ATT0002 2.5 item a CO 2-2023 USAISEC OPSEC Plan.pdf

CUI

ELIE-ISE-CO PLAN No. 1-2023

Military Operations:

U.S. Army Information Systems Engineering Command (USAISEC) Operations Security (OPSEC) Plan

October 2023

Controlled by: U.S. Army Information Systems Engineering Command Controlled by: S3 – Operations CUI Category: Operations Security Distribution/Dissemination Control: Federal Employees and Contractors Only

U.S. ARMY INFORMATION SYSTEMS ENGINEERING COMMAND (USAISEC)

FORT HUACHUCA, AZ 85613

USAISEC PLAN

NO. CO-2-2023

Military Operations

OPERATIONS SECURITY (OPSEC) Plan

Table of Contents

1. Purpose

2. Applicability

3. Concept of Implementation

4. Responsibilities

5. References

6. Points of Contact

APPENDIX A ................................................................................................................. A1

APPENDIX B ................................................................................................................. B1

APPENDIX C.................................................................................................................C1

APPENDIX D ................................................................................................................D1

APPENDIX E ................................................................................................................. E1

APPENDIX F ................................................................................................................. F1

APPENDIX G ............................................................................................................... G1

USAISEC PLAN NO. CO-2-2023

1. Purpose. This plan provides procedural guidance and direction to USAISEC military, civilian, and contractor personnel in the application of OPSEC policy. This guidance adheres to standards set by Department of Defense (DoD) and Department of the Army (DA) for attainment of OPSEC objectives. The ultimate objective of OPSEC is to deny adversaries access to sensitive, unclassified, national defense information. It emphasizes the need for implementation of OPSEC into the planning and execution processes of all activities of USAISEC.

2. Applicability. This plan applies to all USAISEC Military, Civilian, and contractor personnel, including those located outside the Fort Huachuca area. Some directorates may require a unique approach to OPSEC depending upon their function and location, but the basic concepts set forth herein are essentially the same for every organizational element of this command.

3. Concept of Implementation.

a. The awareness and execution of OPSEC is crucial to Army success. For this reason, OPSEC is applicable to all personnel and all Army missions and supporting activities on a daily basis. The OPSEC process denies adversaries information about friendly capabilities, activities, limitations, and intentions that adversaries need to make competent decisions. Without prior knowledge of friendly actions, adversary leaders cannot act effectively to prevent friendly mission accomplishments. That is why OPSEC applies to all Army activities and is required during training, sustainment, and mobilization, as well as preparing for and conducting operations, exercises, tests, or activities.

b. This plan provides guidance to all USAISEC directorates and staff to deal with both steady-state and increased security requirements due to an actual or perceived threat to unit personnel or property. The OPSEC program will include the following:

(1) Employ the OPSEC five-step process (as outlined in AR 530-1) to establish, guide, and manage the program.

(2) Provide an analytic methodology to protect critical information and improve mission effectiveness.

(3) Specify the sensitive but unclassified information the commander has determined to be critical to the success, security, and safety of the unit and its personnel and families.

(4) Recommend and describe OPSEC measures tailored to specific operations or activities to close vulnerability gaps and lower risk.

CUI

USAISEC PLAN NO. CO-2-2023

U.S. ARMY INFORMATION SYSTEMS ENGINEERING COMMAND (USAISEC)

OPERATIONS SECURITY (OPSEC) Plan

(5) Satisfy compliance with National Security Directive (NSD) 298, the 1988 Presidential directive that requires “each executive department and agency assigned or supporting national security missions with classified or sensitive activities to establish a formal OPSEC program,” as well as AR 530-1.

The OPSEC process denies adversaries information about friendly intentions and capabilities by identifying, controlling, and protecting indicators associated with planning and conducting U.S. Government operations and activities. It is an analytical process, which compares operational activities to adversary intelligence (INTEL) collection threats. This process involves:

(6) Identification of critical information

(7) Analysis of threats

(8) Analysis of vulnerabilities

(9) Assessment of risk

(10) Application of OPSEC measures

4. Responsibilities. This section describes the basic responsibilities and gives specific functions about implementation of the USAISEC OPSEC program.

The USAISEC OPSEC Officer will:

(1) Develop the Critical Information List (CIL) for USAISEC commander for approval, and provide guidance and direction to ensure USAISEC personnel understand and apply the CIL to our mission.

(2) Review OPSEC policy, plans, programs, and training for compliance with the Communications-Electronics Command (CECOM) OPSEC program objectives.

(3) Advise the commander of operational risks based on OPSEC indicators, provide feasible protective measures, and determine requirements to support OPSEC.

(4) Provide guidance to directorates through program review, evaluations, monitoring, assessments, and surveys.

(5) Develop, implement, and manage the USAISEC OPSEC policies, programs, and procedures.

(6) Ensure OPSEC assistance visits, inspections, assessments, and command surveys are conducted, as appropriate, throughout the command.

(7) Advise each directorate’s OPSEC point of contact and other staff officers in the preparation of OPSEC requirements in engineering and planning.

(8) Develop, design, and distribute materials for OPSEC awareness and training.

(9) Review, change (as required), or approve news releases before release for publication. Spot-check media and world-wide web publications for information that affects the tasks, functions, and missions of USAISEC.

(10) Provide OPSEC reviews on all USAISEC-related performance work statements, tasks, small acquisition purchases, and contracts.

(11) Coordinate with CECOM Public Affairs Office (PAO) to comply with DoD, DA, and CECOM website administration policies and implement content-approval procedures that include OPSEC reviews before updating or posting information on all websites.

(12) On a monthly basis, institute random measures to ensure the proper handling of CUI/FOUO material. This will consist of preventative measures to include:

(a) Conduct monthly open-source searches to determine if CUI/FOUO is being divulged on publicly accessible social media or web sites. Records of the monthly check will be maintained locally.

(b) Report all incidents of unauthorized disclosure of CUI/FOUO material to the CECOM OPSEC Program Manager. This could include CUI/FOUO disclosed on a publicly accessible medium, the physical or verbal transmission of CUI/FOUO to unauthorized persons or other unauthorized disclosures. Reports (who, what, when, where, how) will be submitted within 48 hours of occurrence.

USAISEC Soldiers, Civilians, and contractors will:

(13) Be familiar with the USAISEC’s CIL and incorporate recommended OPSEC measures.

(14) Complete OPSEC awareness training found at the following link:

https://www.lms.army.mil/.

(a) assigned USAISEC Soldiers and Civilian employees are required to complete OPSEC Level 1 training within 30 days of reporting for duty, and annually thereafter.

(b) (b) All USAISEC contractor employees, including subcontractor employees, assigned for 30 days or more must complete OPSEC Level 1 training within 30 calendar days after contract start date or effective date of incorporation of this requirement into the contract, whichever applies. OPSEC awareness training will be completed annually if the contract or subcontract employee remains onboard over 365 days. The Contracting Officer Representative (COR) will maintain training completion certificates for all employees under their assigned contract.

(15) Ensure all materials (white papers, videos, brochures, etc.) slated for public release receive an OPSEC review and follow CECOM PAO public release requirements.

(16) Report any attempt by unauthorized persons to solicit critical information to the OPSEC officer or security manager.

(17) Comply with the Joint Ethics Regulation, which includes rules that prohibit the release of non-public information and restricts the use of Government computers to access and manage personal websites during official duty time. USAISEC Soldiers, Civilians, and contractors may establish personal accounts on social media websites;

however, personal accounts should NOT:

(a) Be established with Government e-mail addresses

(b) Employ the use of Government logos

(c) Be used to conduct official Government business

(d) Release official agency information

(e) Be used as an official communication device related to the employee’s Government job or activities

(f) Include photos taken within USAISEC facilities without an OPSEC review and public release approval

OPSEC is a continuous process and an inherent part of military culture. We must take into consideration the changing nature of critical information, the threat, and known and unknown vulnerabilities concerning USAISEC’s operations and fully integrate OPSEC into the execution of all our operations and supporting activities. Our adversaries are monitoring our activities, conversations, and communications using a variety of methods in an attempt to gain information they can use against us. Therefore, everyone must carefully consider whether their actions, activities, or coordination processes used to accomplish the mission adequately protect our critical information from our adversaries' collection efforts. The security of our nation, success of the missions, and the lives of our Soldiers, Civilians, and contractors depend on everyone's awareness and practicing good OPSEC.

5. References.

a. National Security Directive (NSD) 298 (National Security Program), 22 January 1988.

b. DODM 5205.02, DoD Operations Security (OPSEC) Program Manual, 3 November 2008 Incorporating Change 1, Effective 26 April 2018.

c. AR 530-1 (Operations Security), 26 September 2014.

d. AR 360-1 (The Army Public Affairs Program), 8 October 2020.

e. AR 380-5 (Information Security Program), 25 March 2022.

f. AR 381-12 (Threat Awareness and Reporting Program), 1 June 2016.

g. AR 525-13 (Antiterrorism), 3 December 2019.

h. AR 25-1 (Army Information Technology), 15 July 2019.

6. Points of Contact. The proponents of this plan are Mr. Joshua Dobbins, at 520-538- 7296, or NIPR email: joshua.s.dobbins.civ@army.mil, and Mr. Luis Morales, at 520-538- 3892, or NIPR email: luis.r.moralesrodriguez.civ@army.mil.

ERICKA M. BROOKS

COL, SC

Commanding

USAISEC PLAN NO. CO-1-2023

ANTITERRORISM (AT) PLAN

A1

APPENDIX A

CRITICAL INFORMATION LIST

1. Critical information is information vital to a mission which, if an adversary obtains it, correctly analyzes it, and acts upon it; could prevent or seriously degrade mission success. Critical information consists of specific facts about friendly Capabilities, Activities, Limitations (including vulnerabilities), and Intentions (CALI). Critical information can also be an action that provides an indicator of value to an adversary and places a friendly activity or operation at risk.

2. Army Regulation 530-1, paragraph 2-22 states that "OPSEC is everyone's responsibility." That responsibility rests with each member of the organization to protect critical information. Likewise, every member of the USAISEC team must make every effort to protect the critical information essential to the success of our missions, and for the protection of our Soldiers, Civilians, and contractors. This requires you to become familiar with the type of information identified as critical.

3. The following list identifies the type of information we need to protect from potential threat exploitation; information which could be used to impact mission accomplishment.

This is the USAISEC critical information list (CIL):

a. Network diagrams or device identifiers of USAISEC-designed DoD networks.

b. Risk management framework assessments/recommendations produced by

USAISEC.

c. Communications capabilities that USAISEC is engineering/implementing on DoD networks.

d. Schedules, itineraries, or purposes of travel of distinguished visitors or key USAISEC personnel.

e. USAISEC’s contingency plans during emergency operations, or current force protection measures and threat condition.

f. Vulnerabilities associated with USAISEC information and communications systems and facilities.

g. Personally Identifiable Information (PII) of USAISEC Soldiers, Civilians, and contractors.

B1

APPENDIX B

OPSEC MEASURES

1. OPSEC considerations must be part of our planned activities. The specific OPSEC measures outlined in this section are intended to eliminate, reduce, or counter USAISEC’s vulnerabilities. Complying with established security policies and procedures also supports the overall OPSEC objective. All personnel at every level are expected to protect critical information that could potentially be exploited by our adversaries. This will minimize unauthorized access to information important to mission success. The following OPSEC measures support the protection of the critical information identified on the USAISEC CIL, and should be implemented in day-to-day activities.

2. Do not discuss your work in public places or where others can overhear your conversation. This includes posting work-related information to your personal web-presence (i.e. social media, e-mail, blogs, etc.).

3. All paper, either handwritten or printed, must be destroyed by using an approved crosscut shredder before being discarded in the trash.

4. Only send critical information and/or PII via encrypted e-mail or discuss over secured telephone (STU/STE or VoSIP), and only disclose on a need-to-know basis. Critical information and/or PII stored on an organizational share drive will be encrypted or permission-protected to limit access.

5. Remove Common Access Card (CAC) when away from your workstation and retrieve documents from printer stations promptly.

6. “CUI” will be the standard handling marking for all unclassified products which, if released to the public, could cause harm to operations or personnel.

7. Don’t carry briefcases/bags or wear clothing/badges that identify you as a member of the military or U.S. government when traveling for either official or leisure purposes, and don’t discuss assignments, duties, projects, or reasons for travel unless absolutely necessary (i.e. security, customs, immigration, etc.).

8. Ensure all information, materials, or records receive an OPSEC review prior to public release.

9. Don’t attempt to talk around classified information by using code words or double-talk.

10. Ensure that all mission-related emails are sent from, and go to, .mil and .gov accounts.

C1

APPENDIX C

INTELLIGENCE COLLECTION THREAT

1. Known Threat. Open-source collection has been used to acquire information for many years. Foreign intelligence organizations gather information on technologies, troop movements, along with any other general information that may be useful. With the continuing growth of information available to the public, there is a need to determine if accessibility could result in a compromised mission. The intelligence threat consists of multiple, overlapping collection efforts targeted against all sources of Army information, capabilities, and activities. The major intelligence collection disciplines used by threats are:

a. Human Intelligence (HUMINT) Threat. HUMINT has become increasingly important to all of our adversaries. Human sources can gain access to information not accessible to other collection assets. HUMINT employs overt, covert, and clandestine operations to achieve worldwide collection objectives. Overt collection operations official diplomatic and trade representatives, visitors, exchange students, journalists, and military personnel legitimately in the United States. Greed, financial gain, alcoholism, drug abuse, sexual perversion, marital infidelity, and financial indebtedness are among the human failures exploited by threat HUMINT collectors. Disenchanted idealists are also a fertile source of information. Another recruitment technique involves misrepresentation of status or the "false flag" approach. A threat agent will attempt to pass himself off as an agent of a U.S. agency or of a friendly government to solicit cooperation.

b. Open-Source Intelligence (OSINT) Threat. OSINT involves the collection and analysis of freely available information, such as that presented in the media, or available in libraries or the internet. Open-source information includes photographs, newspapers, magazine advertisements, government and trade publications, contract specifications, congressional hearings, computers, and other public media. Up to 90 percent of the adversary's intelligence needs can be satisfied through access to open sources without risk and minimum cost. In recent years, the internet has become an ever-greater source of open-source information for adversaries of the U.S. websites in particular, especially personal websites of individual Soldiers (to include web logs or "blogs" and social networking sites or SNS), are a potentially significant vulnerability. Sharing what seems to be even trivial information online can be dangerous to loved ones and the fellow Soldiers and Civilians in the unit. America's enemies scour blogs, forums, chat rooms, and personal web sites to piece together information that can be used to harm the United States and its Soldiers. It's important to know that social media is a quickly evolving means of distributing information and that means OPSEC is more important than ever before. Other sources for open-source information include: public presentations, news releases from units or installations, organizational newsletters (both

C2 for official organizations and unofficial organizations, such as alumni or spouse support groups), and direct observation.

c. Signal Intelligence (SIGINT) Threat. SIGINT incorporates communications intelligence (COMINT), electronics intelligence (ELINT), and foreign instrumentation signals intelligence (FISINT). COMINT has the greatest impact on the day-to-day performance of Army missions. It derives information from the study of intercepted electromagnetic communications. Prime sources of valuable COMINT include clear voice or non-encrypted telephone and radio communications. Adversaries, especially nation states with intelligence services, use various intercept platforms and have a worldwide COMINT capability. Other adversaries without these sophisticated capabilities will use commercially available technology to obtain COMINT, which can be effective when properly utilized.

d. Technical Intelligence (TECHINT) Threat. TECHINT is derived from the collection and analysis of threat and foreign military equipment and associated material for the purposes of preventing technological surprise, assessing foreign scientific technical capabilities, and developing countermeasures designed to neutralize an adversary's technological advantages. Adversaries seek TECHINT on U.S. equipment and material in order to learn their vulnerabilities and counter U.S. technological advantages. As an example, adversaries want to know the vulnerabilities of U.S. vehicles and armor protection in order to conduct effective improvised explosive device attacks against U.S.

forces.

e. Imagery Intelligence (IMINT) Threat. Adversaries can obtain IMINT from land, sea, air, and space platforms when they operate or have access to these IMINT collection platforms. The most serious threat at the strategic level stems from photo-reconnaissance and open skies observation flights. At the tactical level, airborne collection possesses the greatest IMINT threat. The constant improvement of technical equipment and the employment of combinations of sensors enhance the quality and timeliness of the intelligence product for our adversaries. Adversaries can gain open source IMINT from commercial companies selling IMINT products obtained from commercial IMINT collection platforms as well as from commercially available programs on the internet. Some of the readily available commercial IMINT products may not have all the detail necessary for planning an operation, but they provide a foundation of information that adversaries can use.

f. Measurement and Signature Intelligence (MASINT) Threat. MASINT is scientific and technical intelligence obtained by quantitative and qualitative analysis of data derived from technical means for the purpose of identifying any distinctive features associated with the source, emitter, or sender, and to facilitate subsequent identification or measurement. The six sub-disciplines of MASINT are radar, radio frequency, geophysical, nuclear radiation, materials, and electro-optical. MASINT includes all

C3 technical intelligence, except SIGINT and overhead imagery. MASINT is more likely to be used by adversaries with access to highly technical and sophisticated equipment.

2. Listed below are the major threat categories and some examples of specific types of collection methods likely to be employed by personnel within that category. Of course, examples cited may pertain to more than one category, e.g., terrorists might use HUMINT, SIGINT, etc., to collect information about their target.

a. Foreign Intelligence Service Threat

(1) HUMINT (e.g. recruitment, blackmail, surreptitious entry, phone taps, bugs, unauthorized computer access).

(2) SIGINT (e.g. intercept/exploit communications, computer data, TEMPEST).

(3) IMINT (e.g. overhead imaging, hand held photography).

(4) MASINT (e.g. radar intelligence, infrared intelligence and nuclear intelligence.)

(5) OSINT (e.g. Web sites, public releases, newspapers).

b. Terrorist Threat

(1) HUMINT (e.g. recruitment, blackmail, surreptitious entry, phone taps, bugs, unauthorized computer access, etc.)

(2) SIGINT (e.g. intercept/exploit communications, computer data, TEMPEST, etc.)

(3) Kidnapping

(4) OSINT (e.g. web sites, public releases, newspapers)]

(5) Stand-off weapons attacks/raids

c. Insider Threat

(1) Malicious acts by disgruntled personnel (e.g. violence and/or sabotage)

(2) Espionage/theft of classified material for adversary

(3) Unauthorized disclosure of classified material

C4

(4) Theft of property

(5) Inadvertent loss of classified material or critical information

d. Criminal Threat (Outsider)

(1) Use of violence

(2) Theft of property

(3) Hacking/cracking of computer systems

D1

APPENDIX D

VULNERABILITY ASSESSMENT

1. Vulnerabilities are friendly actions that provide indicators that can be obtained and accurately evaluated by an adversary to provide a basis for effective adversary decision making. Vulnerabilities consist of stereotyped actions that habitually occur (patterns), and unique detectable characteristics that identify the type of activity or intention (signatures). An OPSEC vulnerability exists when the following conditions are met:

a. The adversary can collect an indicator of critical information

b. Correctly analyze the information

c. Make a decision

d. Take timely action to adversely influence, degrade, or prevent mission success.

2. The USAISEC OPSEC Officer has compared the adversary collection capabilities against USAISEC activities and determined that the following vulnerabilities, if detected by an adversary, could be used to disrupt our missions and OPSEC measures must be established to protect these potential OPSEC vulnerabilities.

3. Information Security Vulnerabilities

a. Failure of USAISEC personnel to ensure that classified or sensitive unclassified information is furnished or disclosed only to appropriate authorized personnel

b. Failure to provide a security review for classified information resulting in inadvertent disclosure of classified information

c. Employment of un-cleared personnel to duties that may provide the opportunity for access to classified information

d. Failure to follow security classification guidelines for proper classification data

e. Failure to maintain proper security at classified meetings conferences, planning sessions

f. Failure to properly secure classified storage containers and closed areas

g. Failure to follow published security guidance/regulations

h. Failure to follow classification management procedures

i. Failure to properly protect classified and sensitive unclassified equipment and material

D2

j. Failure to ensure inadvertent release of sensitive information to personnel not having the proper need to know

k. Failure of planners to determine the threat/risk prior to beginning various activities

4. Operations Security Vulnerabilities.

a. Open sources whereby documents are published and distributed without OPSEC reviews or limited distribution statements as applicable

b. Classified documents generated within the organization which are not reviewed for proper marking and handling instructions or compliance with the assigned security classification guide (SCG) guidance

c. Improper disposal of sensitive, unclassified information

d. Lack of awareness as to the adversary collection threat to USAISEC operations, causing personnel to become careless in their day-to-day OPSEC and other security responsibilities

e. Failure on the part of personnel to adequately review their security requirements during planning and testing

f. Interception by COMINT means of discussion over non-secure communications involving sensitive information regarding current or future operations

5. Physical Security Vulnerabilities.

a. Failure to maintain or enforce access controls for designated controlled or restricted areas

b. Failure to maintain strict key and lock accountability to facilities

c. Failure to follow procedures for test and maintenance of intrusion detection systems, where applicable

d. Failure to maintain a positive control system for packages, material, and property into or out of secure areas

e. Failure to comply with physical security standards applicable to designated security areas

f. Failure to use authorized locking devices in accordance with the sensitivity of the item/information being protected.

6. Automated Information System (AIS) Vulnerabilities

D3

a. Human error that results in the accidental destruction, disclosure, or modification of sensitive and classified computer-based information

(1) processing of classified or sensitive data on an AIS system which has not been approved or accredited for such information through the intentional disregard of policy

(2) Computer transmissions that could be intercepted causing an unauthorized disclosure of sensitive data

(3) Unauthorized persons who may obtain access to the AIS especially when remote dial-in is allowed

(4) Improper controls on maintenance personnel prior to allowing them access to AIS systems to include improperly qualified AIS escort to accompany and observe performed maintenance

(5) Improper control of AIS passwords

(6) Improper AIS administrator controls and firewall protection

(7) Lack of adequate encryption capabilities

(8) Insufficient training in AIS security features and requirements for AIS system administrators

(9) Lack of anti-virus and patches on AIS systems

7. Antiterrorism/Force Protection (AT/FP) Vulnerabilities

a. Current threat and Force Protection Condition level (FPCON)

b. Commander's intent regarding force protection and antiterrorism

c. Type/number/mix of personnel and security equipment available or in use at USAISEC. What are their capabilities?

d. Identified force protection/security weaknesses

e. Physical security measures implemented at all USAISEC facilities

f. Location of critical facilities and Mission Essential Vulnerable Areas (MEVAs)

E1

APPENDIX E

ASSESSMENT OF RISK

1. OPSEC is a Commander’s program. The reason for this is because OPSEC comes down to risk, and ultimately the level of risk that the Commander is willing to take to complete a mission. For OPSEC purposes, the following equation is used when assessing risk:

Impact x Threat x Vulnerability = Risk

2. Each input is given a rating, with corresponding numerical value, of Low (1), Medium (2), or High (3). The OPSEC Officer will utilize a systematic approach in acquiring and analyzing the information that goes into determining these ratings. The parameters that would warrant the corresponding rating are as follows:

a. Low (1)

(1) Threat: No adversary has demonstrated an intent or has been addressed to have the capability to act against friendly missions.

(2) Vulnerability: Potential for exploitation is negligible.

(3) Impact: No personal injury, property loss of less than $5,000, delays less than 15 minutes, no effect on the integrity of the system, no effect on government or public services, no embarrassment or harm to the reputation of the Unit/Organization or the Nation.

b. Medium (2)

(1) Threat: An adversary has demonstrated both intent and capability to act against similar friendly missions.

(2) Vulnerability: Potentially exploitable by multiple collection disciplines requiring significant corroboration of data.

(3) Impact: Injuries requiring hospital treatment or observation, property loss greater than $5,000 but less than $100K, delays greater than 15 minutes but less than 60 minutes, moderate embarrassment, or harm to the reputation of the Unit/Organization or the Nation.

c. High (3)

(1) Threat: An adversary has demonstrated both intent and capability to act against friendly missions.

E2

(2) Vulnerability: Potentially exploitable by multiple collection disciplines requiring virtually no corroboration of data.

(3) Impact: Death, property loss greater than $100K, delays lasting longer than 60 minutes, catastrophic embarrassment or harm to the Unit/Organization or the Nation.

3. Once ratings are determined for each input, they are then multiplied together to compute the initial risk to the mission. This is an initial risk because measures haven’t been identified and taken into account at this point. If the Commander determines that the initial risk is acceptable, then no measures are needed, and the process is complete. However, if the Commander deems the initial risk is too high, measures will need to be developed in an attempt to lower the risk level. Once measures are determined and applied, each input in the equation will be reevaluated and given a new rating (if applicable). After the new ratings are multiplied, the new total is the residual risk. If the residual risk is still higher than what the Commander is willing to accept, the operation will either be terminated or elevated to the next level of Command for approval. Since implementing measures usually results in an impact to operational, logistic, or procedural effectiveness, an analysis must be made prior to the decision to implement measures. The OPSEC Officer makes recommendations on each measure based on the following questions:

a. What is the current risk without OPSEC measures?

b. Can OPSEC measures reduce the risk?

c. Can the measure’s effects be demonstrated?

d. What are the effects of implementing-vs-not implementing the OPSEC measure?

4. Each OPSEC measure must be individually considered and weighed against the effect on overall mission. Those measures that adversely impact the mission and which, if not implemented, would not likely give critical information to the enemy should not be implemented.

5. The OPSEC measures identified in this PLAN will be monitored by the OPSEC Officer in a continuous process to ensure and verify effectiveness. The OPSEC Officer will recommend adjustments to the Commander to improve the effectiveness of existing measures and recommend new measures if significant new vulnerabilities develop.

F1

APPENDIX F

OPSEC COMPROMISES

1. An OPSEC compromise is the disclosure of critical information that jeopardizes USAISEC’s ability to execute its mission or to adequately protect its personnel and/or equipment.

2. For critical information that has been compromised and is available in open sources, the public domain should not be highlighted or referenced publicly outside of intra-governmental or authorized official communications, because these actions provide further unnecessary exposure of the compromised information. Personnel should not respond to queries to deny or confirm the validity of critical information that has been compromised or released to the public. Notify the OPSEC officer and security manager of all OPSEC compromises.

I1

APPENDIX G

GLOSSARY

Adversary Those individuals, groups, or organizations that must be denied critical information to maintain friendly mission effectiveness.

Adversaries may include hostile countries, terrorists, and allied intelligence agencies.

Collection Threat Collection of information on U.S. Army activities may be conducted by adversaries using various intelligence collection methods. These pieces of information provide an accurate portrayal of the commands overall intentions and/or operations.

Controlled Unclassified Information

Information the government creates or possesses, or that and entity creates or possesses for or on behalf of the government, that a law, regulation, or government-wide policy requires or permits an agency to handle with safeguarding or dissemination controls.

Critical Information Specific facts about friendly intentions, capabilities, and activities needed by adversaries to plan and act to guarantee the failure of friendly mission accomplishment.

Essential Secrecy The condition achieved from the denial of critical information to adversaries.

FOIA Freedom of Information Act. Allows people to gain access to non-classified information from government agencies.

HUMINT Human Intelligence. Collection of information by human sources for intelligence purposes. Gathered covertly by espionage agents, or overtly through information available to the general public, it is the most basic form of intelligence collection.

HUMINT remains significant because it is often the only source with access to an opponent's intentions and plans.

IMINT Imagery Intelligence. Collection of information by photographic, infrared, or radar imagery. Images can be gathered either by individuals or by remote means, such as aircraft or satellite.

This method is valuable because it provides analysts with clues to other areas requiring examination. The IMINT includes unauthorized duplication of documents.

I2

Indicators Friendly detectable actions and open source information that can be interpreted or pieced together by an adversary to derive critical information.

MASINT Measurement and Signature Intelligence. Scientific and technical intelligence obtained by quantitative and qualitative analysis of data derived from technical sensors to identify any distinctive features associated with the source, emitter, or sender. It is technical in nature.

Military Deception Actions executed to mislead foreign decision-makers, causing them to derive and accept desired appreciation of military capabilities, intentions, operations, or other activities that evoke foreign actions that contribute to the originator's objectives.

Deception is an effective OPSEC measure that can be employed given prior coordination (e.g., cause adversary intelligence collection efforts to fail to target friendly activities, create confusion or misinterpretation of information obtainable from open sources).

Observables Actions that convey indicators exploitable by adversaries but that must be carried out regardless, to plan, prepare for and execute activities.

Operations security compromise

The disclosure of sensitive or critical information which has been identified by the Command and all higher headquarters as jeopardizing the unit’s ability to execute its mission or to adequately protect its personnel and/or equipment.

OPSEC Operations Security. A program meant to deny our adversaries access to any critical information.

OPSEC Measure Methods and means to gain and maintain essential secrecy about critical information.

Operations Security vulnerability

A condition in which friendly actions provide OPSEC indicators that may be obtained and accurately evaluated by an adversary in time to provide a basis for effective adversary decision-making.

I3

Sensitive Information

Any information, the loss, misuse, or unauthorized access to, or modification of which could adversely affect the national interest or the conduct of Federal programs, but which has not been specifically authorized under an Executive order or an act of Congress to be kept secret in the interest of national defense or foreign policy (PL 100-235, 8 Jan 88).

SIGINT Signals Intelligence. Collection of information by interception of electronic signals from communications equipment or non-communicative devices that emit an electronic signal, such as a radar beacon. It includes interception of communication and the interception and analysis of communication between pieces of equipment (e.g., LAN).

Vulnerabilities Friendly actions which provide indicators that may be obtained and accurately evaluated by an adversary in time to provide a basis for effective adversary decision making. Vulnerabilities exist when three conditions exist; adversary has capability to collect indicator, and adversary has time to process (report, analyze, take planning action), and the adversary must be able to react.