Document Exploitation

Document Exploitation (DOCEX) is the set of procedures used by the United States Armed Forces to discover, categorize, and use documents seized in combat operations. In the course of performing its missions in the War on Terrorism, members of the United States Armed Forces discover vast amounts of documents in many formats and languages. When documents are suspected of containing information of potential intelligence value, rapid and accurate interpretation of the information identifies targets, bolsters success in subsequent operations, and enhances tactical and strategic all-source intelligence efforts. The sheer volume of documents acquired in the course of military operations can overwhelm a unit's capability to extract meaningful information in a timely manner.

Paratroopers of the 82d Airborne Division secure documents after a raid in Afghanistan

Paratroopers of the 82d Airborne Division secure documents after a raid in Iraq

A DOCEX facility was also operated by the Secure Evidence Unit (SEU) of the Iraqi High Tribunal to extract evidence from seized Iraqi regime documents. Over 6 million pages were processed resulting in numerous execution orders and other incriminating documents being made available to the court. This Docex facility differed in that it was operated mostly by Iraqis with international management. This facility was focused on evidence rather than intelligence as most documents seized dated from the 1980s.

Definitions

DOCEX is the systematic extraction of information from threat documents for the purpose of producing intelligence or answering information requirements. A threat document has been in the possession of the threat, written by the threat, or is directly related to a future threat situation. DOCEX can occur in conjunction with HUMINT collection activities or as a separate activity.[1]

A document is any piece of recorded information regardless of form. Documents include printed materials (books, magazines, pamphlets, maps), official records (government or military origin), currency, maps, blueprints, personal information (diaries, notebooks, journals, photographs, letters, invoices, bank statements), electronically recorded media (computer files, tape recordings, video recordings) and all electronic equipment used to generate or store electronic media (cell phones, computers, cameras, PDAs).

For the purpose of this entry, DOCEX is considered a military field activity conducted in conjunction with combat operations and separate from Document and Media Exploitation (DOMEX). DOMEX is the processing, translation, analysis, and dissemination of collected hard copy documents and electronic media which are under the U.S. Government's physical control and are not publicly available. This definition of DOMEX excludes: handling of documents and media during the collection, initial review, and inventory process; and documents and media withheld from the U.S. Intelligence Community DOMEX dissemination system in accordance with agreements and policies sanctioned by the Director of National Intelligence to protect sources and methods.[2] For the purpose of this entry, DOMEX is considered a multi-organizational activity under the oversight of the DOMEX Committee composed of senior executives of the National Media Exploitation Center, Defense Intelligence Agency (as executive agent), Central Intelligence Agency, Federal Bureau of Investigation, Defense Cyber Crime Center, United States Army, National Security Agency, Drug Enforcement Administration and Department of Homeland Security.

DOCEX Process

The DOCEX process occurs at the lowest echelons possible to facilitate rapid exploitation of captured materials. Service members gain fundamental knowledge of the DOCEX process via common skills training, such as the U.S. Army's Basic Leader Course. The initial intake of captured enemy documents (CED) is performed at the company level by a DOCEX Site Exploitation Team and first analysis of CED is performed by military intelligence personnel assigned to battalion or brigade level DOCEX Support Teams. Actionable information gained through battalion or brigade level DOCEX assets is reported back to the unit that captured the information as expeditiously as possible to fulfill immediate intelligence requirements. The processing of CED progresses from the lowest echelon to the highest, undergoing multiple information extraction applications that increase in complexity and sophistication until the information is categorized as DOMEX under the auspices of the U.S. Intelligence Community and the Director of National Intelligence. The sequence of events in the DOCEX process as performed by a DOCEX Site Exploitation Team is as follows:

1. Receive, Tag
2. Categorize, Inventory, Log
3. Screen
4. Sight Translation (Hybrid Translation/Interpretation)
5. Analyze
6. Report

1. Tag

Document accountability begins the moment the document is received into U.S. possession. Original documents must not be marked, altered or defaced and the capturing unit must attach a DD Form 2745 (Enemy Prisoner of War Capture Tag) to each document. Ongoing combat operations suspends this requirement (to tag a document) until cessation of hostilities. All CEDs are placed in weatherproof containers and the containers are marked with a DTG, name of the capturing unit, identity of the source(s) of the CEDs, and a summary of conditions and circumstances under which the CEDs were obtained.

2. Categorize, Inventory, Log

The first DOCEX unit to receive CEDs will categorize and inventory all CEDs. Captured enemy documents are assigned file numbers and the following information is logged: name of capturing unit, file number, DTG the CEDs were received by the DOCEX unit, description of the CEDs, destination of outgoing transmittals of CEDs and pertinent remarks. Proper categorization and inventory of captured enemy documents ensures strict accountability and preserves evidentiary value.

3. Screen

Document screening is the rapid but systematic evaluation of documents to determine which documents contain priority information. Selected priority documents will be exploited immediately to meet intelligence collection management priorities. For screening purposes, CEDs are considered unclassified unless originated in the U.S. and/or allied nation(s), and are marked classified. The document screening phase is an integral step in the DOCEX process as screening determines applicability of a variety of exploitation treatments and procedures. Interpreters and qualified intelligence analysts working alongside communications and information technology specialists decide the DOCEX course of action during the screening phase. Complete translation is not required at this phase of the DOCEX process, but sufficient translation of documents is required to determine significance and relevance to priority intelligence requirements.

4. Translate

Translations in and of themselves are not intelligence reports, but translation is a precondition for DOCEX. Translation reports must include: where the report will be sent, which unit prepared the report, DTG of the translation, document serial number and description of the document, name of translator, type of translation (full, extract or summary), remarks for clarification and classification (if applicable).

5. Analyze

Analysis of CEDs produces intelligence and involves three steps: assessment, integration and deduction.

• Assessment – The sifting and sorting of evaluated information to update significant themes with respect to current and imminent operations and commander's intent. Intelligence information deemed urgent will be disseminated at this stage prior to further processing.
• Integration – The combination of newly developed information isolated in the assessment phase with known information to develop an overall picture or hypothesis of enemy activities or environmental factors influencing the area of operation.
• Deduction – Conclusions are drawn from the comparison of CED data with known information to bring about meaningful relations among enemy situations, the area of operation, commander's intent and force protection.

6. Report

Information collected from CEDs is normally reported in a SALUTE report or Intelligence Information Report (IIR) (SALUTE = Size, Activity, Location, Unit, Time, Equipment). The IIR is the most widely recognized and accepted format within the Intelligence Community, and is typically generated at higher echelons, such as division, corps or theater commands. SALUTE reports are also referred to as SPOT reports or SPOTREPS and are expeditious reports to provide timely intelligence or status updates regarding events that could have an immediate and significant effect on current planning and operations. Tactical commanders, interrogators and intelligence analysts contribute content for SALUTE reports and IRRs.

DOCEX Equipment

Items typically utilized by tactical DOCEX Site Exploitation Teams or DOCEX Support Teams include:[3]

• Kodak Model 500D Document Scanner
• Fujitsu Model 3906GX Flatbed Scanner
• NEC 6050T Portable PC w/Docking Stations 6000+
• Digital Camera Kits
• Scangraphics Model SGS8000 Wide Format Scanner
• HP Deskjet 340 Portable Printers

References

1. Army Public Affairs
2. FAS
3. Global Security