The Military's Own Covert Army

Introducing: The 1st Capabilities Integration Group (Airborne)

From William Arkin and Marc Ambinder

We start our journey with the most secret government organization there is, more opaque than the CIA, protected by a special access program (SAP) not acknowledged by the government, cloaked with a variety of codenames and cover names that change regularly.

It’s the Army’s covert army: the 1st Capabilities Integration Group (Airborne), or the 1st CIG.

The 1st CIG is at the top of a list of more than 600 secret governmental organizations, ones you literally can’t search for online because no one has published anything about them (yet), and it’s part of an empire of more than 100 current special access program we’re tracking. (This is just the start of our efforts to get through this maze. It’s designed so that no one can ever finish!)

Yes, of course, there exists in the world outside of Plato’s cave properly classified national security information about technical capabilities, “troop movements,” and about intelligence sources and methods; the revelation of those could cause harm to the United States. Those secrets are cool to know, but they tend to interest adversaries, and they aren’t what we’re curious about. 

But secrets like the mere existence of the 1st CIG? It's an absurd tradition and a function of self-selection to be this tippy-top secret; the protection of national defense is incidental. In fact, as we’ll demonstrate over and over, so many of these secret organizations and programs distort and undermine U.S. foreign policy, threaten stability (even strategic (nuclear weapons) stability), hide questionable or even illegal practices, or just bureaucratically protect those who manage to achieve secret status from scrutiny and oversight.

About the 1st CIG

Over the  past several decades, writers have called the 1st CIG ‘the Secret Army of Northern Virginia’, the Intelligence Support Activity, ‘The Activity,’ Task Force Orange, and Gray Fox – all somewhat correct in the day but also not quite getting it exactly right at the moment and never really explaining what they do, who they do it for, what’s so special and different about them, and finally, what the huge degree of secrecy is all about.

The  headquarters of the 1st CIG is tucked at the intersection of Telegraph Road and Jeff Todd Way in Alexandria, Virginia, set back behind dense shrubs and three sets of cyclone fences, in a remote area of Ft. Belvoir. The brigade occupies another six buildings on Ft. Belvoir and its adjacent Davison Army Airfield.

The 1st CIG is a brigade-sized Army intelligence-gathering unit, an army within an army (within the Army). With over 2,000 personnel assigned to a variety of cover units that make up the 1st CIG, it falls under the administrative control of Army headquarters and its Intelligence Security Command (INSCOM) and under the operational control of the U.S. Special Operations Command (SOCOM).

• (Special note: pay attention to this bureaucratic trilogy: the Administrative control (ADCON), Operational control (OPCON) and Tactical control (TACON) distinctions will be important for understanding future secrets!)

It’s become settled lore that the 1st CIG is a wholly owned part of, or subordinate to the not-quite-so-secret Joint Special Operations Command (JSOC), the collection of special mission units and classified standing joint task forces.

That’s not quite accurate.

What is true, is that 1st CIG spends a lot of time working for SOCOM proper, gathering intelligence for SOCOM’s core mission sets, and the funds to improve its facilities often come from SOCOM’s budget, rather than the Army’s.

Sometimes the 1st CIG works with the CIA or intelligence agencies, some of them still secret, and sometimes it conducts what can only be called “national” missions, at the direction of the Secretary of Defense or the President.

While it is proper to call the 1st CIG an intelligence organization, it does more than traditional reconnaissance, SIGINT and HUMINT collection, and cyber operations.

It’s best thought of as an army of spies, of covert operators who can penetrate war zones and countries using cover identities separate from the special operators and the Army and not even the United States, spying, targeting, cajoling, bribing, breaking and entering, emplacing sensors and wiretaps and then silently tracking.

These operators are the vanguard to spy on hostage-takers and terrorists, drug runners and revolutionaries, transnational criminal organizations and political insurgents, war criminals and heads of state. “Close-in” collection is linked to exploitation teams able to collect and exploit signals, media, documents, cell phones, weapons and bomb making materials.

In 2002, the Pentagon placed the unit under the tactical control of JSOC. But as the technologies of close-in collection became more widely available, JSOC developed its own capabilities supporting their own operations, and the Army and NSA jointly developed their  own clandestine SIGINT organization, too; other parts of the military created their own “technical support” units, leaving the 1st CIG as the experienced but separate entity it is today. (An excellent history of the unit, mostly before 9/11, is Michael Smith’s Killer Elite, updated in 2018).

In his book “Relentless Strike,” Sean Naylor notes that, to the generals and admirals at SOCOM, the 1st CIG (then loosely called by its first official name, the Intelligence Support Activity, or ISA) was seen primarily as the “tactical arm” of the National Security Agency, performing CLANSIG (clandestine SIGINT) and CANEX – that is, close access network exploitation tasks – putting the USB drives, the listening devices, the taps – on actual infrastructure – computers, phones, routers – in denied areas.  

Today, the 1st CIG performs what’s called “national missions.”

After 9/11, the 1st CIG prepared the battlefield for the war against foreign violent extremists, though a legacy drug-interdiction mission in Latin America continued. Around 2013, a good part of  the unit’s work began focusing more on operations in and against “denied countries” – Iran, North Korea and China. 

Today, the 1st CIG operates from about 15 locations globally, and its inventory includes a dozen low-profile or even covert special mission aircraft. Logisticians handle roughly $750 million worth of secret squirrel material per year. 

The unit is made up of four battalions (the 1st through 4th), various mission support units, a cyber operations squadron, and a “technology operations squadron.”

Although trained in the basics of special operations and direct action, most assigned personnel are uniquely multilingual,  and, without putting too fine a point on it, tend to look ethnically ambiguous. They are selected for the unit because of their raw intelligence, primarily, and their ability to coax people into doing things they otherwise would not do.  That has allowed 1st CIG operators to be placed under deep cover, acting, in essence, as CIA case officers operating unofficially in war zones.

The CIA would not – it does not – like this comparison; just ask any CIA officer about this organization, and if you get an answer at all, you’ll get an earful about the difference between CIA case officers and the 1st CIG.

One is that the 1st CIG’s cover missions are not linked to embassies; they are deniable. And they tend to be shorter, in duration, than a case officer’s tour. And over time, folks are promoted or shifted out of this special unit, which means that the shelf life of a 1st CIG operator is much shorter than that of a CIA officer.

Still, the 1st CIG’s HUMINT operators are  trained alongside CIA case officers in Virginia, North Carolina, and Colorado.  (And they tend to be good: as Naylor notes, not a single member of 1st CIG(A)’s cover was blown during the first few years of U.S. operations in Syria.) 

As a “national” unit, the 1st CIG is tasked to do things that the CIA doesn’t, that JSOC doesn’t, that the joint Army/NSA unit doesn’t, that the Special Collection Service doesn’t, though over the years, deconfliction of all of these units – and even basic accountability – has been a constant problem.

But when only a select few can even know about the unit, it’s even harder overall to untangle the many competing and overlapping elements, the rules of the road buried in secrecy. 

In the last decade, the NSA, the Army, JSOC, and its various subordinate units have all created their own close-in SIGINT and reconnaissance elements, raising the question of what the 1st CIG is really for, and what, as part of the military, that it really represents. It’s hard to not see it as a national covert action element, covert because the unit is officially unacknowledged and in some ways it is more secret even than the CIA; and national, because its legacy and missions indicate that it operates clandestinely in Latin America, Africa, and the Middle East conducting taskings outside of any military OPLANs. Given that the CIA has its own quasi-military special operations force, it isn’t any longer clear what niche the 1st CIG fits. And it begs the question of whether the military should have a covert force at all.