:

(1) Employee and contractor misconduct: DS/DO/OSI conducts investigations into criminal and administrative misconduct committed by Department employees and contractors stationed domestically, and criminal and administrative misconduct by all executive branch U.S. Government employees and contractors under chief-of-mission (COM) authority. . Misconduct investigations include, but are not limited to, investigations concerning possible violations of:

(a) Local, State, and Federal law;

(b) The Foreign Affairs Manual and Handbook, Department policies, and COM policies; and

(c) Other incidents that may impact an employees continued eligibility and suitability for continued employment, security clearance, and access to classified information;

(2) Extraterritorial criminal investigations: DS/DO/OSI conducts criminal investigations into violations of U.S. extraterritorial laws involving executive branch U.S. Government employees, contractors, and dependents falling under COM authority in accordance with 18 U.S.C. 7, Special Maritime and Territorial Jurisdiction (SMTJ), and 22 U.S.C. 2709(a). In this capacity, DS/DO/OSI conducts investigations committed by and against executive branch U.S. Government employees, contractors, and dependents, as well as crimes occurring within U.S. diplomatic installations and housing abroad. Typical extraterritorial investigations include, but are not limited to:

(a) Assault;

(b) Sexual assault (as specified in 3 FAM 1700);

(c) Child abuse and neglect;

(d) Domestic Violence and stalking;

(e) Homicide, manslaughter, and involuntary manslaughter;

(f) Missing persons;

(g) Possession, manufacturing, and/or transport of child pornography;

(h) Violations of the Military Extraterritorial Jurisdiction Act (MEJA); and

(i) Theft or destruction of U.S. Government property;

(3) Use of force and discharge of a firearm: DS/DO/OSI conducts official investigations into the discharge of firearms and/or the use of force by Department employees and contractors domestically and all executive branch U.S. Government employees and contractors falling within COM authority abroad;

(4) Family advocacy investigations: DS/DO/OSI conducts investigations concerning domestic violence, child abuse, and child neglect in coordination with the Department's family advocacy program as specified in 3 FAM 1810;

(5) Death investigations: DS/DO/OSI conducts death investigations in coordination with the Bureau of Medical Services (MED) and the Armed Forces Medical Examiner System (AFMES) as specified in 12 FAM 227; and

(6) Information and physical security investigations: DS/DO/OSI conducts official investigations into the loss or unauthorized disclosure of classified information.

b. The Department, DS, or the Department of Justice (DOJ) may request DS/DO/OSI consider conducting official investigations that fall outside the scope of other investigative offices and divisions within DS or that are declined or referred by OIG.

c. DS/DO/OSI is authorized to delegate, assign, direct, coordinate, and review for sufficiency all investigations of employee misconduct. During the course of an official investigation, DS/DO/OSI agents or agents acting under DS/DO/OSI's authorization and direction may:

(1) Conduct voluntary interviews with employees, or with authorization from the Directorate of Domestic Operations (DS/DSS/DO) and DS Legal (L/M/DS), require an employee to participate in a compelled interview to respond orally and/or in writing to material and relevant questions related to the performance of their official duties and/or to any questions related to matters within DS/DO/OSIs investigative mandate;

(2) Require employees to produce and/or grant access to all official records and any other related documents or material;

(3) Require employees to produce and/or grant access to all U.S. Government property including all communications equipment;

(4) Require employees to appear at a location designated by the case agent assigned to a DS/DO/OSI investigation, in connection with an official inquiry;

(5) Direct employees to maintain the confidentiality (through use of Form DS-7678) of any information possessed or coming to the attention of the employee concerning DS/DO/OSI inquiries to the extent that such directives neither prohibits nor infringes on the employees right to legal counsel or freedom of speech;

(6) Carry special protective equipment (SPE) in all Department locations in the performance of their official duties; and

(7) As authorized under 5 U.S.C. 303, to administer an oath and take sworn testimony during the course of an investigation involving employee impropriety or misconduct.

12 FAM 226.2 Procedures

(CT:DS-273; 05-19-2017)

a. DS/DO/OSI controls and supervises all special investigations. Accordingly, all matters relating to a special investigation must be transmitted to DS/DO/OSI within 72 hours, unless otherwise specified by Department policy or Federal law, to ensure DS/DO/OSI fulfills its investigative mandate.

b. The authority for officially opening a special investigation and documenting the investigation in the DS Information Management System (IMS) lies solely with DS/DO/OSI. Cases not originating from DS/DO/OSI are not considered formally opened until DS/DO/OSI receives appropriate written notification and assigns an IMS case number.

c. Department management officials and employees receiving information and/or allegations that may merit Special Investigations status must submit the information to DS/DO/OSI for preliminary assessment, research, and guidance as delineated in 3 FAM 4139.13 and 3 FAM 4322. However, Department management officials may conduct limited inquiries:

(1) If they believe that additional information is needed for DS/DO/OSI to make a decision to open a case; and

(2) If safety and security concerns require immediate action.

d. From time to time there may be situations where insufficient information exists to formally open a DS/DO/OSI case. In such situations, DS/DO/OSI may authorize a preliminary inquiry (PQ) and assign an IMS PQ number to determine whether or not additional investigation is warranted.

e. In the event that the DS/DO/OSI preliminary inquiry identifies the alleged misconduct as an employee performance issue, or relatively minor infraction DS/DO/OSI can officially close the inquiry with a referral to the appropriate supervisory official to address the matter in accordance with 3 FAM 4322.3.

f. Only DS/DO/OSI can officially close and document a case in IMS-Classified. The DS/DO/OSI supervisor will review the completed report of investigation (ROI) and determine whether further investigative action is needed.

12 FAM 226.3 Policies for Employee and Contractor Misconduct Investigations

12 FAM 226.3-1 Security Clearance Implications of Misconduct

(CT:DS-273; 05-19-2017)

a. Employee misconduct is a concern of DS/DO/OSI, particularly when an employee occupies a sensitive position or has access to classified information. Other Department offices may be involved or have an interest in certain categories of employee misconduct; for example, alcohol and drug abuse while primarily a medical issue may also pose potential security concerns. The procedures in 3 FAM 4320 delineate the appropriate MED and DS responsibilities in such cases.

b. Other instances of personal misconduct, including but not limited to malfeasance, normally handled in other channels including the OIG, may also require adjudicative review by the Adverse Actions Division (DS/PSS/AA). Management officials or employees who become aware of such issues should coordinate with the appropriate post or Department supervisors and report to DS/DO/OSI any information that may impact continued eligibility and access to classified information.

12 FAM 226.3-2 Marine Security Guards

(CT:DS-273; 05-19-2017)

a. Marine security guards (MSGs) are under chief-of-mission (COM) operational direction, coordination, and supervision at each post where they are assigned (see 12 FAM 430). The COM exercises this responsibility through the regional security officer (RSO). Since the Marine Corps retains the sole responsibility for the conduct and discipline of all Marines assigned for duty with the Department, defer all such matters to the commanding officer, Marine Corps embassy security group (MCESG) for the administration of military justice.

b. Criminal and counterintelligence investigations of Department of the Navy (DON) personnel who are currently serving with the Department will normally be conducted by special agents of the Naval Criminal Investigative Service (NCIS). If requested by DS/DO/OSI, such investigations may be conducted jointly with NCIS. The authority of NCIS special agents and military detachment commanders conducting preliminary inquiries and investigations is limited to MSG or DON personnel. Interviews will not be conducted with locally employed staff (LE staff) or other mission personnel without the express concurrence of the regional security officer (RSO). Criminal and administrative investigations by DS/DO/OSI of other employees, requiring interviews with MSGs, may be conducted jointly with NCIS.

12 FAM 226.3-3 Personnel of Other Agencies

(CT:DS-273; 05-19-2017)

DS/DO/OSI may conduct official investigations into criminal and administrative misconduct involving the employees and contractors of other executive branch agencies that are under COM authority. When DS/DO/OSI identifies another agency's employee as the subject of a criminal or administrative investigation, DS/DO/OSI may coordinate investigative efforts with that agency's Inspector General (IG) and/or that agencys appropriate internal investigative or security office. At the conclusion of the investigation, DS/DO/OSI will provide that agency's IG, and/or that agencys appropriate internal investigative or security office with a copy of the report of investigation (ROI).

12 FAM 226.3-4 Locally Employed Staff (LE Staff) and Third-Country National Contractors

(CT:DS-273; 05-19-2017)

a. The majority of administrative and criminal misconduct cases involving locally employed staff (LE staff) and third-country national contractors can normally be investigated by RSOs at post and may not require DS/DO/OSI notification. The RSO, pursuant to COM authority, conducts appropriate investigations of violations of Department and COM policies, as well as Federal and host-country law by LE staff and third-country national contractors. RSO notification of these investigations to DS/DO/OSI is required when LE staff and third-country national contractors commit criminal violations against U.S. citizens, or there is an interconnection to misconduct by Department employees and contractors or executive branch U.S. Government employees and contractors who fall under COM authority.

b. RSOs shall investigate complaints or allegations against LE staff and third-country nationals or contractors employed at U.S. missions abroad by other agencies in the same manner as investigations of Department LE Staff and U.S. or third-country national contractors. The RSO must inform the COM and the appropriate senior official of the employing agency at post (or at the agencys headquarters, if there is no representative at post) of the initiation and progress of any such investigation.

12 FAM 226.3-5 Investigative Findings

(CT:DS-273; 05-19-2017)

a. In cases involving employee or contractor administrative misconduct, DS/DO/OSI will provide an investigative finding at the conclusion of the ROI. The investigative finding will detail the allegation of misconduct, provide an investigative conclusion, and enumerate the evidence to support the conclusion. The legal standard for the investigative conclusion in an administrative investigation will be a preponderance of the evidence. The possible investigative conclusions are as follows:

(1) Substantiated: The allegation is supported by a preponderance of evidence;

(2) Unsubstantiated: The investigation did not uncover sufficient evidence to prove the allegation(s). This definition includes instances where an investigation would be deemed inconclusive, where there is insufficient evidence to either prove or disprove the allegation(s);

(3) Exonerated: The incident or acts alleged occurred; however, the employees actions were justified, lawful, and proper; and

(4) Unfounded: The investigation conclusively proved that the act alleged did not occur.

b. When DS/DO/OSI substantiates an allegation against an employee or contractor of the Department, DS/DO/OSI will forward a copy of the ROI to the Bureau of Human Resources Conduct Suitability and Discipline Division (HR/ER/CSD), the Office of Personnel Security and Suitability (DS/SI/PSS), and other offices, as appropriate.

12 FAM 226.3-6 Employee Conduct Investigations

(CT:DS-273; 05-19-2017)

a. Within the context of the Departments responsibility for the conduct of foreign affairs, an employees personal traits or practices manifesting in misconduct that may violate Department Standards of Conduct (as delineated in 3 FAM 4138, 3 FAM 4370, and 3 FAM 4540), or that is of a notoriously disgraceful nature (3 FAM 4139.14), may be relevant to evaluating the employees stability, character, discretion, and susceptibility to undue influence or duress.

b. In the event a DS/DO/OSI investigation substantiates allegations that an employees misconduct is of potentially exploitable nature, with the effect that the employee could possibly be subject to undue influence or duress, and susceptible to blackmail or coercion, DS/DO/OSI will refer the matter to DS/SI/PSS for appropriate adjudicative review and action (see 12 FAM 232.3).

c. In instances when a DS/DO/OSI investigation identifies management issues and/or systemic deficiencies, DS/DO/OSI will review, document, and refer the matters via a management review referral (MRR) to the Domestic Operations (DS/DO) Directorate. The MRR will include a brief summary of the precipitating investigation and the pertinent management issues and/or systemic deficiencies identified during the DS/DO/OSI investigation.

d. If, at any time during the course of an investigation, DS/DO/OSI case agents determine that probable cause has been established indicating that a Federal criminal offense has been committed, the investigator must present the case for prosecutorial review to the Department of Justice (DOJ). In the event the DS/DO/OSI investigation determines that probable cause has been established indicating a potential violation of local and/or State law has been committed, notification of the appropriate local/State authorities is required.

12 FAM 226.4 Policies for Extraterritorial Criminal Investigations

12 FAM 226.4-1 Mandatory Notification Regarding Employee, Contractor, or Dependent Criminal Misconduct

(CT:DS-273; 05-19-2017)

Department management officials, employees, contractors, subcontractors, and grantees at all levels overseas who learn of facts that give reason to suspect criminal misconduct involving U.S. Government employees, dependents, or contractors must report the criminal misconduct to the RSO, who must then notify DS/DO/OSI via telephone within 24 hours and follow up the telephonic communication with a DSX channel cable to DS/DO/OSI. The DSX channel cable should include the subject's identity and the basic facts currently known to the RSO (see 3 FAM 4139.13 and 3 FAM 4322).

12 FAM 226.4-2 Coordination with the Department of Justice

(CT:DS-273; 05-19-2017)

DS/DO/OSI will serve as the Bureau's Department of Justice (DOJ) liaison regarding the investigation of extraterritorial crimes involving Department equities. It will refer cases for prosecution or investigative assistance to DOJ or the appropriate U.S. Attorneys Office (USAO) as needed. Case management efforts should limit the number of personnel required to travel to the United States whenever possible, minimizing the impact on post security programs.

12 FAM 226.5 Family Advocacy Program

(CT:DS-273; 05-19-2017)

Special agents assigned to DS/DO/OSI will serve as the DS representatives to the Family Advocacy Committee (FAC) and conduct family advocacy investigations in conjunction with the RSO as defined in 3 FAM 1810.

12 FAM 226.6 Homicide, Suicide, Mysterious Death, or Disappearance

(CT:DS-273; 05-19-2017)

Any homicide, suicide, attempted suicide, unexplained or mysterious death, or disappearance of an employee or contractor occupying a sensitive position may have security implications and/or an adverse impact on Department operations. Domestically, executive directors should report mysterious deaths or disappearances to DS/DO/OSI for potential investigation in conjunction with Federal, State, or local authorities. Deaths originating overseas will be investigated by DS/DO/OSI and the RSO in accordance with 12 FAM 227.

12 FAM 226.7 Information Security Investigations Policy

(CT:DS-273; 05-19-2017)

12 FAM 226.7-1 Objectives of Information Security Investigations

(CT:DS-273; 05-19-2017)

The objective of security actions following a loss or probable compromise of classified information is to determine the possible harm to national security. The formal analysis of this information is called a damage assessment. The Bureau of Intelligence and Researchs Office of Counterintelligence and Counselor Support (INR/CCS) conducts all damage assessments for the Department.

12 FAM 226.7-2 Unauthorized Disclosures of Classified Information

(CT:DS-273; 05-19-2017)

Generally, all information security incidents are investigated and administratively processed by the Application Programs Division (DS/IS/APD), in accordance with 12 FAM 550. DS/DO/OSI reviews allegations of serious unauthorized disclosures of classified information to determine if further administrative or criminal investigation is warranted.

12 FAM 226.7-3 Loss, Unauthorized Disclosure, or Serious Compromise of Classified Information

(CT:DS-273; 05-19-2017)

In instances of loss, unauthorized disclosure, or compromise of classified or administratively controlled documents and information, DS/DO/OSI will review the matter to determine whether additional administrative and/or criminal investigation is warranted. In those cases accepted for investigation by DS/DO/OSI, the office will:

(1) Investigate the loss;

(2) Preliminarily assess or coordinate the assessment of the resultant damages;

(3) Identify the contributing or responsible persons and procedures;

(4) Make a detailed formal report of the investigation upon completion of the investigation; and

(5) Refer criminal cases to DOJs National Security Division and/or administrative cases to State's Bureau of Human Resources Conduct Suitability and Discipline Division (HR/ER/CSD), the Office of Personnel Security and Suitability (DS/SI/PSS), and DS/IS/APD for review.

12 FAM 226.7-4 Unauthorized Disclosure of Sensitive Information

(CT:DS-273; 05-19-2017)

a. Each agency is responsible for safeguarding its classified information. An unauthorized disclosure or leak is the compromise of classified or administratively controlled information to another person not associated with a foreign government or intelligence service.

b. DS/DO/OSI is the lead DS investigative office responsible for unauthorized disclosure investigations. Regardless of where the incident occurred, notify DS/DO/OSI of the compromise of classified information as soon as possible so an investigation can be initiated, if warranted.

c. If a media leak or other unauthorized disclosure is made of classified or administratively controlled information, the originating agency conducts an initial investigation to determine if any other agency was on distribution for or had access to the information. Should the initial inquiry disclose that another agency had access to the information, the originating agency will request that the receiving agency conduct an appropriate investigation. Unauthorized disclosure of national security information may be a violation of Federal criminal statutes and violators may be subject to prosecution by the Department of Justice (DOJ). Investigations of unauthorized disclosures of non-national security material will be conducted according to administrative guidelines. Violators are subject to administrative sanctions up to and including separation from the Federal service (see 3 FAM 4300).

12 FAM 227 Death Investigations

12 FAM 227.1 Purpose

(CT:DS-273; 05-19-2017)

a. The purpose of this section is to ensure that the Department appropriately investigates all deaths of U.S. citizen employees assigned abroad under chief-of-mission (COM) authority, and their eligible family members, using well-established medico-legal techniques and protocols to establish a cause and manner of death.

b. Conducting an investigation into a death is one of the most difficult and important services DS, the Office of Special Investigations (DS/DO/OSI) and the regional security officer (RSO) perform, requiring sensitivity, tact, and a high degree of competence, particularly when death occurs under unusual circumstances. DS and RSOs must deal sympathetically and effectively with the deceaseds surviving spouse, next-of-kin, and other family members or friends who experience emotional stress and are often unprepared to make important decisions in an atmosphere of urgency. DS must conduct these investigations in a swift and professional manner, understanding that prompt repatriation of the remains is a high priority for the family.

c. The Department is committed to thoroughly investigating the death of any U.S. citizen employees assigned abroad and their eligible family members, as defined in 14 FAM 511.3, including deaths that result in Accountability Review Board (ARB) actions (see 12 FAM 030). In cases of criminal conduct, the Department will work to ensure that all perpetrators are brought to justice.

d. Though focused on DS investigative responsibilities via DS/DO/OSI, in the event of a death of a U.S. citizen employee of the Department assigned abroad under COM authority, or their eligible family members, this section relates to responsibilities of other Department bureaus and offices and thus should be read in connection with 3 FAM 2550, 3 FAM 3650, and 16 FAM 133.

12 FAM 227.2 Applicability and Scope

(CT:DS-273; 05-19-2017)

This section applies to the deaths of the following:

(1) All U.S. citizen employees of the U.S. Government executive branch assigned abroad or on temporary official duty abroad under COM authority (except those under the command of an area military commander or on the staff of an international organization). For purposes of this section, persons under personal services contracts (PSCs) or personal services agreements (PSAs) with a Federal agency are considered to be employees of the U.S. Government; and

(2) All family members and members of household (MOH) officially accompanying employees identified in 12 FAM 227.2, subparagraph (1). (For detailed discussion of what constitutes a MOH, COM reporting requirements for their living with an employee, and what government services are provided to a MOH, see 3 FAM 4181.(g)1 and 3 FAM 7121).

12 FAM 227.3 Responsibilities

(CT:DS-273; 05-19-2017)

a. The Department employs a multi-disciplinary team approach to death investigations. Responsible team members at the Washington, DC level include the Departments Office of Casualty Assistance (DGHR/OCA), the Office of Medical Services (MED), and the Office of Special Investigations (DS/DO/OSI). At the post level, team members include, but are not limited to, the deputy chief of mission (DCM), the RSO, and the Foreign Service Medical Specialist (FSMS).

b. Because a death may occur at any time or place, any individual may be the first to discover that a death of a U.S. citizen employee or eligible family member has occurred. Any Department employee who discovers a death covered by this section or learns of the death from someone outside the official community must notify post management, including the DCM, RSO, and FSMS.

12 FAM 227.3-1 Office of Medical Services (MED)

(CT:DS-273; 05-19-2017)

MED:

(1) Maintains agreements with the Armed Forces Medical Examiner System (AFMES), which supplies forensic services when a formal death investigation is indicated;

(2) Ensures that all medical records pertaining to the decedent are properly maintained at post and/or in a centralized electronic medical record. During an investigation of a death at post, relevant portions of the medical record will made available promptly by MED representatives to the RSO (and discussed if requested), AFMES personnel if involved in the investigation, and all records subsequently transferred securely to AFMES facilities if a post mortem examination is to be performed, and/or then to the Division of Quality Management, MED WASHDC;

(3) Confers with DS/DO/OSI about the necessity of opening a death investigation and/or the need to conduct a forensic autopsy; and

(4) Assigns a liaison to DS to fulfill MED responsibilities related to unattended death or suspicious death investigations as discussed in this section.

12 FAM 227.3-2 Office of Casualty Assistance (DGHR/OCA)

(CT:DS-273; 05-19-2017)

See 3 FAM 2550 for a listing of DGHR/OCAs responsibilities and policies regarding the death of an employee abroad.

12 FAM 227.3-3 Bureau of Diplomatic Security (DS)

(CT:DS-273; 05-19-2017)

DS, via DS/DO/OSI:

(1) Receives notification from the post regarding deaths involving the official community;

(2) Conducts investigations into the facts and circumstances surrounding deaths involving the official community;

(3) Confers with MED and DGHR/OCA on carrying out the respective responsibilities under this policy;

(4) Authorizes an autopsy via the DS/DO/OSI Office Director in consultation with MED, if deemed necessary and notifies post and DGHR/OCA in a timely manner;

(5) Coordinates, assists, and exchanges information with the AFMES or host-nation medical examiner; and in event an autopsy is performed in the host country, may order that an additional post mortem examination be performed on some or all of the remains at AFMES CONUS facilities in concordance with MED and AFMES personnel;

(6) Confers with the Department of Justice (DOJ), the U.S. Attorneys Office (USAO), and other Federal law enforcement agencies in cases involving possible Federal prosecution; and

(7) Provides training to RSOs on death investigation procedures and protocols.

12 FAM 227.3-4 Bureau of Consular Affairs (CA)

(CT:DS-273; 05-19-2017)

See 7 FAM 200 for a detailed listing of CA responsibilities and policies regarding the death of a U.S. citizen abroad.

12 FAM 227.3-5 Post Management Section and Regional Bureau

(CT:DS-273; 05-19-2017)

See 7 FAM 225 for a detailed listing of the post management sections and the employing bureaus executive offices responsibilities regarding the death of an employee or dependent.

12 FAM 227.3-6 Chief of Mission (COM) or Principal Officer (PO)

(CT:DS-273; 05-19-2017)

See 3 FAM 2550 for a listing of chief of mission (COM) or principle officer (PO) responsibilities regarding the death of a U.S. citizen abroad.

12 FAM 227.3-7 Foreign Service Medical Specialist (FSMS)

(CT:DS-273; 05-19-2017)

The Foreign Service medical specialist (FSMS) may be the regional medical manager (RMM), regional medical officer (RMO), regional medical officer psychiatrist (RMO/P), or Foreign Service medical specialist (FSMS). FSMSs:

(1) Notify the RSO and DCM of the death of a member of the official community;

(2) Inform MED via secure email or facsimile with all relevant medical information as soon as possible (normally within 24 hours);

(3) Provide necessary medical and mental health support to the official community following the death;

(4) Assist MED and DS as necessary with the determination of cause and manner of death;

(5) Coordinate, when applicable, with the host-nation medical examiner; and

(6) Provide the pertinent information to CA for completion of Form DS-2060, Report of the Death of an American Citizen Abroad.

12 FAM 227.3-8 Regional Security Officer (RSO)

(CT:DS-273; 05-19-2017)

The RSO is a Federal law enforcement officer, and thus, in situations involving the death of a member of the official community, the RSO must:

(1) Immediately notify DS, the FSMS, and the DCM in accordance with 12 FAM 227.4-1;

(2) Respond to and secure any scene of death; and

(3) Conduct or coordinate any additional investigative activities on the basis of instructions from DS. See 12 FAM 227.4-3.

12 FAM 227.4 General Procedures for the Conduct of Death Investigations

(CT:DS-273; 05-19-2017)

12 FAM 227.4-1 Reporting Requirements

(CT:DS-273; 05-19-2017)

a. The notification requirements listed below are in addition to any consular section responsibilities regarding the death of private U.S. citizens abroad, management section responsibilities regarding the death of individuals within the official community, and the Departments Office of Casualty Assistance (DGHR/OCA) responsibilities under 3 FAM 2550.

b. The RSO must notify DS/DO/OSI via the Command Center (DS/TIA/CC) immediately upon notification of a death of a member of the official community. In instances involving apparent terrorist activity or hostile fire in established zones of armed conflict, the RSO must also immediately notify the Office of Protective Intelligence Investigations (DS/TIA/PII) and the Federal Bureau of Investigation (FBI) Legal Attach Office. If the deputy chief of mission (DCM) and the Foreign Service medical provider (FSMS) have not been notified, the RSO will notify them. Following the initial notification by phone, the RSO must send a DSX-channel cable to DS/DO/OSI and DS/TIA/PII in instances involving apparent terrorist activity or hostile fire in established zones of armed conflict, within 24 hours of the initial notification. Do not delay reporting, even when full details are not yet known; submit supplemental reports as additional information becomes available.

12 FAM 227.4-2 The Effect of Diplomatic and Consular Inviolability

(CT:DS-273; 05-19-2017)

a. Embassy employees: In accordance with the Vienna Convention on Diplomatic Relations and 2 FAM 220, officers and employees accredited to the embassy, as well as their families and members of household, enjoy personal inviolability, which persists even after death. The receiving country may not detain, search, or conduct an autopsy on the body of the person enjoying personal inviolability, unless there has been an express waiver of personal inviolability in accordance with 2 FAM 221.5. Contact the Office of the Legal Adviser, Diplomatic Law & Litigation (L/DL), for guidance regarding assertions or waivers of personal inviolability.

b. Consular officers: The bodies of consular officers may enjoy protections even after death. A variety of provisions in our bilateral consular treaties may affect the treatment of deceased consular officers; refer questions concerning consular officers to L/DL.

c. Consular employees and family members at consulates: Bodies of consular employees and family members at consulates generally are entitled to no special privileges. However, because the variety of provisions in our bilateral consular treaties may affect this issue, refer questions concerning consular employees and family members to L/DL right away.

d. Diplomatic premises and vehicles: The land and buildings used for the premises of a diplomatic mission, the residence of the chief of mission (COM), and residences of all diplomatic agents and administrative and technical staff of the embassy are inviolable, pursuant to the Vienna Convention on Diplomatic Relations. As such, they are immune from unauthorized entry and search, as are their contents. Embassy vehicles (and any other mission means of transport) are immune from search and cannot be impounded or otherwise seized. Vehicles driven by diplomats and administrative and technical staff of the embassy enjoy the same protections.

e. Consular premises: The Vienna Convention on Consular Relations provides that those portions of the consular premises that are used exclusively for the work of the consular post are inviolable. This generally includes the office space of the consulate, but not residential or other portions not used for the work of the post. In general, consular residences do not enjoy inviolability and are subject to entry and search in accordance with local law. However, some bilateral consular agreements may provide consular residences with inviolability; thus, refer questions concerning consular residences to L/DL. Consular vehicles and vehicles driven by members of a consular post do not enjoy any protection from search and seizure.

f. Disputes regarding inviolability: If the receiving country disputes the assertion of inviolability, refer the matter to L/DL.

12 FAM 227.4-3 DS Investigation

(CT:DS-273; 05-19-2017)

a. In addition to the duties described in 12 FAM 227.3-8, the RSO:

(1) Provides for the continued safety and security of COM personnel and facilities;

(2) Ensures that all evidence, including the scene of death and the victims remains, are protected for eventual collection by trained evidence-collection teams;

(3) Contacts DS/DO/OSI immediately for guidance as an autopsy may be required;

(4) Collects initial statements from potential witnesses; and

(5) Liaises with host-country law enforcement and the host-country medical examiner.

b. DS consults with the FSMS and/or the Office of Medical Services (MED-WASHDC) after receiving notification of a death involving a member of the official community. If MED cannot ascribe a cause of death on the basis of the deceaseds known medical history or other reliable factors, and prepare an official death certificate indicating the official cause of death, DS will open an official death investigation. Following this initial consultation, DS initiates a death investigation under these circumstances:

(1) Violent deaths, whether apparently homicidal, suicidal, or accidental;

(2) Deaths not caused by readily recognizable disease, disability, or infirmity;

(3) Deaths (including infants and children) under suspicious or unusual circumstances; and

(4) Deaths related to disease resulting from employment or to an accident while employed including deaths possibly related to a pandemic public health condition.

c. Once DS opens a death investigation, DS and the Armed Forces Medical Examiner System (AFMES), in coordination with MED, conduct a transparent and thorough investigation. DS may decide to dispatch an investigative team to the post, which may include criminal investigators and forensic personnel, and consult with the Department of Justice (DOJ), the appropriate U.S. attorneys office (USAO), and other Federal law enforcement agencies in cases involving possible Federal prosecution. DS requires and MED faciliates access to personnel and medical records, to the extent permitted under the Privacy Act (5 U.S.C. 552a) and the Departments regulations, found in STATE 24 and 5 FAM 464.

12 FAM 227.4-4 Autopsy

(CT:DS-273; 05-19-2017)

a. The Director, Office of Special Investigations (DS/DO/OSI) has the authority to request a forensic autopsy, either with AFMES or through the host-nation medical examiner. Prior to requesting a forensic autopsy, DS should consult with the Office of Medical Services (MED) to determine the necessity of a forensic autopsy. DS will consult with AFMES and MED (MCI Database) on the medical and forensic capabilities of the host-nation medical examiner and will notify MED-Dir/Quality Management as requested. DS should attempt to obtain the consent of the decedents next-of-kin. However, DS may authorize an autopsy without that consent. In those situations requiring a forensic autopsy, the DS/DO/OSI Office Director must authorize an autopsy in accordance with 10 U.S.C. 1471.

b. In addition to DSs authority to authorize an autopsy, the Federal Bureau of Investigation (FBI) may also authorize an autopsy without next-of-kin consent and in accordance with 10 U.S.C. 1471, if the death appears to have resulted from terrorist activity or hostile enemy action in established zones of armed conflict.

c. AFMES is a tri-service organization within the Department of Defense (DOD) charged in part with providing a consultation service in the resolution of medical-legal death cases, civil and criminal, for DOD and, when applicable, for other Federal agencies. AFMES performs the following, in accordance with the memorandum of agreement between the Department and AFMES maintained by MED, and as needed:

(1) Assigns a board-certified forensic pathologist to assist DS and MED in the conduct of a death investigation;

(2) Conducts a complete medical investigation of death according to DS requirements. Investigations are normally conducted at the AFMES autopsy or mortuary facility;

(3) Assumes temporary custody and control of all medical records and biological substances pertinent to the medical and legal investigation of death;

(4) Consults with and assists local authorities in their own death investigation if AFMES does not have primary responsibility for the medical investigation and the local authorities are cooperating;

(5) Provides DS and MED with a final medical investigation report of death, as well as any appropriate interim progress reports; and

(6) Makes the Armed Forces DNA Identification Laboratory and the DOD DNA Specimen Repository available to DS and MED to identify human remains.

d. Transport of the decedents remains may be to an AFMES-authorized autopsy facility, using military, commercial, or private aircraft. RSO personnel must establish a well-documented chain of custody during transport. Due to investigative requirements, the Director of DS/DO/OSI must approve the presence of an escort with transported remains. If an escort is approved, post must provide and fund an escort to accompany the remains to the location of the autopsy and final place of interment. Post may seek reimbursement from the decedent's sponsoring agency. The general services officer (GSO) is responsible for coordination with the Office of Logistics Operations (A/LM/OPS) to arrange for the transport of the remains to AFMES. Continued coordination is required to ensure the remains are appropriately transported in conjunction with the Office of Causality Assistance (HR/OCA). When transport to AFMES for a forensic autopsy is not possible, DS may request that AFMES send a forensic team to the post. DS coordinates with consular officers and local authorities as necessary to expedite autopsies and obtain the necessary documentation to repatriate the remains to the United States. For additional guidance regarding the disposition of remains, including financial obligations, see 7 FAM 250.

e. At times, it may be impractical for AFMES to conduct an autopsy, such as when there is no facility within a reasonable distance from post. In these situations and after consulting with L/DL regarding diplomatic inviolability, and MED with respect to the documented capability of the host medical examination system, DS may request the host nations medical examiner conduct an autopsy. An RSO- or their designee must observe the autopsy. The regional medical officer (RMO) or FSHS must act as an observer. However, given the special training required of medical examiners and forensic pathologists, the RMO or FSMS will not be expected to actively participate in the autopsy or provide expert input about the findings beyond what is provided by the host-nation medical examiner.

12 FAM 227.4-5 Maintenance and Disclosure of Records

(CT:DS-273; 05-19-2017)

a. DS maintains death investigation files as law enforcement records within the DS Security Records System. DS manages these records in accordance with established records disposition schedules.

b. The Privacy Act does not apply to the records of deceased individuals. However, the decedents family may have privacy interests in the information contained in the file. To protect the familys privacy interests, limit disclosure of death investigation files within the Department to personnel who have a need to know the information.

c. Outside the Department, death investigation files may be disclosed to other Federal government agencies for purposes of law enforcement and/or public health and safety. Contact L/M/DS for guidance regarding other requests for death investigation files.

d. Death investigation files will not be disclosed to the public, unless disclosure is required under the Freedom of Information Act and/or the Departments regulations.

12 FAM 227.5 Death Investigations Regarding Other Personnel

(CT:DS-273; 05-19-2017)

In the event of a death on mission premises of an individual that falls into one of the categories listed below, the RSO must immediately notify DS/DO/OSI via the DS Command Center and may notify the individual's employing agency or company. After consultation with DS/DO/OSI, the RSO may proceed with an investigation to the extent appropriate and consistent with legal authorities. Contact L/M/DS for guidance on legal authorities.

(1) Personnel of commercial contractors working pursuant to a contract or grant with the U.S. Government;

(2) Nonexecutive branch employees of the U.S. Government; or

(3) Other U.S. Government personnel, contractors, and their dependents not otherwise addressed in this section who are associated with the mission.

12 FAM 228 PROTECTIVE INTELLIGENCE INVESTIGATIONS

12 FAM 228.1 Organizational Responsibilities

(CT:DS-273; 05-19-2017)

a. The Office of Protective Intelligence Investigations (DS/TIA/PII) directs, coordinates, and conducts investigations and implements threat management plans related to terrorism and other threats - or potential threats - directed against the Secretary; domestic Department personnel and facilities; designated foreign dignitaries and diplomatic missions in the United States; and any U.S. Government personnel, facilities, or interests under chief-of-mission (COM) authority overseas.

b. DS/TIA/PII accomplishes its mission through the Operations and Investigations Division (DS/PII/OI) and the Intelligence Liaison Division (DS/PII/ILD.

c. The Operations and Investigations Division (DS/PII/OI) coordinates and conducts threat-management activities to include criminal investigations and protective operations to help safeguard those DS-designated personnel and facilities. DS/PII/OI utilizes highly sensitive information and all-source intelligence to develop comprehensive strategies in order to mitigate threats and effectively respond to incidents. DS/PII/OI coordinates with the Department, other U.S. Government agencies, State and local law enforcement, and international partners to enhance protective intelligence procedures and better detect and mitigate terrorist acts or other threats.

d. The Intelligence Liaison Division (DS/PII/ILD) manages the DS Counterterrorism Liaison Program (CLP) and the Rewards for Justice Program (RFJ). CLP places DS personnel in critical positions throughout the interagency counterterrorism community. The majority of CLP personnel are detailed to Federal Bureau of Investigation (FBI) managed joint terrorism task forces (JTTFs) located throughout the United States, where they conduct counterterrorism investigations on behalf of the U.S. Government and protective intelligence investigations on behalf of DS. Within the National Capital Region, CLP senior liaison officers are assigned to the FBIs Counterterrorism Division, the FBIs International Operations Division, the National Counterterrorism Center, the Central Intelligence Agencys Community HUMINT Coordination Cell, and Department of Defenses Joint Interagency Task ForceNational Capital Region, where they leverage interagency capabilities to support DS protection operations worldwide. RFJ is the Department's counterterrorism rewards program. For more information regarding RFJ, see 12 FAM 228.3.

12 FAM 228.2 Programs and Activities

(CT:DS-273; 05-19-2017)

a. DS/TIA/PII: Conducts, through threat management investigations and directed operations, the following major programs in furtherance of the safety and security of DS-designated personnel and facilities listed above: criminal investigations, protective operations, regional security officer (RSO) assistance, and training support. DS/TIA/PII strives to identify threats, measure risks to Department/COM interests, and develop management strategies to counter and mitigate those threats in collaboration with affected offices.

b. Law enforcement investigations: DS/TIA/PII investigates threats or potential threats of terrorism, political violence, or criminal activity involving U.S. interests. DS/TIA/PII conducts these investigations through traditional law enforcement means, operational psychologist threat assessments, and protective intelligence derived from the intelligence community, as appropriate.

c. Terrorism: DS/TIA/PII is the DS lead investigative office for any acts or potential acts involving terrorism and political violence. Often in conjunction with FBI, DS/TIA/PII will provide temporary duty and/or remote analytical support to offices or posts dealing with terrorism issues.

d. Threat management and investigations: DS/TIA/PII is the DS lead investigative office for threat investigations against all Department or COM personnel. Often in conjunction with the field offices and RSOs, DS/TIA/PII investigates criminal acts for prosecution (when possible) and assesses individuals of concern (IOC) for threat management possibilities if prosecution is not an option. DS/TIA/PII receives threat management training and has operational psychologist support for managing cases.

e. Suspicious activity: DS/TIA/PII supports all Department and COM personnel with investigating any suspicious or potentially threatening activity. DS/TIA/PII assists in protecting Department facilities, protective details, and RSOs by conducting law enforcement and intelligence checks (utilizing systems such as TECS, TIDE, e-Guardian, global SIMAS II, TAVISS, etc.) through the DS/TIA/PII Investigative Analytical Group. Additionally, DS/TIA/PII agents may respond to domestic locations, or overseas, to conduct thorough follow up investigations.

f. Protective operations: DS/TIA/PII identifies and mitigates threats to DS protection details, special events, and facilities in close collaboration with the Directorates of Domestic Operations (DS/DSS/DO,), International Programs (DS/DSS/IP), and High-Threat Programs (DS/HTP). Protection support may include tactical intelligence liaison, threat analysis and social media monitoring, threat vulnerability identification and assessment, plain clothes/low-profile operations, threat/suspicious activity investigations, inter-agency liaison, and comprehensive analytical support.

g. Overseas protection support: DS/TIA/PII supports the Secretarys Detail (DS/P/SD) within the Office of Protection (DS/DO/P) on domestic and overseas stops through analytical support from headquarters and special agents embedded with DS/P/SD. DS/TIA/PII provides social media and open source threat reviews and mitigation recommendations, vulnerability assessments, host-government liaison (through RSO coordination), counter surveillance personnel, threat investigations, and tactical intelligence liaison with the IC.

h. Domestic protection support: DS/TIA/PII supports DS/P/SD, the Dignitary Protection Division (DS/P/DP), and the Protective Liaison Division (DS/P/PL) domestically through data analysis from headquarters and special agents responding or embedded on protection details depending upon the assignment. DS/TIA/PII provides social media and open source threat reviews and mitigation recommendations, vulnerability assessments, local law enforcement liaison (in coordination with DS field offices), threat investigations, and counter surveillance personnel.

i. Major events: DS/TIA/PII supports the DS Major Events Coordination Unit (MECU) with flexible variations of the previously-described overseas protection support for large overseas events. DS/TIA/PII also supports DS/P/DP and DS/P/PL with flexible variations of the previously-described domestic protection support for large domestic events.

j. Domestic facility protection: DS/TIA/PII supports the Office of Domestic Facilities Protection (DS/DO/DFP) with flexible variations of the previously-described domestic protection support for large domestic events targeting Department facilities.

k. RSO assistance: DS/TIA/PII develops and provides mitigation techniques and strategies to address threats and provides consultation support to posts in close collaboration with DS/DSS/IP, DS/HTP, and RSOs. In addition to analytical support from headquarters, DS/TIA/PII may assist RSOs by sending temporary duty (TDY) agent support as requested. This support may address issues such as suspicious activity or specific incident investigations, surveillance detection or counter-surveillance tradecraft consultations, coordination of protection detail intelligence resources from the IC, social media and open source threat monitoring, vulnerability assessments, threat management strategies, and enhanced IC collaboration.

l. Training support: DS/TIA/PII conducts threat recognition and mitigation training in close collaboration with the Directorate of Training (DS/DSS/T). This support includes an introduction to the DS/TIA/PII threat management process for concerning or potentially violent individuals and protective intelligence for the training protective details during basic special agent class (BSAC) classroom and field exercises. Additionally, DS/TIA/PII provides IC liaison support through classified briefings for various DS training programs such as Basic Regional Security Officer (BRSO), RSO In-Service, BSAC, Special Agent In-Service, etc.

m. Contact information: For DS/TIA/PII assistance or general inquiries, contact DS/TIA/PII at DSTIAPIIInvestigations@state.gov (OpenNet), DSTIAPIIInvestigations@state.sgov.gov (ClassNet), or DomDSPII@state.ic.gov (JWICS). For additional information regarding DS/TIA/PII activities, visit the Intranet websites: DS/TIA/PII, DS/PII/OI, and DS/PII/IL.

12 FAM 228.3 Rewards for Justice Program

(CT:DS-293; 04-10-2018)

a. Section 36 of the State Department Basic Authorities Act of 1956, as amended (22 U.S.C. 2708), provides the authority for the Department to establish a rewards program for information on terrorism, activities that support the North Korean regime, and violations of the Computer Fraud and Abuse Act (CFAA) (18 U.S.C. 1030). This program is named "Rewards for Justice" (RFJ).

b. The Bureau of Diplomatic Security (DS) administers the RFJ program, and the Departments Bureau of Counterterrorism (CT), Bureau of International Security and Nonproliferation (ISN), and Office of the Coordinator for Cyber Issues (S/CCI) provide policy guidance as needed.

c. Within DS, the Directorate of Threat Investigations and Analysis (DS/TIA) manages the program and is the Departments point-of-contact for reward proposals and for information and actions concerning the program.

12 FAM 228.3-1 Authorities

(CT:DS-293; 04-10-2018)

a. In the sole discretion of the Secretary, the Secretary may pay a reward of up to $25 million, except as set forth in 12 FAM 228.5-7, paragraph a, and subject to available funding, to any individual who furnishes information leading to:

(1) The arrest or conviction, in any country, of any individual for the commission of an act of international terrorism against a U.S. person or U.S. property; or

(2) The arrest or conviction, in any country, of any individual for conspiring or attempting to commit an act of international terrorism against a U.S. person or U.S. property; or

(3) The arrest or conviction, in any country, of any individual aiding or abetting in the commission of an act described in subparagraph (1) or (2) of this section; or

(4) The prevention, frustration, or favorable resolution of an act described in subparagraph (1), (2), or (3) of this section, including by dismantling an organization in whole or significant part; or

(5) The identification or location of an individual who holds a key leadership position in a terrorist organization;

(6) The disruption of financial mechanisms of a foreign terrorist organization;

(7) The disruption of financial mechanisms of any person who has engaged in conduct described in sections 104(a) or 104(b)(1) of the North Korea Sanctions Policy Enhancement Act of 2016, as amended; or

(8) The identification or location of any person who, while acting at the direction of or under the control of a foreign government, aids or abets a violation of the CFAA.

b. Title 22 U.S.C. 4802(a)(2)(B)(xi) provides that security responsibilities of the Secretary include "carrying out the rewards program for information concerning international terrorism authorized by Section 36(a) of the State Department Basic Authorities Act of 1956." By Delegation of Authority No. 214, Section 8, dated September 20, 1994, the Secretary delegated to the DS Assistant Secretary the functions assigned to the Secretary under 22 U.S.C. 4802(a)(2).

12 FAM 228.3-2 The Interagency Rewards Committees

(CT:DS-321; 05-24-2019)

a. The Interagency Rewards Committees (IRC) address issues associated with the RFJ and consider reward proposals and payment nominations to potential Rewards Program participants (RPPs). The IRCs are chaired by the director, Diplomatic Security Service (DS/DSS), or his or her designee. IRC deliberations and consideration of RFJ issues may occur in person or via email:

(1) For reward proposals and payment nominations of $100,000 or less, for which the Assistant Secretary of Diplomatic Security has delegated authority (Delegation of Authority 449, dated June 4, 2018), the Interagency Rewards Committee is comprised of representatives from:

(a) The Department of States (DOS) Bureau of Diplomatic Securitys RFJ program (DS/TIA);

(b) The DOS Office of the Legal Adviser (L);

(c) The DOS Office of Emergencies in the Diplomatic and Consular Service (M/EDCS);

(d) The Department of Justice (DOJ), if there is federal criminal jurisdiction; and

(e) The nominating agency, if other than DOS.

NOTE: These IRC recommendation decisions will generally take place via email.

(2) For reward proposals and payment nominations of more than $100,000 for information on terrorism outlined in 12 FAM 228.3-1 paragraph a(1-6), the IRC is comprised of representatives from:

(a) The Department of States (DOS) Bureau of Diplomatic Securitys RFJ program (DS/TIA);

(b) The DOS Bureau of Counterterrorism (CT);

(c) The DOS Office of the Legal Adviser (L);

(d) The DOS Office of Emergencies in the Diplomatic and Consular Service (M/EDCS);

(e) The DOS regional bureaus as appropriate;

(f) The Central Intelligence Agency (CIA);

(g) The Department of Defense (DOD);

(h) The Department of Homeland Security (DHS);

(i) The Department of Justice (DOJ);

(j) The Department of the Treasury (DOT);

(k) The Federal Bureau of Investigation (FBI);

(l) The National Counterterrorism Center (NCTC);

(m) The National Security Agency (NSA); and

(n) The National Security Council (NSC).

b. For information on terrorism outlined in 12 FAM 228.3-1 paragraph a(1-6), the IRC is comprised of representatives from:

(1) The Department of States (DOS) Bureau of Diplomatic Securitys RFJ program (DS/TIA);

(2) The DOS Bureau of Counterterrorism (CT);

(3) The DOS Office of the Legal Adviser (L);

(4) The DOS Office of Emergencies in the Diplomatic and Consular Service (M/EDCS);

(5) The DOS regional bureaus as appropriate;

(6) The Central Intelligence Agency (CIA);

(7) The Department of Defense (DOD);

(8) The Department of Homeland Security (DHS);

(9) The Department of Justice (DOJ);

(10) The Department of the Treasury (DOT);

(11) The Federal Bureau of Investigation (FBI);

(12) The National Counterterrorism Center (NCTC);

(13) The National Security Agency (NSA); and

(14) The National Security Council (NSC).

c. For information on activities that support the North Korean regime outlined in 12 FAM 228.3-1 paragraph a(7), the IRC is comprised of representatives from:

(1) The Department of States (DOS) Bureau of Diplomatic Securitys RFJ program (DS/TIA);

(2) The DOS Bureau of International Security and Nonproliferation (ISN);

(3) The DOS Bureau of East Asian and Pacific Affairs (EAP) and/or other regional bureaus as appropriate;

(4) The DOS Office of the Legal Adviser (L);

(5) The DOS Office of Emergencies in the Diplomatic and Consular Service (M/EDCS);

(6) The Central Intelligence Agency (CIA);

(7) The Department of Defense (DOD);

(8) The Department of Justice (DOJ);

(9) The Department of the Treasury (DOT);

(10) The Federal Bureau of Investigation (FBI);

(11) The National Counterproliferation Center (NCPC);

(12) The National Security Agency (NSA); and

(13) The National Security Council (NSC).

d. For information concerning any person who, while acting at the direction of or under the control of a foreign government, aids or abets a violation of the CFAA, as outlined in 12 FAM 228.3-1 paragraph a(8), the IRC is comprised of representatives from:

(1) The Department of States (DOS) Bureau of Diplomatic Securitys RFJ program (DS/TIA);

(2) The DOS Office of the Coordinator for Cyber Issues (S/CCI);

(3) The DOS Office of the Legal Adviser (L);

(4) The DOS Office of Emergencies in the Diplomatic and Consular Service (M/EDCS);

(5) The DOS Bureau of Diplomatic Security Directorate for Cyber and Technology Security (DS/CTS);

(6) The DOS Bureau of Intelligence and Researchs Office of Cyber Affairs (INR/CYBER)

(7) The DOS regional bureaus, as appropriate

(8) The Central Intelligence Agency (CIA);

(9) The Department of Defense (DOD);

(10) The Department of Justice (DOJ);

(11) The Department of the Treasury (DOT);

(12) The Federal Bureau of Investigation (FBI);

(13) The National Security Agency (NSA); and

(14) The National Security Council (NSC).

e. As appropriate, representatives from other Department bureaus or other U.S. Government agencies may also confer with the IRC, or be present as observers.

f. Interagency Rewards Committee make recommendations to the Secretary concerning proposed reward offers and payment nominations. These recommendations are nonbinding as all rewards are made at the sole discretion of the Secretary. However, in matters over which there is Federal criminal jurisdiction, the Secretary must obtain concurrence of the U.S. Attorney General (AG) of the United States before a payment can be authorized.

g. None of the agencies (other than the Department of State, or the Department of Justice in a matter over which there is Federal criminal jurisdiction) participating in the committee meeting shall have the right to block a recommendation to pay a reward. Any disagreement with any aspect of a recommendation to pay a reward will be noted in the action memorandum to the Secretary in accordance with 12 FAM 228.5-6.

12 FAM 228.3-3 Protection of Informants

(CT:DS-293; 04-10-2018)

a. If the Secretary determines that the identity of the Rewards Program participant (RPP) or of the members of the RPPs immediate family must be protected, the Secretary will take protective measures he or she considers necessary in connection with the payment of the reward. "Immediate family members" includes:

(1) A spouse, parent, brother, sister, child, or domestic partner of the individual;

(2) A person with respect to whom the individual stands in loco parentis; and

(3) Any person not covered by subparagraph (1) or (2) of this section, who is living in the individual's household and is related to the individual by blood, marriage, or legal adoption.

b. Specific measures employed to protect the identity of an RPP or potential RPP (and immediate family members, as appropriate) beyond the security procedures set forth in 12 FAM 228.5-4 will depend on the circumstances of each case, but include not identifying the RPP by name in the reports sent to Congress in accordance with 12 FAM 228.6-1.

c. RPPs and their immediate family members may be eligible for participation in the AG's Witness Protection Program authorized under 18 U.S.C. 3521. U.S. Government officials are not authorized to make a promise or inducement of participation in this program without the express approval of DOJ.

d. Per 8 U.S.C. 1101(a)(15)(S)(ii), an RPP may be eligible for a nonimmigrant visa, if the Secretary and the AG jointly determine that the informant:

(1) Possesses critical reliable information concerning a terrorist organization, enterprise, or operation;

(2) Is willing to supply or has supplied such information to Federal law enforcement authorities or a Federal court;

(3) Will be or has been placed in danger as a result of providing such information; and

(4) Is eligible to receive a reward under 22 U.S.C. 2708(a). The informant's immediate family (defined as spouse, children, or parents) may also be eligible for such visas.

e. Per 8 U.S.C. 1101(a)(15)(S)(i), an RPP may be eligible for a non-immigrant visa if the AG determines that the informant:

(1) Is in possession of critical reliable information regarding a criminal organization or enterprise;

(2) Is willing to supply or has supplied such information to Federal or State law enforcement authorities or a Federal or State court; and

(3) Whose presence in the United States the Attorney General determines is essential to the success of an authorized criminal investigation or the successful prosecution of an individual involved in the criminal organization or enterprise.

f. The post, department, or agency working with the informant, should report to DS/TIA what specific additional measures for protection of the identity of an informant are indicated and planned.

12 FAM 228.4 Rewards Program Guidelines

12 FAM 228.4-1 Ineligibility of Government Officers or Employees

(CT:DS-293; 04-10-2018)

An officer or employee of any entity of the Federal, State, or local government or of a foreign government who, while in the performance of his or her official duties, furnishes information as described in 12 FAM 228.3-1, paragraph a, shall not be eligible for a reward under the RFJ rewards program. Such an officer or employee may, in limited circumstances, however, in the case of 12 FAM 228.3-1, paragraph a, be eligible for participation in the DOJ Witness Protection Program. U.S. Government officials are not authorized to make a promise or inducement of participation in this program without the express approval of DOJ.

12 FAM 228.4-2 Coordination with Relevant Host-Government Authorities

(CT:DS-293; 04-10-2018)

RFJ supplements and complements security and law enforcement efforts of relevant host-government authorities who bear the primary responsibility in these areas. To this end, all stages of the rewards process (see 12 FAM 228.6) will be closely coordinated whenever appropriate with responsible host-government authorities.

12 FAM 228.4-3 Responsibilities

(CT:DS-273; 05-19-2017)

a. The RSO is primarily responsible for RFJ at each post within that officer's jurisdiction. Such responsibility includes implementation of each of the stages of the rewards process as set forth in 12 FAM 228.6, including coordination as needed with U.S. Government officials and host-government authorities. In carrying out these responsibilities, the RSO remains subject to the overall direction and supervision of the deputy chief of mission (DCM) and should coordinate with other officers at post, as appropriate.

b. All nominations within the Department to pay a reward under RFJ will be coordinated by DS. In carrying out this responsibility, DS will consult with the members of the IRC, as appropriate. Consultation may take the form of IRC meetings or circulation of written proposals to committee members.

12 FAM 228.4-4 Security Procedures

(CT:DS-273; 05-19-2017)

a. All communications relating to the implementation of RFJ must be transmitted in appropriate channels with classification level and distribution controls sufficient to ensure the security of operations and persons involved. Such communications include:

(1) Proposals for reward offers;

(2) Nominations for rewards payments;

(3) Reports of information received in response to a reward offer;

(4) Measures taken in response to information received;

(5) Contacts with host-government authorities;

(6) Instructions from the Department to posts; and

(7) Other relevant information.

b. Names of RPPs and information that may lead to their identification must be handled in accordance with appropriate operational security procedures. An RPPs identity and relationship with RFJ should be limited only to those individuals with a need to know. An RPPs relationship with RFJ should be kept confidential, even if the RPPs identity and/or role in a case has been publicly disclosed in the media.

c. All other documents relating to implementation must be handled in accordance with appropriate operational security procedures. This includes information relating to identities of RPPs and times, places, and circumstances of contacts with U.S. officials.

12 FAM 228.4-5 Accounting for Funds

(CT:DS-273; 05-19-2017)

Fiscal responsibility and accountability for funds appropriated for use in carrying out the rewards program will reside with the Office of Emergencies in the Diplomatic and Consular Service (M/EDCS). M/EDCS will also be responsible for instituting appropriate financial controls, including controls that may be necessary to maintain the confidentiality of payments within the framework of internal control and audit requirements.

12 FAM 228.5 Rewards Process

12 FAM 228.5-1 Proposals to Offer Rewards

(CT:DS-293; 04-10-2018)

a. The Department, posts, or other agencies may propose that a reward be offered for information on terrorism in accordance with regulations and authorities set forth in 12 FAM 228.3-1, and 12 FAM 228.4.

b. Such proposals may include that a reward be offered jointly with a foreign government.

c. A generic reward offer for information relating to all potential targets may also be proposed.

d. The relevant IRC will review and clear all such reward proposals.

e. When a reward offer is approved by the Secretary of State, it may then be publicized in accordance with 12 FAM 228.5-2.

12 FAM 228.5-2 Publicizing Reward Offers

(CT:DS-293; 04-10-2018)

a. Reward offers may be publicized through media campaigns developed by the Department. These reward offers may also be posted on the rewards programs website.

b. All reward program announcements and other media campaigns must be cleared by the appropriate bureaus within the Department. Relevant posts must also be consulted regarding proposed announcements and may be directed to consult with respective host governments.

12 FAM 228.5-3 Actions upon Receiving Information at Post in Response to Reward Offers

(CT:DS-293; 04-10-2018)

The designated officer at post, usually the regional security officer (RSO), establishes policies and procedures for handling all information received in response to a reward offer in support of existing policies. All information should be coordinated with appropriate embassy offices and the RFJ program.

12 FAM 228.5-4 Nominations to Pay Rewards

(CT:DS-293; 04-10-2018)

a. Nominations for payment under RFJ may originate at post, at the Department, or at other agencies. Such nominations must include specific details concerning the factors set forth in 12 FAM228.5-5. In no case may any individual agree to pay a reward under RFJ without express approval from the Department through RFJ in accordance with 12 FAM 228.5-5 paragraph e and 12 FAM 228.5-7.

b. If a nomination originates within the Department, RFJ will seek the views of the IRC and relevant post(s) before recommending the payment of a reward.

c. Posts proposing RPPs should advise RFJ of any host-country sensitivities that may affect the decision making process. For example, host-country legal restrictions may apply to the payment or promise of payment to witnesses for their testimony. Such restrictions, including the effect that a payment of a reward would have on host-country authorities law enforcement efforts, must be considered in making recommendations.

d. Posts should advise whether any specific measures for protection of the identity of the RPP are deemed necessary (see 12 FAM 228.4-4.)

12 FAM 228.5-5 Reviewing Reward Payment Nominations

(CT:DS-293; 04-10-2018)

a. In cases covered by 22 U.S.C. 2708(b)(1), (2) or (4), concerning information leading to the arrest or conviction for commission of, or for attempt or conspiracy to commit, or for aiding or abetting an act of international terrorism, the decision to pay a reward and the amount thereof depend on various considerations, including, but not limited to, the following factors:

(1) The degree to which the terrorist act targeted a U.S. person or U.S. property;

(2) The seriousness of the injury or potential injury to a U.S. person or U.S. property;

(3) The number of acts;

(4) The degree of seriousness of the act(s);

(5) The likelihood that the information provided has materially aided in bringing the individuals responsible to justice;

(6) The value of the information;

(7) The degree of participation in the terrorist act of the individual(s) responsible;

(8) The degree of risk faced by the potential reward recipient and his or her family in providing the information;

(9) The degree to which the arrest or conviction will seriously impede the functions of a terrorist organization; and

(10) The degree to which the RPP(s) voluntarily cooperated with authorities.

b. In cases covered by 22 U.S.C. 2708(b)(5) or (6), concerning information leading to:

(1) The prevention or frustration of an act of international terrorism;

(2) The favorable resolution of an act of international terrorism;

(3) The dismantling of a terrorist organization in whole or significant part; or

(4) The identification or location of an individual who holds a key leadership position in a terrorist organization, the decision to pay a reward and the amount thereof will depend on various considerations, including, but not limited to, the following factors:

(a) The credibility and specificity of available information indicating, as applicable:

(i) That there is a threat of an act of international terrorism;

(ii) The on-going activities of the applicable terrorist organization or threat; or

(iii) The identification or location of the individual who holds a key leadership position in a terrorist organization;

(b) The seriousness of the danger to a U.S. person or U.S. property indicated by the available information;

(c) The likelihood that, and the degree to which, the information provided has materially aided in successfully, as applicable:

(i) Avoiding or countering the terrorism threat;

(ii) Favorably resolving an act of international terrorism or an ongoing international terrorist activity;

(iii) Dismantling a terrorist organization in whole or in part; or

(iv) Identifying or locating the key individual;

(d) The degree of risk faced by the potential reward recipient and his or her family in providing the information; and

(e) The extent to which the reward recipient voluntarily cooperated with authorities.

c. In cases covered by 22 U.S.C. 2708(b)(12), concerning information leading to the disruption of financial mechanisms of any person who has engaged in conduct described in sections 104(a) or 104(b)(1) of the North Korea Sanctions Policy Enhancement Act of 2016, as amended, the decision to pay a reward and the amount thereof depend on various considerations, including, but not limited to, the following factors:

(1) The extent to which the information provided contributes to the policy goals described in sections 104(a) or 104(b)(1) of the North Korea Sanctions Policy Enhancement Act of 2016, as amended;

(2) The likelihood that the information provided has materially aided in disrupting activities that support the DPRK regime;

(3) The value of the information;

(4) The credibility and specificity of available information;

(5) The degree of risk faced by the potential reward recipient and his or her family in providing the information; and

(6) The degree to which the RPP(s) voluntarily cooperated with authorities.

d. In cases covered by 22 U.S.C. 2708(b)(11), concerning information leading to the location or identification of any person who, at the direction of a foreign government, has aided or abetted a violation of the CFAA, the decision to pay a reward and the amount thereof depend on various considerations, including, but not limited to, the following factors:

(1) The seriousness of the potential or actual injury or damage arising out of the conduct described in 22 U.S.C. 2708(b)(11);

(2) The value of the information;

(3) The likelihood that the information provided has materially aided in disrupting activities undertaken by an individual at the direction of a foreign government to aid or abet a violation of the CFAA;

(4) The degree of risk faced by the potential reward recipient and his or her family in providing the information; and

(5) The degree to which the RPP(s) voluntarily cooperated with authorities.

e. Whether a reward is paid and in what amount in any given case are matters within the discretion of the Secretary, with the concurrence of the U.S. Attorney General (AG) if it is a matter over which there is Federal criminal jurisdiction.

f. If a payment nomination is denied by the IRC, the Secretary, or the AG, RFJ will advise relevant parties of the decision, specifying the basis for denial.

12 FAM 228.5-6 Action Memoranda

(CT:DS-293; 04-10-2018)

a. If an IRC recommends a reward payment, RFJ will send an action memorandum to the Secretary recommending that a reward be certified for payment.

b. The action memo will include:

(1) A summary and analysis of the nomination;

(2) An analysis and recommendation that the Secretary determine that the information provided by the individual falls within the categories set out in 12 FAM 228.3-1 paragraph a(1-8) that authorize a reward payment;

(3) An analysis and recommendation regarding the amount of the reward based on the factors set out in 12 FAM 228.5-5 and/or the method of payment;

(4) A recommendation as to the amount of the reward;

(5) A recommendation as to whether protection measures are necessary and describing any necessary measures to protect the identity of the recipient and/or members of the recipient's immediate family;

(6) The dissenting opinion(s) of any IRC representatives involved in the decision to recommend payment of a reward;

(7) A proposed letter seeking the concurrence of the AG if the matter is one over which there is Federal criminal jurisdiction. See also 12 FAM 228.5-5, paragraph e.

12 FAM 228.5-7 Reward Payment

(CT:DS-293; 04-10-2018)

a. The Secretary may authorize a reward payment greater than $25 million if he or she determines that an offer or payment of an award of a larger amount is necessary to combat terrorism or defend the nation against terrorist acts. The Secretary may also authorize a reward of up to $50 million for the capture or information leading to the capture of a leader of a foreign terrorist organization.

b. Title 22 U.S.C. 2708(e)(2) requires the Secretary to approve a reward of more than $100,000. Absent delegation of reward payments of $100,000 or less, all proposals for reward payments must be sent to the Secretary of State for authorization.

c. The Secretary will determine the amount of the reward paid. He or she may seek the views of other agencies, the post, Department personnel, or the agency proposing the reward, when making such a determination.

d. Provided the Secretary has decided that a reward will be paid, and has received the concurrence of the AG if it is a matter over which there is Federal criminal jurisdiction, RFJ will notify the appropriate post, department, or agency and coordinate the payment of the reward.

12 FAM 228.6 Reporting Requirements

12 FAM 228.6-1 Reports on the Payment and Offer of Rewards

(CT:DS-293; 04-10-2018)

a. Per 22 U.S.C. 2708(g)(1), not later than 30 days after the payment of any reward, the Secretary shall submit a report to the House Committee on Foreign Affairs and the Senate Committee on Foreign Relations with respect to such reward. RFJ will prepare the report, which may be submitted in classified form, if necessary, and must:

(1) Specify the amount of the reward paid;

(2) Provide an identification number which will be used instead of a name to protect the recipients identity;

(3) State the acts with respect to which the reward was paid; and

(4) Discuss the significance of the information for which the reward was paid in dealing with the respective acts.

b. Not less than 15 days after a reward offer is authorized under this section, the Secretary of State shall submit to the appropriate congressional committees a report, which may be submitted in classified form if necessary to protect intelligence sources and methods, detailing information about the reward offer, including the identity of the individual for whom the reward offer is being made, the amount of the reward offer, the acts with respect to which the reward offer is being made, and how the reward is being publicized.

12 FAM 228.6-2 Annual and Quarterly Reports

(CT:DS-293; 04-10-2018)

a. Per 22 U.S.C. 2708(g)(1), the Secretary will provide within 60 days after the end of each fiscal year an annual report to the Committee on Foreign Relations, the Committee on Appropriations of the Senate, the Committee on Foreign Affairs, and the Committee on Appropriations of the House of Representatives. The report will include operational costs covered by the Bureau of Diplomatic Security as well as any advertising related expenditures and reward payments from the appropriation for Emergencies in the Diplomatic and Consular Service for that fiscal year.

b. The Office of Emergencies in the Diplomatic and Consular Service (M/EDCS) must also report information on a quarterly basis the total amounts expended to carry out the RFJ Program, including any reward payments made and any amounts expended to publicize the availability of rewards. M/EDCS generates these quarterly reports.

12 FAM 229 UNASSIGNED

UNCLASSIFIED (U)