INVESTIGATIONS
(CT:DS-450; 09-05-2025)
(Office of Origin: DS/DSS)
12 FAM 221 SCOPE AND RESPONSIBILITY
(CT:DS-450; 09-05-2025)
The Bureau of Diplomatic Security (DS) provides a broad range of investigative services through its Directorates for Domestic Operations (DS/DSS/DO), Threat Investigations and Analysis (DS/DSS/TIA), Cyber and Technology Security (DS/DSS/CTS), and Security Infrastructure (DS/DSS/SI). Regional Security Officers (RSOs) and Overseas Criminal Investigators (OCIs), formerly known as ARSO-Is, work with these investigative offices to conduct and complete investigations overseas.
12 FAM 221.1 Types of Investigative Services
(CT:DS-450; 09-05-2025)
12 FAM 221.1-1 Security-Related Investigations
(CT:DS-450; 09-05-2025)
DS/DO, DS/SI, DS/CTS, and DS/TIA investigate all security-related matters pertaining to personnel and operations of the Department and the Foreign Service. Investigations range from personnel vetting for suitability, fitness, national security, and credentialing, damage assessments of successful network penetrations, failures to safeguard Department information and information systems, unauthorized disclosures of classified information, counterintelligence (CI), counterespionage (CE), protective intelligence and threats, and review of conduct that might reflect adversely on the integrity or trustworthiness of Department personnel.
12 FAM 221.1-2 Investigations for Other Department Elements
(CT:DS-450; 09-05-2025)
The Office of Investigations (DS/DO/INV), Office of Counterintelligence (DS/DO/CI), Office of Protective Intelligence Investigations (DS/TIA/PII), and the Office of Special Investigations (DS/DO/OSI) may provide investigative support for other Department elements such as the Bureau of Global Talent Management (GTM), the Office of Inspector General (OIG), the Bureau of Consular Affairs (CA), the Bureau of Medical Services (MED), the Office of Civil Rights (OCR), and U.S. Diplomatic posts, as requested by a chief of mission (COM).
12 FAM 221.1-3 Investigations for Other U.S. Government Departments and Agencies
(CT:DS-450; 09-05-2025)
DS may honor requests for investigative assistance abroad on behalf of other departments or agencies of the U.S. government pursuant to 22 U.S.C. 3904(3). The other department or agency may need to provide funding for such assistance. (See 4 FAM 840) This assistance should be coordinated through the Criminal Investigative Liaison Branch (DS/CR/CIL) at CrimeLiaison@state.gov. DS/CR/CIL should consult DS/EX and the Office of Legal Adviser when there are funding questions.
12 FAM 221.1-4 Criminal Investigations Abroad
(CT:DS-450; 09-05-2025)
Outside of the United States, DS conducts criminal investigations in accordance with DS statutory authority defined in Title 22 U.S. Code, Section 2709, Title 22 U.S. Code, Section 4802, and 12 FAM 226 as authorized by law.
12 FAM 221.2 Bureau of Diplomatic Security Support Agreements with Other Agencies
(CT:DS-450; 09-05-2025)
DS has memoranda of agreement, memoranda of understanding, and exchanges of letters with the investigative, law enforcement, and security offices of other U.S. government agencies. In some instances, DS may have more than one agreement with an agency depending on the subjects involved. These agreements establish the parameters of cooperation and jurisdiction between the two agencies in specified areas relating to security matters. The Policy and Planning Division (DS/MGT/PPD) coordinates all such agreements for DS and maintains files of all current agreements (see 12 FAM 053.)
12 FAM 221.3 International Criminal Police Organization (INTERPOL) and European Union Agency for Law Enforcement Cooperation (EUROPOL) Relationships
(CT:DS-450; 09-05-2025)
DS/CR/CIL serves as the Bureau of Diplomatic Security’s representative to INTERPOL and Europol. INTERPOL and Europol are liaison channels with foreign law enforcement organizations and European Union member states respectively, that provide an avenue for exchange of information and access to strategic and operational analysis on criminal and terrorist-related intelligence on behalf of the Department.
12 FAM 221.4 DS Personnel Authorized to Conduct Investigations
(CT:DS-450; 09-05-2025)
a. Special agents of the Diplomatic Security Service, credentialed security specialists assigned to the Programs Application Division (DS/IS/APD) and Office of Counterintelligence (DS/DO/CI), and credentialed special investigators and other personnel vetting practitioners (e.g., case managers, adjudicators) assigned to the Office of Personnel Security and Suitability (DS/SI/PSS), conduct investigations as authorized by statute or other authority. DS authorizes special agents to open investigations and provides direction and guidance for conducting those investigations. In some investigations at posts, checks and inquiries may be made by Foreign Service National Investigators (FSNIs) and Criminal Fraud Investigators (CFIs) upon the instructions and guidance of the responsible RSOs or OCIs.
b. The Office of Investigations (DS/DO/INV), the Office of Protective Intelligence Investigations (DS/TIA/PII), the Office of Counterintelligence (DS/DO/CI), and the Office of Special Investigations (DS/DO/OSI) as applicable, instruct, and provide recommendations to all special agents for the conduct of investigations.
c. In some investigations, RSOs may instruct post security officers within their geographic region of their responsibility to conduct limited checks and inquiries on specific cases. Post security officers are not authorized to conduct personnel vetting for suitability, fitness, national security, or credentialing.
12 FAM 221.5 Authorities
(CT:DS-450; 09-05-2025)
a. Statutes, Executive Orders, and regulations contain the authority for DS to conduct investigations, including:
(1) 22 U.S.C. 4802;
(2) 22 U.S.C. 2709; and
(3) E.O. 13526, Chapter 4.
(4) E.O. 12968, as amended.
NOTE: Subchapters 12 FAM 220, 12 FAM 550, 12 FAM 590, and 12 FAM 230 provide citations that explain specific types of investigations.
b. Criminal statutes: DS is authorized to conduct investigations relating to the protection of the Secretary of State, Deputy Secretary of State, and official representatives of the United States Government, in the United States or abroad; protection of United States Government missions abroad; protection of foreign officials, diplomatic personnel, and foreign missions in the United States; suitability for employment; employee security; illegal passport and visa issuance or use; identity theft or document fraud affecting or relating to the programs, functions, or authorities of the Department of State; Federal offenses committed within the special maritime and territorial jurisdiction of the United States (as defined in Title 18 U.S. Code, Section 7(9)), except as such jurisdiction relates to the premises of United States military missions and related residences; and other investigations, as authorized by law. Such investigations may involve allegations of criminal misconduct.
c. Policies: Most administrative investigations involve violations of Department policy or the failure to perform duties required by these policies. Frequently cited FAMs include the 3 FAM (the Department’s employee relations policies), as well as 7 FAM and 9 FAM (the Department’s visa, passport, and consular services policies).
d. The Privacy Act and SORN: 5 U.S.C. 552a, The Privacy Act of 1974 generally protects records about U.S. citizens and LPRs stored in name-retrievable systems by Federal agencies from disclosure except where permissible pursuant to exemptions contained in the Privacy Act and routine uses identified in agency System of Records Notices. Such records maintained by DS are generally governed by the System of Records Notice, STATE-36, “Security Records.”
12 FAM 221.6 Investigative Method
(CT:DS-450; 09-05-2025)
12 FAM 221.6-1 Fairness, Objectivity, and Impartiality
(CT:DS-450; 09-05-2025)
a. All investigations and interviews must be conducted in an impartial manner, to ensure fairness both to the individual being investigated or interviewed and to the Department. Any investigator who knows of circumstances about a given case that might adversely affect their impartiality or objectivity, or may give the perception that the circumstances could adversely affect the quality of the investigation, must make those circumstances known to their immediate supervisor. The supervisor and agent will decide if recusal is appropriate.
b. Investigators must only investigate persons or incidents in DS’s statutory authority. DSS agents serving on detail on a federal task force, e.g., the Joint Terrorism Task Force, may investigate persons or incidents under other federal law enforcement agencies’ authorities, consistent with applicable law and regulation.
Moreover, they must be particularly careful not to investigate persons other than the subject of the inquiry, or to create the impression that they are doing so. Occasionally, in background investigations, interest may legitimately focus on persons other than the main subject under investigation, but there must be direct and reasonable relevance of the other person’s activity to the subject’s general suitability, fitness, or loyalty (see 12 FAM 232).
12 FAM 221.6-2 Accuracy and Completeness
(CT:DS-450; 09-05-2025)
a. Reports of investigation must be complete and accurate. Unsupported conclusions, conflicting statements, or unverified allegations should be investigated further and either corroborated or refuted when the issue in question is pertinent to the purpose of the investigation.
b. In DS personnel vetting for suitability, fitness, national security, and credentialing investigations, when information of a potentially disqualifying nature surfaces, an investigator must probe further to acquire sufficient details to permit a reasonable evaluation. Investigators must investigate any incomplete record of criminal activity to obtain specific details and to determine final disposition of the matter. Investigators may seek guidance from their immediate superiors, when necessary, in furtherance of a complete and objective investigation.
c. To obtain maximum effectiveness, investigations must be well planned, carefully executed, and properly reported in a timely manner. Upon receipt of a request for a personnel investigation or collateral lead, the investigators must:
(1) Study the basic material, including any special instructions;
(2) Identify the objectives of the investigation and essential issues involved; and
(3) Determine the facts required to resolve them.
d. Investigators must abide by and follow any legal constraints relevant to an investigation. This includes any criminal or administrative due process safeguards with respect to either subjects or sources.
12 FAM 222 CRIMINAL INVESTIGATIONS DIVISION
(CT:DS-450; 09-05-2025)
12 FAM 222.1 Criminal Investigative Liaison Branch (DS/CR/CIL)
(CT:DS-450; 09-05-2025)
DS/CR/CIL coordinates investigations requested by:
(1) The Department’s Office of Inspector General (OIG);
(2) The Inspector General (IG) of any executive department having personnel at U.S. posts abroad;
(3) Other Federal, State, and local law enforcement agencies, which have primary investigative jurisdiction, but for which investigative activity is required outside the United States;
(4) A Federal agency or department having primary investigative responsibility for other criminal violations (including waste, fraud, and mismanagement cases, which fall under OIG jurisdiction); and
(5) The Department of Justice (DOJ), unless the specific case falls under the narrower purview of specialized DS offices (e.g., DS/DO/OSI or DS/DO/CI).
12 FAM 222.2 Diplomatic Security (DS) and Inspector General Relationship
(CT:DS-450; 09-05-2025)
a. Under 1 FAM 053.2-5, DS and other Department personnel shall provide assistance and information requested by the OIG.
b. In accordance with 22 U.S.C. 3929(c)(6) and 1 FAM 053.2-3 the Assistant Secretary for DS is required to submit to the Inspector General a report of the following allegations, within 5 business days of learning of the allegation:
(1) Waste, fraud, or abuse in a Department program or operation;
(2) Criminal or serious misconduct on the part of a Department employee at the FS-1, GS-15, GM-15 level, or higher;
(3) Criminal misconduct on the part of a Department employee; and
(4) Serious, noncriminal misconduct on the part of a Department employee who is authorized to carry a weapon, make arrests, or conduct searches, such as conduct that, if proved, would constitute perjury or material dishonesty, warrant suspension as discipline for a first offense, or result in loss of law enforcement authority.
12 FAM 222.3 Inquiry at Post Regarding Counterfeit Currency
(CT:DS-450; 09-05-2025)
a. Upon receiving an allegation of counterfeit U.S. currency overseas, the RSO should first communicate and coordinate with the U.S. Secret Service (USSS).
b. USSS requests for additional investigative activities to the RSO should be directed to DS/CR/CIL for coordination. RSO should generally not initiate investigations for USSS without coordinating and receiving approval from DS/CR/CIL. In cases where USSS is at Post, RSOs should notify CIL of the investigation and any coordination required in the U.S. RSOs should coordinate any questions or concerns to their International Programs (DS/DSS/IP) or High Threat Programs (DS/DSS/HTP) desk officer and DS/CR/CIL.
c. If there are allegations of counterfeit currency related to a U.S. employee cleared under Chief of Mission authority
12 FAM 223 OVERSEAS CRIMINAL INVESTIGATIONS DIVISION (DS/INV/OCI)
(CT:DS-450; 09-05-2025)
12 FAM 223.1 Responsibilities
(CT:DS-450; 09-05-2025)
The Overseas Criminal Investigations Division (DS/INV/OCI) plays an instrumental role in detecting, disrupting, and dismantling transnational criminal networks by investigating visa and passport fraud, and other crimes defined in Title 22 U.S. Code, Section 2709(a)(1), via its global network of overseas criminal investigators. DS/INV/OCI is responsible for managing the efforts of special agents and support personnel assigned to Overseas Criminal Investigations Units (OCIUs) providing policy, investigative, and budgetary guidance to OCIU personnel, and advises Regional Security Officers (RSOs) and consular chiefs on investigative support matters in relation to OCIU responsibilities and the Criminal Investigative Liaison program. DS/INV/OCI works closely with the Bureau of Consular Affairs (CA) Office of Fraud Prevention Programs (CA/FPP) and other bureaus, offices, and agencies on international investigative matters and coordinates sensitive and complex investigations being worked by OCIUs, with the headquarters office responsible for the case subject matter (e.g. DS/INV/CR, DS/TIA/PII, DS/DO/OSI, etc.). DS/INV/OCI monitors the progress and accomplishments of each OCIU and reports the results to the Office of Investigations (DS/DO/INV).
See 12 FAH-4, H-700, Overseas Criminal Investigations.
12 FAM 224 CONSULAR AFFAIRS-RELATED INVESTIGATIONS: PASSPORT, VISA, AND ISSUANCE FRAUD
(CT:DS-417; 09-20-2023)
12 FAM 224.1 Diplomatic Security Responsibilities
(CT:DS-450; 09-05-2025)
12 FAM 224.1-1 General
(CT:DS-450; 09-05-2025)
DS special agents’ law enforcement authorities are described in 22 U.S.C. 2709 and 22 U.S.C. 4802.
12 FAM 224.1-2 Criminal Investigations Division (DS/INV/CR) Responsibility
(CT:DS-450; 09-05-2025)
DS/INV/CR responsibilities are defined in 1 FAM 262.4-2(C).
12 FAM 224.1-3 Overseas Criminal Investigations Division (DS/INV/OCI) Responsibility
(CT:DS-450; 09-05-2025)
DS/INV/OCI facilitates DS/DO/INV’s mission by providing program management, oversight, and analytical support to Overseas Criminal Investigators deployed worldwide. DS/INV/OCI responsibilities are defined in 1 FAM 262.4-2(D).
12 FAM 224.1-4 Role of DS Field Offices and RSOs
(CT:DS-450; 09-05-2025)
DS field offices and RSOs are authorized to conduct criminal and administrative investigations. Refer to 12 FAH-4, The Investigations Handbook, for DS standards and procedures on DS investigations.
12 FAM 224.2 Passport Fraud Investigations
(CT:DS-450; 09-05-2025)
12 FAM 224.2-1 Authorities
(CT:DS-450; 09-05-2025)
a. DS special agents investigate passport fraud for the Department in accordance with Title 22 U.S. Code, Section 2709 and Title 22 U.S. Code, Section 4802.
b. CA/PPT exercises the Secretary’s authority to revoke or deny any U.S. passport. DSS special agents should review the passport regulations at 8 FAM and 22 CFR Part 51; the following regulations are of particular relevance to the conduct of passport fraud investigations::
(1) 22 CFR 51.60 - Denial and restriction of passports;
(2) 22 CFR 51.62 - Revocation or limitation of passports and cancellation of Consular Reports of Birth Abroad;
(3) 22 CFR 51.66 - Surrender of passport and/or Consular Report of Birth Abroad; and
(4) 22 CFR 51.7 - Passport property of the U.S. Government;
(5) 8 FAM 804.1-1 – Transmittal of Passport Revocation and Consular Report of Birth Abroad (CBRA) Cancellation Requests.
12 FAM 224.2-2 Recovery and Seizure of Passports
(CT:DS-450; 09-05-2025)
a. 22 CFR 51.7(a) states that a U.S. passport at all times remains the property of the United States and must be returned to the U.S. Government upon demand.
b. CA/FPP or CA/PPT may request DS confiscate a passport that CA/PPT issued. See 12 FAH-4 H-124.2. The Department’s authorized representative (usually the case agent) is authorized to confiscate a revoked passport. If the bearer refuses to do so, CA/PPT may invalidate the passport by notifying the bearer in writing of the invalidation (22 CFR 51.4).
c. Only CA/PPT/S/A may revoke U.S. passports. DSS agents may lawfully seize a U.S. passport pursuant to:
(1) A search warrant or other court order;
(2) Incident to arrest, when the passport has evidentiary value to an underlying crime; ;
(3) A lawful, warrantless seizure pursuant to a warrant exception when probable cause exists that the U.S. passport itself is evidence of a crime;
(4) The express consent of the subject; or
If CA intends to revoke the passport of a subject of a DS investigation, and DS has presented the case to DOJ for prosecution, the DS special agent must notify the prosecutor.
d. All property acquired by DS will be collected and treated as though it were evidence to ensure proper handling until such determination is made. Special agents may only acquire property in accordance with the law as it relates to searches and seizures, judicial forfeiture, and by voluntary delivery by the owner. Occasionally, items may be seized or taken into custody for safekeeping (i.e., high value items, illegal drugs, firearms and weapons, etc.). Special agents are not authorized to acquire property in any other manner other than by direction of CA to recover U.S. passports.
e. The procedural aspects of passport seizure by a DS special agent are contained in 12 FAH-4 H-120. That section contains important information as well as relevant timelines for notification to the Department of the seizure.
f. For more information on passport revocations, see 8 FAM 804, Revocation.
g. DS may receive recovered U.S. passports from different sources, such as local law enforcement, local governments, airlines, and transportation centers. To maintain the integrity of the U.S. passport as a secure travel document, CA/PPT makes every effort to account for the final disposition of all U.S. passports. Therefore, DS should mail all found or recovered (not seized or confiscated) U.S. passports to CA/PPT at:
|
U.S. Department of State Office of Adjudication (CA/PPT/S/A) 44132 Mercure Cir PO Box 1199 Sterling, VA 20166-1199 |
NOTE: In instances where fraud is suspected or has been established, DS special agents should coordinate with CA/FPP.
12 FAM 224.3 Visa Fraud Investigations
(CT:DS-450; 09-05-2025)
12 FAM 224.3-1 Authorities
(CT:DS-450; 09-05-2025)
DS special agents investigate visa fraud for the Department in accordance with Title 22 U.S. Code, Section 2709 and Title 22 U.S. Code, Section 4802. Refer to 12 FAH-4, The Investigations Handbook, for standards and procedures for DS visa fraud investigations.
12 FAM 224.4 Consular Malfeasance Investigations
(CT:DS-450; 09-05-2025)
12 FAM 224.4-1 General
(CT:DS-450; 09-05-2025)
a. Investigations of alleged consular malfeasance by Department employees fall within the purview of the Criminal Investigations Division (DS/INV/CR), which may request participation by the Overseas Criminal Investigations Division (DS/INV/OCI).
b. Some activities that fall within this area are violations of Federal criminal law whereas others constitute violations of Federal regulations and/or Department administrative and procedural policy.
c. DS/INV/CR is authorized to delegate, assign, direct, coordinate, and review for sufficiency all investigations of consular malfeasance. During the course of an official investigation, DS/INV/CR special agents or special agents acting under DS/INV/CR's authorization and direction may:
(1) Conduct voluntary interviews with employees, or with authorization from the Deputy Assistant Director for the Office of Investigations (DS/DO/INV) and the Department’s Office of the Legal Adviser (L/M/DS), require an employee to participate in a compelled interview to respond orally and/or in writing to material and relevant questions related to the performance of their official duties and/or to any questions related to matters within DS/INV/CR’s investigative mandate;
(2) Require employees to produce and/or grant access to all official records and related documents or material;
(3) Require employees to produce and/or grant access to all U.S. Government property including all communications equipment;
(4) Require employees to appear at a location designated by the case agent assigned to a DS/INV/CR investigation, in connection with an official inquiry;
(5) Direct employees to maintain the confidentiality (through use of Form DS-7678) of any information possessed or coming to the attention of the employee concerning DS/INV/CR inquiries to the extent that such directives neither prohibits nor infringes on the employee’s legal rights;
(6) Carry special protective equipment (SPE) in all Department locations in the performance of their official duties; and
(7) As authorized under 5 U.S.C. 303, to administer an oath and take sworn testimony during the course of an investigation.
12 FAM 224.4-2 Consular Malfeasance Investigations Assignment and Control
(CT:DS-450; 09-05-2025)
DS/INV/CR and DS/INV/OCI, as applicable (see 12 FAM 224.3-1 above), have responsibility for initiating, directing, and closing all investigations of cases of consular malfeasance. Special agents should rely on guidance and direction from DS/INV/CR in the conduct of consular malfeasance investigations.
12 FAM 224.4-3 Controls and Administrative Guidance
(CT:DS-450; 09-05-2025)
12 FAM 224.4-3(A) “Need to Know” Policy
(CT:DS-450; 09-05-2025)
Because consular malfeasance cases may involve allegations of criminal activity or other misconduct by Department employees, special agents should limit dissemination of the information. Limit knowledge of the initial allegations and subsequent investigative efforts only to individuals with a “need to know.” This policy protects both the integrity of the investigation and the privacy of the employee concerned.
12 FAM 224.4-3(B) Release of Case Documents
(CT:DS-450; 09-05-2025)
DS/INV/CR may approve the release of any documentation pertaining to a consular malfeasance investigation in accordance with Department SORNs.
12 FAM 224.4-3(C) Report of Allegations
(CT:DS-450; 09-05-2025)
All DS offices and agents, including those assigned overseas, must report every allegation of consular malfeasance, including those identified by another U.S. law enforcement agency, directly to DS/INV/CR. DS/INV/CR is responsible for notifying, when appropriate, CA’s Consular Integrity Division (CA/FPP/CID).
12 FAM 225 (U) PERSONNEL INVESTIGATIONS
(CT:DS-417; 09-20-2023)
12 FAM 225.1 (U) Objective
(CT:DS-417; 09-20-2023)
(U) The main objective of a personnel security investigation is to establish the individual’s general character, integrity, and trustworthiness, as demonstrated by past conduct and acceptance of responsibility. This will permit an assessment of the probability that the individual will perform their duties faithfully and responsibly, and will hold in confidence, even under adverse circumstances, matters of official business which require discretion (see 12 FAM 321.3, Policy).
12 FAM 225.2 (U) Scope
(CT:DS-417; 09-20-2023)
(U) All U.S. Government positions are designated in terms of their national security sensitivity to assure appropriate screening under E.O. 10450 (see 12 FAM 230, Personnel Security). A full-field background investigation is required for sensitive positions in which an individual, either deliberately or through negligence, could adversely affect the security interests of the United States. Because of the potential risk to national security, it is essential that sensitive positions be filled only by persons of demonstrated loyalty and trustworthiness. The absence of disqualifying information about an individual is insufficient to make a positive determination about a person’s eligibility for a sensitive position; enough positive information must be known about the individual to lead a reasonable person to conclude that the individual under investigation can be trusted with responsibility for matters of more than routine consequence to the nation, and the individual will maintain that trust in the face of unusual pressures or hazards. The purpose of the background investigation is to acquire the information necessary and relevant for such a determination (see 12 FAM 233, Eligibility for Security Clearance).
12 FAM 225.3 (U) Authority
(CT:DS-417; 09-20-2023)
(U) Authorities:
(1) (U) Executive Order 10450 – Security Requirements for Government Employees;
(2) (U) Executive Order 12968 – Access to Classified Information;
(3) (U) Executive Order 12829 – National Industrial Security Program;
(4) (U) Executive Order 13467 - Reforming Processes Related to Suitability for Government Employment, Fitness for Contractor Employees, and Eligibility for Access to Classified National Security Information;
(5) (U) Executive Order 13488 - Granting Reciprocity on Excepted Service and Federal Contractor Employee Fitness and Reinvestigating Individuals in Positions of Public Trust
(6) (U) Executive Order 13526 - Classified National Security Information;
(7) (U) Executive Order 13587 - Structural Reforms to Improve the Security of Classified Networks and the Responsible Sharing and Safeguarding of Classified Information;
(8) (U) Adjudicative Guidelines for Determining Eligibility for Access to Classified Information issued pursuant to E.O. 12968;
(9) (U) Homeland Security Presidential Directive 12 (HSPD-12) “Policy for a Common Identification Standard for Federal Employees and Contractors”;
(10) (U) Presidential Policy Directive (PPD-19) “Protecting Whistleblowers with Access to Classified Information”;
(11) (U) Office of Management and Budget (OMB) Memo on Reciprocity, December 12, 2005;
(12) (U) 5 CFR 731 – OPM part 731, Suitability; and
(13) (U) 5 U.S.C. 1104(a)(2) – Delegation of Authority for Personnel Management.
12 FAM 225.4 (U) Responsibilities
(CT:DS-417; 09-20-2023)
(U) The Office of Personnel Security and Suitability (DS/SI/PSS) directs the conduct of personnel security investigations of employees, applicants, certain contractors, and others seeking access to Department information and/or facilities. It also assists in conducting or directing the conduct of such civilian investigations abroad for other Federal agencies.
12 FAM 225.4-1 (U) Other Agency Requests for Personnel Investigations
(CT:DS-417; 09-20-2023)
(U) DS/SI/PSS is the central authorizing office for requests by other agencies for personnel investigations requiring field inquiries, employment verification, and source interviews by RSOs. DS/SI/PSS does not usually consider routine requests for record checks, such as police, embassy, credit, telephone subscriber information, etc., as constituting a personnel investigation (see 12 FAM 232.1). By mutual agreement, requests from other Federal law enforcement agencies for record checks on employees may be made directly to RSOs.
12 FAM 225.4-2 (U) Investigations for Local Guard Programs
(CT:DS-417; 09-20-2023)
(U) As a matter of policy, RSOs are responsible for conducting background checks of prospective guard personnel. In some cases, the RSO has tasked commercial contractors to conduct portions of the investigation. The RSO must in all cases be satisfied with the effectiveness of the contractor investigation. RSOs themselves must complete local police checks and must review files of appropriate agencies at post. The RSO must keep the results of these investigations for subsequent inspection by DS supervisory personnel (see 12 FAH-7 H-130, Types of Local Guard Programs).
12 FAM 225.4-3 (U) DS Personnel Authorized to Conduct Personnel Investigations
(CT:DS-417; 09-20-2023)
(U) DS special agents and contract special investigators may conduct investigations domestically. RSOs and special investigators may conduct investigations abroad. Post security officers, with the instruction and guidance of RSOs, may also conduct limited checks and inquiries in some applicant-type investigations.
12 FAM 226 (U) DS/DO/OSI
(CT:DS-417; 09-20-2023)
12 FAM 226.1 (U) Scope and Authority
(CT:DS-417; 09-20-2023)
a. (U) DS/DO/OSI has the primary responsibility within the Department for administrative and operational case control of non-routine investigations that do not fall within the purview of other DS investigative offices and divisions. OSI is specifically charged with conducting and/or coordinating the following investigations:
(1) (U) Employee and contractor misconduct: DS/DO/OSI conducts investigations into criminal and administrative misconduct committed by Department employees and contractors stationed domestically, and criminal and administrative misconduct by all executive branch U.S. Government employees and contractors under chief-of-mission (COM) authority. Misconduct investigations include, but are not limited to, investigations concerning possible violations of:
(a) (U) Local, State, and Federal law;
(b) (U) The Foreign Affairs Manual and Handbooks, Department policies, and COM policies; and
(c) (U) Other incidents that may impact an employee’s continued eligibility and suitability for continued employment, security clearance, and access to classified information.
(2) (U) Extraterritorial criminal investigations: DS/DO/OSI conducts criminal investigations into violations of U.S. extraterritorial laws involving executive branch U.S. Government employees, contractors, and dependents falling under COM authority in accordance with 18 U.S.C. 7, Special Maritime and Territorial Jurisdiction (SMTJ), and 22 U.S.C. 2709(a). In this capacity, DS/DO/OSI conducts investigations committed by and against executive branch U.S. Government employees, contractors, and dependents, as well as crimes occurring within U.S. diplomatic installations and housing abroad. Typical extraterritorial investigations include, but are not limited to:
(a) (U) Assault;
(b) (U) Sexual assault (as specified in 3 FAM 1700);
(c) (U) Child abuse and neglect;
(d) (U) Domestic Violence and stalking;
(e) (U) Homicide, manslaughter, and involuntary manslaughter;
(f) (U) Missing persons;
(g) (U) Possession, manufacturing, and/or transport of child pornography;
(h) (U) Violations of the Military Extraterritorial Jurisdiction Act (MEJA); and
(i) (U) Theft or destruction of U.S. Government property.
(3) (U) Use of force and discharge of a firearm: DS/DO/OSI conducts official investigations into the discharge of firearms and/or the use of force by Department employees and contractors domestically and all executive branch U.S. Government employees and contractors falling within COM authority abroad;
(4) (U) Family advocacy investigations: DS/DO/OSI conducts investigations concerning domestic violence, child abuse, and child neglect in coordination with the Department's family advocacy program as specified in 3 FAM 1810;
(5) (U) Death investigations: DS/DO/OSI conducts death investigations in coordination with the Bureau of Medical Services (MED) and the Armed Forces Medical Examiner System (AFMES) as specified in 12 FAM 227; and
(6) (U) Information and physical security investigations: DS/DO/OSI conducts official investigations into the loss or unauthorized disclosure of classified information.
b. (U) The Department, DS, or DOJ may request DS/DO/OSI consider conducting official investigations that fall outside the scope of other investigative offices and divisions within DS or that are declined or referred by OIG.
c. (U) DS/DO/OSI is authorized to delegate, assign, direct, coordinate, and review for sufficiency all investigations of employee misconduct. During the course of an official investigation, DS/DO/OSI agents or agents acting under DS/DO/OSI's authorization and direction may:
(1) (U) Conduct voluntary interviews with employees, or with authorization from DS/DSS/DO and DS Legal (L/M/DS), require an employee to participate in a compelled interview to respond orally and/or in writing to material and relevant questions related to the performance of their official duties and/or to any questions related to matters within DS/DO/OSI’s investigative mandate;
(2) (U) Require employees to produce and/or grant access to all official records and any other related documents or material;
(3) (U) Require employees to produce and/or grant access to all U.S. Government property including all communications equipment;
(4) (U) Require employees to appear at a location designated by the case agent assigned to a DS/DO/OSI investigation, in connection with an official inquiry;
(5) (U) Direct employees to maintain the confidentiality (through use of Form DS-7678) of any information possessed or coming to the attention of the employee concerning DS/DO/OSI inquiries to the extent that such directives neither prohibits nor infringes on the employee’s right to legal counsel or freedom of speech;
(6) (U) Carry special protective equipment (SPE) in all Department locations in the performance of their official duties; and
(7) (U) As authorized under 5 U.S.C. 303, to administer an oath and take sworn testimony during the course of an investigation involving employee impropriety or misconduct.
12 FAM 226.2 (U) Procedures
(CT:DS-417; 09-20-2023)
a. (U) DS/DO/OSI controls and supervises all special investigations. Accordingly, all matters relating to a special investigation must be transmitted to DS/DO/OSI within 72 hours, unless otherwise specified by Department policy or Federal law, to ensure DS/DO/OSI fulfills its investigative mandate.
b. (U) The authority for officially opening a special investigation and documenting the investigation in the DS Information Management System (IMS) lies solely with DS/DO/OSI. Cases not originating from DS/DO/OSI are not considered formally “opened” until DS/DO/OSI receives appropriate written notification and assigns an IMS case number.
c. (U) Department management officials and employees receiving information and/or allegations that may merit “Special Investigations” status must submit the information to DS/DO/OSI for preliminary assessment, research, and guidance as delineated in 3 FAM 4139.13 and 3 FAM 4322. However, Department management officials may conduct limited inquiries:
(1) (U) If they believe that additional information is needed for DS/DO/OSI to make a decision to open a case; and
(2) (U) If safety and security concerns require immediate action.
d. (U) From time to time there may be situations where insufficient information exists to formally open a DS/DO/OSI case. In such situations, DS/DO/OSI may authorize a preliminary inquiry (PQ) and assign an IMS PQ number to determine whether or not additional investigation is warranted.
e. (U) In the event that the DS/DO/OSI preliminary inquiry identifies the alleged misconduct as an employee performance issue, or relatively minor infraction DS/DO/OSI can officially close the inquiry with a referral to the appropriate supervisory official to address the matter in accordance with 3 FAM 4322.3.
f. (U) Only DS/DO/OSI can officially close and document a case in IMS-Classified. The DS/DO/OSI supervisor will review the completed report of investigation (ROI) and determine whether further investigative action is needed.
12 FAM 226.3 (U) Policies for Employee and Contractor Misconduct Investigations
(CT:DS-417; 09-20-2023)
12 FAM 226.3-1 (U) Security Clearance Implications of Misconduct
(CT:DS-417; 09-20-2023)
a. (U) Employee misconduct is a concern of DS/DO/OSI, particularly when an employee occupies a sensitive position or has access to classified information. Other Department offices may be involved or have an interest in certain categories of employee misconduct; for example, alcohol and drug abuse while primarily a medical issue may also pose potential security concerns. The procedures in 3 FAM 4320 delineate the appropriate MED and DS responsibilities in such cases.
b. (U) Other instances of personal misconduct, including but not limited to malfeasance, normally handled in other channels including the OIG, may also require adjudicative review by the Adverse Actions Division (DS/PSS/AA). Management officials or employees who become aware of such issues should coordinate with the appropriate post or Department supervisors and report to DS/DO/OSI any information that may impact continued eligibility and access to classified information.
12 FAM 226.3-2 (U) Marine Security Guards
(CT:DS-417; 09-20-2023)
a. (U) Marine security guards (MSGs) are under chief-of-mission (COM) operational direction, coordination, and supervision at each post where they are assigned (see 12 FAM 430). The COM exercises this responsibility through the RSO. Since the Marine Corps retains the sole responsibility for the conduct and discipline of all Marines assigned for duty with the Department, defer all such matters to the commanding officer, Marine Corps embassy security group (MCESG) for the administration of military justice.
b. (U) Criminal and counterintelligence investigations of Department of the Navy (DON) personnel who are currently serving with the Department will normally be conducted by special agents of the Naval Criminal Investigative Service (NCIS). If requested by DS/DO/OSI, such investigations may be conducted jointly with NCIS. The authority of NCIS special agents and military detachment commanders conducting preliminary inquiries and investigations is limited to MSG or DON personnel. Interviews will not be conducted with locally employed staff (LE staff) or other mission personnel without the express concurrence of the RSO. Criminal and administrative investigations by DS/DO/OSI of other employees, requiring interviews with MSGs, may be conducted jointly with NCIS.
12 FAM 226.3-3 (U) Personnel of Other Agencies
(CT:DS-417; 09-20-2023)
(U) DS/DO/OSI may conduct official investigations into criminal and administrative misconduct involving the employees and contractors of other executive branch agencies that are under COM authority. When DS/DO/OSI identifies another agency's employee as the subject of a criminal or administrative investigation, DS/DO/OSI may coordinate investigative efforts with that agency's Inspector General (IG) and/or that agency’s appropriate internal investigative or security office. At the conclusion of the investigation, DS/DO/OSI will provide that agency's IG, and/or that agency’s appropriate internal investigative or security office with a copy of the report of investigation (ROI).
12 FAM 226.3-4 (U) Locally Employed Staff (LE Staff) and Third-Country National Contractors
(CT:DS-439; 04-23-2025)
a. (U) The majority of administrative and criminal misconduct cases involving locally employed staff (LE staff) and third-country national contractors can normally be investigated by RSOs at post and may not require DS/DO/OSI notification. The RSO, pursuant to COM authority, conducts appropriate investigations of violations of Department and COM policies, as well as violations of Federal law and violations of the laws of the receiving state by LE staff and third-country national contractors. RSO notification of these investigations to DS/DO/OSI is required when LE staff and third-country national contractors commit criminal violations against U.S. citizens, or there is an interconnection to misconduct by Department employees and contractors or executive branch U.S. Government employees and contractors who fall under COM authority.
b. (U) RSOs shall investigate complaints or allegations against LE staff and third-country nationals or contractors employed at U.S. missions abroad by other agencies in the same manner as investigations of Department LE Staff and U.S. or third-country national contractors. The RSO must inform the COM and the appropriate senior official of the employing agency at post (or at the agency’s headquarters, if there is no representative at post) of the initiation and progress of any such investigation.
12 FAM 226.3-5 (U) Investigative Findings
(CT:DS-450; 09-05-2025)
a. (U) In cases involving employee or contractor administrative misconduct, DS/DO/OSI will provide an investigative finding at the conclusion of the ROI. The investigative finding will detail the allegation of misconduct, provide an investigative conclusion, and enumerate the evidence to support the conclusion. The legal standard for the investigative conclusion in an administrative investigation will be a preponderance of the evidence. The possible investigative conclusions are as follows:
(1) (U) Substantiated: The allegation is supported by a preponderance of evidence;
(2) (U) Unsubstantiated: The investigation did not uncover sufficient evidence to prove the allegation(s). This definition includes instances where an investigation would be deemed inconclusive, where there is insufficient evidence to either prove or disprove the allegation(s);
(3) (U) Exonerated: The incident or acts alleged occurred; however, the employee’s actions were justified, lawful, and proper; and
(4) (U) Unfounded: The investigation conclusively proved that the act alleged did not occur.
b. (U) When DS/DO/OSI substantiates an allegation against an employee or contractor of the Department, DS/DO/OSI will forward a copy of the ROI to the Bureau of Personnel and Training, Employee Relations, Accountability and Discipline Division (PERT/ER/AD), the Office of Personnel Security and Suitability (DS/SI/PSS), and other offices, as appropriate.
12 FAM 226.3-6 (U) Employee Conduct Investigations
(CT:DS-417; 09-20-2023)
a. (U) Within the context of the Department’s responsibility for the conduct of foreign affairs, an employee’s personal traits or practices manifesting in misconduct that may violate Department Standards of Conduct (as delineated in 3 FAM 4138, 3 FAM 4370, and 3 FAM 4540), or that is of a notoriously disgraceful nature (3 FAM 4139.14), may be relevant to evaluating the employee’s stability, character, discretion, and susceptibility to undue influence or duress.
b. (U) In the event a DS/DO/OSI investigation substantiates allegations that an employee’s misconduct is of potentially exploitable nature, with the effect that the employee could possibly be subject to undue influence or duress, and susceptible to blackmail or coercion, DS/DO/OSI will refer the matter to DS/SI/PSS for appropriate adjudicative review and action (see 12 FAM 232.3).
c. (U) In instances when a DS/DO/OSI investigation identifies management issues and/or systemic deficiencies, DS/DO/OSI will review, document, and refer the matters via a management review referral (MRR) to the Domestic Operations (DS/DO) Directorate. The MRR will include a brief summary of the precipitating investigation and the pertinent management issues and/or systemic deficiencies identified during the DS/DO/OSI investigation.
d. (U) If, at any time during the course of an investigation, DS/DO/OSI case agents determine that probable cause has been established indicating that a Federal criminal offense has been committed, the investigator must present the case for prosecutorial review to DOJ. In the event the DS/DO/OSI investigation determines that probable cause has been established indicating a potential violation of local and/or State law has been committed, notification of the appropriate local/State authorities is required.
12 FAM 226.4 (U) Policies for Extraterritorial Criminal Investigations
(CT:DS-417; 09-20-2023)
12 FAM 226.4-1 (U) Mandatory Notification Regarding Employee, Contractor, or Dependent Criminal Misconduct
(CT:DS-417; 09-20-2023)
(U) Department management officials, employees, contractors, subcontractors, and grantees at all levels overseas who learn of facts that give reason to suspect criminal misconduct involving U.S. Government employees, dependents, or contractors must report the criminal misconduct to the RSO, who must then notify DS/DO/OSI via telephone within 24 hours and follow up the telephonic communication with a DSX channel cable to DS/DO/OSI. The DSX channel cable should include the subject's identity and the basic facts currently known to the RSO (see 3 FAM 4139.13 and 3 FAM 4322).
12 FAM 226.4-2 (U) Coordination with the Department of Justice
(CT:DS-417; 09-20-2023)
(U) DS/DO/OSI will serve as the DOJ liaison regarding the investigation of extraterritorial crimes involving Department equities. It will refer cases for prosecution or investigative assistance to DOJ or the appropriate USAO as needed. Case management efforts should limit the number of personnel required to travel to the United States whenever possible, minimizing the impact on post security programs.
12 FAM 226.5 (U) Family Advocacy Program
(CT:DS-417; 09-20-2023)
(U) Special agents assigned to DS/DO/OSI will serve as the DS representatives to the Family Advocacy Committee (FAC) and conduct family advocacy investigations in conjunction with the RSO as defined in 3 FAM 1810.
12 FAM 226.6 (U) Homicide, Suicide, Mysterious Death, or Disappearance
(CT:DS-417; 09-20-2023)
(U) Any homicide, suicide, attempted suicide, unexplained or mysterious death, or disappearance of an employee or contractor occupying a sensitive position may have security implications and/or an adverse impact on Department operations. Domestically, executive directors should report mysterious deaths or disappearances to DS/DO/OSI for potential investigation in conjunction with Federal, State, or local authorities. Deaths originating overseas will be investigated by DS/DO/OSI and the RSO in accordance with 12 FAM 227.
12 FAM 226.7 (U) Information Security Investigations Policy
(CT:DS-417; 09-20-2023)
12 FAM 226.7-1 (U) Objectives of Information Security Investigations
(CT:DS-417; 09-20-2023)
(U) The objective of security actions following a loss or probable compromise of classified information is to determine the possible harm to national security. The formal analysis of this information is called a damage assessment. The Bureau of Intelligence and Research’s Office of Counterintelligence and Counselor Support (INR/CCS) conducts all damage assessments for the Department.
12 FAM 226.7-2 (U) Unauthorized Disclosures of Classified Information
(CT:DS-417; 09-20-2023)
(U) Generally, all information security incidents are investigated and administratively processed by the Application Programs Division (DS/IS/APD), in accordance with 12 FAM 550. DS/DO/OSI reviews allegations of serious unauthorized disclosures of classified information to determine if further administrative or criminal investigation is warranted.
12 FAM 226.7-3 (U) Loss, Unauthorized Disclosure, or Serious Compromise of Classified Information
(CT:DS-417; 09-20-2023)
(U) In instances of loss, unauthorized disclosure, or compromise of classified or administratively controlled documents and information, DS/DO/OSI will review the matter to determine whether additional administrative and/or criminal investigation is warranted. In those cases accepted for investigation by DS/DO/OSI, the office will:
(1) (U) Investigate the loss;
(2) (U) Preliminarily assess or coordinate the assessment of the resultant damages;
(3) (U) Identify the contributing or responsible persons and procedures;
(4) (U) Make a detailed formal report of the investigation upon completion of the investigation; and
(5) (U) Refer criminal cases to DOJ’s National Security Division and/or administrative cases to State's Bureau of Human Resource’s Conduct Suitability and Discipline Division (HR/ER/CSD), the Office of Personnel Security and Suitability (DS/SI/PSS), and DS/IS/APD for review.
12 FAM 226.7-4 (U) Unauthorized Disclosure of Sensitive Information
(CT:DS-417; 09-20-2023)
a. (U) Each agency is responsible for safeguarding its classified information. An unauthorized disclosure or leak is the compromise of classified or administratively controlled information to another person not associated with a foreign government or intelligence service.
b. (U) DS/DO/OSI is the lead DS investigative office responsible for unauthorized disclosure investigations. Regardless of where the incident occurred, notify DS/DO/OSI of the compromise of classified information as soon as possible so an investigation can be initiated, if warranted.
c. (U) If a media leak or other unauthorized disclosure is made of classified or administratively controlled information, the originating agency conducts an initial investigation to determine if any other agency was on distribution for or had access to the information. Should the initial inquiry disclose that another agency had access to the information, the originating agency will request that the receiving agency conduct an appropriate investigation. Unauthorized disclosure of national security information may be a violation of Federal criminal statutes and violators may be subject to prosecution by the DOJ. Investigations of unauthorized disclosures of non-national security material will be conducted according to administrative guidelines. Violators are subject to administrative sanctions up to and including separation from the Federal service (see 3 FAM 4300).
12 FAM 227 (U) Death Investigations
(CT:DS-417; 09-20-2023)
12 FAM 227.1 (U) Purpose
(CT:DS-417; 09-20-2023)
a. (U) The purpose of this section is to ensure that the Department appropriately investigates all deaths of U.S. citizen employees assigned abroad under chief-of-mission (COM) authority, and their eligible family members, using well-established medico-legal techniques and protocols to establish a cause and manner of death.
b. (U) Conducting an investigation into a death is one of the most difficult and important services DS, DS/DO/OSI and the RSO perform, requiring sensitivity, tact, and a high degree of competence, particularly when death occurs under unusual circumstances. DS and RSOs must deal sympathetically and effectively with the deceased’s surviving spouse, next-of-kin, and other family members or friends who experience emotional stress and are often unprepared to make important decisions in an atmosphere of urgency. DS must conduct these investigations in a swift and professional manner, understanding that prompt repatriation of the remains is a high priority for the family.
c. (U) The Department is committed to thoroughly investigating the death of any U.S. citizen employees assigned abroad and their eligible family members, as defined in 14 FAM 511.3, including deaths that result in Accountability Review Board (ARB) actions (see 12 FAM 030). In cases of criminal conduct, the Department will work to ensure that all perpetrators are brought to justice.
d. (U) Though focused on DS investigative responsibilities via DS/DO/OSI, in the event of a death of a U.S. citizen employee of the Department assigned abroad under COM authority, or their eligible family members, this section relates to responsibilities of other Department bureaus and offices and thus should be read in connection with 3 FAM 2550, 3 FAM 3650, and 16 FAM 133.
12 FAM 227.2 (U) Applicability and Scope
(CT:DS-417; 09-20-2023)
(U) This section applies to the deaths of the following:
(1) (U) All U.S. citizen employees of the U.S. Government executive branch assigned abroad or on temporary official duty abroad under COM authority (except those under the command of an area military commander or on the staff of an international organization). For purposes of this section, persons under personal services contracts (PSCs) or personal services agreements (PSAs) with a Federal agency are considered to be employees of the U.S. Government; and
(2) (U) All family members and members of household (MOH) officially accompanying employees identified in 12 FAM 227.2, subparagraph (1). (For detailed discussion of what constitutes a MOH, COM reporting requirements for their living with an employee, and what government services are provided to a MOH, see 3 FAM 4181.(g)1 and 3 FAM 7121).
12 FAM 227.3 (U) Responsibilities
(CT:DS-417; 09-20-2023)
a. (U) The Department employs a multi-disciplinary team approach to death investigations. Responsible team members at the Washington, DC level include the Department’s Office of Casualty Assistance (DGHR/OCA), the Office of Medical Services (MED), and DS/DO/OSI. At the post level, team members include, but are not limited to, the deputy chief of mission (DCM), the RSO, and the Foreign Service Medical Specialist (FSMS).
b. (U) Because a death may occur at any time or place, any individual may be the first to discover that a death of a U.S. citizen employee or eligible family member has occurred. Any Department employee who discovers a death covered by this section or learns of the death from someone outside the official community must notify post management, including the DCM, RSO, and FSMS.
12 FAM 227.3-1 (U) Office of Medical Services (MED)
(CT:DS-417; 09-20-2023)
(U) MED:
(1) (U) Maintains agreements with the Armed Forces Medical Examiner System (AFMES), which supplies forensic services when a formal death investigation is indicated;
(2) (U) Ensures that all medical records pertaining to the decedent are properly maintained at post and/or in a centralized electronic medical record. During an investigation of a death at post, relevant portions of the medical record will made available promptly by MED representatives to the RSO (and discussed if requested), AFMES personnel if involved in the investigation, and all records subsequently transferred securely to AFMES facilities if a post mortem examination is to be performed, and/or then to the Division of Quality Management, MED WASHDC;
(3) (U) Confers with DS/DO/OSI about the necessity of opening a death investigation and/or the need to conduct a forensic autopsy; and
(4) (U) Assigns a liaison to DS to fulfill MED responsibilities related to unattended death or suspicious death investigations as discussed in this section.
12 FAM 227.3-2 (U) Office of Casualty Assistance (DGHR/OCA)
(CT:DS-417; 09-20-2023)
(U) See 3 FAM 2550 for a listing of DGHR/OCA’s responsibilities and policies regarding the death of an employee abroad.
12 FAM 227.3-3 (U) Bureau of Diplomatic Security (DS)
(CT:DS-439; 04-23-2025)
(U) DS via DS/DO/OSI:
(1) (U) Receives notification from the post regarding deaths involving the official community;
(2) (U) Conducts investigations into the facts and circumstances surrounding deaths involving the official community;
(3) (U) Confers with MED and DGHR/OCA on carrying out the respective responsibilities under this policy;
(4) (U) Authorizes an autopsy via the DS/DO/OSI office director in consultation with MED, if deemed necessary and notifies post and DGHR/OCA in a timely manner;
(5) (U) Coordinates, assists, and exchanges information with the AFMES or medical examiners of the receiving state, and in the event an autopsy is performed in the receiving state, may order that an additional post mortem examination be performed on some or all of the remains at AFMES CONUS facilities in concordance with MED and AFMES personnel;
(6) (U) Confers with the DOJ, USAO, and other Federal law enforcement agencies in cases involving possible Federal prosecution; and
(7) (U) Provides training to RSOs on death investigation procedures and protocols.
12 FAM 227.3-4 (U) Bureau of Consular Affairs (CA)
(CT:DS-417; 09-20-2023)
(U) See 7 FAM 200 for a detailed listing of CA responsibilities and policies regarding the death of a private U.S. citizen abroad.
12 FAM 227.3-5 (U) Post Management Section and Regional Bureau
(CT:DS-417; 09-20-2023)
(U) See 7 FAM 225 for a detailed listing of the post management section’s and the employing bureau’s executive office’s responsibilities regarding the death of an employee or dependent.
12 FAM 227.3-6 (U) Chief of Mission (COM) or Principal Officer (PO)
(CT:DS-417; 09-20-2023)
(U) See 3 FAM 2550 for a listing of chief of mission (COM) or principle officer (PO) responsibilities regarding the death of a U.S. citizen abroad.
12 FAM 227.3-7 (U) Foreign Service Medical Specialist (FSMS)
(CT:DS-450; 09-05-2025)
(U) The Foreign Service medical specialist (FSMS) may be the regional medical manager (RMM), regional medical officer (RMO), regional medical officer psychiatrist (RMO/P), or Foreign Service medical specialist (FSMS). FSMSs:
(1) (U) Notify the RSO and DCM of the death of a member of the official community;
(2) (U) Inform MED via secure email or facsimile with all relevant medical information as soon as possible (normally within 24 hours);
(3) (U) Provide necessary medical and mental health support to the official community following the death;
(4) (U) Assist MED and DS as necessary with the determination of cause and manner of death;
(5) (U) Coordinate, when applicable, with the medical examiner of the receiving state; and
(6) (U) Provide the pertinent information to CA for completion of Form DS-2060, Report of the Death of an American Citizen Abroad.
12 FAM 227.3-8 (U) RSO
(CT:DS-417; 09-20-2023)
(U) The RSO is a Federal law enforcement officer, and thus, in situations involving the death of a member of the official community, the RSO must:
(1) (U) Immediately notify DS, the FSMS, and the DCM in accordance with 12 FAM 227.4-1;
(2) (U) Respond to and secure any scene of death; and
(3) (U) Conduct or coordinate any additional investigative activities on the basis of instructions from DS. See 12 FAM 227.4-3.
12 FAM 227.4 (U) General Procedures for the Conduct of Death Investigations
(CT:DS-417; 09-20-2023)
12 FAM 227.4-1 (U) Reporting Requirements
(CT:DS-417; 09-20-2023)
a. (U) The notification requirements listed below are in addition to any consular section responsibilities regarding the death of private U.S. citizens abroad, management section responsibilities regarding the death of individuals within the official community, and the Department’s Office of Casualty Assistance (DGHR/OCA) responsibilities under 3 FAM 2550.
b. (U) The RSO must notify DS/DO/OSI via the Command Center (DS/TIA/CC) immediately upon notification of a death of a member of the official community. In instances involving apparent terrorist activity or hostile fire in established zones of armed conflict, the RSO must also immediately notify DS/TIA/PII and the FBI Legal Attaché Office. If the deputy chief of mission (DCM) and the Foreign Service medical provider (FSMS) have not been notified, the RSO will notify them. Following the initial notification by phone, the RSO must send a DSX-channel cable to DS/DO/OSI and DS/TIA/PII in instances involving apparent terrorist activity or hostile fire in established zones of armed conflict, within 24 hours of the initial notification. Do not delay reporting, even when full details are not yet known; submit supplemental reports as additional information becomes available.
12 FAM 227.4-2 (U) The Effect of Diplomatic and Consular Inviolability
(CT:DS-417; 09-20-2023)
a. (U) Embassy employees: In accordance with the Vienna Convention on Diplomatic Relations and 2 FAM 220, officers and employees accredited to the embassy, as well as their families and members of household, enjoy personal inviolability, which persists even after death. The receiving state may not detain, search, or conduct an autopsy on the body of the person enjoying personal inviolability, unless there has been an express waiver of personal inviolability in accordance with 2 FAM 221.5. Contact the Office of the Legal Adviser, Diplomatic Law & Litigation (L/DL), for guidance regarding assertions or waivers of personal inviolability.
b. (U) Consular officers: The bodies of consular officers may enjoy protections even after death. A variety of provisions in our bilateral consular treaties may affect the treatment of deceased consular officers; refer questions concerning consular officers to L/DL.
c. (U) Consular employees and family members at consulates: Bodies of consular employees and family members at consulates generally are entitled to no special privileges. However, because the variety of provisions in our bilateral consular treaties may affect this issue, refer questions concerning consular employees and family members to L/DL right away.
d. (U) Diplomatic premises and vehicles: The land and buildings used for the purposes of a diplomatic mission, the residence of the chief of mission (COM), and residences of all diplomatic agents and administrative and technical staff of the embassy are inviolable, pursuant to the Vienna Convention on Diplomatic Relations. As such, they are immune from unauthorized entry and search, as are their contents. Embassy vehicles (and any other mission means of transport) are immune from search and cannot be impounded or otherwise seized. Vehicles driven by diplomats and administrative and technical staff of the embassy enjoy the same protections.
e. (U) Consular premises: The Vienna Convention on Consular Relations provides that those portions of the consular premises “that are used exclusively for the work of the consular post” are inviolable. This generally includes the office space of the consulate, but not residential or other portions not used for the work of the post. In general, consular residences do not enjoy inviolability and are subject to entry and search in accordance with local law. However, some bilateral consular agreements may provide consular residences with inviolability; thus, refer questions concerning consular residences to L/DL. Consular vehicles and vehicles driven by members of a consular post do not enjoy any protection from search and seizure.
f. (U) Disputes regarding inviolability: If the receiving state disputes the assertion of inviolability, refer the matter to L/DL.
12 FAM 227.4-3 (U) DS Investigation
(CT:DS-439; 04-23-2025)
a. (U) In addition to the duties described in 12 FAM 227.3-8, the RSO:
(1) (U) Provides for the continued safety and security of COM personnel and facilities;
(2) (U) Ensures that all evidence, including the scene of death and the victim’s remains, are protected for eventual collection by trained evidence-collection teams;
(3) (U) Contacts DS/DO/OSI immediately for guidance as an autopsy may be required;
(4) (U) Collects initial statements from potential witnesses; and
(5) (U) Liaises with law enforcement of the receiving state and the medical examiner of the receiving state.
b. (U) DS consults with the FSMS and/or the Office of Medical Services (MED-WASHDC) after receiving notification of a death involving a member of the official community. If MED cannot ascribe a cause of death on the basis of the deceased’s known medical history or other reliable factors, and prepare an official death certificate indicating the official cause of death, DS will open an official death investigation. Following this initial consultation, DS initiates a death investigation under these circumstances:
(1) (U) Violent deaths, whether apparently homicidal, suicidal, or accidental;
(2) (U) Deaths not caused by readily recognizable disease, disability, or infirmity;
(3) (U) Deaths (including infants and children) under suspicious or unusual circumstances; and
(4) (U) Deaths related to disease resulting from employment or to an accident while employed including deaths possibly related to a pandemic public health condition.
c. (U) Once DS opens a death investigation, DS and the Armed Forces Medical Examiner System (AFMES), in coordination with MED, conduct a transparent and thorough investigation. DS may decide to dispatch an investigative team to the post, which may include criminal investigators and forensic personnel, and consult with the DOJ, the appropriate U.S. attorney’s office (USAO), and other Federal law enforcement agencies in cases involving possible Federal prosecution. DS requires and MED facilitates access to personnel and medical records, to the extent permitted under the Privacy Act (5 U.S.C. 552a) and the Department’s regulations, found in STATE 24 and 5 FAM 464.
12 FAM 227.4-4 (U) Autopsy
(CT:DS-439; 04-23-2025)
a. (U) The director of DS/DO/OSI has the authority to request a forensic autopsy, either with AFMES or through the medical examiner of the receiving state. Prior to requesting a forensic autopsy, DS should consult with the Office of Medical Services (MED) to determine the necessity of a forensic autopsy. DS will consult with AFMES and MED (MCI Database) on the medical and forensic capabilities of the medical examiner of the receiving state and will notify MED-Dir/Quality Management as requested. DS should attempt to obtain the consent of the decedent’s next-of-kin. However, DS may authorize an autopsy without that consent. In those situations requiring a forensic autopsy, the DS/DO/OSI Office director must authorize an autopsy in accordance with 10 U.S.C. 1471.
b. (U) In addition to DS’s authority to authorize an autopsy, the FBI may also authorize an autopsy without next-of-kin consent and in accordance with 10 U.S.C. 1471, if the death appears to have resulted from terrorist activity or hostile enemy action in established zones of armed conflict.
c. (U) AFMES is a tri-service organization within the DOD charged in part with providing a consultation service in the resolution of medical-legal death cases, civil and criminal, for DOD and, when applicable, for other Federal agencies. AFMES performs the following, in accordance with the memorandum of agreement between the Department and AFMES maintained by MED, and as needed:
(1) (U) Assigns a board-certified forensic pathologist to assist DS and MED in the conduct of a death investigation;
(2) (U) Conducts a complete medical investigation of death according to DS requirements. Investigations are normally conducted at the AFMES autopsy or mortuary facility;
(3) (U) Assumes temporary custody and control of all medical records and biological substances pertinent to the medical and legal investigation of death;
(4) (U) Consults with and assists local authorities in their own death investigation if AFMES does not have primary responsibility for the medical investigation and the local authorities are cooperating;
(5) (U) Provides DS and MED with a final medical investigation report of death, as well as any appropriate interim progress reports; and
(6) (U) Makes the Armed Forces DNA Identification Laboratory and the DOD DNA Specimen Repository available to DS and MED to identify human remains.
d. (U) Transport of the decedent’s remains may be to an AFMES-authorized autopsy facility, using military, commercial, or private aircraft. RSO personnel must establish a well-documented chain of custody during transport. Due to investigative requirements, the Director of DS/DO/OSI must approve the presence of an escort with transported remains. If an escort is approved, post must provide and fund an escort to accompany the remains to the location of the autopsy and final place of interment. Post may seek reimbursement from the decedent's sponsoring agency. The general services officer (GSO) is responsible for coordination with the Office of Logistics Operations (A/LM/OPS) to arrange for the transport of the remains to AFMES. Continued coordination is required to ensure the remains are appropriately transported in conjunction with the Office of Causality Assistance (HR/OCA). When transport to AFMES for a forensic autopsy is not possible, DS may request that AFMES send a forensic team to the post. DS coordinates with consular officers and local authorities as necessary to expedite autopsies and obtain the necessary documentation to repatriate the remains to the United States. For additional guidance regarding the disposition of remains, including financial obligations, see 7 FAM 250.
e. (U) At times, it may be impractical for AFMES to conduct an autopsy, such as when there is no facility within a reasonable distance from post. In these situations and after consulting with L/DL regarding diplomatic inviolability, and MED with respect to the documented capability of the medical examination system of the receiving state, DS may request the medical examiner of the receiving state conduct an autopsy. An RSO or their designee must observe the autopsy. The regional medical officer (RMO) or FSHS must act as an observer. However, given the special training required of medical examiners and forensic pathologists, the RMO or FSMS will not be expected to actively participate in the autopsy or provide expert input about the findings beyond what is provided by the medical examiner of the receiving state.
12 FAM 227.4-5 (U) Maintenance and Disclosure of Records
(CT:DS-417; 09-20-2023)
a. (U) DS maintains death investigation files as law enforcement records within the DS Security Records System. DS manages these records in accordance with established records disposition schedules.
b. (U) The Privacy Act does not apply to the records of deceased individuals. However, the decedent’s family may have privacy interests in the information contained in the file. To protect the family’s privacy interests, limit disclosure of death investigation files within the Department to personnel who have a “need to know” the information.
c. (U) Outside the Department, death investigation files may be disclosed to other Federal government agencies for purposes of law enforcement and/or public health and safety. Contact L/M/DS for guidance regarding other requests for death investigation files.
d. (U) Death investigation files will not be disclosed to the public, unless disclosure is required under the Freedom of Information Act and/or the Department’s regulations.
12 FAM 227.5 (U) Death Investigations Regarding Other Personnel
(CT:DS-417; 09-20-2023)
(U) In the event of a death on mission premises of an individual that falls into one of the categories listed below, the RSO must immediately notify DS/DO/OSI via the DS Command Center and may notify the individual's employing agency or company. After consultation with DS/DO/OSI, the RSO may proceed with an investigation to the extent appropriate and consistent with legal authorities. Contact L/M/DS for guidance on legal authorities.
(1) (U) Personnel of commercial contractors working pursuant to a contract or grant with the U.S. Government;
(2) (U) Nonexecutive branch employees of the U.S. Government; or
(3) (U) Other U.S. Government personnel, contractors, and their dependents not otherwise addressed in this section who are associated with the mission.
12 FAM 228 (U) PROTECTIVE INTELLIGENCE INVESTIGATIONS
(CT:DS-417; 09-20-2023)
12 FAM 228.1 (U) Organizational Responsibilities
(CT:DS-417; 09-20-2023)
a. (U) DS/TIA/PII directs, coordinates, and conducts investigations and implements threat management plans related to terrorism and other threats - or potential threats - directed against the Secretary; domestic Department personnel and facilities; designated foreign dignitaries and diplomatic missions in the United States; and any U.S. Government personnel, facilities, or interests under chief-of-mission (COM) authority overseas.
b. (U) DS/TIA/PII accomplishes its mission through the Operations and Investigations Division (DS/PII/OI) and the Intelligence Liaison Division (DS/PII/ILD.
c. (U) The Operations and Investigations Division (DS/PII/OI) coordinates and conducts threat-management activities to include criminal investigations and protective operations to help safeguard those DS-designated personnel and facilities. DS/PII/OI utilizes highly sensitive information and all-source intelligence to develop comprehensive strategies to mitigate threats and effectively respond to incidents. DS/PII/OI coordinates with the Department, other U.S. Government agencies, State and local law enforcement, and international partners to enhance protective intelligence procedures and better detect and mitigate terrorist acts or other threats.
d. (U) The Intelligence Liaison Division (DS/PII/ILD) manages the DS Counterterrorism Liaison Program (CLP) and the Rewards for Justice Program (RFJ). CLP places DS personnel in critical positions throughout the interagency counterterrorism community. The majority of CLP personnel are detailed to the FBI-managed joint terrorism task forces (JTTFs) located throughout the United States, where they conduct counterterrorism investigations on behalf of the U.S. Government and protective intelligence investigations on behalf of DS. Within the National Capital Region, CLP senior liaison officers are assigned to the FBI’s Counterterrorism Division, the FBI’s International Operations Division, the National Counterterrorism Center, the Central Intelligence Agency’s Community HUMINT Coordination Cell, and Department of Defense’s Joint Interagency Task Force—National Capital Region, where they leverage interagency capabilities to support DS protection operations worldwide. RFJ is the Department's counterterrorism rewards program. For more information regarding RFJ, see 12 FAM 228.3.
12 FAM 228.2 (U) Programs and Activities
(CT:DS-417; 09-20-2023)
a. (U) DS/TIA/PII: Conducts, through threat management investigations and directed operations, the following major programs in furtherance of the safety and security of DS-designated personnel and facilities listed above: criminal investigations, protective operations, RSO assistance, and training support. DS/TIA/PII strives to identify threats, measure risks to Department/COM interests, and develop management strategies to counter and mitigate those threats in collaboration with affected offices.
b. (U) Law enforcement investigations: DS/TIA/PII investigates threats or potential threats of terrorism, political violence, or criminal activity involving U.S. interests. DS/TIA/PII conducts these investigations through traditional law enforcement means, operational psychologist threat assessments, and protective intelligence derived from the intelligence community, as appropriate.
c. (U) Terrorism: DS/TIA/PII is the DS lead investigative office for any acts or potential acts involving terrorism and political violence. Often in conjunction with FBI, DS/TIA/PII will provide temporary duty and/or remote analytical support to offices or posts dealing with terrorism issues.
d. (U) Threat management and investigations: DS/TIA/PII is the DS lead investigative office for threat investigations against all Department or COM personnel. Often in conjunction with the field offices and RSOs, DS/TIA/PII investigates criminal acts for prosecution (when possible) and assesses individuals of concern (IOC) for threat management possibilities if prosecution is not an option. DS/TIA/PII receives threat management training and has operational psychologist support for managing cases.
e. (U) Suspicious activity: DS/TIA/PII supports all Department and COM personnel with investigating any suspicious or potentially threatening activity. DS/TIA/PII assists in protecting Department facilities, protective details, and RSOs by conducting law enforcement and intelligence checks (utilizing systems such as TECS, TIDE, e-Guardian, myDSIR, TAVISS, etc.) through the DS/TIA/PII Investigative Analytical Group. Additionally, DS/TIA/PII agents may respond to domestic locations, or overseas, to conduct thorough follow up investigations.
f. (U) Protective operations: DS/TIA/PII identifies and mitigates threats to DS protection details, special events, and facilities in close collaboration with the Directorates of Domestic Operations (DS/DSS/DO), International Programs (DS/DSS/IP), and High-Threat Programs (DS/HTP). Protection support may include tactical intelligence liaison, threat analysis and social media monitoring, threat vulnerability identification and assessment, plain clothes/low-profile operations, threat/suspicious activity investigations, inter-agency liaison, and comprehensive analytical support.
g. (U) Overseas protection support: DS/TIA/PII supports the Secretary’s Detail (DS/P/SD) within the Office of Protection (DS/DO/P) on domestic and overseas stops through analytical support from headquarters and special agents embedded with DS/P/SD. DS/TIA/PII provides social media and open-source threat reviews and mitigation recommendations, vulnerability assessments, government of the receving state liaison (through RSO coordination), counter surveillance personnel, threat investigations, and tactical intelligence liaison with the IC.
h. (U) Domestic protection support: DS/TIA/PII supports DS/P/SD, the Dignitary Protection Division (DS/P/DP), and the Protective Liaison Division (DS/P/PL) domestically through data analysis from headquarters and special agents responding or embedded on protection details depending upon the assignment. DS/TIA/PII provides social media and open-source threat reviews and mitigation recommendations, vulnerability assessments, local law enforcement liaison (in coordination with DS field offices), threat investigations, and counter surveillance personnel.
i. (U) Major events: DS/TIA/PII supports the DS Major Events Coordination Unit (MECU) with flexible variations of the previously described overseas protection support for large overseas events. DS/TIA/PII also supports DS/P/DP and DS/P/PL with flexible variations of the previously described domestic protection support for large domestic events.
j. (U) Domestic facility protection: DS/TIA/PII supports the Office of Domestic Facilities Protection (DS/DO/DFP) with flexible variations of the previously described domestic protection support for large domestic events targeting Department facilities.
k. (U) RSO assistance: DS/TIA/PII develops and provides mitigation techniques and strategies to address threats and provides consultation support to posts in close collaboration with DS/DSS/IP, DS/HTP, and RSOs. In addition to analytical support from headquarters, DS/TIA/PII may assist RSOs by sending temporary duty agent support as requested. This support may address issues such as suspicious activity or specific incident investigations, surveillance detection or counter-surveillance tradecraft consultations, coordination of protection detail intelligence resources from the IC, social media and open-source threat monitoring, vulnerability assessments, threat management strategies, and enhanced IC collaboration.
l. (U) Training support: DS/TIA/PII conducts threat recognition and mitigation training in close collaboration with the Directorate of Training (DS/DSS/T). This support includes an introduction to the DS/TIA/PII threat management process for concerning or potentially violent individuals and protective intelligence for the training protective details during basic special agent class (BSAC) classroom and field exercises. Additionally, DS/TIA/PII provides IC liaison support through classified briefings for various DS training programs such as basic regional security officer, RSO In-Service, BSAC, Special Agent In-Service, etc.
m. (U) Contact information: For DS/TIA/PII assistance or general inquiries, contact DS/TIA/PII at DSTIAPIIInvestigations@state.gov (OpenNet), DSTIAPIIInvestigations@state.sgov.gov (ClassNet), or DomDSPII@state.ic.gov (JWICS). For additional information regarding DS/TIA/PII activities, visit the Intranet websites: DS/TIA/PII, DS/PII/OI, and DS/PII/IL.
12 FAM 228.3 (U) The Office of Rewards for Justice (DS/TIA/RFJ)
(CT:DS-430; 12-16-2024)
a. (U) Section 36 of the State Department Basic Authorities Act of 1956, as amended (22 U.S.C. 2708), provides the authority for the Department to establish rewards programs. The Office of Rewards for Justice (DS/TIA/RFJ) manages, directs, and administers the Department’s national security rewards programs known as "Rewards for Justice" (RFJ).
b. (U) DS administers the RFJ programs, and the Department's relevant functional bureaus provide policy guidance as needed.
12 FAM 228.3-1 (U) Authorities
(CT:DS-430; 12-16-2024)
a. (U) The Secretary may authorize reward payments of up to $25 million, except as set forth in 12 FAM 228.5-7, paragraph a, and subject to available funding, to individuals who furnish certain information as outlined in Section 36 of the State Department Basic Authorities Act of 1956, as amended. The decision to approve a reward payment is made at the sole discretion of the Secretary, except in matters over which there is federal criminal jurisdiction, where concurrence of the Attorney General is required. For reward proposals and payments of $100,000 or less, the Secretary can delegate the authority. Delegation of Authority 449, dated June 4, 2018, authorizes DS to approve reward proposals and payment nominations of $100,000 or less.
b. (U) Under DS/TIA/RFJ, rewards can be offered for information on and paid to individuals who furnish information leading to:
(1) (U) The arrest or conviction, in any country, of any individual for the commission of an act of international terrorism against a U.S. person or U.S. property; or
(2) (U) The arrest or conviction, in any country, of any individual for conspiring or attempting to commit an act of international terrorism against a U.S. person or U.S. property; or
(3) (U) The arrest or conviction, in any country, of any individual aiding or abetting in the commission of an act described in subparagraph (1) or (2) of this section; or
(4) (U) The prevention, frustration, or favorable resolution of an act described in subparagraph (1), (2) or (3) of this section, including by dismantling an organization in whole or significant part; or
(5) (U) The identification or location of an individual who holds a key leadership position in a terrorist organization; or
(6) (U) The disruption of financial mechanisms of a foreign terrorist organization; or
(7) (U) The disruption of financial mechanisms of any person who has engaged in conduct described in sections 104(a) or 104(b)(1) of the North Korea Sanctions Policy Enhancement Act of 2016, as amended; or
(8) (U) The identification or location of any person who, while acting at the direction of or under the control of a foreign government, aids or abets a violation of the Computer Fraud and Abuse Act; or
(9) (U) The identification or location of a foreign person who knowingly engaged or is engaging in foreign election interference; or
(10) (U) The prevention, frustration, or favorable resolution of an act of foreign election interference, including by dismantling an organization in whole or significant part; or
(11) (U) The prevention, frustration, or resolution of the hostage taking of a United States person, the identification, location, arrest, or conviction of a person responsible for the hostage taking of a United States person, or the location of a United States person who has been taken hostage, in any country.
c. (U) Title 22 U.S.C. 4802(a)(2)(B)(xi) provides that security responsibilities of the Secretary include "carrying out the rewards program for information concerning international terrorism authorized by Section 36(a) of the State Department Basic Authorities Act of 1956." By Delegation of Authority No. 214, Section 8, dated September 20, 1994, the Secretary delegated to the DS Assistant Secretary the functions assigned to the Secretary under 22 U.S.C. 4802(a)(2).
12 FAM 228.3-2 (U) The Interagency Rewards Committees
(CT:DS-430; 12-16-2024)
a. (U) The Interagency Rewards Committees (IRCs) consider RFJ reward proposals and payment nominations to potential Rewards Program participants (RPPs). The IRCs are chaired by the Director of the Diplomatic Security Service (DS/DSS), or their designee. IRC deliberations and consideration of RFJ issues may occur in person or via email.
b. (U) For reward offer proposals and reward payment nominations of $100,000 or less, for which the Assistant Secretary of Diplomatic Security has delegated authority (Delegation of Authority 449, dated June 4, 2018), the Interagency Rewards Committee is comprised of representatives from:
(1) (U) The following Department of State components: The Directorate for Threat Investigations and Analysis (DS/TIA);the Office of the Legal Adviser (L); and the Office of Emergencies in the Diplomatic and Consular Service (CGFS/EDCS);
(2) (U) The Department of Justice (DOJ), if there is federal criminal jurisdiction; and
(3) (U) The nominating agency, if other than State.
(U) NOTE: These IRC recommendation decisions will generally take place via email.
c. (U) For reward offer proposals and reward payment nominations of more than $100,000, the Interagency Rewards Committees include interagency partners relevant to the subject matter at issue.
(1) (U) Terrorism: For information on terrorism outlined in 12 FAM 228.3-1 paragraph b(1-6) (see also 22 U.S.C. 2708(b)(1-7)), the IRC is comprised of representatives from:
(a) (U) The Directorate for Threat Investigations and Analysis (DS/TIA);
(b) (U) The Bureau of Counterterrorism (CT);
(c) (U) The Office of the Legal Adviser (L);
(d) (U) The Office of Emergencies in the Diplomatic and Consular Service (CGFS/EDCS);
(e) (U) The relevant regional bureau, as appropriate;
(f) (U) The Central Intelligence Agency (CIA);
(g) (U) The Department of Defense (DOD);
(h) (U) The Department of Homeland Security (DHS);
(i) (U) The Department of Justice (DOJ);
(j) (U) The Department of the Treasury (Treasury);
(k) (U) The Federal Bureau of Investigation (FBI);
(l) (U) The National Counterterrorism Center (NCTC);
(m) (U) The National Security Agency (NSA); and
(n) (U) The National Security Council (NSC).
(2) (U) Democratic People's Republic of Korea (DPRK): For information on activities that support DPRK outlined in 12 FAM 228.3-1 paragraph b(7) (see also 22 U.S.C. 2708(b)(12)), the IRC is comprised of representatives from:
(a) (U) The Directorate for Threat Investigations and Analysis (DS/TIA);
(b) (U) The Bureau of International Security and Nonproliferation (ISN);
(c) (U) The relevant regional bureau, as appropriate;
(d) (U) The Office of the Legal Adviser (L);
(e) (U) The Office of Emergencies in the Diplomatic and Consular Service (CGFS/EDCS);
(f) (U) The Central Intelligence Agency (CIA);
(g) (U) The Department of Defense (DOD);
(h) (U) The Department of Homeland Security (DHS);
(i) (U) The Department of Justice (DOJ);
(j) (U) The Department of the Treasury (Treasury);
(k) (U) The Federal Bureau of Investigation (FBI);
(m) (U) The National Security Agency (NSA); and
(n) (U) The National Security Council (NSC).
(3) (U) Malicious Cyber Activity: For information concerning cyber activities as outlined in 12 FAM 228.3-1 paragraph b(8) (see also 22 U.S.C. 2708(b)(11)), the IRC is comprised of representatives from:
(a) (U) The Directorate for Threat Investigations and Analysis (DS/TIA);
(b) (U) The relevant functional bureau, as appropriate;
(c) (U) The Office of the Legal Adviser (L);
(d) (U) The Office of Emergencies in the Diplomatic and Consular Service (CGFS/EDCS);
(e) (U) The relevant regional bureau, as appropriate;
(f) (U) The Central Intelligence Agency (CIA);
(g) (U) The Department of Defense (DOD);
(h) (U) The Department of Homeland Security (DHS);
(i) (U) The Department of Justice (DOJ);
(j) (U) The Department of the Treasury (Treasury);
(k) (U) The Federal Bureau of Investigation (FBI);
(l) (U) The National Security Agency (NSA); and
(m) (U) The National Security Council (NSC).
(4) (U) Election Interference: For information concerning election interference activities as outlined in 12 FAM 228.3-1 paragraph b(9-10) (see also 22 U.S.C. 2708(b)(5) and (13)), the IRC is comprised of representatives from:
(a) (U) The Directorate for Threat Investigations and Analysis (DS/TIA);
(b) (U) The relevant functional bureau, as appropriate;
(c) (U) The Office of the Legal Adviser (L);
(d) (U) The Office of Emergencies in the Diplomatic and Consular Service (CGFS/EDCS);
(e) (U) The relevant regional bureau, as appropriate;
(f) (U) The Central Intelligence Agency (CIA);
(g) (U) The Department of Defense (DOD);
(h) (U) The Department of Homeland Security (DHS);
(i) (U) The Department of Justice (DOJ);
(j) (U) The Department of the Treasury (Treasury);
(k) (U) The Federal Bureau of Investigation (FBI);
(l) (U) The National Security Agency (NSA); and
(m) (U) The National Security Council (NSC).
(5) (U) Hostage Taking: For information concerning hostage taking activities as outlined in 12 FAM 228.3-1 paragraph b(11) (see also 22 U.S.C. 2708(b)(14)), the IRC is comprised of representatives from:
(a) (U) The Directorate for Threat Investigations and Analysis (DS/TIA);
(b) (U) The relevant functional bureau, as appropriate;
(c) (U) The Office of the Legal Adviser (L);
(d) (U) The Office of Emergencies in the Diplomatic and Consular Service (CGFS/EDCS);
(e) (U) The relevant regional bureau, as appropriate;
(f) (U) The Central Intelligence Agency (CIA);
(g) (U) The Department of Defense (DOD);
(h) (U) The Department of Homeland Security (DHS);
(i) (U) The Department of Justice (DOJ);
(j) (U) The Department of the Treasury (Treasury);
(k) (U) The Federal Bureau of Investigation (FBI);
(l) (U) The National Security Agency (NSA); and
(m) (U) The National Security Council (NSC).
d. (U) As appropriate, representatives from other Department bureaus or other U.S. government agencies may also confer with the IRC or be present as observers.
e. (U) The IRCs make recommendations to the Secretary concerning proposed reward offers and payment nominations. These recommendations are nonbinding, as all rewards are made at the sole discretion of the Secretary. However, in matters over which there is Federal criminal jurisdiction, the Secretary must obtain the concurrence of the U.S. Attorney General (AG) of the United States before a payment can be made.
f. (U) None of the agencies (other than the Department of State, or the Department of Justice in a matter over which there is Federal criminal jurisdiction) participating in the committee meeting shall have the right to block a recommendation to pay a reward. Any disagreement with any aspect of a recommendation to pay a reward will be noted in the action memorandum to the Secretary in accordance with 12 FAM 228.5-6.
12 FAM 228.3-3 (U) Protection of Informants
(CT:DS-430; 12-16-2024)
a. (U) If the Secretary determines that the identity of the Rewards Program participant (RPP) or of the members of the RPP’s immediate family must be protected, the Secretary may take protective measures they consider necessary in connection with the payment of the reward. "Immediate family members" includes:
(1) (U) A spouse, parent, sibling, child, or domestic partner of the individual;
(2) (U) A person with respect to whom the individual stands in loco parentis; and
(3) (U) Any person not covered by subparagraph (1) or (2) of this section, who is living in the individual's household and is related to the individual by blood, marriage, or legal adoption.
b. (U) Specific measures employed to protect the identity of an RPP or potential RPP (and immediate family members, as appropriate) beyond the security procedures set forth in 12 FAM 228.5-4 will depend on the circumstances of each case but may include not identifying the RPP by name in the reports sent to Congress in accordance with 12 FAM 228.6-1.
c. (U) RPPs and their immediate family members may be eligible for participation in the AG's Witness Protection Program authorized under 18 U.S.C. 3521. U.S. government officials are not authorized to make a promise or inducement of participation in this program without the express approval of DOJ.
d. (U) Per 8 U.S.C. 1101(a)(15)(S)(ii), an RPP may be eligible for a nonimmigrant visa, if the Secretary and the AG jointly determine that the informant:
(1) (U) Is in possession of critical reliable information concerning a terrorist organization, enterprise, or operation;
(2) (U) Is willing to supply or has supplied such information to federal law enforcement authorities or a federal court;
(3) (U) Will be or has been placed in danger as a result of providing such information; and
(4) (U) Is eligible to receive a reward under 22 U.S.C. 2708(a).
(U) If the Secretary and the AG consider it to be appropriate, the informant's immediate family (defined as spouse, children, or parents) may also be eligible for such visas.
e. (U) Per 8 U.S.C. 1101(a)(15)(S)(i), an RPP may be eligible for a non-immigrant visa if the AG determines that the informant:
(1) (U) Is in possession of critical reliable information regarding a criminal organization or enterprise;
(2) (U) Is willing to supply or has supplied such information to Federal or State law enforcement authorities or a Federal or State court; and
(3) (U) Whose presence in the United States the Attorney General determines is essential to the success of an authorized criminal investigation or the successful prosecution of an individual involved in the criminal organization or enterprise.
f. (U) The post, department, or agency working with the informant should report to DS/TIA/RFJ what specific additional measures for protection of the identity of an informant are needed.
12 FAM 228.4 (U) Rewards Program Guidelines
(CT:DS-430; 12-16-2024)
12 FAM 228.4-1 (U) Ineligibility of Government Officers or Employees
(CT:DS-430; 12-16-2024)
(U) An officer or employee of any entity of the federal, state, or local government or of a foreign government who, while in the performance of their official duties, furnishes information as described in 12 FAM 228.3-1, paragraph a, shall not be eligible for a reward payment under the RFJ rewards program. Such an officer or employee may, in limited circumstances, however, in the case of 12 FAM 228.3-1, paragraph a, be eligible for participation in the DOJ Witness Protection Program. U.S. government officials are not authorized to make a promise or inducement of participation in this program without the express approval of DOJ.
12 FAM 228.4-2 (U) Coordination with Relevant Authorities of the Government of the Receiving State
(CT:DS-439; 04-23-2025)
(U) RFJ supplements and complements security and law enforcement efforts of relevant authorities of the government of the receiving state who bear the primary responsibility in these areas. To this end, RFJ may coordinate, if appropriate, with responsible authorities of the government of the receiving state on the rewards process.
12 FAM 228.4-3 (U) Responsibilities
(CT:DS-439; 04-23-2025)
a. (U) The RSO is primarily responsible for any RFJ program set up at that U.S. mission. Such responsibility includes implementation of each of the stages of the rewards process, with support from RFJ and as set forth in 12 FAM 228.6, including coordination with the country team and as needed with other U.S. government and authorities of the government of the receiving state.
b. (U) All nominations within the Department to pay a reward under RFJ will be coordinated by DS. In carrying out this responsibility, DS will consult with the members of the IRC, as appropriate. Consultation may take the form of IRC meetings or circulation of written proposals to committee members.
12 FAM 228.4-4 (U) Security Procedures
(CT:DS-439; 04-23-2025)
a. (U) All communications relating to the implementation of RFJ must be transmitted in appropriate channels with classification level and distribution controls sufficient to ensure the security of operations and persons involved. Such communications include:
(1) (U) Proposals for reward offers;
(2) (U) Nominations for rewards payments;
(3) (U) Reports of information received in response to a reward offer;
(4) (U) Measures taken in response to information received;
(5) (U) Contacts with authorities of the government of the receiving state;
(6) (U) Instructions from the Department to posts; and
(7) (U) Other relevant information.
b. (U) Names of RPPs and information that may lead to their identification must be handled in accordance with appropriate operational security procedures. An RPP’s identity and relationship with RFJ should be limited only to those individuals with a need to know. An RPP’s relationship with RFJ should be kept confidential, even if the RPP’s identity and/or role in a case has been publicly disclosed in the media.
c. (U) All other documents relating to implementation must be handled in accordance with appropriate operational security procedures. This includes information relating to identities of RPPs and times, places, and circumstances of contacts with U.S. officials.
12 FAM 228.4-5 (U) Accounting for Funds
(CT:DS-417; 09-20-2023)
(U) Fiscal responsibility and accountability for funds appropriated for use in carrying out the rewards program will reside with CGFS/EDCS. CGFS/EDCS will also be responsible for instituting appropriate financial controls, including controls that may be necessary to maintain the confidentiality of payments within the framework of internal control and audit requirements.
12 FAM 228.5 (U) Rewards Process
(CT:DS-417; 09-20-2023)
12 FAM 228.5-1 (U) Proposals to Offer Rewards
(CT:DS-430; 12-16-2024)
a. (U) U.S. missions or other agencies may propose that a reward be offered in accordance with procedures, regulations and authorities set forth in 12 FAM 228.
b. (U) Such proposals may include that a reward be offered jointly with a foreign government.
c. (U) A generic reward offer for information may also be proposed. Under each generic reward offer, specific individuals, entities, or activities may be highlighted.
d. (U) The relevant IRC will review all such reward proposals.
e. (U) When a reward offer is approved by the Secretary of State, or DS Assistant Secretary where appropriate, it may then be publicized in accordance with 12 FAM 228.5-2.
12 FAM 228.5-2 (U) Publicizing Reward Offers
(CT:DS-430; 12-16-2024)
a. (U) Reward offers may be publicized through various types of media campaigns developed by RFJ. Reward offers and other related information may also be posted on the internet, RFJ website, social media, open and direct communications channels, public and private forums, and are available for use by other U.S. government agencies, as appropriate.
b. (U) All reward offer public announcements must be cleared by the appropriate bureaus within the Department. Relevant posts must also be consulted regarding proposed announcements and may be directed to consult with respective governments of the receiving state.
12 FAM 228.5-3 (U) Actions upon Receiving Information at Post in Response to Reward Offers
(CT:DS-417; 09-20-2023)
(U) The designated officer at post, usually the RSO, establishes policies and procedures for handling all information received in response to a reward offer in support of existing policies. All information should be coordinated with appropriate embassy offices and the RFJ program.
12 FAM 228.5-4 (U) Nominations to Pay Rewards
(CT:DS-xxx; xx-xx-2025)
a. (U) Nominations for payment under RFJ may originate at U.S. missions or at other agencies. Such nominations must include specific details concerning the factors set forth in 12 FAM 228.5-5. In no case may any individual agree to pay a reward under RFJ without express approval from the Department through RFJ in accordance with 12 FAM 228.5-5 paragraph g and 12 FAM 228.5-7.
b. (U) A nomination will not necessarily result in a recommendation to the Secretary, a determination by the Secretary, or a reward payment authorized by the Secretary. A nomination is only the first stage in the Department's review process. Once a U.S. government-submitted nomination that meets the factors set forth in 12 FAM 228.5-5 is received by RFJ, the Office of the Legal Adviser reviews for statutory compliance with 22 U.S.C. 2708. Should such a potential reward payment be found legally available, RFJ may convene the appropriate IRC committee in accordance with 12 FAM 228.3-2.
c. (U) If a nomination originates from a U.S. mission, RFJ will seek the views of the IRC and relevant post(s) before recommending the payment of a reward to the Secretary.
d. (U) U.S. missions proposing RPPs should advise RFJ of any sensitivities of the receiving state that may affect the decision-making process. For example, legal restrictions of the receiving state may apply to the payment or promise of payment to witnesses for their testimony. Such restrictions, including the effect that a payment of a reward would have on the efforts of law enforcement authorities of the receiving state must be considered in making recommendations.
e. (U) U.S. missions should advise whether any specific measures for protection of the identity of the RPP are deemed necessary (see 12 FAM 228.4-4.)
12 FAM 228.5-5 (U) Reviewing Reward Payment Nominations
(CT:DS-430; 12-16-2024)
a. (U) In cases covered by 22 U.S.C. 2708(b)(1), (2) or (4) (see also 12 FAM 228.3-1 paragraph b(1-4)), concerning information leading to the arrest or conviction for commission of, or for attempt or conspiracy to commit, or for aiding or abetting an act of international terrorism, the decision to pay a reward and the amount thereof depend on various considerations, including, but not limited to, the following factors:
(1) (U) The degree to which the terrorist act targeted a U.S. person or U.S. property;
(2) (U) The seriousness of the injury or potential injury to a U.S. person or U.S. property;
(3) (U) The number of acts;
(4) (U) The degree of seriousness of the act(s);
(5) (U) The likelihood that the information provided has materially aided in bringing the individuals responsible to justice;
(6) (U) The value of the information;
(7) (U) The degree of participation in the terrorist act of the individual(s) responsible;
(8) (U) The degree of risk faced by the potential reward recipient and their family in providing the information;
(9) (U) The degree to which the arrest or conviction will seriously impede the functions of a terrorist organization; and
(10) (U) The degree to which the RPP(s) voluntarily cooperated with authorities.
b. (U) In cases covered by 22 U.S.C. 2708(b)(5) or (6) (see also 12 FAM 228.3-1 paragraph b(4-6)), concerning information leading to the prevention or frustration of an act of international terrorism, the favorable resolution of an act of international terrorism, the dismantling of a terrorist organization in whole or significant part, or the identification or location of an individual who holds a key leadership position in a terrorist organization, the decision to pay a reward and the amount thereof will depend on various considerations, including, but not limited to, the following factors:
(1) (U) The credibility and specificity of available information indicating, as applicable:
(a) (U) That there is a threat of an act of international terrorism;
(b) (U) The on-going activities of the applicable terrorist organization or threat; or
(c) (U) The identification or location of the individual who holds a key leadership position in a terrorist organization;
(2) (U) The seriousness of the danger to a U.S. person or U.S. property indicated by the available information;
(3) (U) The likelihood that, and the degree to which, the information provided has materially aided in successfully, as applicable:
(a) (U) Avoiding or countering the terrorism threat;
(b) (U) Favorably resolving an act of international terrorism or an ongoing international terrorist activity;
(c) (U) Dismantling a terrorist organization in whole or in part; or
(d) (U) Identifying or locating the key individual;
(4) (U) The degree of risk faced by the potential reward recipient and their family in providing the information; and
(5) (U) The extent to which the reward recipient voluntarily cooperated with authorities.
c. (U) In cases covered by 22 U.S.C. 2708(b)(12) (see also 12 FAM 228.3-1 paragraph b(7)), concerning information leading to the disruption of financial mechanisms of any person who has engaged in conduct described in sections 104(a) or 104(b)(1) of the North Korea Sanctions Policy Enhancement Act of 2016, as amended (NKSPEA), the decision to pay a reward and the amount thereof depend on various considerations, including, but not limited to, the following factors:
(1) (U) The extent to which the information provided contributes to the policy goals described in NKSPEA;
(2) (U) The likelihood that the information provided has materially aided in disrupting activities that support the DPRK;
(3) (U) The value of the information;
(4) (U) The credibility and specificity of available information;
(5) (U) The degree of risk faced by the potential reward recipient and their family in providing the information; and
(6) (U) The degree to which the RPP(s) voluntarily cooperated with authorities.
d. (U) In cases covered by 22 U.S.C. 2708(b)(11) (see also 12 FAM 228.3-1 paragraph b(8)), concerning information leading to the location or identification of any person who, at the direction of a foreign government, has aided or abetted a violation of the CFAA, the decision to pay a reward and the amount thereof depend on various considerations, including, but not limited to, the following factors:
(1) (U) The seriousness of the potential or actual injury or damage arising out of the conduct described in 22 U.S.C. 2708(b)(11);
(2) (U) The value of the information;
(3) (U) The likelihood that the information provided has materially aided in disrupting activities undertaken by an individual at the direction of a foreign government to aid or abet a violation of the CFAA;
(4) (U) The degree of risk faced by the potential reward recipient and their family in providing the information; and
(5) (U) The degree to which the RPP(s) voluntarily cooperated with authorities.
e. (U) In cases covered by 22 U.S.C. 2708(b)(13) or (5) (see also 12 FAM 228.3-1 paragraph b(9-10)) concerning the identification or location of a foreign person who knowingly engaged or is engaging in foreign election interference; or the prevention, frustration, or favorable resolution of an act of foreign election interference, including by dismantling an organization in whole or significant part, the decision to pay a reward and the amount thereof depend on various considerations, including, but not limited to, the following factors:
(1) (U) The value of the information;
(2) (U) The credibility and specificity of available information;
(3) (U) The degree of risk faced by the potential reward recipient and their family in providing the information; and
(4) (U) The degree to which the RPP(s) voluntarily cooperated with authorities.
f. (U) In cases covered by 22 U.S.C. 2708(b)(14) (see also 12 FAM 228.3-1 paragraph b(11)) concerning the prevention, frustration, or resolution of the hostage taking of a United States person, the identification, location, arrest, or conviction of a person responsible for the hostage taking of a United States person, or the location of a United States person who has been taken hostage, in any country, the decision to pay a reward and the amount thereof depend on various considerations, including, but not limited to, the following factors:
(1) (U) The value of the information;
(2) (U) The credibility and specificity of available information;
(3) (U) The degree of risk faced by the potential reward recipient and their family in providing the information; and
(4) (U) The degree to which the RPP(s) voluntarily cooperated with authorities.
g. (U) Whether a reward is paid and in what amount in any given case are matters within the discretion of the Secretary, with the concurrence of the U.S. Attorney General (AG) if it is a matter over which there is Federal criminal jurisdiction.
h. (U) If a payment nomination is denied by the IRC, the Secretary, or the AG, RFJ will advise relevant U.S. government partners, and foreign government partners where appropriate, of the decision, specifying the basis for denial.
12 FAM 228.5-6 (U) Action Memoranda
(CT:DS-430; 12-16-2024)
a. (U) After the IRC reviews a reward payment nomination, RFJ may send an action memorandum to the Secretary recommending that the Secretary approve a reward payment.
b. (U) The action memorandum shall include:
(1) (U) A summary and analysis of the nomination;
(2) (U) An analysis showing that the information provided by the individual falls within the categories set out in 12 FAM 228.3-1 paragraph a(1-11) ;
(3) (U) A recommendation regarding the amount of the reward based on the factors set out in 12 FAM 228.5-5 and/or the method of payment;
(4) (U) A recommendation as to the amount of the reward;
(5) (U) A recommendation as to whether protection measures are necessary and describing any necessary measures to protect the identity of the recipient and/or members of the recipient's immediate family;
(6) (U) The dissenting opinion(s) of any IRC representatives involved in the decision to recommend payment of a reward; and
(7) (U) A proposed letter seeking the concurrence of the AG if the matter is one over which there is Federal criminal jurisdiction. See also 12 FAM 228.5-5, paragraph g.
12 FAM 228.5-7 (U) Reward Payment
(CT:DS-430; 12-16-2024)
a. (U) The Secretary may authorize a reward payment greater than $25 million if they determine that an offer or payment of an award of a larger amount is necessary to combat terrorism or defend the nation against terrorist acts. The Secretary may also authorize a reward of up to $50 million for the capture or information leading to the capture of a leader of a foreign terrorist organization.
b. (U) Title 22 U.S.C. 2708(e)(2) requires Secretary approval before any reward payment of more than $100,000 can be made. For reward proposals and payment nominations of $100,000 or less, the Assistant Secretary of Diplomatic Security has delegated authority (Delegation of Authority 449, dated June 4, 2018).
c. (U) The Secretary will determine the amount of the reward paid. They may seek the views of other agencies, post, Department personnel, or the agency proposing the reward, when making such a determination.
d. (U) Provided the Secretary has decided that a reward will be paid and has received the concurrence of the AG if it is a matter over which there is Federal criminal jurisdiction, RFJ will notify the appropriate post, department, or agency and coordinate the payment of the reward.
12 FAM 228.6 (U) Reporting Requirements
(CT:DS-430; 12-16-2024)
12 FAM 228.6-1 (U) Reports on the Payment and Offer of Rewards
(CT:DS-430; 12-16-2024)
a. (U) Per 22 U.S.C. 2708(g)(1), not later than 30 days after the payment of any reward, the Secretary shall submit a report to the House Committee on Foreign Affairs and the Senate Committee on Foreign Relations with respect to such reward. RFJ will prepare the report, which may be submitted in classified form, if necessary, and must:
(1) (U) Specify the amount of the reward paid;
(2) (U) Provide an identification number, which will typically be used instead of a name to protect the recipient’s identity;
(3) (U) State the acts with respect to which the reward was paid; and
(4) (U) Discuss the significance of the information for which the reward was paid in dealing with the respective acts.
b. (U) Not later than 15 days before making a reward in a form that includes cryptocurrency, the Secretary of State shall notify the Committee on Foreign Affairs of the House of Representatives and the Committee on Foreign Relations of the Senate of such form for the reward.
c. (U) Per 22 U.S.C. 2708(g)(4), not less than 15 days after a reward offer is authorized under this section, the Secretary of State shall submit to the appropriate congressional committees a report, which may be submitted in classified form, if necessary to protect intelligence sources and methods, and must:
(1) (U) Detail information about the reward offer;
(2) (U) Identify the individual for whom the reward offer is being made;
(3) (U) State the amount of the reward offer, and
(4) (U) Discuss the acts with respect to which the reward offer is being made and how the reward is being publicized.
12 FAM 228.6-2 (U) Annual and Quarterly Reports
(CT:DS-430; 12-16-2024)
a. (U) Per 22 U.S.C. 2708(g)(1), the Secretary will provide within 60 days after the end of each fiscal year an annual report to the Committee on Foreign Relations, the Committee on Appropriations of the Senate, the Committee on Foreign Affairs, and the Committee on Appropriations of the House of Representatives. The report will include operational costs related to the RFJ program covered by the Bureau of Diplomatic Security as well as any advertising related expenditures and reward payments from the appropriation for “Emergencies in the Diplomatic and Consular Service” for that fiscal year.
b. (U) CGFS/EDCS must also report information on the total amounts expended to carry out the RFJ programs, including any reward payments made and any amounts expended to publicize the availability of rewards. CGFS/EDCS generates these quarterly reports.
12 FAM 229 (SBU) Monitoring and recording
(CT:DS-417; 09-20-2023)
(U) Applies to all Department Personnel, Agency for International Development and Foreign Affairs Agencies.
12 FAM 229.1 (SBU) Definitions
(CT:DS-430; 12-16-2024)
(State Only)
(Applies to Foreign and Civil Service Employees)
(SBU) Consensual monitoring: Monitoring, which can include recording, to which at least one involved party has consented, but not all parties participating have consented. Such monitoring is permissible by law enforcement personnel under 18 U.S.C. 2511(2)(C).
(SBU) Custodial interviews: An interview of an individual in a place of detention, following arrest, but prior to initial appearance. A place of detention is any structure where persons are held in connection with federal criminal charges where those persons can be interviewed. This includes not only federal facilities, but also any state, local, or tribal law enforcement facility, office, correctional or detention facility, jail, police or sheriff’s station, holding cell, or other structure used for such purpose.
(U) Department facility: A Department facility is a building, office, annex, or other structure used for official Department purposes. It does not include U.S. government housing overseas.
(SBU) Domestic consensual monitoring: Consensual monitoring when all parties are in the United States.
(SBU) Routine monitoring/recording: Recording that does not present either significant foreign policy considerations or special circumstances as set forth in the 2002 DOJ Memorandum, as amended.
(SBU) Special circumstances: Refers to monitoring investigation of senior members of the executive (level IV and above), judicial, or legislative branches, certain public officials involved in bribery, extortion or conflict of interest, and members of the diplomatic corps of a foreign country. All such monitoring, no matter where it occurs, requires prior written approval from the Secretary or Deputy Secretary and from the Department of Justice and the relevant U.S. Attorney. See Attorney General Memorandum, "Procedures for Lawful, Warrantless Monitoring of Verbal Communications," (2002).
12 FAM 229.2 (SBU) Prohibition on Monitoring or Recording Conversations Without Consent
(CT:DS-417; 09-20-2023)
a. (SBU) While in Department facilities or in the performance of official duties, Department personnel are prohibited from conducting, directing, permitting, or otherwise facilitating the monitoring or recording of any conversation without the express consent of all persons involved in the conversation, unless such monitoring or recording is authorized consistent with the provisions of this chapter.
b. (SBU) Cases that involve significant foreign policy implications or special circumstances may be monitored or recorded with the advance approval of the secretary or deputy secretary:
c. (SBU) Cases that do not involve significant foreign policy implications or special circumstances may be monitored or recorded, without the express consent of all persons involved in the conversation, with the advance approval of the Under Secretary for Management; and
d. (SBU) DS personnel may conduct consensual monitoring in cases that do not involve significant foreign policy implications as part of an investigation consistent with their official duties, subject to the restrictions and requirements set forth below.
e. (SBU) OIG personnel may conduct consensual monitoring as part of an investigation consistent with their official duties, subject to the restrictions and requirements set forth in the OIG Special Agent's Manual.
f. (SBU) Personnel who fail to adhere to this policy may face disciplinary action.
12 FAM 229.3 (SBU) Permissible Routine Monitoring or Recording
(CT:DS-417; 09-20-2023)
(SBU) The following routine monitoring and recording are permissible and do not require additional authorization:
(1) (SBU) The automatic recording of calls to the main number or operator at Department facilities in the United States and overseas. When feasible, callers to Department facilities will be informed that the call may be monitored or recorded;
(2) (SBU) Recordings made by event data recorders installed in U.S. government vehicles under Chief of Mission security responsibility;
(3) (SBU) Public Affairs recordings, such as recordings of town hall meetings or BNET recordings;
(4) (SBU) Recordings of interviews at San Ysidro, California border crossing; or
(5) (SBU) Recordings made by the Uniformed Protection Division Security Command Center voice logger system.
12 FAM 229.4 (SBU) Consensual Monitoring by DS
(CT:DS-417; 09-20-2023)
12 FAM 229.4-1 (SBU) Approval Authority
(CT:DS-417; 09-20-2023)
(SBU) Pursuant to 12 FAM 229.2, DS may authorize and conduct consensual monitoring as part of an investigation and consistent with the official duties of its personnel:
(1) (SBU) In cases that do not involve significant foreign policy implications or special circumstances;
(2) (SBU) So long as they are conducted in a manner consistent with the 2002 and 2014 DOJ Policies Concerning Electronic Recording of Statements, and
(3) (SBU) After obtaining the approvals as set forth in sections 12 FAM 229.4 below. All other cases require the approval of the Secretary, Deputy Secretary, or Under Secretary of Management as set forth in 12 FAM 229.2.
12 FAM 229.4-2 (SBU) Domestic Consensual Monitoring In Criminal Investigations
(CT:DS-417; 09-20-2023)
a. (SBU) Non-custodial interviews: When consensual monitoring will occur solely in the United States, DS special agents must first consult with a federal prosecutor to ensure that the monitoring as contemplated is permissible under federal law. Department approval authority to conduct consensual monitoring is as follows:
(1) (SBU) Assistant Secretary for Diplomatic Security: When the matter is not routine or there are potential (but not significant) foreign policy implications or other sensitivities with respect to the proposed recording, approval authority rests with the Assistant Secretary for Diplomatic Security. Cases involving significant foreign policy implications require the approval specified in 12 FAM 229.2 and
(2) (SBU) DS SAC: When the matter is routine and there are no foreign policy implications or other sensitivities with respect to the proposed recording, approval authority rests with the relevant DS SAC.
b. (SBU) Custodial interviews: There is a presumption that DS special agents will record custodial interviews in domestic federal criminal investigations so long as they are acting consistent with the 2014 DOJ Policy Concerning Electronic Recording of Statements. In such circumstances, no supervisory approval is required.
12 FAM 229.4-3 (SBU) Overseas Consensual Monitoring In Criminal Investigations
(CT:DS-439; 04-23-2025)
a. (SBU) DS special agents may conduct consensual monitoring in overseas criminal cases under the following conditions:
(1) (SBU) with Chief of Mission concurrence;
(2) (SBU) when such consensual monitoring occurs entirely within a U.S. embassy or mission or when such monitoring occurs outside a U.S. embassy or mission and is lawful under the laws of the receiving state and coordinated with appropriate officials of the government of the receiving state;
(3) (SBU) With Office of the Legal Adviser clearance, and
(4) (SBU) After obtaining DOJ/OIA and U.S. prosecutorial approval.
b. (SBU) DS special agents must obtain consent before consensual monitoring of victims in overseas criminal cases. Victims may decline to have their conversations and/or interviews recorded; and
c. (SBU) For guidelines on overseas consensual monitoring by DS/DO/OSI in criminal investigations review 12 FAM 229.4-4.
12 FAM 229.4-4 (SBU) Consensual Monitoring of Interviews in Criminal and Administrative Investigations by DS/DO/OSI
(CT:DS-417; 09-20-2023)
a. (SBU) DS special agents assigned to the DS/DO/OSI are authorized to conduct announced consensual monitoring in the form of an audio and/or audiovisual recording of interviews in both compelled and voluntary settings in routine criminal and administrative investigations. DS/DO/OSI special agents may conduct audio or audiovisual recordings of subjects, victims, and witnesses.
b. (SBU) Victims may decline to have their interviews recorded.
c. (SBU) Witnesses may decline to have their interviews recorded in the context of voluntary interviews. If DS/DO/OSI wishes to record a witness who has declined a recorded interview, DO/DO/OSI must compel the witness in accordance with 12 FAM 226.1 and obtain the applicable approvals.
d. (SBU) DS/DO/OSI special agents must adhere to the following audio or audiovisual recording guidelines:
(1) (SBU) For compelled interviews, DS will provide the interviewee with at least 24-hours advance notice of any interview unless such notification could jeopardize the investigation;
(2) (SBU) If asked by the employee or by the employee’s representative, DS will advise whether the employee is the subject of the investigation unless such notification could jeopardize the investigation;
(3) (SBU) The DS/DO/OSI interview room will bear a sign that indicates when recording is in progress;
(4) (SBU) Inform the interviewee before entering the interview room that he or she will be recorded. Notify the interviewee a second time once inside the interview room;
(5) (SBU) Advise the interviewee when the recording begins and when it ends;
(6) (SBU) Advise the interviewee that it is an unclassified discussion. If there is a need to address any classified information, it will be done at the end of the interview after the recording is turned off and in an appropriate setting for discussing classified material;
(7) (SBU) Provide the appropriate warnings and assurances at the outset of the interview and allow the interviewee to have legal or other representation present, as appropriate;
(8) (SBU) When agreeing to take a break during an interview, specify in advance how long that break will be and inform the interviewee that the recording devices will remain on throughout the duration of the break;
(9) (SBU) A secondary recording device, such as an audio-recorder will record the interview via audio only in DS/OSI interview room. This will serve as a redundant capability;
(10) (SBU) Allow the interviewee to adjourn to a private setting to confer with his or her representative away from the recording devices;
(11) (SBU) Employees and/or their representatives will be entitled to a copy of the recording at the appropriate opportunity should formal action (e.g., disciplinary action or revocation of the employee's security clearance) be pursued. The recording will be provided to the adjudicative body for review;
(12) (SBU) Preserve recordings of interviews via approved electronic media and attach the recording(s) to the Report of Investigation and
(13)(SBU) If the Department employee is represented by a union and the union representative has the appropriate security clearance, an interviewee's union representative will be permitted to review a recording of any prior interviews in an appropriate setting.
e. (U) DS/DO/OSI special agents must also adhere to the guidelines set forth in the 2016 Memorandum of Understanding between the Department of State, AFSA and AFGE.
12 FAM 229.4-5 (SBU) Overseas Administrative Investigations
(CT:DS-439; 04-23-2025)
a. (SBU) DS special agents conducting administrative investigations of locally employed staff outside the United States may record locally employed staff subject and witness interviews in a U.S. embassy or mission facility without the consent of the interviewee after:
(1) (SBU) Obtaining Office of the Legal Adviser (L/LEI and L/M/DS) clearance, including any needed coordination with the receiving state; and
(2) (SBU) Provide the appropriate warnings and assurances at the outset of the interview.
b. (SBU) Administrative investigations of U.S. direct hire personnel outside the United States are subject to the same guidelines as set forth in 12 FAM 3 for recordings by DS/DO/OSI.