INVESTIGATIONS
(CT:DS-450; 09-05-2025)
(Office of Origin: DS/DSS)
12 FAM 221 SCOPE AND RESPONSIBILITY
(CT:DS-450; 09-05-2025)
The Bureau of Diplomatic Security (DS) provides a broad range of investigative services through its Directorates for Domestic Operations (DS/DSS/DO), Threat Investigations and Analysis (DS/DSS/TIA), Cyber and Technology Security (DS/DSS/CTS), and Security Infrastructure (DS/DSS/SI). Regional Security Officers (RSOs) and Overseas Criminal Investigators (OCIs), formerly known as ARSO-Is, work with these investigative offices to conduct and complete investigations overseas.
12 FAM 221.1 Types of Investigative Services
(CT:DS-450; 09-05-2025)
12 FAM 221.1-1 Security-Related Investigations
(CT:DS-450; 09-05-2025)
DS/DO, DS/SI, DS/CTS, and DS/TIA investigate all security-related matters pertaining to personnel and operations of the Department and the Foreign Service. Investigations range from personnel vetting for suitability, fitness, national security, and credentialing, damage assessments of successful network penetrations, failures to safeguard Department information and information systems, unauthorized disclosures of classified information, counterintelligence (CI), counterespionage (CE), protective intelligence and threats, and review of conduct that might reflect adversely on the integrity or trustworthiness of Department personnel.
12 FAM 221.1-2 Investigations for Other Department Elements
(CT:DS-450; 09-05-2025)
The Office of Investigations (DS/DO/INV), Office of Counterintelligence (DS/DO/CI), Office of Protective Intelligence Investigations (DS/TIA/PII), and the Office of Special Investigations (DS/DO/OSI) may provide investigative support for other Department elements such as the Bureau of Global Talent Management (GTM), the Office of Inspector General (OIG), the Bureau of Consular Affairs (CA), the Bureau of Medical Services (MED), the Office of Civil Rights (OCR), and U.S. Diplomatic posts, as requested by a chief of mission (COM).
12 FAM 221.1-3 Investigations for Other U.S. Government Departments and Agencies
(CT:DS-450; 09-05-2025)
DS may honor requests for investigative assistance abroad on behalf of other departments or agencies of the U.S. government pursuant to 22 U.S.C. 3904(3). The other department or agency may need to provide funding for such assistance. (See 4 FAM 840) This assistance should be coordinated through the Criminal Investigative Liaison Branch (DS/CR/CIL) at CrimeLiaison@state.gov. DS/CR/CIL should consult DS/EX and the Office of Legal Adviser when there are funding questions.
12 FAM 221.1-4 Criminal Investigations Abroad
(CT:DS-450; 09-05-2025)
Outside of the United States, DS conducts criminal investigations in accordance with DS statutory authority defined in Title 22 U.S. Code, Section 2709, Title 22 U.S. Code, Section 4802, and 12 FAM 226 as authorized by law.
12 FAM 221.2 Bureau of Diplomatic Security Support Agreements with Other Agencies
(CT:DS-450; 09-05-2025)
DS has memoranda of agreement, memoranda of understanding, and exchanges of letters with the investigative, law enforcement, and security offices of other U.S. government agencies. In some instances, DS may have more than one agreement with an agency depending on the subjects involved. These agreements establish the parameters of cooperation and jurisdiction between the two agencies in specified areas relating to security matters. The Policy and Planning Division (DS/MGT/PPD) coordinates all such agreements for DS and maintains files of all current agreements (see 12 FAM 053.)
12 FAM 221.3 International Criminal Police Organization (INTERPOL) and European Union Agency for Law Enforcement Cooperation (EUROPOL) Relationships
(CT:DS-450; 09-05-2025)
DS/CR/CIL serves as the Bureau of Diplomatic Security’s representative to INTERPOL and Europol. INTERPOL and Europol are liaison channels with foreign law enforcement organizations and European Union member states respectively, that provide an avenue for exchange of information and access to strategic and operational analysis on criminal and terrorist-related intelligence on behalf of the Department.
12 FAM 221.4 DS Personnel Authorized to Conduct Investigations
(CT:DS-450; 09-05-2025)
a. Special agents of the Diplomatic Security Service, credentialed security specialists assigned to the Programs Application Division (DS/IS/APD) and Office of Counterintelligence (DS/DO/CI), and credentialed special investigators and other personnel vetting practitioners (e.g., case managers, adjudicators) assigned to the Office of Personnel Security and Suitability (DS/SI/PSS), conduct investigations as authorized by statute or other authority. DS authorizes special agents to open investigations and provides direction and guidance for conducting those investigations. In some investigations at posts, checks and inquiries may be made by Foreign Service National Investigators (FSNIs) and Criminal Fraud Investigators (CFIs) upon the instructions and guidance of the responsible RSOs or OCIs.
b. The Office of Investigations (DS/DO/INV), the Office of Protective Intelligence Investigations (DS/TIA/PII), the Office of Counterintelligence (DS/DO/CI), and the Office of Special Investigations (DS/DO/OSI) as applicable, instruct, and provide recommendations to all special agents for the conduct of investigations.
c. In some investigations, RSOs may instruct post security officers within their geographic region of their responsibility to conduct limited checks and inquiries on specific cases. Post security officers are not authorized to conduct personnel vetting for suitability, fitness, national security, or credentialing.
12 FAM 221.5 Authorities
(CT:DS-450; 09-05-2025)
a. Statutes, Executive Orders, and regulations contain the authority for DS to conduct investigations, including:
(1) 22 U.S.C. 4802;
(2) 22 U.S.C. 2709; and
(3) E.O. 13526, Chapter 4.
(4) E.O. 12968, as amended.
NOTE: Subchapters 12 FAM 220, 12 FAM 550, 12 FAM 590, and 12 FAM 230 provide citations that explain specific types of investigations.
b. Criminal statutes: DS is authorized to conduct investigations relating to the protection of the Secretary of State, Deputy Secretary of State, and official representatives of the United States Government, in the United States or abroad; protection of United States Government missions abroad; protection of foreign officials, diplomatic personnel, and foreign missions in the United States; suitability for employment; employee security; illegal passport and visa issuance or use; identity theft or document fraud affecting or relating to the programs, functions, or authorities of the Department of State; Federal offenses committed within the special maritime and territorial jurisdiction of the United States (as defined in Title 18 U.S. Code, Section 7(9)), except as such jurisdiction relates to the premises of United States military missions and related residences; and other investigations, as authorized by law. Such investigations may involve allegations of criminal misconduct.
c. Policies: Most administrative investigations involve violations of Department policy or the failure to perform duties required by these policies. Frequently cited FAMs include the 3 FAM (the Department’s employee relations policies), as well as 7 FAM and 9 FAM (the Department’s visa, passport, and consular services policies).
d. The Privacy Act and SORN: 5 U.S.C. 552a, The Privacy Act of 1974 generally protects records about U.S. citizens and LPRs stored in name-retrievable systems by Federal agencies from disclosure except where permissible pursuant to exemptions contained in the Privacy Act and routine uses identified in agency System of Records Notices. Such records maintained by DS are generally governed by the System of Records Notice, STATE-36, “Security Records.”
12 FAM 221.6 Investigative Method
(CT:DS-450; 09-05-2025)
12 FAM 221.6-1 Fairness, Objectivity, and Impartiality
(CT:DS-450; 09-05-2025)
a. All investigations and interviews must be conducted in an impartial manner, to ensure fairness both to the individual being investigated or interviewed and to the Department. Any investigator who knows of circumstances about a given case that might adversely affect their impartiality or objectivity, or may give the perception that the circumstances could adversely affect the quality of the investigation, must make those circumstances known to their immediate supervisor. The supervisor and agent will decide if recusal is appropriate.
b. Investigators must only investigate persons or incidents in DS’s statutory authority. DSS agents serving on detail on a federal task force, e.g., the Joint Terrorism Task Force, may investigate persons or incidents under other federal law enforcement agencies’ authorities, consistent with applicable law and regulation.
Moreover, they must be particularly careful not to investigate persons other than the subject of the inquiry, or to create the impression that they are doing so. Occasionally, in background investigations, interest may legitimately focus on persons other than the main subject under investigation, but there must be direct and reasonable relevance of the other person’s activity to the subject’s general suitability, fitness, or loyalty (see 12 FAM 232).
12 FAM 221.6-2 Accuracy and Completeness
(CT:DS-450; 09-05-2025)
a. Reports of investigation must be complete and accurate. Unsupported conclusions, conflicting statements, or unverified allegations should be investigated further and either corroborated or refuted when the issue in question is pertinent to the purpose of the investigation.
b. In DS personnel vetting for suitability, fitness, national security, and credentialing investigations, when information of a potentially disqualifying nature surfaces, an investigator must probe further to acquire sufficient details to permit a reasonable evaluation. Investigators must investigate any incomplete record of criminal activity to obtain specific details and to determine final disposition of the matter. Investigators may seek guidance from their immediate superiors, when necessary, in furtherance of a complete and objective investigation.
c. To obtain maximum effectiveness, investigations must be well planned, carefully executed, and properly reported in a timely manner. Upon receipt of a request for a personnel investigation or collateral lead, the investigators must:
(1) Study the basic material, including any special instructions;
(2) Identify the objectives of the investigation and essential issues involved; and
(3) Determine the facts required to resolve them.
d. Investigators must abide by and follow any legal constraints relevant to an investigation. This includes any criminal or administrative due process safeguards with respect to either subjects or sources.
12 FAM 222 CRIMINAL INVESTIGATIONS DIVISION
(CT:DS-450; 09-05-2025)
12 FAM 222.1 Criminal Investigative Liaison Branch (DS/CR/CIL)
(CT:DS-450; 09-05-2025)
DS/CR/CIL coordinates investigations requested by:
(1) The Department’s Office of Inspector General (OIG);
(2) The Inspector General (IG) of any executive department having personnel at U.S. posts abroad;
(3) Other Federal, State, and local law enforcement agencies, which have primary investigative jurisdiction, but for which investigative activity is required outside the United States;
(4) A Federal agency or department having primary investigative responsibility for other criminal violations (including waste, fraud, and mismanagement cases, which fall under OIG jurisdiction); and
(5) The Department of Justice (DOJ), unless the specific case falls under the narrower purview of specialized DS offices (e.g., DS/DO/OSI or DS/DO/CI).
12 FAM 222.2 Diplomatic Security (DS) and Inspector General Relationship
(CT:DS-450; 09-05-2025)
a. Under 1 FAM 053.2-5, DS and other Department personnel shall provide assistance and information requested by the OIG.
b. In accordance with 22 U.S.C. 3929(c)(6) and 1 FAM 053.2-3 the Assistant Secretary for DS is required to submit to the Inspector General a report of the following allegations, within 5 business days of learning of the allegation:
(1) Waste, fraud, or abuse in a Department program or operation;
(2) Criminal or serious misconduct on the part of a Department employee at the FS-1, GS-15, GM-15 level, or higher;
(3) Criminal misconduct on the part of a Department employee; and
(4) Serious, noncriminal misconduct on the part of a Department employee who is authorized to carry a weapon, make arrests, or conduct searches, such as conduct that, if proved, would constitute perjury or material dishonesty, warrant suspension as discipline for a first offense, or result in loss of law enforcement authority.
12 FAM 222.3 Inquiry at Post Regarding Counterfeit Currency
(CT:DS-450; 09-05-2025)
a. Upon receiving an allegation of counterfeit U.S. currency overseas, the RSO should first communicate and coordinate with the U.S. Secret Service (USSS).
b. USSS requests for additional investigative activities to the RSO should be directed to DS/CR/CIL for coordination. RSO should generally not initiate investigations for USSS without coordinating and receiving approval from DS/CR/CIL. In cases where USSS is at Post, RSOs should notify CIL of the investigation and any coordination required in the U.S. RSOs should coordinate any questions or concerns to their International Programs (DS/DSS/IP) or High Threat Programs (DS/DSS/HTP) desk officer and DS/CR/CIL.
c. If there are allegations of counterfeit currency related to a U.S. employee cleared under Chief of Mission authority
12 FAM 223 OVERSEAS CRIMINAL INVESTIGATIONS DIVISION (DS/INV/OCI)
(CT:DS-450; 09-05-2025)
12 FAM 223.1 Responsibilities
(CT:DS-450; 09-05-2025)
The Overseas Criminal Investigations Division (DS/INV/OCI) plays an instrumental role in detecting, disrupting, and dismantling transnational criminal networks by investigating visa and passport fraud, and other crimes defined in Title 22 U.S. Code, Section 2709(a)(1), via its global network of overseas criminal investigators. DS/INV/OCI is responsible for managing the efforts of special agents and support personnel assigned to Overseas Criminal Investigations Units (OCIUs) providing policy, investigative, and budgetary guidance to OCIU personnel, and advises Regional Security Officers (RSOs) and consular chiefs on investigative support matters in relation to OCIU responsibilities and the Criminal Investigative Liaison program. DS/INV/OCI works closely with the Bureau of Consular Affairs (CA) Office of Fraud Prevention Programs (CA/FPP) and other bureaus, offices, and agencies on international investigative matters and coordinates sensitive and complex investigations being worked by OCIUs, with the headquarters office responsible for the case subject matter (e.g. DS/INV/CR, DS/TIA/PII, DS/DO/OSI, etc.). DS/INV/OCI monitors the progress and accomplishments of each OCIU and reports the results to the Office of Investigations (DS/DO/INV).
See 12 FAH-4, H-700, Overseas Criminal Investigations.
12 FAM 224 CONSULAR AFFAIRS-RELATED INVESTIGATIONS: PASSPORT, VISA, AND ISSUANCE FRAUD
(CT:DS-450; 09-05-2025)
12 FAM 224.1 Diplomatic Security Responsibilities
(CT:DS-450; 09-05-2025)
12 FAM 224.1-1 General
(CT:DS-450; 09-05-2025)
DS special agents’ law enforcement authorities are described in 22 U.S.C. 2709 and 22 U.S.C. 4802.
12 FAM 224.1-2 Criminal Investigations Division (DS/INV/CR) Responsibility
(CT:DS-450; 09-05-2025)
DS/INV/CR responsibilities are defined in 1 FAM 262.4-2(C).
12 FAM 224.1-3 Overseas Criminal Investigations Division (DS/INV/OCI) Responsibility
(CT:DS-450; 09-05-2025)
DS/INV/OCI facilitates DS/DO/INV’s mission by providing program management, oversight, and analytical support to Overseas Criminal Investigators deployed worldwide. DS/INV/OCI responsibilities are defined in 1 FAM 262.4-2(D).
12 FAM 224.1-4 Role of DS Field Offices and RSOs
(CT:DS-450; 09-05-2025)
DS field offices and RSOs are authorized to conduct criminal and administrative investigations. Refer to 12 FAH-4, The Investigations Handbook, for DS standards and procedures on DS investigations.
12 FAM 224.2 Passport Fraud Investigations
(CT:DS-450; 09-05-2025)
12 FAM 224.2-1 Authorities
(CT:DS-450; 09-05-2025)
a. DS special agents investigate passport fraud for the Department in accordance with Title 22 U.S. Code, Section 2709 and Title 22 U.S. Code, Section 4802.
b. CA/PPT exercises the Secretary’s authority to revoke or deny any U.S. passport. DSS special agents should review the passport regulations at 8 FAM and 22 CFR Part 51; the following regulations are of particular relevance to the conduct of passport fraud investigations::
(1) 22 CFR 51.60 - Denial and restriction of passports;
(2) 22 CFR 51.62 - Revocation or limitation of passports and cancellation of Consular Reports of Birth Abroad;
(3) 22 CFR 51.66 - Surrender of passport and/or Consular Report of Birth Abroad; and
(4) 22 CFR 51.7 - Passport property of the U.S. Government;
(5) 8 FAM 804.1-1 – Transmittal of Passport Revocation and Consular Report of Birth Abroad (CBRA) Cancellation Requests.
12 FAM 224.2-2 Recovery and Seizure of Passports
(CT:DS-450; 09-05-2025)
a. 22 CFR 51.7(a) states that a U.S. passport at all times remains the property of the United States and must be returned to the U.S. Government upon demand.
b. CA/FPP or CA/PPT may request DS confiscate a passport that CA/PPT issued. See 12 FAH-4 H-124.2. The Department’s authorized representative (usually the case agent) is authorized to confiscate a revoked passport. If the bearer refuses to do so, CA/PPT may invalidate the passport by notifying the bearer in writing of the invalidation (22 CFR 51.4).
c. Only CA/PPT/S/A may revoke U.S. passports. DSS agents may lawfully seize a U.S. passport pursuant to:
(1) A search warrant or other court order;
(2) Incident to arrest, when the passport has evidentiary value to an underlying crime; ;
(3) A lawful, warrantless seizure pursuant to a warrant exception when probable cause exists that the U.S. passport itself is evidence of a crime;
(4) The express consent of the subject; or
If CA intends to revoke the passport of a subject of a DS investigation, and DS has presented the case to DOJ for prosecution, the DS special agent must notify the prosecutor.
d. All property acquired by DS will be collected and treated as though it were evidence to ensure proper handling until such determination is made. Special agents may only acquire property in accordance with the law as it relates to searches and seizures, judicial forfeiture, and by voluntary delivery by the owner. Occasionally, items may be seized or taken into custody for safekeeping (i.e., high value items, illegal drugs, firearms and weapons, etc.). Special agents are not authorized to acquire property in any other manner other than by direction of CA to recover U.S. passports.
e. The procedural aspects of passport seizure by a DS special agent are contained in 12 FAH-4 H-120. That section contains important information as well as relevant timelines for notification to the Department of the seizure.
f. For more information on passport revocations, see 8 FAM 804, Revocation.
g. DS may receive recovered U.S. passports from different sources, such as local law enforcement, local governments, airlines, and transportation centers. To maintain the integrity of the U.S. passport as a secure travel document, CA/PPT makes every effort to account for the final disposition of all U.S. passports. Therefore, DS should mail all found or recovered (not seized or confiscated) U.S. passports to CA/PPT at:
|
U.S. Department of State Office of Adjudication (CA/PPT/S/A) 44132 Mercure Cir PO Box 1199 Sterling, VA 20166-1199 |
NOTE: In instances where fraud is suspected or has been established, DS special agents should coordinate with CA/FPP.
12 FAM 224.3 Visa Fraud Investigations
(CT:DS-450; 09-05-2025)
12 FAM 224.3-1 Authorities
(CT:DS-450; 09-05-2025)
DS special agents investigate visa fraud for the Department in accordance with Title 22 U.S. Code, Section 2709 and Title 22 U.S. Code, Section 4802. Refer to 12 FAH-4, The Investigations Handbook, for standards and procedures for DS visa fraud investigations.
12 FAM 224.4 Consular Malfeasance Investigations
(CT:DS-450; 09-05-2025)
12 FAM 224.4-1 General
(CT:DS-450; 09-05-2025)
a. Investigations of alleged consular malfeasance by Department employees fall within the purview of the Criminal Investigations Division (DS/INV/CR), which may request participation by the Overseas Criminal Investigations Division (DS/INV/OCI).
b. Some activities that fall within this area are violations of Federal criminal law whereas others constitute violations of Federal regulations and/or Department administrative and procedural policy.
c. DS/INV/CR is authorized to delegate, assign, direct, coordinate, and review for sufficiency all investigations of consular malfeasance. During the course of an official investigation, DS/INV/CR special agents or special agents acting under DS/INV/CR's authorization and direction may:
(1) Conduct voluntary interviews with employees, or with authorization from the Deputy Assistant Director for the Office of Investigations (DS/DO/INV) and the Department’s Office of the Legal Adviser (L/M/DS), require an employee to participate in a compelled interview to respond orally and/or in writing to material and relevant questions related to the performance of their official duties and/or to any questions related to matters within DS/INV/CR’s investigative mandate;
(2) Require employees to produce and/or grant access to all official records and related documents or material;
(3) Require employees to produce and/or grant access to all U.S. Government property including all communications equipment;
(4) Require employees to appear at a location designated by the case agent assigned to a DS/INV/CR investigation, in connection with an official inquiry;
(5) Direct employees to maintain the confidentiality (through use of Form DS-7678) of any information possessed or coming to the attention of the employee concerning DS/INV/CR inquiries to the extent that such directives neither prohibits nor infringes on the employee’s legal rights;
(6) Carry special protective equipment (SPE) in all Department locations in the performance of their official duties; and
(7) As authorized under 5 U.S.C. 303, to administer an oath and take sworn testimony during the course of an investigation.
12 FAM 224.4-2 Consular Malfeasance Investigations Assignment and Control
(CT:DS-450; 09-05-2025)
DS/INV/CR and DS/INV/OCI, as applicable (see 12 FAM 224.3-1 above), have responsibility for initiating, directing, and closing all investigations of cases of consular malfeasance. Special agents should rely on guidance and direction from DS/INV/CR in the conduct of consular malfeasance investigations.
12 FAM 224.4-3 Controls and Administrative Guidance
(CT:DS-450; 09-05-2025)
12 FAM 224.4-3(A) “Need to Know” Policy
(CT:DS-450; 09-05-2025)
Because consular malfeasance cases may involve allegations of criminal activity or other misconduct by Department employees, special agents should limit dissemination of the information. Limit knowledge of the initial allegations and subsequent investigative efforts only to individuals with a “need to know.” This policy protects both the integrity of the investigation and the privacy of the employee concerned.
12 FAM 224.4-3(B) Release of Case Documents
(CT:DS-450; 09-05-2025)
DS/INV/CR may approve the release of any documentation pertaining to a consular malfeasance investigation in accordance with Department SORNs.
12 FAM 224.4-3(C) Report of Allegations
(CT:DS-450; 09-05-2025)
All DS offices and agents, including those assigned overseas, must report every allegation of consular malfeasance, including those identified by another U.S. law enforcement agency, directly to DS/INV/CR. DS/INV/CR is responsible for notifying, when appropriate, CA’s Consular Integrity Division (CA/FPP/CID).