TARP Answers — Threat Awareness and Reporting Program

The expansion is historically correct, but the PROGRAM NO LONGER CARRIES THIS NAME. Effective 13 July 2025, AR 381-12 (13 June 2025) renamed it from the Threat Awareness and Reporting Program (TARP) to Counterintelligence Awareness and Reporting (CIAR). "TARP" appears nowhere in the current regulation. Soldiers searching "TARP" are looking for what is now called CIAR.

AR 381-12, Threat Awareness and Reporting Program.

To educate and train all Department of the Army (DA) personnel to recognize and report threats from espionage, international terrorism, sabotage, subversion, and other intelligence-related activities directed against the U.S. Army.

All DA personnel including active duty soldiers, Army National Guard, Army Reserve, DA civilians, and all supporting contractors with access to Army facilities or information.

Course ID refinement: the current AR 381-12 (13 June 2025), para 3-2b names "Counterintelligence Awareness and Reporting for DoD Employees" - CI116.16 (not CI116), hosted at cdse.edu.

A person with authorized access to U.S. government resources who uses that access to harm the security of the United States. This includes espionage, terrorism, unauthorized disclosure of classified information, or actions that could threaten the health and safety of the workforce.

Espionage, international terrorism, sabotage, subversion, and theft or illegal diversion of military technology.

The act of obtaining, delivering, transmitting, communicating, or receiving information about the national defense with intent or reason to believe that it will be used to the injury of the United States or to the advantage of a foreign nation.

A technique used by foreign intelligence entities to subtly extract information from people during what appears to be normal and innocent conversation. The target may not even realize they are being pumped for information.

Flattery, false statements to provoke a correction, appealing to ego, sharing false or sensitive information to encourage reciprocity, deliberate provocation, feigning ignorance, and asking leading questions in a casual setting.

A counterintelligence technique where a person uses romantic or sexual relationships to compromise an intelligence target and extract classified information or recruit them as an agent.

As soon as possible, typically within 24 hours of the observation or event.

Your chain of command, security manager, or Military Intelligence/Counterintelligence (CI) personnel. You can also report through the iSalute portal or by calling the Army CI hotline.

A web-based system that allows Army personnel to submit online reports of suspicious activity, foreign contacts, and other counterintelligence-related information.

Any contact with a known or suspected foreign intelligence officer, any request for classified or sensitive information by unauthorized persons, attempts to recruit you as a source, suspicious approaches at conferences or trade shows, and any unexplained contact with foreign nationals that seems intelligence-related.

All personal foreign travel must be reported to your security manager or command. This includes travel to countries that are known intelligence threats, and any suspicious contacts during foreign travel.

Persistent contact by a foreign national who is overly interested in your work, unexpected invitations to social events by foreign nationals, unsolicited gifts or offers of financial assistance, requests to provide information outside official channels, and being approached at conferences or professional events.

They create fake profiles to establish relationships with military and government personnel, use social engineering to extract information, monitor open-source postings about military operations or capabilities, and identify potential recruitment targets based on vulnerabilities revealed online.

A foreign intelligence service (FIS) is a government-run intelligence organization. A foreign intelligence entity (FIE) is broader and includes any foreign government or non-government entity that engages in intelligence activities directed against the United States, including terrorist organizations and foreign corporations.

Do not provide any information. End the conversation politely. Report the contact immediately through proper channels. Document as many details as possible including the person's description, what was discussed, and any business cards or contact information provided.

Actions designed to undermine the military, economic, psychological, or political strength of a nation. It includes attempts to influence military personnel to violate their duties or act against the interests of the United States.

An act or acts with intent to injure, interfere with, or obstruct the national defense by willfully destroying, damaging, or obstructing national defense material, premises, or utilities.

Even if a person has a security clearance, they should only be given access to classified information that they need for the performance of their official duties. Unauthorized sharing of classified information — even with cleared personnel — can constitute a security violation.

Working unusual hours without authorization, unexplained affluence, interest in matters outside job responsibilities, unauthorized removal of classified material, excessive copying of sensitive documents, attempts to bypass security procedures, and significant changes in behavior or lifestyle.

A phone line available for reporting suspicious activity and potential counterintelligence threats. Personnel can call to report concerns anonymously if needed.

Failure to report can result in UCMJ action for military personnel, disciplinary action for civilians, and potential criminal prosecution. It may also enable foreign intelligence activities that harm national security.

The unauthorized or illegal transfer of sensitive or classified military technology, equipment, data, or know-how to a foreign entity, whether by espionage, theft, or circumvention of export controls.

Human intelligence (HUMINT) through agents and elicitation, signals intelligence (SIGINT) through electronic eavesdropping, cyber operations targeting networks and systems, open source intelligence (OSINT) from public information, and technical surveillance.

When a foreign intelligence officer misrepresents their true affiliation or nationality during a recruitment attempt — for example, claiming to work for an allied nation's intelligence service when they actually work for a hostile nation.

Any unusual or persistent interest in your work, any requests for information that seems beyond normal professional exchange, any offers of gifts, travel, or hospitality that seem excessive, and any attempts to establish personal relationships that feel manipulative.

CI identifies, deceives, exploits, disrupts, or neutralizes foreign intelligence entities, insider threats, and terrorist organizations that threaten the U.S. Army, DoD, or national security.

OPSEC is the process of identifying critical information, analyzing threats and vulnerabilities, and applying countermeasures to deny adversaries information about friendly activities. TARP awareness supports OPSEC by helping personnel recognize when foreign entities are attempting to collect such information.

Observable actions, conditions, or information that suggest foreign intelligence activity, insider threat behavior, or terrorist planning. Recognizing indicators is the first step in threat reporting.

Yes. Foreign intelligence entities actively collect unclassified information including organizational charts, personnel directories, training schedules, and technical manuals. Aggregation of unclassified information can reveal classified capabilities.

When individually insignificant pieces of unclassified information are combined to reveal classified or sensitive information about military capabilities, operations, or vulnerabilities.

Phishing emails designed to steal credentials, social engineering attacks, malware targeting military networks, unauthorized access to information systems, and data exfiltration by insiders or foreign actors.

Do not click any links or open attachments. Report it to your Information Assurance (IA) officer or security manager. Do not forward it to others. Document the sender's information.

TARP addresses external threats (foreign intelligence, terrorism) while the Insider Threat Program focuses on threats from within the organization. Both require awareness and reporting, and an insider can be recruited by an external foreign intelligence entity.

Financial difficulties, substance abuse, relationship problems, disgruntlement with employer, ego/desire for recognition, ideology, and susceptibility to blackmail or compromise.

Money, Ideology, Compromise (or Coercion), and Ego.

Under 18 U.S.C. 794, espionage can be punished by death or imprisonment for any term of years, including life.

TARP replaced Subversion and Espionage Directed Against the U.S. Army (SAEDA) to expand the scope of threat awareness beyond just espionage to include terrorism, sabotage, subversion, and technology theft.

OUTDATED. The current AR 381-12 (13 June 2025) contains no reference to ALMS and does not designate an "only authorized alternative." Para 3-2b now directs: DA personnel will complete "Counterintelligence Awareness and Reporting for DoD Employees" - CI116.16, located at https://www.cdse.edu/, to satisfy Army annual training requirements. The 2025 revision expressly removed the train-the-trainer certification and standard briefing tool requirements.

Within 30 days of assignment and annually (every 12 months) thereafter.

Being invited to attend a conference in a foreign country; Becoming romantically involved with a foreign national

Hackers; State-sponsored computer experts of foreign nations; Foreign Corporations

Assessing