Investigative Definitions & Glossary

Intelligence derived from the analysis of acoustic phenomena, particularly underwater sound for submarine detection.

Also known as: APT

A sophisticated, well-resourced, and often state-sponsored threat actor that conducts prolonged, targeted cyber campaigns against specific organizations or nations. APTs are characterized by their ...

A written sworn statement of facts submitted by an investigator to a judge in support of a request for a search warrant, arrest warrant, or other court order.

Also known as: All-Source Analysis, Fused Intelligence

Intelligence products and organizations that incorporate all sources of information in the production of finished intelligence. All-source analysis fuses information from HUMINT, SIGINT, IMINT, MAS...

Also known as: ACH

A structured analytic technique that identifies a complete set of alternative hypotheses, systematically evaluates data for consistency with each hypothesis, and focuses analysis on disproving hypo...

Also known as: AML

A set of laws, regulations, procedures, and controls designed to prevent criminals from disguising illegally obtained funds as legitimate income. AML frameworks require financial institutions to im...

A defined interface that enables automated access to platform data and services, used extensively in OSINT for programmatic data collection.

Also known as: Agent, Recruited Source, Recruited Agent

A person — typically a foreign national — recruited by an intelligence service to provide secret information or to perform clandestine tasks. An asset is not an employee of the intelligence service...

The investigative process of identifying, locating, and documenting assets belonging to a subject of investigation. Asset tracing follows the movement of funds and property through multiple account...

A tabular analytical tool used to identify and display the relationships between entities (people, organizations, events, locations) in an investigation. The matrix arranges entities along both axe...

The total number of points where an unauthorized user can attempt to enter or extract data from a system, including network interfaces, software, APIs, and human factors.

The process of identifying the responsible party behind a cyber operation or attack. Attribution is technically challenging and politically sensitive, requiring correlation of technical indicators,...

The process of establishing that evidence is what it purports to be. Digital evidence authentication may involve hash verification, metadata analysis, chain of custody documentation, and expert tes...

A systematic inquiry into an individual's history and character, typically conducted as part of employment screening, security clearance processing, or tenancy evaluation. Background investigations...

The primary U.S. anti-money laundering law that requires financial institutions to maintain records of cash transactions and report suspicious activities to FinCEN.

The natural person(s) who ultimately own, control, or benefit from a legal entity or financial arrangement, even if the entity is legally owned through intermediaries, shell companies, or nominees.

Automated methods of recognizing or verifying the identity of a living person based on physiological or behavioral characteristics. Biometric modalities include fingerprints, facial recognition, ir...

A distributed, immutable digital ledger that records transactions across a network of computers. Each block contains a cryptographic hash of the previous block, creating a tamper-evident chain used...

A network of compromised computers (bots or zombies) controlled remotely by an attacker, typically used for DDoS attacks, spam distribution, or credential stuffing.

Also known as: Brady Disclosure, Exculpatory Evidence

Evidence in the possession of the prosecution that is favorable to the defendant and material to either guilt or punishment. Under the Brady v. Maryland Supreme Court ruling, the prosecution has a ...

A brief, prearranged moment of physical proximity during which materials are discreetly transferred between an intelligence officer and an asset without observable direct contact.

An official statement that an intelligence source or agent is unreliable, has been compromised, or should no longer be trusted or used for intelligence purposes.

Also known as: BEC, CEO Fraud, Email Account Compromise

A sophisticated fraud scheme in which criminals use email — often after compromising or spoofing a legitimate business email account — to impersonate executives, vendors, or attorneys and trick emp...

Stored copies of web pages maintained by search engines and web archives that preserve content even after the original has been modified or deleted.

Also known as: CARVER

A target analysis and vulnerability assessment methodology that evaluates potential targets based on six criteria: Criticality, Accessibility, Recuperability, Vulnerability, Effect, and Recognizabi...

Also known as: Handler, Operations Officer

A professional intelligence officer responsible for recruiting, managing, and directing human intelligence assets. The case officer develops relationships with potential sources, assesses their acc...

The categorization of weapons of mass destruction and hazardous materials by their type. CBRN defense encompasses detection, protection, decontamination, and medical countermeasures.

The documented chronological history of the seizure, custody, control, transfer, analysis, and disposition of evidence. A proper chain of custody establishes that evidence has been handled in a man...

The system by which national security information is designated at levels reflecting the damage that unauthorized disclosure could cause. The three classification levels are Confidential (damage), ...

Systematic patterns of deviation from rational judgment that affect intelligence analysis. Common biases include confirmation bias (favoring information that confirms existing beliefs), anchoring b...

A structured interviewing technique developed by Fisher and Geiselman that uses cognitive psychological principles to enhance witness memory retrieval. The technique employs mental reinstatement of...

The process of converting intelligence requirements into collection requirements, establishing priorities, tasking or coordinating with appropriate collection sources or agencies, monitoring result...

A systematic document that identifies the intelligence gaps, determines the appropriate collection capabilities, assigns specific collection tasks, and establishes timelines for collecting the requ...

The current state and readiness of an organization's intelligence collection capabilities against specific targets or requirements.

Also known as: Communications Intelligence

Intelligence derived from the intercept of foreign communications by other than the intended recipients. COMINT includes the monitoring, recording, and exploitation of foreign voice, data, fax, and...

Also known as: C2, C&C

The infrastructure and communication channels used by an attacker to maintain contact with and issue instructions to compromised systems within a target network. C2 mechanisms range from simple dir...

The principle of limiting access to information to only those persons who require it for their specific roles, even among individuals with the same security clearance level.

Also known as: CI (Business), Business Intelligence

The systematic collection and analysis of information about competitors, market conditions, and industry trends using legally and ethically obtained sources. Competitive intelligence informs strate...

The degree of certainty an analyst has in an intelligence assessment or judgment. Typically expressed as high, moderate, or low confidence based on the quality and quantity of available information...

A court-enforced agreement in which an entity agrees to specific reforms or actions to resolve alleged violations without admitting guilt or liability. In law enforcement, consent decrees are used ...

A search conducted by law enforcement with the voluntary consent of the person with authority over the area or property to be searched, without the need for a warrant.

An investigative technique in which law enforcement allows an illegal or suspect shipment to continue under surveillance to identify all parties involved in the criminal activity.

Also known as: CI

Activities conducted to identify, assess, neutralize, and exploit the intelligence collection efforts of foreign adversaries, terrorist organizations, and other hostile entities. CI encompasses bot...

Active measures taken by an individual or team to detect, identify, and evade surveillance. Countersurveillance techniques include surveillance detection routes (SDRs), counter-technical surveillan...

Also known as: Data Breach, Credential Dump, Combo List

An incident in which user authentication data — typically email addresses and passwords — is exposed through a data breach and subsequently made available on the internet or dark web. Investigators...

The physical and cyber systems and assets so vital to a nation that their incapacitation or destruction would have a debilitating impact on national security, economic stability, public health, or ...

The process of analyzing blockchain transactions to follow the movement of cryptocurrency between wallets and identify the parties involved. Despite the pseudonymous nature of most cryptocurrencies...

Also known as: CTR

A mandatory report filed by financial institutions with FinCEN for each cash transaction exceeding $10,000. CTRs capture information about the transaction and the parties involved. Structuring tran...

Intelligence of immediate interest to consumers concerning events and developments that are ongoing or have recently occurred.

The process of verifying customer identity, understanding their business, and assessing the risk level they present for money laundering or terrorist financing.

Also known as: Kill Chain

A framework developed by Lockheed Martin that describes the stages of a cyberattack from initial reconnaissance through actions on objectives. The seven stages are: reconnaissance, weaponization, d...

Intelligence derived from cyberspace operations and cyber threat data.

A person intentionally presented to a foreign intelligence service as a potential recruit, either to gather intelligence about the service's recruitment methods or to feed disinformation.

The portion of the internet that is intentionally hidden and inaccessible through standard web browsers, requiring specialized software (such as Tor) to access. The dark web hosts both legitimate p...

A business that collects, aggregates, and sells personal information from public records, social media, and commercial sources to third parties.

The legal standard for admissibility of expert testimony and scientific evidence in federal courts, established by Daubert v. Merrell Dow Pharmaceuticals. Under Daubert, the trial judge evaluates w...

An attack that overwhelms a target system, service, or network with traffic from multiple compromised sources, rendering it unavailable to legitimate users.

A method of clandestine communication in which materials (documents, funds, instructions) are left at a prearranged hidden location for later retrieval by another party, avoiding the need for direc...

The process of determining whether multiple law enforcement agencies or units are investigating the same subject, location, or event, in order to prevent operational conflicts, officer safety issue...

The passive data trail generated by a person's online activities without their deliberate intent, including metadata from files, IP address logs, browser fingerprints, device identifiers, location ...

The trail of data a person or entity leaves behind through their digital activities, including websites visited, social media activity, emails sent, online purchases, and data shared with services....

Also known as: Computer Forensics, Cyber Forensics

The scientific process of identifying, preserving, collecting, analyzing, and presenting digital evidence from electronic devices and digital storage media in a manner that is legally admissible. D...

The pretrial legal process in which parties to a lawsuit can obtain evidence and information from each other and from third parties through depositions, interrogatories, requests for documents, and...

The timely delivery of finished intelligence to authorized consumers in the appropriate format and through authorized channels.

A technique that uses different domain names at different layers of communication to circumvent censorship or disguise the true destination of traffic.

Also known as: Google Hacking, Advanced Search Operators

The technique of using advanced search operators and specialized queries to locate specific information on the internet that is not easily discoverable through basic searches. Operators like site:,...

An agent who has been turned or recruited by a second intelligence service to work against their original service while maintaining the appearance of loyalty. Double agents can provide valuable cou...

A comprehensive investigation and analysis conducted to evaluate a person, business, or transaction before entering into a contractual agreement, partnership, investment, or employment relationship...

The strategic use of conversational techniques to extract information from a person without their awareness that they are being specifically targeted for intelligence purposes. Elicitation exploits...

Also known as: Electronic Intelligence

Intelligence derived from foreign non-communications electromagnetic radiations emanating from sources other than nuclear detonations or radioactive sources. Primarily concerned with radar emission...

The process of converting plaintext data into an unreadable format (ciphertext) using a mathematical algorithm and a key, so that only authorized parties with the correct decryption key can access ...

Heightened scrutiny and additional verification measures applied to higher-risk customers, such as politically exposed persons (PEPs), foreign correspondents, and customers from high-risk jurisdict...

An illegal law enforcement practice in which an officer or agent induces a person to commit a crime that they would not have otherwise committed. Entrapment is an affirmative defense; the defendant...

The clandestine practice of obtaining secret or confidential information from a government, military, corporation, or other entity without the permission of the holder. Espionage may be conducted b...

Intelligence that projects future developments and outcomes, identifying what might happen and its implications.

An analytical visualization technique that displays events in chronological order along a timeline, showing the relationships between activities, actors, and outcomes. Event charts help investigato...

The procedures and measures taken to protect physical and digital evidence from contamination, alteration, loss, or destruction from the point of collection through court presentation. Proper prese...

A legal principle that prohibits evidence obtained in violation of the Fourth Amendment from being used in criminal prosecution. The rule is designed to deter unconstitutional police conduct. Excep...

Also known as: EXIF, Exchangeable Image File Format

Exchangeable Image File Format data embedded in digital photographs that can contain the camera model, date and time the photo was taken, GPS coordinates, exposure settings, and software used to ed...

Emergency conditions that justify law enforcement taking immediate action without a warrant, such as imminent destruction of evidence, hot pursuit of a suspect, or threat to life.

A person with specialized knowledge, skill, experience, training, or education who is qualified to provide opinion testimony on matters within their expertise to assist the trier of fact.

A piece of code, technique, or sequence of commands that takes advantage of a vulnerability to cause unintended behavior, including unauthorized access or code execution.

An operation designed to appear as if it were carried out by a party other than the actual perpetrator, used in both intelligence operations and cyberattacks to misdirect attribution.

The bureau of the U.S. Department of the Treasury responsible for collecting and analyzing financial transaction data to combat money laundering, terrorist financing, and other financial crimes.

Also known as: Financial Intelligence

Intelligence gathered from analysis of financial transactions, monetary flows, and economic data to detect illicit financing, money laundering, sanctions evasion, terrorist financing, and other fin...

The final product of the intelligence cycle — analyzed, evaluated, and interpreted information that has been converted into intelligence suitable for the customer's use. Finished intelligence provi...

A network security device or software that monitors and controls incoming and outgoing network traffic based on predetermined security rules, establishing a barrier between trusted and untrusted ne...

Also known as: FISA

A federal law that establishes procedures for the physical and electronic surveillance and collection of foreign intelligence information between foreign powers and agents of foreign powers. FISA c...

Preventive measures taken to mitigate hostile actions against military personnel, resources, facilities, and critical information. Force protection encompasses security operations, personal protect...

Also known as: FPCON

A system of progressive security measures implemented by the Department of Defense when a terrorist threat exists. The five FPCON levels are Normal, Alpha (general threat), Bravo (increased and pre...

Also known as: FIS

An organ of a foreign government responsible for collecting intelligence outside its own borders, conducting espionage, and carrying out covert operations.

The specialized practice of applying accounting, auditing, and investigative skills to examine financial records for use in legal proceedings. Forensic accountants trace funds, quantify losses, det...

Also known as: Bit-Stream Copy, Disk Image, Forensic Copy

A bit-for-bit exact copy of a digital storage device that captures every sector including deleted files, file fragments, slack space, and unallocated space. Forensic images are created using valida...

Also known as: Super Timeline, Timeline Reconstruction

The reconstruction of a chronological sequence of events using data from multiple digital sources including file system timestamps, log entries, browser history, email headers, and metadata. Timeli...

The amendment to the U.S. Constitution that protects individuals against unreasonable searches and seizures by the government. It requires that warrants be issued only upon probable cause, supporte...

The process of resolving allegations of fraud by obtaining evidence, taking statements, writing reports, and assisting in the detection, investigation, and prevention of fraud. Fraud examiners comb...

A legal doctrine that extends the exclusionary rule to make inadmissible any evidence derived from an initial illegal search, seizure, or interrogation. If the original evidence was obtained uncons...

A collaborative effort of two or more agencies that provide resources, expertise, and information to a central location to maximize the ability to detect, prevent, investigate, and respond to crimi...

Also known as: Reverse Location Warrant

A court order that compels technology companies to provide information about all devices that were present within a defined geographic area during a specified time period. These warrants have faced...

Also known as: Geospatial Intelligence

Intelligence derived from the exploitation and analysis of imagery and geospatial data to describe, assess, and visually depict physical features and geographically referenced activities on the ear...

The process of determining the physical geographic location of a person, device, or object using digital evidence. Methods include analyzing EXIF metadata from photographs, correlating IP addresses...

The examination and interpretation of geographic data patterns to understand spatial relationships, identify trends, and support decision-making. In investigations, geospatial analysis maps crime p...

A body of citizens convened to evaluate whether sufficient evidence exists to bring criminal charges (indictment) against a suspect. Grand jury proceedings are conducted in secret, and the standard...

Published or unpublished materials that are not controlled by commercial publishers and are often difficult to locate through conventional bibliographic means. Includes technical reports, working p...

A psychological phenomenon in which the desire for harmony in a group leads to irrational or dysfunctional decision-making, suppressing dissent and critical evaluation of alternatives.

A fixed-length numerical value produced by a mathematical algorithm from input data. In digital forensics, hash values (typically MD5, SHA-1, or SHA-256) serve as digital fingerprints to verify dat...

An informal value transfer system based on trust and personal networks that operates outside of traditional banking channels. In hawala, a customer gives money to a broker (hawaladar) in one locati...

A person who is inspired by, but not directed by, a foreign terrorist organization to plan or commit acts of violence within their home country.

An intelligence recruitment or compromise operation that uses romantic or sexual enticement to gain access to a target, extract information, or create leverage for blackmail.

Also known as: Human Intelligence, Human Source Intelligence

Intelligence gathered through interpersonal contact and human sources. Includes information obtained from diplomats, recruited agents, travelers, prisoners of war, refugees, and any person with acc...

The fraudulent acquisition and use of another person's personal identifying information to commit crimes, make purchases, obtain credit, or assume the victim's identity.

Also known as: Imagery Intelligence

Intelligence derived from the exploitation of visual representations produced by optical, electro-optical, radar, infrared, and multispectral sensors. Imagery can be collected from satellite, airbo...

Also known as: IR

The organized approach to addressing and managing the aftermath of a security breach or cyberattack. Incident response aims to limit damage, reduce recovery time and costs, and learn from the incid...

The intelligence activities intended to detect and report time-sensitive intelligence information on foreign developments that could pose a threat. I&W includes identifying and reporting indicators...

An observable action, condition, or fact that suggests an adversary has adopted or is preparing a specific course of action. Indicators are used in intelligence analysis to provide warning of impen...

Also known as: IOA

Proactive indicators that focus on identifying the intent and techniques of an adversary rather than the artifacts left behind. IOAs describe active attack behaviors such as code execution patterns...

Also known as: IOC

An artifact observed on a network or in a system that indicates, with high confidence, that a security breach or malicious activity has occurred. IOCs include malicious IP addresses, domain names, ...

Also known as: Confidential Informant, CI, Source, Cooperating Witness

A person who provides information about criminal activity to law enforcement, typically in exchange for reduced charges, monetary compensation, or other consideration. Their identities are protecte...

The risk posed by individuals within an organization who use their authorized access to intentionally or unintentionally harm the organization through espionage, sabotage, unauthorized disclosure, ...

The collective of government agencies and organizations responsible for intelligence activities. In the U.S., the IC comprises 18 member organizations.

The process by which information is acquired, converted into finished intelligence, and made available to policymakers and commanders. The cycle consists of five phases: planning and direction, col...

A formal assessment of a situation, condition, or capability of a foreign entity, produced by an intelligence organization. Intelligence estimates synthesize available information to provide judgme...

Also known as: Fusion

The process of combining and integrating multiple intelligence sources and disciplines into a cohesive, comprehensive picture. Fusion centers bring together information from federal, state, local, ...

Also known as: IGL

An assessment of the potential intelligence value gained from continuing an operation or surveillance against the risk of losing access, compromising sources, or alerting the target. IGL calculatio...

Also known as: IPB, Intelligence Preparation of the Environment (IPOE)

A systematic approach to analyzing the threat and environment in a specific geographic area. IPB is designed to support military decision-making by defining the operational environment, describing ...

A statement of need for specific intelligence information to support decision-making, often categorized as Priority Intelligence Requirements (PIR).

A formal inquiry conducted within an organization to examine allegations of policy violations, misconduct, fraud, harassment, data breaches, or other concerns. Internal investigations typically inv...

A structured analytic technique that identifies and examines the fundamental assumptions underlying an analysis. The purpose is to make hidden assumptions explicit, evaluate their validity, and con...

Also known as: KYC

The regulatory requirement and process by which financial institutions verify the identity of their customers, understand the nature of their business relationships, and assess the risk they pose f...

Techniques used by an attacker after initial access to move through a network, accessing additional systems and escalating privileges to reach their ultimate objective.

A fabricated personal history and documentation created to support the cover identity of an intelligence officer or covert operative.

An analytical technique used to evaluate relationships and connections between nodes (people, organizations, places, events, objects) in a network. Link analysis visually maps and mathematically me...

A foundational forensic science principle established by Dr. Edmond Locard stating that every contact between two entities results in an exchange of material. When a person interacts with a scene, ...

The examination of recorded events from systems, applications, networks, and security devices to detect anomalies, investigate incidents, and reconstruct timelines. Logs from firewalls, servers, au...

Also known as: Lone Actor, Solo Actor

An individual who plans and carries out an act of violence independently, without direct orders, direction, or material support from a formal terrorist organization or group. Lone wolves may be ins...

Software intentionally designed to cause damage, gain unauthorized access, disrupt operations, or otherwise compromise computer systems. Categories include viruses, worms, trojans, ransomware, spyw...

Also known as: Measurement and Signature Intelligence

Intelligence obtained by quantitative and qualitative analysis of physical attributes of targets and events to characterize, locate, and identify them. MASINT employs a broad range of disciplines i...

Also known as: Medical Intelligence

Intelligence derived from the collection, evaluation, analysis, and interpretation of foreign medical, bio-scientific, and environmental information that is of interest to strategic planning for me...

Data that provides information about other data. In investigative contexts, metadata from files, communications, and digital activities can reveal authorship, creation and modification dates, devic...

The constitutional rights that law enforcement must communicate to suspects in custodial interrogation, as established by Miranda v. Arizona. These include the right to remain silent, the warning t...

A cognitive bias in which an analyst assumes that the subject of analysis will act or think in the same way the analyst would in similar circumstances. This bias can lead to significant errors when...

A comprehensive knowledge base and framework of adversary tactics, techniques, and procedures (TTPs) based on real-world observations. ATT&CK catalogs the specific methods threat actors use across ...

The particular method or pattern of behavior a criminal uses to commit crimes, reflecting their learned habits and practical choices. Distinguished from signature, which reflects psychological needs.

A long-term penetration agent who has been recruited or placed within an intelligence service, government agency, or other target organization to secretly provide information to a foreign intellige...

The process of making illegally obtained money appear legitimate by disguising its true origin. Money laundering typically involves three stages: placement (introducing illicit funds into the finan...

A security mechanism that requires two or more independent verification factors (something you know, have, or are) to authenticate a user's identity.

Also known as: MLAT

A bilateral or multilateral agreement between countries that formalizes the process for exchanging evidence and information in criminal investigations and prosecutions. MLATs establish the legal fr...

The FBI-managed centralized database of criminal justice information including wanted persons, stolen property, missing persons, and criminal history records accessible to law enforcement nationwide.

Also known as: NIE

The most authoritative written judgment of the U.S. intelligence community concerning national security issues. NIEs contain the coordinated judgments of the intelligence community regarding the pr...

The determination that a prospective recipient of classified information requires access to perform their official duties, applied in addition to and beyond having the requisite security clearance.

A U.S. government list of individuals who are prohibited from boarding commercial aircraft due to their assessed threat to aviation or national security.

Also known as: OFAC, Office of Foreign Assets Control

An agency of the U.S. Department of the Treasury responsible for administering and enforcing economic and trade sanctions programs against targeted countries, regimes, terrorists, and international...

Also known as: OPSEC

A systematic process for identifying, controlling, and protecting critical information that could be used by an adversary to compromise operations, intelligence activities, or personnel. The five-s...

The measures and tradecraft an OSINT investigator employs to conduct research without alerting the target or compromising the investigation. Includes using VPNs, dedicated research machines, manage...

Also known as: OOB, OB

The identification, strength, command structure, equipment, disposition, and combat effectiveness of military forces. Maintaining an accurate and current order of battle for adversary forces is a f...

Also known as: Open Source Intelligence

Intelligence produced from publicly available information that is collected, exploited, and disseminated in a timely manner to an appropriate audience. Sources include news media, social media, pub...

A system that records DNS resolution data observed over time, creating a historical database of which domain names resolved to which IP addresses and when. Unlike active DNS queries, passive DNS do...

Also known as: POL, Pattern of Life

The systematic study of an individual's or group's routine activities, behaviors, movements, and associations over time to establish baseline norms. Deviations from established patterns may indicat...

A non-coercive investigative interviewing framework widely used in the UK and internationally, standing for Planning and preparation, Engage and explain, Account (clarify and challenge), Closure, a...

Surveillance tools and their corresponding court orders that capture communications metadata. A pen register records outgoing dialing information (numbers called), while a trap and trace device cap...

A court order authorizing the collection of outgoing communications metadata (numbers dialed, email addresses contacted) from a specific account or device.

Also known as: Pen Test, Ethical Hacking

An authorized simulated cyberattack performed against a computer system, network, or application to evaluate its security posture. Penetration testers use the same tools and techniques as malicious...

The creation, maintenance, and operational employment of fictitious online identities for intelligence collection or investigation purposes.

A social engineering attack that uses deceptive electronic communications to trick recipients into revealing sensitive information, clicking malicious links, or downloading malware. Variants includ...

The systematic observation of persons, places, or activities by law enforcement or intelligence personnel using visual and electronic means. Physical surveillance is conducted on foot or by vehicle...

The act of using one discovered data point to uncover additional connected information during an investigation. An investigator may pivot from an email address to find associated usernames, from a ...

A negotiated agreement between the prosecution and defense in which the defendant agrees to plead guilty to specified charges in exchange for concessions such as reduced charges or sentencing recom...

An individual who holds or has held a prominent public position, along with their family members and close associates, who present elevated risk for money laundering and corruption.

A fraudulent investment operation in which returns to existing investors are paid from funds contributed by new investors rather than from legitimate business profits. Named after Charles Ponzi, th...

The factual basis that reasonably indicates criminal activity has occurred, is occurring, or will occur, and that justifies the initiation of an investigation. Predication standards vary by agency ...

The intelligence needs identified by a commander or decision-maker as being critical to accomplishing the mission, prioritized above other requirements.

The exploitation of vulnerabilities or misconfigurations to gain elevated access rights beyond what was initially authorized, moving from standard user to administrator level.

A legal standard requiring sufficient facts and circumstances that would lead a reasonable person to believe that a crime has been, is being, or will be committed, and that the person, place, or th...

Also known as: Queen for a Day, Proffer Agreement

A formal meeting between a suspect or defendant and prosecutors, typically under a proffer agreement (queen-for-a-day agreement), in which the individual provides information about criminal activit...

Also known as: PAI

Information that has been published or broadcast for general public consumption, is available on request to the public, is accessible online or otherwise to the public, is available to the public b...

The process by which an individual adopts increasingly extreme political, social, or religious ideologies that may lead to the acceptance or advocacy of violence as a legitimate means of achieving ...

A type of malware that encrypts a victim's files or systems and demands payment (typically in cryptocurrency) for the decryption key. Modern ransomware operations often employ double extortion, whe...

The process of establishing a positive interpersonal connection with an interview subject to facilitate communication, cooperation, and information sharing. Research demonstrates that rapport-based...

Collected information that has not yet been processed, analyzed, or converted into finished intelligence. Raw intelligence may be fragmentary, unverified, and potentially unreliable until it underg...

A legal standard lower than probable cause, based on specific and articulable facts that would lead a reasonable person to suspect criminal activity. Reasonable suspicion justifies brief investigat...

Also known as: Red Teaming, Devil's Advocacy

A structured analytic approach where a group adopts the perspective and mindset of an adversary or competitor to challenge established assumptions, expose vulnerabilities, and test plans and hypoth...

A structured interrogation method developed in the 1960s that involves a two-phase process: a non-accusatory interview using Behavior Analysis Interview (BAI) techniques, followed by a nine-step ac...

A technique that uses an image as the search input rather than text to find visually similar images, identify the origin and spread of an image, locate different versions or resolutions, and identi...

Also known as: RICO

A federal law enacted in 1970 that provides for extended criminal penalties and civil causes of action for acts performed as part of an ongoing criminal organization. RICO allows prosecutors to cha...

A systematic process that identifies and evaluates potential threats, vulnerabilities, and the consequences of adverse events to determine the overall level of risk. Risk is typically calculated as...

Malware designed to provide continued privileged access to a system while actively hiding its presence from administrators and security tools.

Also known as: ROE

Directives issued by competent military authority that delineate the circumstances and limitations under which forces will initiate or continue combat engagement with hostile forces. ROE govern the...

An isolated environment used to safely execute and observe the behavior of suspicious files, programs, or code without risk to production systems.

A court order issued by a judge or magistrate authorizing law enforcement to search a specific location, person, or digital account and seize specified evidence. A search warrant must be supported ...

A unique identifier used to search for or track an individual, entity, or piece of infrastructure across databases and platforms. Common selectors include email addresses, phone numbers, usernames,...

Operations, programs, or activities that due to their sensitive nature require special access controls, enhanced security measures, and restricted knowledge. These may include clandestine operation...

Also known as: SCI

Classified information concerning or derived from intelligence sources, methods, or analytical processes that requires handling within formal access control systems beyond those used for regular cl...

A legal entity that has no active business operations, significant assets, or employees but exists on paper to hold assets, facilitate transactions, or obscure the identity of the true owner. While...

A platform that collects, correlates, and analyzes security event data from across an enterprise to detect threats and support incident response.

Also known as: Signals Intelligence

Intelligence derived from the interception of electronic signals and communications. Encompasses COMINT (Communications Intelligence) from intercepted voice and data transmissions, and ELINT (Elect...

The organizational component within a signals intelligence agency responsible for the collection, processing, and reporting of SIGINT. The SID manages collection priorities, technical capabilities,...

A distinctive behavior or action performed by a criminal that goes beyond what is necessary to commit the crime and reflects the offender's psychological needs or desires. Signatures remain relativ...

The psychological manipulation of people to perform actions or divulge confidential information. Social engineering exploits human trust, authority, urgency, and other psychological principles rath...

Also known as: SNA, Network Analysis

A quantitative and qualitative methodology for mapping and measuring relationships and information flows between people, groups, organizations, or other entities. SNA identifies network structures,...

A fictitious online identity created by an investigator or threat actor to conduct covert research, infiltrate communities, or engage with targets without revealing their true identity. In legitima...

Also known as: Social Media Intelligence

Intelligence derived from monitoring, collecting, and analyzing publicly available social media content. Used to identify networks, track narratives, detect threats, assess sentiment, and gather in...

A location, facility, or event with limited security measures that is vulnerable to attack and may contain large concentrations of people, such as shopping centers, transportation hubs, and public ...

Also known as: Source Rating, Admiralty Code, NATO System

The process of assessing the reliability of an intelligence source and the credibility of the information provided. Commonly uses a standardized alphanumeric rating system where a letter (A through...

The intentional, reckless, or negligent destruction, alteration, or concealment of evidence relevant to a legal proceeding. Spoliation can result in adverse inference instructions, sanctions, or se...

Also known as: Linguistic Statement Analysis, SCAN (Scientific Content Analysis)

The systematic examination of written or verbal statements to detect deception, identify omissions, and assess the reliability of an account. Analysts examine linguistic indicators including change...

Also known as: IMSI Catcher, Cell-Site Simulator, Hailstorm

An electronic surveillance device that mimics a legitimate cell tower to trick mobile phones in the area into connecting to it, thereby allowing the operator to identify phones in the vicinity, cap...

Also known as: Structured Threat Information Expression, Trusted Automated Exchange of Intelligence Information

Standardized frameworks for sharing cyber threat intelligence. STIX (Structured Threat Information Expression) is a language for describing threat information including indicators, TTPs, threat act...

Also known as: SATs

A set of formalized methods for analyzing intelligence problems that help analysts overcome cognitive limitations, manage complexity, and produce more rigorous assessments. SATs include brainstormi...

Also known as: Smurfing

The illegal practice of breaking up financial transactions into smaller amounts specifically to avoid triggering mandatory reporting thresholds, such as the $10,000 CTR requirement. Also known as s...

A legal document commanding a person to appear before a court or other legal body to give testimony (subpoena ad testificandum) or produce documents and records (subpoena duces tecum). In investiga...

Systematic measures employed by a person or team to determine whether they are under surveillance, using deliberate route variations, observation points, and behavioral awareness.

Also known as: SDR, Cleaning Route

A preplanned route designed to identify surveillance while appearing natural and unremarkable to any observer. SDRs incorporate deliberate turns, stops, directional changes, varied environments, an...

In law enforcement context, a report filed by citizens, businesses, or officers documenting behavior or activities that may be indicative of criminal or terrorist pre-operational planning. Distinct...

Also known as: SAR

A regulatory filing that financial institutions are required to submit to FinCEN when they detect a transaction or pattern of transactions that they know, suspect, or have reason to suspect involve...

Also known as: TTP

The patterns of behavior and methods used by threat actors in conducting cyber operations. Tactics describe the adversary's goals, techniques describe how those goals are achieved, and procedures a...

A comprehensive compilation of intelligence information about a specific target, assembled to support operational planning and decision-making. A target package typically includes identification de...

A multi-agency law enforcement team assembled to address a specific criminal problem, threat, or investigation that crosses jurisdictional boundaries.

Also known as: Technical Intelligence

Intelligence derived from the collection, processing, analysis, and exploitation of data and information pertaining to foreign equipment and materiel. The purpose is to prevent technological surpri...

Also known as: TSCM, Bug Sweep, Debugging

The systematic physical and electronic examination of a facility, vehicle, or device to detect technical surveillance devices (bugs, hidden cameras, GPS trackers, compromised phones). TSCM sweeps u...

The study of time-based patterns in data to identify trends, cycles, anomalies, and relationships between events. In investigations, temporal analysis examines the timing and sequencing of activiti...

The process by which terrorist organizations raise, store, move, and spend funds to support their operations, recruitment, propaganda, and attacks. Terrorist financing may involve both illegal sour...

A brief, investigative detention of a person by law enforcement based on reasonable suspicion of criminal activity, as authorized by Terry v. Ohio.

An individual, group, or organization that conducts or has the intent and capability to conduct malicious activities against targets in cyberspace. Threat actor categories include nation-states, cy...

The formal evaluation of the nature, likelihood, and severity of a potential threat. Threat assessments consider the intent, capability, and opportunity of threat actors to harm a specific target, ...

The proactive and iterative practice of searching through networks and systems to detect advanced threats that have evaded existing automated security controls. Unlike reactive incident response, t...

A standardized system for communicating the current assessed level of terrorist or security threat to the public and government agencies. Threat level systems provide a common framework for underst...

Also known as: Title III, Wire Intercept

Court-authorized electronic surveillance conducted under Title III of the Omnibus Crime Control and Safe Streets Act of 1968. Title III wiretaps require a showing of probable cause, exhaustion of o...

Also known as: The Onion Router, Onion Routing

A free, open-source software and network that enables anonymous communication by directing internet traffic through a worldwide volunteer overlay network of relays. Tor conceals a user's location a...

The process of disguising the proceeds of crime by manipulating international trade transactions through over-invoicing, under-invoicing, multiple invoicing, or misrepresenting the quality or quant...

The methods, techniques, and procedures used in intelligence operations to conduct activities clandestinely and securely. Tradecraft encompasses surveillance detection, clandestine communications, ...

An investigative technique in which a law enforcement officer or agent assumes a false identity to infiltrate a criminal organization, gather evidence, and build cases against suspects. Undercover ...

Digital information that is lost when a device is powered off or restarted. Volatile data includes running processes, network connections, logged-in users, system time, clipboard contents, and the ...

A technology that creates an encrypted tunnel between a user's device and a remote server, masking the user's IP address and protecting data in transit.

A weakness in a system, application, network, or process that could be exploited by a threat actor to gain unauthorized access or cause harm. Vulnerabilities may exist in software code, hardware, c...

A database of known or suspected individuals of concern maintained by law enforcement and intelligence agencies to facilitate screening at borders, airports, and other checkpoints.

The Internet Archive's web archiving service that captures and stores snapshots of web pages over time. Investigators use it to view historical versions of websites, recover deleted content, verify...

Also known as: WMD, CBRN (Chemical, Biological, Radiological, Nuclear)

Weapons capable of causing death or serious injury to a significant number of people through their explosive, incendiary, poisonous, chemical, biological, radiological, or nuclear properties.

The automated extraction of data from websites using software tools or scripts. In investigative contexts, web scraping is used to collect large volumes of publicly available data from forums, soci...

An individual who reports illegal, unethical, or unsafe practices within an organization to internal authorities, regulatory bodies, law enforcement, or the public. Whistleblower protection laws in...

A query-and-response protocol used to look up domain name registration information, including registrant name, organization, contact details, registration and expiration dates, name servers, and th...

A federal crime involving the use of electronic communications (wire, radio, television, internet) to execute a scheme to defraud. Wire fraud carries significant penalties and is one of the most co...

A hardware or software tool that prevents any write operations to a storage device while allowing read access. Write blockers are essential in digital forensics to ensure that the process of examin...

Also known as: 0-Day

A previously unknown software vulnerability that has not been publicly disclosed or patched by the vendor. The term refers to the fact that the vendor has had zero days to develop and release a fix...