Attachment 0003 OPSEC Plan 2019.pdf

Project Director Main Battle Tank Systems

(MBTS)

Operations Security (OPSEC) Plan

July 1, 2019

PREPARED BY: Security Manager, PD MBTS, SFAE-GCS-M/MS 506, 6501 East Eleven Mile Road, Warren, MI 48397-5000

SUBMITTED BY

___________________________ __23 July 2019__________ MELISSA PARTAKA Date OPSEC Officer

APPROVED BY

___________________________ __29 July 2019__________ DAVID W. MARCK Date Project Director, Main Battle Tank Systems

PEO GCS OPSEC P lan June 2019 i

Table of Contents PD MBTS Mission Statement General OPSEC Definition OPSEC Concept OPSEC Compromise Penalties Responsibilities

Program Executive Officer OPSEC Officer as the PEO’s executive agent will -- PEO Public Affairs Officer (PAO) PEO Webmaster Program Managers All U.S. Personnel with access to PD MBTS CUI or classified information

OPSEC Considerations Critical Information OPSEC Measures

Administrative/Personnel OPSEC Awareness Conference Room Security Conferences and Symposia Teleworking Employee Travel Computer Security Media Networked Printers Compromising Emanations Waste Disposal Public Release Website OPSEC Reviews Unsolicited Requests for Information Shipment of Sensitive Materials Communications Security Insider Threat Document Markings CUI Protection Measures Visitor Control Escorts for Foreign Visitors Contractor Requirements

Annex A – The Multidiscipline Collection Threat Annex B – Vulnerability Assessment

Annex C – OPSEC Checklist

Annex D – Terms

Annex E – References

PD MBTS Mission Statement Modernize and sustain premier tank and support systems to equip the warfighter and strategic partners.

General This publication addresses the common features of a functional, active and documented Operations Security (OPSEC) program. It assigns responsibilities and requirements within the Project Director Main Battle Tank Systems (PD MBTS) to plan for and implement a systematic approach to OPSEC measures; training; review requirements for measures and reporting; and cross-command and interagency support to the PD MBTS OPSEC program, which includes reviews, assessments, and survey training.

It is designed to provide a basic understanding of OPSEC functions and how to apply them within PD MBTS. OPSEC is applicable to all aspects of work, from daily routine planning through testing, exercise, and evaluation phases to force deployment, recovery, and reconstitution.

PD MBTS OPSEC Officer: Melissa Partaka, (586) 282-6268

This OPSEC Plan documents the policies and procedures needed to meet the specific OPSEC program requirements of PEO GCS and to support the OPSEC programs of higher echelons.

The overall purpose of OPSEC is to strengthen our traditional security procedures by identifying existing vulnerabilities and applying measures to protect sensitive technologies. The goal is to deny our adversaries access to any critical information -- to include technologies and information that is sensitive -- and the disclosure of which could seriously impact our programs. Technology or information does not have to be classified to be of value to an adversary. An adversary can learn a lot about our programs by piecing together obtainable unclassified information. Therefore, in our attempts to shield our activities, it is not only important to follow normal security practices but also to implement OPSEC measures. This OPSEC Plan will discuss the five-step process: Identifying Critical Information, Analysis of Threats, Analysis of Vulnerabilities, Assessment of Risks, and the Application of OPSEC measures.

OPSEC applies to everyone within PD MBTS. All information identified as critical information will be reviewed for OPSEC before being released. All information, regardless of whether it is critical, will be reviewed for OPSEC before its release to the public in any manner.

OPSEC Definition OPSEC is a process of identifying critical information and subsequently analyzing friendly actions attendant to military operations and other activities to:

1. Identify actions that can be observed by adversary intelligence systems.

2. Determine indicators that hostile intelligence systems can obtain that could be interpreted or pieced together to derive critical information in time to be useful to adversaries.

3. Select and execute measures that eliminate or reduce to an acceptable level the vulnerabilities of friendly actions to adversary exploitation.

OPSEC Concept Many daily routine functions may convey information and indicators to adversaries in spite of routine security measures (personnel, physical, document, cryptographic, computer) to protect classified information. Information available from detectable friendly activities, when combined with other information held by an adversary will, in unknown ways, shape the adversary's perceptions of friendly intentions, military capabilities, actions, and possible weaknesses, all of which will provide answers to adversary intelligence questions. Acting routinely during classified or sensitive unclassified activities (e.g., operations, exercises, field tests of military systems) can often result in adversaries gaining harmful appreciations by piecing together the various indicators.

Intelligence systems function worldwide. Even if PD MBTS is vigilant, other organizations that provide support may conduct activities that convey pertinent PD MBTS information or indicators of intentions, capabilities, limitations, and vulnerabilities.

Therefore, planning for primary and supporting operations and other activities (e.g., a test administered by the Army Test and Evaluation Command [ATEC]) must be systematically examined to determine potential disclosures that would cause cancellation or failure of the primary mission. Subsequently, one must plan and execute protective measures that permit operations and activities to proceed effectively while preserving requisite essential secrecy; OPSEC is the process designed to do this.

An OPSEC vulnerability exists when OPSEC indicators leading to critical information are collectable by adversary collection systems, the collected information can be processed, and the adversary has time to react in a way harmful to the United States.

The most serious problem facing PD MBTS in this respect is that critical information collected by an adversary today could be used to develop a technological advantage for the adversary’s use many years in the future. Collection capabilities used to obtain information from accessible activities generally depend on some form of target cooperation. For example, throwing any information in the trash allows it to be retrieved by an adversary who will gain information about our activities, and releasing information into the public domain allows the adversary to obtain useable information at no risk to their assets. The detection of predictable actions depends on our acting in stereotyped ways and giving the adversary an advantage. Thus, if proper OPSEC measures are applied, it is often possible to eliminate or control many detectable indicators of critical information about our intentions, capabilities, and activities.

The key objective of OPSEC is to ensure mission effectiveness. Some protective measures to eliminate information conveyed by an activity may unacceptably reduce effectiveness. For example, telemetry and communications are often needed in tests;

and personnel, equipment, and material movements are unavoidable if operations and activities are to be executed. In these instances, it may be possible to deny information by acting against the collectors or analysts, rather than stopping the actions. Actions that maybe implemented include the use of jamming, obscurant, weather, camouflage, environmental conditions, covers, or military deception to influence adversary perceptions and conclusions (e.g., cover operations to explain observable activities, diversions to draw collection and analytical interest elsewhere, creating conditioning to cause activities to be ignored, multiple impressions to confuse interpretation of information). In Joint operations, OPSEC is an element of command and control warfare. Countering the adversary command and control, and protecting friendly command and control are functions of OPSEC.

Planning for secrecy must extend beyond exposure of raw information and consider possible assumptions and estimates made by an adversary. Logical conclusions based on generally available information, trend analysis based on historical data or technical possibilities, and broad experience of adversary planners and decision-makers must be factored in to planning. Military deception may be required to mislead adversary analysts in order to maintain essential secrecy.

The following are examples of unclassified information that are indicators that could alert an adversary to the existence of a classified project, existence or application of advanced technology, or a new tactic or technique unknown to adversaries:

• Unclassified agreements between government agencies or their association in a project or operation that outlines methods, procedures, and current U.S.

Government intentions or future objectives.

• Special or unique requests providing special instructions that could reveal capabilities or the technology of a new weapon system.

• Public relations release describing aspects of technological or operational cooperation between the U.S. and other nations.

• Announcements of formation of specialized groups, special elements, or organizations, which could signal special intentions, activities, or capabilities.

• Consolidated budget execution for specific projects, testing of items or tactics, and monies spent that are intended for future acquisition.

OPSEC Compromise An OPSEC compromise is the disclosure of critical or sensitive information that jeopardizes PD MBTS’s ability to execute its mission or to adequately protect its personnel or equipment. Good OPSEC practices can prevent these compromises and allow us to maintain essential secrecy about our operations.

Critical or sensitive information that has been compromised and is available in open sources and the public domain should not be highlighted or referenced publicly outside of intragovernmental or authorized official communications, because these actions provide further unnecessary exposure of the compromised information. Report any known or suspected OPSEC compromise to the PD MBTS Security Manager immediately.

Penalties Failure to comply with OPSEC orders, directives, or policies may be punished as violations of a lawful punitive order under Article 92 of the Uniform Code of Military Justice (UCMJ) (Reference (a)) or under other disciplinary, administrative, or other actions as applicable. Personnel not subject to the UCMJ who fail to protect critical and sensitive information from unauthorized disclosure may be subject to administrative, disciplinary, contractual, or criminal action.

Responsibilities Every individual is responsible for the security of the information he or she has access

to. Each piece of information that an adversary gains access to fills in one more part of the puzzle as it relates to our overall plan of action.

Program Executive Officer

• Issue orders, directives, and policies to protect PEO GCS critical and sensitive information to clearly define the specific OPSEC measures that all PEO GCS personnel should practice.

• Ensure that the OPSEC program and measures are coordinated and synchronized with security programs, e.g., information security (INFOSEC), information assurance (IA), physical security, and force protection.

• Ensure that all official information released to the public, to include information released on the World Wide Web, receives an OPSEC review prior to dissemination.

• Establish a documented OPSEC program that includes as a minimum, OPSEC Officer appointment orders and an OPSEC Plan.

• Appoint an OPSEC Officer in writing with responsibility for supervising the execution of proper OPSEC within the organization.

• Ensure that the appointed OPSEC Officer is of appropriate grade or rank, and receives appropriate training in accordance with (IAW) Chapter 4, Army Regulation (AR) 530-1, (Reference (h)).

• Approve the PEO GCS Critical Information List (CIL) and circulate it to all subordinates as widely as security permits.

• Provide guidance and direction to ensure that each subordinate organization understands, adapts, and applies the CIL to its mission and provides feedback.

• Weigh the risk in the mission against the costs of protection and decide what OPSEC measures to implement; and publish such measures in the OPSEC Plan.

OPSEC Officer as PD MBTS’s executive agent will:

• Implement and direct the OPSEC program.

• Plan for and implement OPSEC before, during, and after operations and other activities, including RDT&E, which affect the combat capability of the Army;

ensure that OPSEC is part of initial planning guidance.

• Chair the PD MBTS-level OPSEC Working Group (OWG) to coordinate OPSEC actions on a consistent basis.

• Develop the CIL in conjunction with other subject matter experts.

• Develop and recommend OPSEC measures to be implemented.

• Conduct OPSEC reviews of operational plans and reports to ensure adherence to OPSEC policies and procedures.

• Coordinate with the Public Affairs and Freedom of Information Act (FOIA) Officers to ensure that information is reviewed for OPSEC before being released.

• Ensure that all OPSEC training is IAW AR 530-1 (Reference (h)) and this OPSEC Plan.

• Integrate intelligence, counterintelligence, and force protection into OPSEC planning and practice.

• Prepare the annual OPSEC report.

• Perform other duties and responsibilities as defined in AR 530-1, Appendix H (Reference (h)).

• Provide quarterly reminders of the importance of sound OPSEC practices, including but not limited to OPSEC news releases in publications, OPSEC information bulletins, and OPSEC awareness briefings.

PEO GCS Public Affairs Officer (PAO)

• Comply with Federal, Department of Defense (DoD), and Department of the Army (DA) website administration policies and implementing content-approval procedures that include OPSEC.

• Consider OPSEC in preparation of all public releases of official information.

• Coordinate with the OPSEC Officer before updating or posting information on all websites, IAW AR 25-2 (Reference (d)) paragraph 4-20.g.(11).

https://armypubs.us.army.mil/epubs/dr_pubs/DR_c/pdf/r530_1.pdf https://akocomm.us.army.mil/usapa/epubs/DR_pubs/DR_c/r530_1.pdf

• Ensure the office providing the information, materials, or records to the PAO for release should accomplish OPSEC reviews IAW AR 360-1 (Reference (e)), paragraph 5-4.

• Ensure that in addition to the OPSEC Officer, the webmaster and other appropriate designees (e.g., command counsel, force protection, intelligence) have properly cleared information prior to posting to the web, unclassified intranet, or to Army Knowledge Online (AKO) areas accessible to all account types.

• Coordinate directly with the OPSEC Officer on all questionable releases and for additional guidance on any release.

• Ensure that all military, civilian, or contractor personnel who post or maintain information (e.g., documents, spreadsheets) in the public domain for official PEO GCS purposes (also including OPSEC Officers and PAO personnel) complete “Social Media and Operations Security” training at Information Assurance Training Center or DISA’s Social Network Course; or similar courses that may be required in the future.

• PAOs and other personnel who interact with the public on a regular basis will receive external official presence training or attend a Level II OPSEC officers course, IAW AR 530-1 (Reference (h)), paragraph 4-2.b.(2).

• Be the primary spokesperson to the news media in the event of an antiterrorism incident, or work in conjunction with the installation public affairs office, IAW AR 525-13, (Reference (g)).

• Provide unclassified information about the Army and its activities to the public with maximum disclosure and minimum delay. Do not release information that would adversely affect national security, threaten the personal safety, or invade the privacy of members of the Armed Forces, IAW AR 360-1 (Reference (e)), paragraph 2-3.d.(5).

PEO GCS Webmaster

• Comply with Federal, DoD, and DA web site administration policies and implement content-approval procedures that include OPSEC and PAO reviews before updating or posting information on all websites IAW AR 25-2 (Reference (d)) paragraph 4-20,g.(11).

• Conduct annual OPSEC reviews of all organizational web sites and provide these results to the OPSEC Officer for inclusion in the annual OPSEC report IAW AR 25-2 (Reference (d)) paragraph 4-20.g. (15).

• Coordinate directly with the OPSEC Officer for additional guidance on any questionable website posting.

• Take the Social Media and Operations Security training course at Information Assurance Training Center or DISA’s Social Network Course.

Project Director

• Implement an OPSEC program.

• Approve the PD MBTS OPSEC Plan.

• Appoint an OPSEC Officer in writing with responsibility for supervising the execution of proper OPSEC within the organization.

• Ensure appropriate OPSEC measures are taken within PD MBTS to preserve essential secrecy.

• Ensure appropriate OPSEC measures are taken in order to provide maximum protection of all functions and activities.

• Assist the OPSEC Officer with integrating OPSEC into all organizational activities.

• Plan for and implement OPSEC before, during, and after operations and other activities, including RDT&E that affect the combat capability of the Army; ensure that OPSEC is part of the PD’s initial planning guidance.

All U.S. Personnel with access to PD MBTS CUI or classified information

• Implement OPSEC measures as identified in this plan.

• Receive Operations Security Level I training IAW AR 530-1, (Reference (h)) Chapter 4, to:

o Understand how OPSEC complements traditional security programs to maintain essential secrecy of U.S. military capabilities, intentions, and plans.

o Learn how to apply OPSEC to daily tasks.

o Learn why OPSEC is important to the organization.

o Understand how adversaries aggressively seek information on U.S.

military capabilities, intentions, and plans.

o Become knowledgeable of the CIL and how to protect it by applying

OPSEC measures to prevent inadvertent disclosure.

• Be familiar with this OPSEC Plan and where to obtain additional OPSEC guidance if needed.

• Maintain need-to-know and telephone security.

• Limit distribution

• Do not talk about work in public locations.

• Safeguard unclassified technical data.

• Handle any attempt by unauthorized personnel to solicit sensitive or critical information as a TARP incident per AR 381-12 (Reference (f)). Report all facts immediately to the nearest supporting counterintelligence office and inform the chain of command.

OPSEC Considerations OPSEC must be considered when preparing policies, procedures, and doctrine; when designing systems; and when prescribing logistic and administrative practices.

Policies, procedures, and doctrines govern the freedom of action of commanders and can introduce a degree of rigidity in the way functions are performed. Over time, the constraints imposed on commanders and procedural habits will become apparent, allowing adversaries to better predict what commanders will or will not do and how various functions will be carried out.

Systems and tactics are of little value if during their development, an adversary develops the capability to locate, track, identify, target, and destroy that system or counter the tactic when it is deployed or implemented. Administrative and logistic practices are generally overt and can reveal information of considerable value to an adversary. Standard ways of executing tasks make it simple to detect changes in routines, or against a specific background, to detect capabilities being readied for use.

Critical Information Critical information consists of specific facts about friendly intentions, capabilities, and activities vitally needed by adversaries for them to plan and act effectively to guarantee failure or unacceptable consequences for friendly mission accomplishment.

The OPSEC Officer, in conjunction with a working group, develops the PD MBTS overall CIL, which is then approved by the PD. The PD’s intent is that all personnel — military, civilian, and contractors — are aware of the organization’s critical information so they can better apply OPSEC to their daily tasks.

The overall PD MBTS CIL is as follows:

• When, where, and how often specific groups/teams/pairs of PD MBTS employees travel for government business, i.e., Intelligence Electronics Testing, Worldwide Armor Conference, communications, computers, intelligence, surveillance, reconnaissance (C4ISR) Conference, etc.

• PD MBTS platform-specific program activities relating to system vulnerabilities, planned upgrades, goals, funding activities

• PD MBTS platform information systems; electronics; lasers; optics; electronic warefare; C4ISR; cybersecurity and modeling/simulations; sensors; and Active Protection Systems (APS)

• Emerging technologies and cutting-edge technologies being considered for PD MBTS platforms

• PD MBTS platform system requirements; capabilities; threshold/object specifications; and performance measures

• Identification of Critical Program Information (CPI) within PD MBTS platforms associated critical functions; Program Protective Procedures; and anti-tamper implementation methods

• Photos (internal or external) of information about vehicles or equipment that have been damaged by threats or malfunction; combat damage photos of any vehicle should not be commented on, noted, or discussed in open forum

• Identification of reliability or effectiveness, operational limitations, and vulnerabilities against ballistic, nuclear, chemical, biological, electronic warfare disclosing vulnerabilities; cybersecurity and limitation of PD MBTS platforms;

custom computer software/unique algorithms used on MBTS platforms

• PD MBTS Foreign Military Sales (FMS) platform programmatic resourcing decisions not yet approved (i.e. program/contract cancellations; pre-POM/BES lock budget data; and shortfalls in meeting program cost, schedule, and performance thresholds)

• Classification levels of the program – Special Compartmented Information (SCI) and Special Access Program (SAP) accesses; Security Classification Guide (SCG) identifies classified critical information; Department of Defense (DD 254) if addressing SCI or SAP

• Testing information on PD MBTS platforms compromising location, date, time, and method of transport for components, vehicles, and/or equipment

• Test results indicating demonstrated performance levels against system requirements

• Logistics information, when tied to a specific unit and location, and is protected and sensitive

OPSEC Measures OPSEC measures are in place to protect identified critical information. OPSEC measures reduce the probability of the adversary either collecting the indicators or being able to correctly analyze their meaning. There are three main categories of OPSEC measures:

1. Action Control: Internal actions to eliminate the indicators or vulnerabilities -attack the adversary’s collection system

2. Countermeasure: Disrupt effective adversary collection - prevent the adversary from detecting an indicator.

3. Counteranalysis: Prevent accurate interpretations of what is seen - provide an alternative analysis of an indicator.

Example: Access control devices are physical security devices, but they rely on personal security procedures to dictate who should be allowed or denied entry. and who should be denied. Access control devices also rely on employee compliance with procedures to walk through such devices and to identify themselves by badge, ID number, or biometric measurements. If the employees do not uniformly comply with these procedures, the device is ineffective. If an analyst accepts that the presence of access control hardware is by its very presence effective, he or she will have missed the true vulnerabilities in its effectiveness.

Information can be compromised in a variety of ways. Security education emphasizes the threat of overt and clandestine intelligence collectors. Conversations at work and off the job must not pertain to subjects that listeners do not have a need to know.

Information security is of vital importance to the PD MBTS OPSEC program. Security procedures, such as using only approved storage containers, double-checking offices before departure, having a clean-desk policy, and ensuring need-to-know are some of the measures that will be taken to protect classified and sensitive program-related information.

The measures identified here are not all-inclusive of those practiced in PD MBTS.

OPSEC measures in this section apply to all personnel at all operating locations. The OPSEC measures outlined in this section are designed to eliminate, reduce, or counter the possible vulnerabilities identified earlier in this plan.

Administrative/Personnel

Vulnerability or Potential Threat OPSEC measure

Loss of information

An aggregation/compilation of information could lead to a compromise of classified information.

Unauthorized personnel can see or overhear information (obtain information) while walking through areas to attend meetings.

Posting CUI (technical data or FOUO) in cubicles can be observed by visitors.

Data on glass walls/partitions and monitors can be observed by visitors.

Organizational charts can provide the adversary with targets to extract or acquire information.

Don’t talk about work in public places or common areas at work such as hallways, cafeterias, stairwells, etc.

Don’t talk around classified in unclassified environments.

Know who is around you before having sensitive or technical conversations.

Foreign National visitors will be announced before their arrival. Know when Foreign Nationals are in your area to avoid discussing information in common areas.

Avoid posting of planned schedule notices that reveal when sensitive events will occur.

Avoid access to CUI by unauthorized personnel (don’t leave unattended in uncontrolled areas, secure it overnight, etc).

Avoid displaying CUI in public places (e.g., airports, airplanes, restaurants).

Protect information whenever you leave your desk. Whenever you step away, make a quick check to see whether there is sensitive information on your desk; if so, place it in a secure location off your desktop.

Be prepared to implement a “clean desk” on one-hour notice in the event of visitors.

Organization charts will only contain PEO/DPEO, PM/DPM names only. All other names will be removed from organization charts prior to distribution outside the organization. This include team group photos, phone list/rosters, etc.

OPSEC Awareness

Vulnerability or Potential Threat OPSEC measure

Lack of OPSEC awareness can cause an unintentional release of information or spillage.

Complacency in not following the rules, conducting escorts, etc.

PD PMBTS personnel will maintain compliance with OPSEC and security training.

OPSEC posters will posted around PD MBTS areas and rotated on a quarterly basis.

OPSEC awareness emails, newsletter, bulletins will be sent quarterly.

Conference Room Security

Vulnerability or Potential Threat OPSEC measure

Unauthorized personnel may gain entrance in larger meeting rooms and become exposed to information for which they do not have the need-to-know.

Unknown caller into the meeting is exposed to technical or CUI information.

Meetings, briefings and conferences will be held to limit exposure of information (access control).

The individuals responsible for arranging the meetings will also be responsible for the security of the meeting. The responsible individual will:

• During meeting, close the doors to prevent eavesdropping.

• For teleconferences, maintain awareness of all participants calling in.

• Make sure no sensitive material has been left behind.

• Clean the white boards.

Handle any attempts by anyone, regardless of nationality, to obtain or acquire unauthorized access to classified or unclassified information concerning DOD facilities, activities, personnel, technology, or material through questioning, elicitation, trickery, bribery, threats, coercion, blackmail, photography, observation, collection of documents or material, correspondence (including electronic correspondence), or automated systems intrusions as an incident per AR 381-12 (Reference (f)). Report all such incidents immediately to the nearest supporting counterintelligence office and inform the chain of command.

Conferences and Symposia

Vulnerability or Potential Threat OPSEC measure

Personnel are susceptible to elicitation and exploitation during attendance at conferences/symposia.

Become familiar with the CIL.

Do not release information relating to the CIL.

If receive persistent solicitation of information, get a business card (or good description) and report to 902d Military Intelligence (MI) Group upon return.

Handle any attempts by anyone, regardless of nationality, to obtain or acquire unauthorized access to classified or unclassified information concerning DOD facilities, activities, personnel, technology, or material through questioning, elicitation, trickery, bribery, threats, coercion, blackmail, photography, observation, collection of documents or material, correspondence (including electronic correspondence), or automated systems intrusions as an incident per AR 381-12 (Reference (f). Report all such incidents immediately to the nearest supporting counterintelligence office and inform the chain of command.

Teleworking

Vulnerability or Potential Threat OPSEC measure

Working at an alternate worksite can expose program information to individuals who do not have a need-to-know.

Turn your monitor away from windows and from others to avoid unauthorized viewing (aka shoulder surfing).

Information no longer has layers of protection such as security in depth to protect the CUI at alternate work locations.

Limit hardcopy CUI taken to an alternate worksite. Protect per the CUI Protection Measures.

Laptops and software will utilize appropriate security measures for remote work with CUI information when the access method involves a direct connection to the Government network, such as through the virtual private network or remote access server.

Employee Travel

Vulnerability or Potential Threat OPSEC measure

PD MBTS personnel are susceptible to elicitation and exploitation during travel by individuals who covertly represent the intelligence collection agencies of foreign governments. Collection efforts may range from innocuous questions from friendly inhabitants to blackmail by intelligence agents, electronic monitoring, document duplications, and physical theft of material.

Without constant awareness of the threat and the CIL, personnel may inadvertently provide information of analytic value to foreign intelligence agents.

Travel in civilian clothes whenever possible.

Do not carry bags or other items that identify you as a member of PD MBTS or the Army.

Avoid wearing business logos while traveling.

Don’t put business cards in fish bowls for drawings for free dinners, etc.

Avoid discussing government-related work in restaurants, airports, and other public locations.

Secure travel related documents as you would for CUI and disposed properly.

Use a passport instead of military orders whenever possible.

Do not discuss assignments, duties, or reasons for travel unless absolutely necessary (e.g., with security, customs, or immigration personnel).

Comply with PEO GCS Policy for Traveling Outside the Continental United States (OCONUS) with Government Furnished Equipment (GCS-12-007), 24 October 2017.

Computer Security

Vulnerability or Potential Threat OPSEC measure

The nature of PD MBTS operations requires extensive use of computer equipment.

Process classified information on computer systems that have been approved to process

Without adequate security measures, this equipment is susceptible to intrusion or tampering through hardware or software manipulation.

that level of classified information. PEO GCS has a SIPR Room located in Building 229 and at Enterprise Court that can be used for Secret and below information.

Physically protect computer systems from intrusion, tampering or theft.

Don’t leave your laptop exposed in your vehicle. Keep it secured and obscured from view.

Media

Vulnerability or Potential Threat OPSEC measure

Enemy will exploit photos or other media showing results of improvised explosive device (IED) strikes, battle scenes, casualties, destroyed or damaged equipment.

Media requests to be released to the public may contain information that is not owned by PD MBTS or exposed sensitive information to public.

Unauthorized photographs, Facetime, etc., capture information other than subject.

Background information can contain sensitive information that should not be released.

Don’t share photos with individuals who do not have need-to-know.

Encrypt email that contain all photos or protect at the appropriate classification level.

Films, documentaries, interviews require the script or questions and answers have OPSEC review completed prior to filming. A subject matter expert (SME) who is briefed on OPSEC will be present during filming.

Obtained approval from non-PD MBTS owner to release information.

Photographs or live streaming are not authorized in PD MBTS areas.

Badges will not be photographed or copied.

Networked Printers

Vulnerability or Potential Threat OPSEC measure

CUI documents printed and never retrieved are left on printers or can be picked up accidentally by others.

If available, use the “lock” feature to hold print the CUI until you release it at the printer.

Compromising Emanations

Vulnerability or Potential Threat OPSEC measure

Electronic and electromechanical telecommunications and automated information processing equipment can produce unintentional, intelligence-bearing emanations. The study of these emanations is commonly known as TEMPEST.

Interception and analysis of these emanations can disclose information transmitted, received, handled, or otherwise processed by the equipment.

Prior to electronic processing of classified information, a TEMPEST Countermeasure Review must be completed.

• Contractors submit requested information through the government Security Manager in accordance with (IAW) the DD254 and the scope of work

• Government submit requested information through the Security Manager.

Waste Disposal

Vulnerability or Potential Threat OPSEC measure

Unclassified information thrown in the trash or not properly destroyed can release information that can be aggregated/compiled to expose classified information.

Don’t throw paper in the trash – shred all paper or use Shred-it bins. The trash can is for non-informational items only (e.g., food waste, wrappers).

Destroy classified waste. PEO GCS can shred paper, CDs and DVDs in Building 229, Room 3B237, and the TACOM Life Cycle Management Command (LCMC) G-2 can degauss and destroy hard drives and other media (See Reference (i)).

IMCOM Director of Operations has the capability to destroy paper in the Building 230E shipping dock.

Public Release

Vulnerability or Potential Threat OPSEC measure

Loss of information

An aggregation/compilation of information could lead to a compromise of classified information.

All information to be released to the public will undergo a public release review (STA 7114-2

PEO).

Trash is equated to public release. Do not throw government information in the trash, use the Shred-it bins located throughout the facility or use the shredder located in the SIPR rooms.

Website OPSEC Reviews

Vulnerability or Potential Threat OPSEC measure

The internet and intranet allow the increase in distribution of print and broadcast mediums to reach a wider audience.

Verify a valid mission need to disseminate the information to be posted.

Obtain approval via the PEO GCS Public Release process prior to posting information to the web site.

Protect information according to its sensitivity, and ensure reviewing officials and webmasters are selected and have received appropriate training in security and release requirements IAW Army web policy.

Security Managers, PAOs, and webmasters will use the PEO GCS checklist to review content quarterly on their publicly accessible websites.

Unsolicited Requests for Information

Vulnerability or Potential Threat OPSEC measure

Intelligence collectors often use elicitation as a technique to discreetly gather information that could facilitate targeting attempts.

Elicitation techniques are usually non-threatening, easy to disguise, deniable, effective, and usable to obtain information on personnel, military installations, and government facilities. The conversation can be in person, over the phone, or in writing.

Do not share information unless you can identify recipient has a valid need.

Be suspicious of people who seek such information.

Politely discourage conversation topics and deflect possible elicitations by—

• Referring them to public sources (e.g., web sites, press releases)

• Ignoring any question or statement you think is improper and changing the topic

• Deflecting a question with one of your own

• Responding with "Why do you ask?"

• Giving a nondescript answer

• Stating that you do not know

• Stating that you would have to clear such discussions with your security office

• Stating that you cannot discuss the matter

If you believe someone has tried to elicit information from you, especially about your work, report it to your OPSEC Officer.

Shipment of Sensitive Materials

Vulnerability or Potential Threat OPSEC measure

Not only are shipments of sensitive material subject to interception, but labels placed on packaging can sometimes reveal information of analytic value.

Do not place sensitive information on shipping labels or elsewhere on the package.

Classified will be IAW government regulations.

Communications Security

Vulnerability or Potential Threat OPSEC measure

All unsecured telephone conversations are vulnerable to monitoring, and all long-distance microwave transmissions are subject to intercept. Such vulnerabilities provide a rich source of information to adversary intelligence agents.

Classified will not be discussed over an un-secure telephone or network. Use Secure Telephone Equipment (STE) or Voice Over Internet Protocol (VOIP) in the encrypted mode for all classified discussions.

Limit verbal communications when discussing CUI in public or uncontrolled areas.

Whenever possible send an encrypted email to transmit the CUI that will limit the verbal exposure of CUI over open lines communication.

Defense Collaboration Services (DCS) is an alternate secure option when used with a headset or in a conference room using the conference room security identified above.

DCS is encrypted to DoD-mandated levels of security and is housed in DISA’s secure computing facilities. DCS is available to anyone with a Common Access Card (CAC) and to individuals sponsored by a CAC holder (with registration).

Don’t talk around classified information. Use secure communications -- secure telephone, classified fax, and classified email.

Limit release of information until latest possible date or until activities are complete.

Limit distribution to personnel with need-to-know. Control distribution of non-classified, sensitive information in accordance with distribution markings for technical and operational information.

Using unsecure facsimile, coordinate the transmission and receipt of information prior to faxing to ensure the information does not remain unattended on the receiving end of the transmission.

Transmit CUI via encrypted email or via AMRDEC Safe Exchange.

Insider Threat

Vulnerability or Potential Threat OPSEC measure

Personnel who become disgruntled present an attractive target to foreign intelligence services.

Non-action on the part of personnel who become aware of these situations can be a significant threat, as the individual who is experiencing may be exploited.

Report individuals with personal risk indicators (e.g., marital difficulties, criminal or non-acceptable social behavior, excessive indebtedness, indiscriminate use of alcohol or drugs) to the OPSEC Officer.

Document Markings

Vulnerability or Potential Threat OPSEC measure

Lack of document markings to indicate classification or the presence of CUI can lead to improper protection or dissemination to unauthorized personnel.

All documents will be marked appropriately by the author upon creation to include working papers and draft documents.

Classified information will be marked IAW DoDM 5200.01, Vol. 3 (Reference (c)) to identify the level of protection and dissemination of the information.

Controlled Unclassified Information will be marked For Official Use Only (FOUO) or with a distribution statement for technical information. Marking instructions are in the SCG or DoD Instruction 5230.24, (Reference (b)).

When in doubt, ask the MBTS Security Manager.

CUI Protection Measures

Vulnerability or Potential Threat OPSEC measure

Controlled Unclassified Information is information that is vulnerable to susceptibility and being acquired by foreign intelligence services.

An aggregation/compilation of information could lead to a compromise of classified information.

Release CUI only to an individual who is a U.S. person and has a valid need for such access in connection with the accomplishment of a lawful and authorized Government purpose.

Handle CUI material to prevent its disclosure to the general public and to limit its circulation to those employees who need the material to perform their work duties.

Do not leave CUI material unattended.

After working hours, store CUI information in locked desks, file cabinets, bookcases, locked rooms, or similar means.

Do not display CUI in public places, such as airports, airplanes, restaurants, etc.

Do not process CUI on public computers (e.g.

those available for use by the general public in kiosks, hotel business centers) or computers that do not have access control, including personally owned computers.

Protect CUI stored electronically on portable devices (e.g., laptops, personal electronic devices, removable media) physically or by using approved Data-at-Rest.

Transmission of CUI through encrypted email (use NIST- or NIAP-approved cryptographic products), sent via AMRDEC Safe Exchange or sent via classified networks.

Printed documents and material may be transmitted through mail channels or hand-carried.

FOUO information may be disseminated to DoD personnel and DoD contractors to conduct official business for the program. If dissemination is required outside of DoD personnel or DoD contractors, contact the appropriate OPSEC Officer or Security Manager for approval. Technical data will follow the release instructions identified in the Distribution Statement.

Destroy by any means approved for the destruction of classified information, i.e., cross-cut shredding or other means that would make it difficult to recognize or reconstruct the information to include authorized shred bins.

Former associates do not have the need-to-know for current operations; current employees need to remain vigilant in protecting the CUI and not shared information with previous coworkers, regardless of previous work relationship and prior access to information.

Visitor Control

Vulnerability or Potential Threat OPSEC measure

Unauthorized personnel can see or overhear information (obtain information) while walking through areas to attend meetings.

Posting CUI (technical data or FOUO) in cubicles can be observed by visitors.

Data on glass walls/partitions and monitors can be observed by visitors.

Visitors are individuals who do not have a need-to-know for PD MBTS information.

Areas that cannot control or limit access to visitors without a need-to-know will employ a clean-desk policy. Refer to the CUI Protections Measures above.

The OPSEC Officer will provide briefings to remind PD MBTS personnel of the potential for the inadvertent release of information by visual or oral means when visitors are present.

Escorts for Foreign Visitors

Vulnerability or Potential Threat OPSEC measure

Unauthorized personnel can see or overhear information (obtain information) while walking through areas to attend meetings.

Posting CUI (technical data or FOUO) in cubicles can be observed by visitors.

Data on glass walls/partitions and monitors can be observed by visitors.

All foreign visitors (i.e. non-citizens) will have escorts at all times in PD MBTS and other US Government facilities.

Escorts will be a U.S. Government employee.

The supporting Foreign Disclosure Officer will provide an Escort Briefing prior to escorting any foreign nationals.

OPSEC Officer will send a notification to the workforce prior to the visit of the impending visit, to include the “path” the visitors will take (to remind to limit discussions in hallways, cleaning white boards, etc.) and then the day of the visit.

OPSEC Officer to walk the path immediately prior to the visit.

Contractor Requirements

Vulnerability or Potential Threat OPSEC measure

PD MBTS contractors (and subcontractors) have access to and work with the critical information. PD MBTS contracts need to reflect the requirement for the protection of the CIL.

STA Form 255-PEO GCS version will be used for all requirement packages and scope of work changes to implement Antiterrorism and OPSEC onto contractors.

Comply with PEO Policy on Security Documents and Templates in Support of PEO GCS Acquisitions (GCS-045).

Contracts that require the contractor to access, process, handle or store Controlled Unclassified Information (FOUO or technical data) or classified information will define the OPSEC requirements in the contract and the scope of work to outline the specific OPSEC needs or to follow and implement the PD MBTS OPSEC Plan. This will include “Guidelines for Protecting Controlled Unclassified Information” as an attachment to the contract or scope language in the contract.

Annex A – The Multidiscipline Collection Threat

General Applicability: Intelligence threats stem primarily from five sources: Human Intelligence (HUMINT), Signals Intelligence (SIGINT), Imagery Intelligence (IMINT), Measurement and Signatures Intelligence (MASINT), and Foreign Intelligence Services and Non-traditional Threats. The worldwide intelligence collection threat is multidisciplined, highly sophisticated, and extremely dedicated. Intelligence collection efforts may use only one discipline or a combination of disciplines to obtain information.

Local threat assessments, such as those published by the Army Counterintelligence Center, contain information critical to unit threat analysis.

Human Intelligence (HUMINT) Threat: Human intelligence describes activities to obtain both classified and unclassified information through the use of human agents.

Endeavors of human agents, both overt and covert, pose a substantial threat if countermeasures to neutralize or minimize their activities are not employed.

1. Overt–Open Source Intelligence (OSINT). Significant quantities of unclassified information, whether in publications, on the internet, or at trade shows and conferences, offer a lucrative target to an adversary. In addition to collecting this information, the adversary may make requests for documents either directly or through FOIA. Personnel should report unusual requests for documents or information to Army counterintelligence via 1-800-CALL-SPY or the web-based platform iSALUTE, https://www.inscom.army.mil/isalute/.

2. Visitors. Visitors to the facilities include government personnel, subcontractors, vendors, suppliers, contract labor organizations and service groups (repairmen, telephone, janitorial, etc.) who may obtain information of interest to an intelligence service or criminal element. Units are at risk for inadvertent visual and oral disclosures that may occur during these visits.

3. Covert–Espionage. While this aspect of HUMINT is not as common as other forms of intelligence collection, the possibility exists for this method to be employed. An example of covert collection is placing hidden listening devices in working areas where agents have access to sensitive information. Covert operations inflict severe damage and compromise to our country’s security.

Signals Intelligence (SIGINT) Threat: SIGINT describes the capability to obtain classified and unclassified information by monitoring communication systems or by analyzing electromagnetic radiation/emanations from various types of equipment. This threat includes communications intelligence (COMINT), electronic intelligence (ELINT), and foreign instrumentation signals intelligence (FISINT). This threat targets telephones (including cellular, pagers, and residential), radio transmissions, and facsimile transmissions (both secure and non-secure). Exploitation is much easier when any deviation from standard security practices occurs. The most common error is discussion of sensitive, unclassified information over a non-secure telephone or transmitted via non-secure facsimile. Offshore ships, satellites, and fixed land-based sites perform https://www.inscom.army.mil/isalute/

SIGINT collection. Clandestine intelligence personnel with collection equipment sometimes perform signals collection efforts within close proximity of their target.

1. Telephone conversations are especially vulnerable because most are relayed, at some point in transmission, via microwave signals or satellite, both of which are easily monitored. The use of double-talk and self-generated codes is not effective as a means to protect sensitive information during telephone conversations; such measures are easily defeated by professional intelligence analysts.

2. Current technology has produced a situation in which telephones in the hung-up (on-hook) position may frequently transmit room conversations occurring in the vicinity of the telephone. The telephone handset acts as a microphone that can pick-up and transmit room electronic signals and voice.