Skip to content
Irregularpedia Logo Irregularpedia

Incident Response — Clearance Holder (Personal or Family Incident)

SEAD-4 (Continuous Evaluation) — common self-reporting triggers

Section titled “SEAD-4 (Continuous Evaluation) — common self-reporting triggers”

Paraphrased, not legal advice. Defer to your security manager for the specific list applicable to your program.

  • Coercion-capable events: NCII targeting you or an immediate family member, financial distress, arrests, foreign contacts, gambling problems, substance use, mental-health hospitalization.
  • Adverse contact with a foreign national.
  • Suspected attempt by anyone to elicit classified or sensitive information.
  • Use of unauthorized digital services (personal email, consumer messaging) for official information.
  • Foreign travel — before AND after, per program rules.
  • Significant personal-life changes (marriage, divorce, cohabitation, bankruptcy).
  • See your security manager for the EXACT reportable-event list for YOUR program. Different programs (SAP, SCI, Q, L) have different matrices.

Counterintelligence reporting channels by service

Section titled “Counterintelligence reporting channels by service”
  • Army: SAEDA — AR 381-12. Report to local CI element OR Army CI hotline 1-800-CALL-SPY (1-800-225-5779). Available 24/7.
  • Air Force / Space Force: OSI Tip Line — osi.af.mil; report via I-WATCH (Eagle Eyes/iWatch); local OSI detachment.
  • Navy / Marine Corps: NCIS Tipline 1-877-579-3648; ncis.navy.mil; NCIS Tips app (iOS/Android).
  • Coast Guard: Coast Guard Investigative Service (CGIS) — local field office.
  • DCSA (Defense Counterintelligence and Security Agency): overall DOD CI/clearance authority; dcsa.mil.
  • DOD IG Hotline: 1-800-424-9098, dodig.mil/hotline. For fraud, waste, abuse, mismanagement, or major CI concerns.
  • NCSC (National Counterintelligence and Security Center) reporting line: dni.gov/ncsc.

FIE indicators relevant to NCII / personal incidents

Section titled “FIE indicators relevant to NCII / personal incidents”

When does a personal incident cross into a CI concern?

  • Tailored timing: right before deployment, before a read-on, before sensitive travel, before a high-visibility assignment.
  • Foreign-affiliated infrastructure: the platform hosting the abuse, or the contact making demands, traces to Russia, China, Iran, North Korea, or any state with hostile intelligence services.
  • Unsolicited “professional” approach: LinkedIn / professional-channel message from a stranger that name-drops your specific role or program.
  • Repeated “social” encounters with foreign nationals showing surprising interest in your work (especially at conferences, embassies, alumni events).
  • Family-member contact: a relative gets contacted by an unfamiliar foreign account specifically about you.
  • Material with leverage potential: anything that could be used to embarrass or coerce (NCII, financial irregularities, addiction-related, extramarital, mental-health, family-member legal trouble).

Any one of these does not necessarily mean FIE. Two or more together = report and let CI assess. CI’s job is to evaluate; your job is to surface the signal.

Talking to your security manager — what to share, what to hold back

Section titled “Talking to your security manager — what to share, what to hold back”

Share (these are materially relevant):

  • Factual timeline of the incident.
  • What you have done (steps taken, reports filed, advocates contacted).
  • What you plan to do next.
  • Any FIE indicators or unusual contacts.
  • Honest assessment of coercion potential.

You generally do not need to volunteer (talk to JAG if unsure):

  • Detailed identity of involved family members beyond what’s necessary.
  • Content of any sensitive imagery or communications.
  • Speculation about motives or relationships.
  • Information about other people that is not material to your reporting obligation.

Talk to JAG Legal Assistance, your security manager, or DCSA legal counsel if the line is unclear. JAG consultation is free.

Family-member side — parallel track

Section titled “Family-member side — parallel track”

The underlying NCII playbook lives at /cybersecurity/incident-response/image-based-abuse. Your daughter (or whoever was targeted) should follow it with CCRI advocates.

Free family support resources:

  • Military OneSource — 1-800-342-9647 — includes counseling for adult dependents.
  • MFLC (Military Family Life Counselor) — free, confidential, on-installation, includes adult family.
  • JAG Legal Assistance — your dependents are eligible for free legal counsel for many civil matters (state varies on whether non-spouse adult dependents are eligible — ask).
  • For NCII specifically: CCRI Helpline 1-844-878-2274.

Coordinate with the family member on disclosure timing — sometimes “wait 24 hours, let her sleep” is right; sometimes “I need to report now and you should know first” is right. The family member’s wellbeing comes first; your reporting obligation comes second; the two are usually compatible within the same business day.

Coercion-resistance hygiene — practical steps

Section titled “Coercion-resistance hygiene — practical steps”
  • Tell your spouse and adult immediate family BEFORE adversaries can leverage. The secret being public is the cure.
  • Send your security manager a brief written statement (email, properly classified channel): “Incident occurred [date/scope]. I have reported to [list]. I will provide updates if material changes.” Creates a record that protects you.
  • Tighten OPSEC for the next 90 days. Adversaries who try once often retry through different vectors — review your social-media footprint, your home address exposure, who has your personal phone number.
  • Audit your dependents’ OPSEC too. If a hostile service used your daughter as a lever once, they may try a sibling, parent, or close friend next.
  • Document any subsequent unusual contacts (recruiter messages, unfamiliar professional outreach, “coincidence” meetings) — even if they seem innocuous in isolation. The pattern matters more than any single event.

What this is NOT

Section titled “What this is NOT”

Clarifying so people do not over- or under-report:

  • SEAD-4 reporting is NOT a punishment. It is a normal continuous-evaluation requirement designed to give your security manager and adjudicators the full picture. Most reported events have NO clearance impact.
  • You are NOT required to volunteer information that has no plausible nexus to coercion, foreign influence, or your fitness for the clearance.
  • You ARE required to report categorical events listed in your program’s reportable-event matrix. If unsure, err on the side of reporting and ask JAG.
  • Most personal incidents do NOT involve FIE. Report on the merits when indicators exist; do not invent threats that aren’t there.
  • Self-reporting is treated favorably across decades of adjudication history. Concealment that comes out later is what generates adverse action.

Reporting

Section titled “Reporting”
ScenarioFirst callSecondaryLegal/regulatory
Suspected FIE contact / approachLocal CI element OR Army CI 1-800-CALL-SPY (or branch equivalent)DCSA; DOD IG 1-800-424-9098AR 381-12 / SAEDA
Coercion-capable personal eventSecurity manager same daySEAD-4 continuous-evaluation portal (program-specific)SEAD-4
Family NCII targeting clearance holderCCRI 1-844-878-2274 (family member) + Security manager (you)StopNCII.org / Take It Down; platform reportsCivil suit (state law); SEAD-4 reporting; SAEDA if FIE indicators
Foreign travel notificationPer program-specific portal/processSecurity managerSEAD-3 (Foreign Travel) for some programs
Active suicidal thoughts (you or family)988 (call/text)Military Crisis Line 988 + 1; Military OneSource 1-800-342-9647—
Substance use you want to addressMilitary OneSource referral to ASAP / treatment programChaplain (confidential)SEAD-4 reporting (after seeking help is generally treated favorably)
Domestic-violence incidentFamily Advocacy Program (FAP) on installationNational DV Hotline 1-800-799-7233; Military OneSource—

Pivot to

Section titled “Pivot to”