DOJ National Security Division: Counterterrorism and Intelligence

The Department of Justice National Security Division (NSD) sits at the intersection of law enforcement and intelligence, managing federal prosecutions and oversight functions that directly affect national security outcomes. This page covers the NSD's structural definition, operational mechanics, characteristic case types, and the decision boundaries that separate NSD jurisdiction from other DOJ components. Understanding the NSD's role is essential to grasping how the United States government translates intelligence into prosecutable legal action while maintaining constitutional constraints.

Definition and scope

The National Security Division was established by the USA PATRIOT Improvement and Reauthorization Act of 2005 (Pub. L. 109-177) and became operational on September 19, 2006. Congress created it in direct response to the 9/11 Commission's finding that a "wall" between intelligence and law enforcement had impeded pre-attack information sharing. Before the NSD existed, national security prosecutorial functions were fragmented across the Criminal Division and the Office of Intelligence Policy and Review.

The NSD's statutory mandate covers four primary areas:

1. Counterterrorism — prosecution of domestic and international terrorism cases under statutes including 18 U.S.C. § 2339A and § 2339B (material support to terrorism)
2. Counterespionage — investigation and prosecution of espionage, export control violations, and foreign agent registration failures under the Foreign Agents Registration Act (FARA), 22 U.S.C. § 611 et seq.
3. Intelligence oversight — legal review of Foreign Intelligence Surveillance Act (FISA) applications submitted to the Foreign Intelligence Surveillance Court (FISC)
4. Export control and sanctions enforcement — coordinating prosecutions under the Export Control Reform Act and International Emergency Economic Powers Act (IEEPA)

The NSD is one of DOJ's primary litigating divisions, as described in the broader DOJ Divisions Overview. Its geographic scope is national, but it coordinates extensively with U.S. Attorneys' Offices in all 94 federal districts.

How it works

The NSD operates through three internal sections: the Counterterrorism Section (CTS), the Counterintelligence and Export Control Section (CES), and the Intelligence Section (IS). A fourth body, the Office of Intelligence, handles FISA-related functions.

FISA oversight represents one of the NSD's most distinctive functions. Before any federal agency can conduct electronic surveillance of a foreign power or its agents inside the United States, NSD attorneys review and certify the application. The FISC, a specialized Article III court established under 50 U.S.C. § 1803, receives these applications. In fiscal year 2022, the government submitted 232 FISA applications targeting individuals, according to the Annual Statistical Transparency Report Regarding Use of National Security Authorities, published by the Office of the Director of National Intelligence.

Prosecution coordination flows through the NSD's relationship with the FBI's National Security Branch and the intelligence community. When an investigation transitions from intelligence collection to criminal prosecution — a threshold with significant Fourth and Fifth Amendment implications — NSD attorneys manage the legal transition to avoid tainting evidence gathered under intelligence authorities.

The NSD also administers the Justice Against Sponsors of Terrorism Act (JASTA), which opened a narrow civil litigation avenue against foreign state sponsors of terrorism, and coordinates designations with the Treasury Department's Office of Foreign Assets Control (OFAC).

Common scenarios

The NSD handles case categories that rarely arise in other DOJ divisions:

• Material support prosecutions: Individuals who provide financial transfers, personnel, or logistical resources to designated foreign terrorist organizations under 18 U.S.C. § 2339B face up to 20 years imprisonment per count. The NSD's Counterterrorism Section leads or supervises these prosecutions nationwide.

• Espionage and leaks: Cases involving the unauthorized disclosure of national defense information under 18 U.S.C. § 793 (the Espionage Act) route through CES. High-profile prosecutions under this statute have involved government contractors and cleared personnel.

• Foreign agent registration failures: Individuals acting as agents of foreign governments or political parties who fail to register under FARA face criminal penalties. The NSD's FARA Unit, housed within CES, has significantly increased enforcement activity; between 2016 and 2021, FARA criminal prosecutions exceeded the total from the prior 50 years combined, according to the DOJ FARA Unit enforcement data.

• Weapons of mass destruction (WMD) threats: The NSD's WMD Coordinator network, embedded in U.S. Attorneys' Offices, handles cases involving chemical, biological, radiological, and nuclear threats under 18 U.S.C. § 175 and related statutes.

• Cyber-enabled espionage: Cases at the intersection of cybercrime and national security, including state-sponsored intrusions, are jointly handled with the DOJ Cybercrime Enforcement infrastructure and the FBI's Cyber Division.

Decision boundaries

The NSD's jurisdiction overlaps with other components in ways that require formal delineation:

NSD vs. Criminal Division: The Criminal Division handles domestic terrorism cases that lack a foreign nexus and do not implicate intelligence equities. When a plot involves a designated foreign terrorist organization or foreign intelligence service, the NSD takes primary responsibility. The DOJ Criminal Division retains lead authority over purely domestic violent extremism without a foreign principal.

NSD vs. U.S. Attorneys' Offices: The NSD does not prosecute cases independently in most instances. Rather, it supervises and co-counsels with the U.S. Attorneys' Offices in the district where the offense occurred. Standalone NSD prosecution is reserved for cases requiring classified information management under the Classified Information Procedures Act (CIPA), 18 U.S.C. App. III.

Intelligence equity vs. prosecution: The most consequential decision boundary is whether to prosecute or protect intelligence sources and methods. Prosecuting a terrorism suspect may require disclosing how surveillance was conducted. The NSD's Litigation Section navigates CIPA hearings to determine whether classified evidence can be introduced, substituted, or withheld without prejudicing the defendant's Sixth Amendment rights. This tension is documented in the DOJ's special counsel and oversight framework and affects charging decisions at the foundational level.

The DOJ National Security Division page on this network provides a structural overview, while the DOJ Organizational Structure page situates the NSD within the broader department hierarchy. For readers approaching DOJ structure from the beginning, the site index provides a complete reference map of covered topics.