Official U.S. Intelligence And Law Enforcement Source Register

UNCLASSIFIED//OPEN SOURCE

See Source Registers hub and Documentation Index.

Source Register ID: WI-SOURCE-REGISTER-USILE-2026-0001

Prepared UTC: 2026-06-18T11:54:34Z

Information cutoff UTC: 2026-06-18T11:54:34Z

Source base: ODNI, CIA, FBI, DHS, CISA, NSA, State, Treasury, DOJ, DEA, ATF, CBP, Coast Guard, NGA, congressional, sanctions, border, cyber, counterterrorism, counternarcotics, law-enforcement, and geospatial official public source families.

Analytic confidence: High for source-family routing and issuer identity. Moderate for individual page currency and case-level completeness pending dated source refreshes.

Purpose: Organize official U.S. intelligence, homeland security, law enforcement, sanctions, border, cyber, counterterrorism, counternarcotics, and geospatial source families for WARLOCK-INDEX strategic threat analysis.

Boundary: This register supports public strategic research only. It does not provide recommendations, targeting support, collection tasking, investigative direction, operational planning, enforcement guidance, tactical instructions, surveillance guidance, informant handling, route selection, technical exploitation, or domestic political profiling.

Framing Rule

WARLOCK-INDEX does not create a political "enemies list." This register uses official public threat categories: foreign states, foreign intelligence services, terrorist organizations, nonstate armed networks, transnational criminal organizations, cyber actors, sanctions targets, border and maritime threat vectors, weapons of mass destruction concerns, and domestic terrorism or domestic violent extremism where official sources define those categories.

Domestic threat coverage must remain tied to violence, criminal conduct, official public definitions, and civil liberties boundaries. It must not treat lawful dissent, protected speech, religion, ethnicity, nationality, political identity, journalism, protest, or association as an intelligence target.

Core Official Source Families

ODNI Annual Threat Assessment

• Source class: A
• Publisher: Office of the Director of National Intelligence
• Current repository anchor: ODNI Annual Threat Assessment 2026
• URL: https://www.dni.gov/files/ODNI/documents/assessments/ATA-2026-Unclassified-Report.pdf
• Use: Public Intelligence Community baseline for foreign adversaries, terrorism, cyber, space, WMD, regional instability, and homeland-relevant threat framing.
• Reliability note: Authoritative for public IC framing. It is a public assessment with release constraints and should be cross-read with agency source packets for domain detail.

ODNI Global Biolab Program Disclosure

• Source class: A
• Publisher: Office of the Director of National Intelligence
• Publication date: 2026-06-12
• URL: https://www.dni.gov/index.php/newsroom/press-releases/press-releases-2026/4163-pr-10-26
• Linked evidence artifact: https://www.dni.gov/files/BIOLAB_Slides.pdf
• Use: Official public ODNI source event for biolab, biosecurity, Ukraine-war, WMD/proliferation, oversight, and information-resilience source treatment.
• Reliability note: Authoritative for ODNI issuer perspective and the existence of the public release. It does not by itself settle individual facility, research, funding, legality, safety, or disinformation claims. WARLOCK-INDEX should use the dedicated source-treatment note before incorporating this disclosure into later products.
• Boundary: Do not reproduce biological methods, biological-material lists, facility tables, contractor details, site identifiers, vulnerability analysis, targeting support, or collection guidance.

CIA World Leaders

• Source class: A
• Publisher: Central Intelligence Agency
• Publication cadence: CIA states that the directory is updated weekly.
• URL: https://www.cia.gov/resources/world-leaders/
• Use: Foreign government leadership, cabinet, ambassador, and permanent representative reference source.
• Reliability note: Authoritative public CIA reference for foreign leadership directory use. It is not a threat assessment and should not be converted into targeting or personal dossiers.

CIA World Factbook And CIA Maps Legacy Source

• Source class: A
• Publisher: Central Intelligence Agency
• Status note: CIA announced in February 2026 that The World Factbook had sunset. It remains useful as legacy context only where archived material is available and where a dated product can identify the cutoff.
• URL: https://www.cia.gov/the-world-factbook/
• Use: Legacy country, geography, demographic, economic, and map context; current country facts should be refreshed through State Department, CIA World Leaders, ODNI, DoD, Commerce, Treasury, Census, USGS, or other current official sources.
• Reliability note: Strong historical reference value, but not a current country database after sunset. Maps are strategic reference artifacts only; WARLOCK-INDEX does not use maps for targeting or operational planning.
• Replacement note: Use the Legacy Factbook Replacement Note for current field-by-field source routing.

FBI Terrorism Program Public Page

• Source class: A
• Publisher: Federal Bureau of Investigation
• URL: https://www.fbi.gov/investigate/terrorism
• Use: FBI public framing for terrorism, international terrorism, domestic terrorism, Joint Terrorism Task Force context, threat evolution, and public definitions.
• Reliability note: Authoritative for FBI public law-enforcement framing. Domestic coverage must distinguish violent criminal conduct from protected expression and association.

FBI Counterintelligence And Espionage

• Source class: A
• Publisher: Federal Bureau of Investigation
• URL: https://www.fbi.gov/investigate/counterintelligence
• Use: Public FBI framing for foreign intelligence activity, espionage, economic espionage, malign foreign influence, insider threat, and counterintelligence risk.
• Reliability note: Authoritative for FBI public mission framing. It does not authorize WARLOCK-INDEX to identify persons, organizations, or communities as intelligence threats absent official public evidence.

FBI Cyber

• Source class: A
• Publisher: Federal Bureau of Investigation
• URL: https://www.fbi.gov/investigate/cyber
• Use: Public FBI cyber threat framing, cybercrime categories, ransomware, cyber-enabled fraud, foreign cyber actor context, and reporting pathways.
• Reliability note: Authoritative for FBI public cyber mission framing. WARLOCK-INDEX uses it for strategic categorization and does not reproduce exploit steps, evasion methods, malware procedures, or investigative tactics.

FBI Internet Crime Complaint Center

• Source class: A
• Publisher: FBI Internet Crime Complaint Center
• URL: https://www.ic3.gov/Media/PDF/AnnualReport/2024_IC3Report.pdf
• Use: Cybercrime reporting and annual loss/complaint trend baseline, including fraud, ransomware, business email compromise, extortion, and victim-reporting categories.
• Reliability note: Authoritative for IC3 public complaint data. Complaint data is not a complete measurement of all cybercrime and should be labeled as reported activity.

FBI Weapons Of Mass Destruction

• Source class: A
• Publisher: Federal Bureau of Investigation
• URL: https://www.fbi.gov/investigate/wmd
• Use: Public law-enforcement framing for WMD terrorism, chemical, biological, radiological, nuclear, and explosive threat prevention at strategic level.
• Reliability note: Authoritative for FBI public framing. WARLOCK-INDEX must not provide materials, methods, recipes, deployment guidance, or vulnerability exploitation detail.

Federal Select Agent Program

• Source class: A
• Publisher: Centers for Disease Control and Prevention / USDA Animal and Plant Health Inspection Service
• URL: https://www.selectagents.gov/
• Use: Public U.S. source family for select-agent oversight, inspection, compliance, biosafety, and biosecurity source routing.
• Reliability note: Authoritative for public oversight framing. WARLOCK-INDEX may use this source family for governance and regulatory context only; do not reproduce controlled lists, quantities, facility-sensitive details, or compliance workarounds.

White House National Biodefense Strategy And Implementation Plan

• Source class: A
• Publisher: White House archived site
• URL: https://bidenwhitehouse.archives.gov/wp-content/uploads/2022/10/National-Biodefense-Strategy-and-Implementation-Plan-Final.pdf
• Use: Whole-of-government biodefense, biological-risk, preparedness, response, recovery, biosecurity, and global health-security source family.
• Reliability note: Authoritative for public strategy framing. It is not a technical laboratory or facility source.

Defense Threat Reduction Agency

• Source class: A
• Publisher: Defense Threat Reduction Agency
• URLs: https://www.dtra.mil/ ; https://www.dtra.mil/Portals/125/Documents/Media-Kit/DTRA-HQC-Fact-Sheet-FINAL-02052025-v1.pdf
• Use: DoD WMD and emerging-threat reduction source family, including future Cooperative Threat Reduction and biological-threat-reduction source packets.
• Reliability note: Authoritative for DTRA public mission framing. General mission pages do not validate specific foreign-laboratory, contract, or partner-country claims without follow-on document-level sources.

DoD BTRP Ukraine Fact Sheet And Embassy Source Family

• Source class: A
• Publisher: U.S. Department of Defense; U.S. Embassy in Ukraine
• URLs: https://media.defense.gov/2022/Mar/11/2002954612/-1/-1/0/FACT-SHEET-THE-DEPARTMENT-OF-DEFENSE%27S-COOPERATIVE-THREAT-REDUCTION-PROGRAM-BIOLOGICAL-THREAT-REDUCTION-PROGRAM-ACTIVITIES-IN-UKRAINE.PDF ; https://ua.usembassy.gov/embassy/kyiv/sections-offices/defense-threat-reduction-office/biological-threat-reduction-program/ ; https://ua.usembassy.gov/u-s-ukraine-partnership-to-reduce-biological-threats/
• Use: Official DoD and embassy routing for Ukraine biological threat reduction claims, including the DoD March 2022 public BTRP fact sheet and access-caveated embassy source-family pages.
• Reliability note: The DoD fact sheet is verified as a public DoD issuer-position source. The embassy pages returned access barriers in this environment and require later refresh before direct extraction.
• Boundary: Use for source reconciliation only. Do not reproduce facility lists, local site identifiers, biological-material details, sample-handling direction, vulnerability analysis, or operational implications.

NCTC Terrorist Groups Public Guide

• Source class: A
• Publisher: National Counterterrorism Center / ODNI
• URL: https://www.dni.gov/nctc/groups.html
• Use: Public historical counterterrorism group reference and state sponsor context.
• Reliability note: The page states that its information was valid as of
• 2015. Use as historical baseline only and refresh current status through State, Treasury, ODNI, FBI, DHS, UN, allied, and research sources. Do not reproduce tactics or operational method detail.

DHS Homeland Threat Assessment Product Family

• Source class: A
• Publisher: U.S. Department of Homeland Security
• URL: https://www.dhs.gov/homeland-threat-assessment
• Use: Homeland threat framing involving terrorism, targeted violence, border security, illicit drugs, cyber, election security, critical infrastructure, natural hazards, and foreign influence where publicly released.
• Reliability note: Authoritative for DHS public framing. Current URL and PDF paths should be refreshed during each dated source-packet update because DHS pages are dynamic and sometimes protected by content delivery controls.

DHS Office Of Intelligence And Analysis

• Source class: A
• Publisher: U.S. Department of Homeland Security
• URL: https://www.dhs.gov/office-intelligence-and-analysis
• Use: DHS intelligence mission framing, homeland threat environment, and coordination with federal, state, local, tribal, territorial, and private partners.
• Reliability note: Authoritative for DHS public organizational framing. WARLOCK-INDEX must avoid sensitive collection, fusion center, or partner operational detail.

CISA Known Exploited Vulnerabilities Catalog

• Source class: A
• Publisher: Cybersecurity and Infrastructure Security Agency
• URL: https://www.cisa.gov/known-exploited-vulnerabilities-catalog
• Use: Public exploited-vulnerability reference for strategic cyber risk, patch-priority awareness, and source-class mapping.
• Reliability note: Authoritative CISA catalog. WARLOCK-INDEX may use it for high-level vulnerability trend analysis, not exploit instructions, weaponization, evasion, scanning, or targeting.

CISA Cybersecurity Advisories

• Source class: A
• Publisher: Cybersecurity and Infrastructure Security Agency
• URL: https://www.cisa.gov/news-events/cybersecurity-advisories
• Use: Public cyber advisory source family, including joint advisories with NSA, FBI, and allied agencies.
• Reliability note: Authoritative advisory source. Technical detail should be summarized only at defensive strategic level; do not reproduce exploit paths or operational playbooks.

NSA Cybersecurity Advisories

• Source class: A
• Publisher: National Security Agency
• URL: https://www.nsa.gov/Press-Room/Cybersecurity-Advisories-Guidance/
• Use: Public NSA cyber defense guidance and joint advisory source family.
• Reliability note: Authoritative for public NSA defensive guidance. WARLOCK-INDEX should extract actor, sector, and mitigation themes without turning advisories into exploit manuals.

PRC State-Sponsored Cyber Advisory Source Family

• Source class: A
• Publishers: CISA, NSA, FBI, and allied cyber agencies where jointly listed on specific advisories.
• Accessed UTC: 2026-06-14T19:56:06Z
• URLs: https://www.cisa.gov/news-events/cybersecurity-advisories ; https://www.cisa.gov/news-events/cybersecurity-advisories/aa24-038a ; https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-144a ; https://www.nsa.gov/Press-Room/Cybersecurity-Advisories-Guidance/ ; https://www.justice.gov/archives/opa/pr/us-government-disrupts-botnet-peoples-republic-china-used-conceal-hacking-critical
• Use: Defensive public source family for PRC state-sponsored cyber activity, critical-infrastructure risk, espionage, actor naming, sector exposure, allied advisory coordination, and DOJ/FBI disruption-source event routing. The China/PLA source baseline and PRC cyber defensive packet use this as the main defensive source-family lane, with the PRC APT/Typhoon label crosswalk controlling broader actor-label use.
• Reliability note: Authoritative for public defensive advisory framing. Individual advisories require dated extraction before claim-level use. WARLOCK-INDEX should summarize actor, sector, and defensive themes only. Some specific advisory pages need later page-level refresh because the current pass relies on source-family routing and DOJ cross-links for some advisory identities.
• Boundary: No exploit steps, command syntax, scanning procedure, indicator-for-misuse tables, malware operation, credential theft workflow, victim-specific guidance, or evasion detail.

DOJ PRC Botnet Disruption Source Event

• Source class: A law-enforcement source event.
• Publisher: U.S. Department of Justice.
• Publication date: 2024-01-31; archived page updated 2025-02-06.
• Accessed UTC: 2026-06-14T19:56:06Z
• URL: https://www.justice.gov/archives/opa/pr/us-government-disrupts-botnet-peoples-republic-china-used-conceal-hacking-critical
• Use: Public DOJ source event for the U.S. Government disruption of a PRC-linked botnet used to conceal hacking of critical infrastructure, including source routing to CISA advisory material and FBI/DOJ critical infrastructure framing.
• Reliability note: Authoritative for DOJ's public account of the court-authorized disruption and government source links. It is not a complete actor map, victim inventory, technical remediation playbook, or operational cyber source.
• Boundary: Do not reproduce malware procedures, botnet operation, router-targeting guidance, commands, indicators, victim data, or disruption methods.

Salt Typhoon Telecommunications Defensive Source Family

• Source class: A/B by source lane.
• Publishers: Treasury/OFAC, State Rewards for Justice, CISA, NSA, FBI, FCC, Senate Commerce, and allied cyber agencies where directly captured.
• Accessed UTC: 2026-06-17T21:06:51Z
• URLs: https://home.treasury.gov/news/press-releases/jy2792 ; https://rewardsforjustice.net/rewards/foreign-malicious-cyber-activity-against-u-s-critical-infrastructure/ ; https://www.commerce.senate.gov/press/dem/release/cantwell-demands-att-verizon-ceos-come-clean-on-salt-typhoon-hacks-ongoing-network-security-risks/ ; https://www.cisa.gov/news-events/cybersecurity-advisories ; https://www.nsa.gov/Press-Room/Cybersecurity-Advisories-Guidance/ ; https://www.fbi.gov/investigate/cyber ; https://www.fcc.gov/
• Use: Defensive source-family routing for Salt Typhoon telecommunications and communications-infrastructure source treatment, Treasury sanctions, critical-infrastructure reward routing, congressional oversight, CISA/NSA/FBI advisory refresh, FCC telecom-regulatory refresh, PRC APT/Typhoon label separation, and allied cyber-agency cross-checks.
• Reliability note: Treasury, Rewards for Justice, and Senate Commerce routes were directly accessible in the 2026-06-17 pass. CISA, NSA, FBI, and FCC routes returned access barriers, generic challenge pages, transport errors, or timeouts and require later page-level refresh before direct advisory, FBI, or FCC claims are carried. Use the dedicated Salt Typhoon source note and PRC APT/Typhoon label crosswalk for claim separation.
• Boundary: No exploit steps, commands, IOCs, vulnerability lists, router configuration guidance, lawful-intercept system detail, provider-specific vulnerability mapping, victim identification, incident-response playbooks, sanctions-evasion guidance, or operational cyber guidance.

Cyber Nation-State Actor And APT Source Family

• Source class: A/B by source lane.
• Publishers: FBI, CISA, NSA, IC3, DOJ, Treasury/OFAC, State Rewards for Justice, FCC/Senate where relevant, and allied cyber centers where directly captured.
• Accessed UTC: 2026-06-28T08:22:00Z
• URLs: https://www.fbi.gov/investigate/cyber ; https://www.fbi.gov/investigate/cyber/cyber-threat-overview-china ; https://www.fbi.gov/investigate/cyber/cyber-threat-overview-iran ; https://www.cisa.gov/news-events/cybersecurity-advisories ; https://www.nsa.gov/Press-Room/Cybersecurity-Advisories-Guidance/ ; https://www.ic3.gov/ ; https://www.justice.gov/nsd ; https://ofac.treasury.gov/ ; https://rewardsforjustice.net/rewards/foreign-malicious-cyber-activity-against-u-s-critical-infrastructure/
• Use: Official U.S. source-family routing for PRC, Russian, Iranian, DPRK, and state-crime overlap cyber coverage; APT/actor-label source treatment; defensive advisories; law-enforcement source events; cyber sanctions; reward notices; IC3 complaint-source context; telecom and critical-infrastructure source separation; PRC APT/Typhoon label control; Russia state-cyber source-packet routing; weekly source-sweep control; and allied cyber-center cross-checks.
• Reliability note: Authoritative for each issuer's public framing and source identity. APT labels, vendor aliases, service-level attribution, and law-enforcement allegations require source-class notes before use in broader assessments. Use the dedicated cyber nation-state actor tracker for alias and extraction rules, the PRC APT/Typhoon label crosswalk for PRC label source-classing, and the Russia state-cyber packet for GRU/FSB/Russian Intelligence Services legal, advisory, reward, and allied-warning source separation.
• Boundary: No exploit steps, commands, IOCs, vulnerability lists, malware procedures, credential theft workflows, victim lists, provider vulnerability maps, lawful-intercept detail, sanctions-evasion guidance, cryptocurrency laundering detail, or operational cyber guidance.

State Department Foreign Terrorist Organizations

• Source class: A
• Publisher: U.S. Department of State
• URL: https://www.state.gov/foreign-terrorist-organizations/
• Use: Official FTO designation list and legal-public baseline for designated foreign terrorist organizations.
• Reliability note: Authoritative for State designation status. Use with NCTC, Treasury, FBI, DHS, UN, and allied sources for broader context.

State Department Country Reports On Terrorism

• Source class: A
• Publisher: U.S. Department of State
• URL: https://www.state.gov/country-reports-on-terrorism/
• Use: Annual country and regional public reporting on terrorism, counterterrorism cooperation, foreign terrorist organizations, and terrorist safe haven context.
• Reliability note: Authoritative State public reporting. It reflects U.S. policy and diplomatic perspective and should be cross-read with UN and allied sources.

Treasury OFAC Sanctions Lists And Risk Assessments

• Source class: A
• Publisher: U.S. Department of the Treasury
• URLs: https://ofac.treasury.gov/ ; https://home.treasury.gov/policy-issues/terrorism-and-illicit-finance
• Use: Sanctions, terrorist financing, money laundering, proliferation finance, cyber sanctions, narcotics finance, corruption, and illicit finance source family.
• Reliability note: Authoritative for Treasury public sanctions and risk framing. WARLOCK-INDEX must not provide sanctions evasion or compliance circumvention guidance.

DEA National Drug Threat Assessment

• Source class: A
• Publisher: Drug Enforcement Administration
• URL: https://www.dea.gov/
• Use: Official U.S. law-enforcement source family for drug trafficking, synthetic opioids, cartels, illicit finance, precursor supply chains, and domestic public safety effects.
• Reliability note: Authoritative for DEA public threat framing. WARLOCK-INDEX should use it for strategic source mapping, not trafficking methods, concealment, production, or distribution guidance.

ATF Firearms Commerce And Trafficking Sources

• Source class: A
• Publisher: Bureau of Alcohol, Tobacco, Firearms and Explosives
• URL: https://www.atf.gov/resource-center/data-statistics
• Use: Firearms commerce, tracing, trafficking, explosives, arson, and criminal gun intelligence source family at public statistical level.
• Reliability note: Authoritative for ATF public statistics and program framing. Do not convert tracing or explosives material into investigative, procurement, trafficking, or device guidance.

CBP Border Statistics

• Source class: A
• Publisher: U.S. Customs and Border Protection
• URL: https://www.cbp.gov/newsroom/stats
• Use: Border encounters, seizures, migration, trade enforcement, transnational criminal organization pressure, and port-of-entry source family.
• Reliability note: Authoritative for CBP public statistics. Statistics require careful definitions and do not by themselves prove criminality, intent, nationality-level threat, or individual risk.

U.S. Coast Guard Maritime Security Sources

• Source class: A
• Publisher: U.S. Coast Guard
• URL: https://www.uscg.mil/
• Use: Maritime security, port security, counter-drug interdiction public reporting, Arctic maritime, illegal fishing, and homeland maritime source family.
• Reliability note: Authoritative for Coast Guard public framing. Avoid patrol patterns, interdiction tactics, vessel targeting, or sensitive movement analysis.

DOJ National Security Division

• Source class: A
• Publisher: U.S. Department of Justice
• URL: https://www.justice.gov/nsd
• Use: Public legal case, counterintelligence, counterterrorism, export control, sanctions, foreign agent, and cyber prosecution source family.
• Reliability note: Authoritative for public filings and DOJ statements. Legal cases are allegation- and evidence-specific and should not be generalized to communities, protected classes, or political categories.

National Geospatial-Intelligence Agency Public Sources

• Source class: A
• Publisher: National Geospatial-Intelligence Agency
• URL: https://www.nga.mil/
• Use: Public geospatial intelligence, maps, maritime safety, and open reference source family where released.
• Reliability note: Authoritative for public NGA material. WARLOCK-INDEX uses maps only for strategic orientation and not for targeting, surveillance, facility vulnerability analysis, or operational movement.

Threat Family To Source Mapping

Cross References

• U.S. Official Threat Source Operating Picture
• Official U.S. Threat Source Baseline Packet
• U.S. Law Enforcement Threat Source Capture Packet
• Official Threat Source Collection Tracker
• Cyber Nation-State Actor And APT Source Tracker
• Weekly Current Source Sweep Tracker
• PRC APT/Typhoon Label Crosswalk And Advisory Refresh Source Packet
• Russia State Cyber Source Packet Weekly Sweep Continuation
• Official U.S. Threat Source Assimilation Matrix
• Legacy Factbook Replacement Note
• ODNI Global Biolab Disclosure Source-Treatment Note
• Ukraine Biolab Claim-Reconciliation Source Note
• WMD/Biosecurity Public Source Baseline Packet
• Official U.S. Sources