Attachment 0007_PEO GCS OPSEC Plan.pdf

Program Executive Office Ground Combat Systems (PEO GCS)

Operations Security (OPSEC) Plan

PREPARED BY: Security Office, PEO GCS, SFAE-GCS-CIO/MS 505, 6501 East Eleven Mile Road, Warren, MI 48397-5000

SUBMITTED BY

NANCY CHAPLIN Date OPSEC Officer

APPROVED BY

BRIAN P. CUMMINGS Date Major General, USA Program Executive Officer, Ground Combat Systems

22 May 2019

9 June 2019

CHAPLIN.NANCY.

A.1230490259

Digitally signed by

CHAPLIN.NANCY.A.1230490259

Date: 2019.05.22 14:29:59 -04'00'

CUMMINGS.BRIAN.P

ATRICK.1047098382

Digitally signed by

CUMMINGS.BRIAN.PATRICK.104709838

Date: 2019.06.09 11:52:09 -04'00'

PEO GCS OPSEC P lan June 2019 i

Table of Contents PEO GCS Mission Statement General OPSEC Definition OPSEC Concept OPSEC Compromise Penalties Responsibilities

Program Executive Officer OPSEC Officer as the PEO’s executive agent will -- PEO Public Affairs Officer (PAO) PEO Webmaster Program Managers All U.S. Personnel with access to PEO GCS CUI or classified information

OPSEC Considerations Critical Information OPSEC Measures

Administrative/Personnel OPSEC Awareness Conference Room Security Conferences and Symposia Teleworking Employee Travel Computer Security Media Networked Printers Compromising Emanations Waste Disposal Public Release Website OPSEC Reviews Unsolicited Requests for Information Shipment of Sensitive Materials Communications Security Insider Threat Document Markings CUI Protection Measures Visitor Control Escorts for Foreign Visitors Contractor Requirements

Annex A – The Multidiscipline Collection Threat Annex B – Vulnerability Assessment Annex C – OPSEC Checklist Annex D – Terms Annex E – References

PEO GCS Mission Statement Modernize, sustain and transform the Army's portfolio of premier ground combat systems.

General This publication specifically addresses the common features of a functional, active and documented Operations Security (OPSEC) program. This publication assigns OPSEC responsibilities and requirements within the Program Executive Office Ground Combat Systems (PEO GCS) to plan for and implement OPSEC; a systematic approach to developing necessary OPSEC measures; implementation of OPSEC training;

requirements for the review of OPSEC measures and reporting; and cross-command and interagency support to the PEO GCS OPSEC program, which includes reviews, assessments, and survey training. It is designed to provide a basic understanding of OPSEC functions and how to apply them within PEO GCS. OPSEC is applicable to all aspects of work, from daily routine planning through testing, exercise, and evaluation phases to force deployment, recovery, and reconstitution.

PEO OPSEC Officer: Nancy Chaplin, 586-282-9648

This OPSEC Plan documents the policies and procedures needed to meet the specific OPSEC program requirements of PEO GCS and to support the OPSEC programs of higher echelons.

The overall purpose of OPSEC is to strengthen our traditional security procedures by identifying existing vulnerabilities or weaknesses and applying measures to protect sensitive technologies. The goal is to deny our adversaries access to any critical information. Critical information includes technologies and information desired by an adversary that is sensitive and the disclosure of which could seriously impact our programs. Technology or information does not have to be classified to be of value to an adversary. An adversary can learn a lot about our programs by piecing together obtainable unclassified information. Therefore, in our attempts to shield our activities, it is not only important to follow normal security practices but also to implement OPSEC measures. This OPSEC Plan will discuss the five-step process: Identifying Critical Information, Analysis of Threats, Analysis of Vulnerabilities, Assessment of Risks, and the Application of OPSEC measures.

OPSEC applies to everyone within PEO GCS. All information identified as critical information will be reviewed for OPSEC before being released. All information, regardless of whether it is critical, will be reviewed for OPSEC before its release to the public in any manner.

OPSEC Definition OPSEC is a process of identifying critical information and subsequently analyzing friendly actions attendant to military operations and other activities to—

1. Identify actions that can be observed by adversary intelligence systems.

2. Determine indicators that hostile intelligence systems can obtain that could be interpreted or pieced together to derive critical information in time to be useful to adversaries.

3. Select and execute measures that eliminate or reduce to an acceptable level the vulnerabilities of friendly actions to adversary exploitation.

OPSEC Concept Many daily normal functions or may convey information and indicators to adversaries in spite of routine security measures (personnel, physical, document, cryptographic, computer) to protect classified information. Information available from detectable friendly activities, when combined with other information held by an adversary will, in unknown ways, shape the adversary's perceptions of friendly intentions, military capabilities, actions, and possible weaknesses, all of which will provide answers to adversary intelligence questions. During classified or sensitive unclassified activities (e.g., operations, exercises, field tests of military systems), are planned and executed, acting routinely can often result in adversaries gaining harmful appreciations by piecing together the various indicators.

Intelligence systems function worldwide. Even if PEO GCS is vigilant, other organizations that provide support may conduct activities that convey pertinent PEO GCS information or indicators of intentions, capabilities, limitations, and vulnerabilities.

Therefore, planning for primary and supporting operations and other activities (e.g., a test administered by the Army Test and Evaluation Command [ATEC]) must be systematically examined to determine potential disclosures that would cause cancellation or failure of the primary mission. Subsequently, one must plan and execute protective measures that permit operations and activities to proceed effectively while preserving requisite essential secrecy. OPSEC is the process designed to do this.

An OPSEC vulnerability exists when OPSEC indicators leading to critical information are collectable by adversary collection systems, the collected information can be processed, and the adversary has time to react in a way harmful to the United States.

The most serious problem facing PEO GCS in this respect is that critical information collected by an adversary today could in fact be used to develop a technological advantage for the adversary’s use many years in the future. Collection capabilities used to obtain information from accessible activities generally depend on some form of target cooperation. For example, throwing any information in the trash allows it to be retrieved by an adversary who will gain information about our activities, and releasing information into the public domain allows the adversary to obtain useable information at no risk to their assets. The detection of predictable actions depends on our acting in stereotyped ways and giving the adversary an advantage. Thus, if proper OPSEC measures are applied, it is often possible to eliminate or control many detectable indicators of critical information about our intentions, capabilities, and activities.

The key objective of OPSEC is to ensure mission effectiveness. Some protective measures to eliminate information conveyed by an activity may unacceptably reduce effectiveness. For example, telemetry and communications are often needed in tests;

and personnel, equipment, and material movements are unavoidable if operations and activities and to be executed. In these instances, it may be possible to deny information by acting against the collectors or analysts, rather than stopping the actions. Actions that may implemented include the use of jamming, obscurant, weather, camouflage, environmental conditions, covers, or military deception to influence adversary perceptions and conclusions (e.g., cover operations to explain observable activities, diversions to draw collection and analytical interest elsewhere, creating conditioning to cause activities to be ignored, multiple impressions to confuse interpretation of information). In Joint operations, OPSEC is an element of command and control warfare. Countering the adversary command and control, and protecting friendly command and control are functions of OPSEC.

Planning for secrecy must extend beyond exposure of raw information and consider possible assumptions and estimates made by an adversary. Logical conclusions based on generally available information, trend analysis based on historical data or technical possibilities, and broad experience of adversary planners and decision-makers must be factored in to planning. Military deception may be required to mislead adversary analysts in order to maintain essential secrecy.

The following are examples of unclassified information that are indicators that could alert or key an adversary to the existence of a classified project, existence or application of advanced technology, or a new tactic or technique unknown to adversaries:

Unclassified agreements between government agencies or their association in a project or operation that outlines methods, procedures, and current U.S.

Government intentions or future objectives.

Special or unique requests providing special instructions that could reveal capabilities or the technology of a new weapon system.

Public relations release describing aspects of technological or operational cooperation between the U.S. and other nations.

Announcements of formation of specialized groups, special elements, or organizations, which could signal special intentions, activities, or capabilities.

Consolidated budget execution for specific projects, testing of items or tactics, and monies spent that are intended for future acquisition.

OPSEC Compromise An OPSEC compromise is the disclosure of critical or sensitive information that jeopardizes PEO GCS’s ability to execute its mission or to adequately protect its personnel or equipment. Good OPSEC practices can prevent these compromises and allow us to maintain essential secrecy about our operations.

Critical or sensitive information that has been compromised and is available in open sources and the public domain should not be highlighted or referenced publicly outside of intragovernmental or authorized official communications, because these actions provide further unnecessary exposure of the compromised information. Report any known or suspected OPSEC compromise to the PEO Security Office immediately.

Penalties Failure to comply with OPSEC orders, directives, or policies may be punished as violations of a lawful punitive order under Article 92 of the Uniform Code of Military Justice (UCMJ) (Reference (a)) or under other disciplinary, administrative, or other actions as applicable. Personnel not subject to the UCMJ who fail to protect critical and sensitive information from unauthorized disclosure may be subject to administrative, disciplinary, contractual, or criminal action.

Responsibilities Every individual is ultimately responsible for the security of the information to which he or she has access. Each piece of information that an adversary can get access to fills in one more piece of the puzzle as it relates to our overall plan of action.

Program Executive Officer

Issue orders, directives, and policies to protect PEO GCS critical and sensitive information to clearly define the specific OPSEC measures that all PEO personnel should practice.

Ensure that the OPSEC program and OPSEC measures are coordinated and synchronized with security programs, e.g., information security (INFOSEC), information assurance (IA), physical security, and force protection.

Ensure that all official information released to the public, to include information released on the World Wide Web, receives an OPSEC review prior to dissemination.

Establish a documented OPSEC program that includes as a minimum, OPSEC Officer appointment orders and an OPSEC Plan.

Appoint an OPSEC officer in writing with responsibility for supervising the execution of proper OPSEC within the organization.

Ensure that the appointed OPSEC Officer is of appropriate grade or rank, and receives appropriate training in accordance with (IAW) Chapter 4, Army Regulation (AR) 530-1, (Reference (h)).

Approve the PEO GCS Critical Information List (CIL) and circulate it to all subordinates as widely as security permits.

Provide guidance and direction to ensure that each subordinate organization understands, adapts, and applies the CIL to its mission and provides feedback.

Weigh the risk in the mission against the costs of protection and decide what OPSEC measures to implement; and publish such measures in the OPSEC Plan.

OPSEC Officer as the PEO’s executive agent will --

Direct and implement the OPSEC program.

Plan for and implement OPSEC before, during, and after operations and other activities, including RDT&E that affect the combat capability of the Army; ensure that OPSEC is part of the initial planning guidance.

Chair the OPSEC Working Group (OWG) to coordinate OPSEC actions on a consistent basis.

Develop the CIL in conjunction with other subject matter experts.

Develop and recommend OPSEC measures to be implemented.

Conduct OPSEC reviews of operational plans and reports to ensure adherence to OPSEC policies and procedures.

Conduct OPSEC assessments of PMOs using the published OPSEC guidance to determine whether the PMO is implementing PEO-directed and their own OPSEC policies and procedures.

Coordinate with the Public Affairs and Freedom of Information Act (FOIA) Officers to ensure that information is reviewed for OPSEC before being released.

Ensure that all OPSEC training is IAW AR 530-1 (Reference (h)) and this OPSEC Plan.

Integrate intelligence, counterintelligence, and force protection into OPSEC planning and practice.

Prepare the annual OPSEC Report.

Perform other duties and responsibilities as defined in AR 530-1, Appendix H (Reference (h)).

Provide quarterly reminders of the importance of sound OPSEC practices, including but not limited to OPSEC news releases in publications, OPSEC information bulletins, and OPSEC awareness briefings.

PEO Public Affairs Officer (PAO)

Comply with Federal, Department of Defense (DoD), and Department of the Army (DA) website administration policies and implementing content-approval procedures that include OPSEC.

Consider OPSEC in preparation of all public releases of official information.

Coordinate with the OPSEC Officer before updating or posting information on all Web sites, IAW AR 25-2 (Reference (d)) paragraph 4-20.g.(11).

Ensure the office providing the information, materials, or records to the PAO for release should accomplish OPSEC reviews IAW AR 360-1 (Reference (e)), paragraph 5-4.

Ensure that in addition to the OPSEC Officer, the webmaster and other appropriate designees (e.g., command counsel, force protection, intelligence) have properly cleared information prior to posting to the web, unclassified intranet, or to Army Knowledge Online (AKO) areas accessible to all account types.

Coordinate directly with the OPSEC Officer on all questionable releases and for additional guidance on any release.

Ensure that all military, civilian, or contractor personnel who post or maintain information (e.g., documents, spreadsheets) in the public domain for official PEO GCS purposes (also including OPSEC Officers and PAO personnel) complete “Social Media and Operations Security” training at Information Assurance Training Center or DISA’s Social Network Course; or such similar courses that may be required in the future.

PAOs and other personnel who interact with the public on a regular basis will received external official presence training or attend a Level II OPSEC officers course, IAW AR 530-1 (Reference (h)), paragraph 4-2.b.(2).

Be the primary spokesperson to the news media in the event an antiterrorism incident or work in conjunction with the installation public affairs office, IAW AR 525-13, (Reference (g)).

Provide unclassified information about the Army and its activities to the public with maximum disclosure and minimum delay. Do not release information that would adversely affect national security, threaten the personal safety, or invade the privacy of members of the Armed Forces, IAW AR 360-1 (Reference (e)), paragraph 2-3.d.(5).

PEO Webmaster

Comply with Federal, DoD, and DA web site administration policies and implement content-approval procedures that include OPSEC and PAO reviews before updating or posting information on all websites IAW AR 25-2 (Reference (d)) paragraph 4-20,g.(11).

Conduct annual OPSEC reviews of all organizational web sites and provide these results to the OPSEC Officer for inclusion in the annual OPSEC report IAW AR 25-2 (Reference (d)) paragraph 4-20.g. (15).

Coordinate directly with the OPSEC Officer for additional guidance on any questionable web site posting.

Take the Social Media and Operations Security training course at Information Assurance Training Center or DISA’s Social Network Course.

Program Managers

Implement an OPSEC program.

Approve the PM’s OPSEC Plan.

Appoint an OPSEC officer in writing with responsibility for supervising the execution of proper OPSEC within the organization.

Ensure appropriate OPSEC measures are taken within the PMO to preserve essential secrecy.

Ensure appropriate OPSEC measures are taken in order to provide maximum protection of all functions and activities.

Assist the OPSEC Officer with integrating OPSEC into all organizational activities.

Plan for and implement OPSEC before, during, and after operations and other activities, including RDT&E that affect the combat capability of the Army; ensure that OPSEC is part of the PM’s initial planning guidance.

All U.S. Personnel with access to PEO GCS CUI or classified information

Implement OPSEC measures as identified in this plan.

Receive Operations Security Level I training IAW AR 530-1, (Reference (h)) Chapter 4, to— o Understand how OPSEC complements traditional security programs to maintain essential secrecy of U.S. military capabilities, intentions, and plans.

o Learn how to apply OPSEC to daily tasks.

o Learn why OPSEC is important to the organization.

o Understand how adversaries aggressively seek information on U.S.

military capabilities, intentions, and plans.

o Become knowledgeable of the CIL and how to protect it by applying

OPSEC measures to prevent inadvertent disclosure.

Be familiar with this OPSEC Plan and where to obtain additional OPSEC guidance if needed.

Maintain need-to-know and telephone security.

Limit distribution

Do not talk about work in public locations.

Safeguard unclassified technical data.

Handle any attempt by unauthorized personnel to solicit sensitive or critical information as a TARP incident per AR 381-12 (Reference (f)). Report all facts immediately to the nearest supporting counterintelligence office and inform the chain of command.

OPSEC Considerations OPSEC must be considered when preparing policies, procedures, and doctrine; when designing systems; and when prescribing logistic and administrative practices.

Policies, procedures, and doctrines govern the freedom of action of commanders and can introduce a degree of rigidity in the way functions are performed. Over time, the constraints imposed on commanders and procedural habits will become apparent, allowing adversaries to better predict what commanders will or will not do and how various functions will be carried out.

Systems and tactics are of little value if during their development, an adversary develops the capability to locate, track, identify, target, and destroy that system or counter the tactic when it is deployed or implemented. Administrative and logistic practices are generally overt and can reveal information of considerable value to an adversary. Standard ways of executing tasks make it simple to detect changes in routines, or against a specific background, to detect capabilities being readied for use.

Critical Information Critical information consists of specific facts about friendly intentions, capabilities, and activities vitally needed by adversaries for them to plan and act effectively to guarantee failure or unacceptable consequences for friendly mission accomplishment.

The OPSEC Officer, in conjunction with a working group, develops the PEO GCS overall CIL, which is then approved by the PEO. The PEO’s intent is that all personnel—military, civilian, and contractors—are aware of the organization’s critical information so they can better apply OPSEC to their daily tasks.

The overall PEO CIL is as follows:

Vulnerabilities and limitations in weapons and weapons systems – Operational limitations (weather, terrain); reliability or effectiveness of the weapon system; lack of performance or identification of damage against threat (e.g., ballistic, non-ballistic, nuclear, chemical, biological, electronic warfare)

Weapons systems development schedules below summary – Specific date, time, or location information prior to and during the event

Emerging technologies applicable to new weapons systems Custom computer software used in weapons systems development, testing and evaluation Identification of Critical Program Information (CPI) and Program Protection

Plan (PPP) implementation methods – Location of CPI within the weapon system; identification of contractor developing CPI; protection measures implemented to protect CPI and critical functions of the weapon system

Specifics or requirements of the program in acquisition – Threshold and Objective specifications and technical performance measures

Preliminary programmatic and resourcing decisions not yet approved by the Army – Program or contract cancellations; pre-Program Objective Memorandum (POM) or Budget Estimate Submission (BES) lock budget data;

shortfalls in meeting program cost, schedule, and performance thresholds

Classification levels of the program – Special Compartmented Information (SCI) and Special Access Program (SAP) accesses; Security Classification Guide (SCG) identifies classified critical information; Department of Defense (DD) Form 254, if addressing SCI or SAP

OPSEC Measures OPSEC measures are in place to protect identified critical information. OPSEC measures reduce the probability of the adversary either collecting the indicators or being able to correctly analyze their meaning. There are three main categories of OPSEC measures:

1. Action Control: Internal actions to eliminate the indicators or vulnerabilities -attack the adversary’s collection system

2. Countermeasure: Disrupt effective adversary collection - prevent the adversary from detecting an indicator.

3. Counteranalysis: Prevent accurate interpretations of what is seen - provide an alternative analysis of an indicator.

Example: Access control devices are physical security devices, but they rely on personal security procedures to dictate who should be allowed entry and who should be denied. Access control devices also rely on employee compliance with procedures to walk through such devices and to identify themselves by badge, ID number, or biometric measurements. If the employees do not uniformly comply with these procedures, the device is not effective. If an analyst accepts that the presence of access control hardware is by its very presence effective, he or she will have missed the true vulnerabilities in its effectiveness.

Information can be compromised in a variety of ways. Security education emphasizes the threat of overt and clandestine intelligence collectors. Conversations at work and off the job must not pertain to subjects that listeners do not have a need to know.

Information security is of vital importance to the PEO GCS OPSEC program. Security procedures, such as using only approved storage containers, double-checking offices before departure, having a clean desk policy, and ensuring need to know are some of the measures that will be taken to protect classified and sensitive program related information.

The measures identified here are not all-inclusive of those practiced in PEO GCS.

OPSEC measures in this section apply to all personnel at all operating locations. The

OPSEC measures outlined in this section are designed to eliminate, reduce, or counter the possible vulnerabilities identified earlier in this plan.

Administrative/Personnel

Vulnerability or Potential Threat OPSEC measure

Loss of information

An aggregation/compilation of information could lead to a compromise of classified information.

Unauthorized personnel can see or overhear information (obtain information) while walking through areas to attend meetings.

Posting CUI (technical data or FOUO) in cubicles can be observed by visitors.

Data on glass walls/partitions and monitors can be observed by visitors.

Organizational charts can provide the adversary with targets to extract or acquire information.

Don’t talk about work in public places or common areas at work such as hallways, cafeterias, stairwells, etc.

Don’t talk around classified in unclassified environments.

Know who is around you before having sensitive or technical conversations.

Foreign National visitors will be announced before their arrival. Know when Foreign Nationals are in your area to avoid discussing information in common areas.

Avoid posting of planned schedule notices that reveal when sensitive events will occur.

Avoid access to CUI by unauthorized personnel (don’t leave unattended in uncontrolled areas, secure it overnight, etc).

Avoid displaying CUI in public places (e.g., airports, airplanes, restaurants).

Protect information whenever you leave your desk. Whenever you step away, make a quick check to see whether there is sensitive information on your desk; if so, place it in a secure location off your desktop.

Be prepared to implement a “clean desk” on 1-hour notice in the event of visitors.

Organization charts will only contain PEO/DPEO, PM/DPM names only. All other names will be removed from organization charts prior to distribution outside the organization. This include team group photos, phone list/rosters, etc.

OPSEC Awareness

Vulnerability or Potential Threat OPSEC measure

Lack of OPSEC awareness can cause an unintentional release of information or spill.

Complacency in not following the rules, conducting escorts, etc.

PEO GCS personnel will maintain compliance with OPSEC and security training.

OPSEC posters will posted around the PEO areas and rotated on a quarterly basis.

OPSEC awareness emails, newsletter, bulletins will be sent quarterly.

Conference Room Security

Vulnerability or Potential Threat OPSEC measure

Unauthorized personnel may gain entrance in larger meeting rooms and become exposed to information for which they do not have the need-to-know.

Unknown caller into the meeting is exposed to technical or CUI information.

Meetings, briefings and conferences will be held to limit exposure of information (access control).

The individuals responsible for arranging the meetings will also be responsible for the security of the meeting. The responsible individual will:

During meeting, close the doors to prevent eavesdropping.

For teleconferences, maintain awareness of all participants calling in.

Make sure no sensitive material has been left behind.

Clean the white boards.

Handle any attempts by anyone, regardless of nationality, to obtain or acquire unauthorized access to classified or unclassified information concerning DOD facilities, activities, personnel, technology, or material through questioning, elicitation, trickery, bribery, threats, coercion, blackmail, photography, observation, collection of documents or material, correspondence (including electronic correspondence), or automated systems intrusions as an incident per AR 381-12 (Reference (f)). Report all such incidents immediately to the nearest supporting counterintelligence office and inform the chain of command.

Conferences and Symposia

Vulnerability or Potential Threat OPSEC measure

Personnel are susceptible to elicitation and exploitation during attendance at conferences/symposia.

Become familiar with the CIL.

Do not release information relating to the CIL.

If receive persistent solicitation of information, get a business card (or good description) and report to 902d upon return.

Handle any attempts by anyone, regardless of nationality, to obtain or acquire unauthorized access to classified or unclassified information concerning DOD facilities, activities, personnel, technology, or material through questioning, elicitation, trickery, bribery, threats, coercion, blackmail, photography, observation, collection of documents or material, correspondence (including electronic correspondence), or automated systems intrusions as an incident per AR 381-12 (Reference (f). Report all such incidents immediately to the nearest supporting counterintelligence office and inform the chain of command.

Teleworking

Vulnerability or Potential Threat OPSEC measure

Working at an alternate worksite can expose program information to individuals who do not have a need-to-know.

Information no longer has layers of protection such as security in depth to protect the CUI at alternate work locations.

Turn your monitor away from windows and from others to avoid unauthorized viewing (aka shoulder surfing).

Limit hardcopy CUI taken to an alternate worksite. Protect per the CUI Protection Measures.

Laptops and software will utilize appropriate security measures for remote work with CUI information when the access method involves a direct connection to the Government network, such as through the virtual private network or remote access server.

Employee Travel

Vulnerability or Potential Threat OPSEC measure

PEO GCS personnel are susceptible to elicitation and exploitation during travel by individuals who covertly represent the intelligence collection agencies of foreign governments. Collection efforts may range from innocuous questions from friendly inhabitants to actual blackmail by intelligence agents, electronic monitoring, document duplications, and actual theft of material.

Without constant awareness of the threat and the CIL, personnel may inadvertently provide information of analytic value to foreign intelligence agents.

Travel in civilian clothes whenever possible.

Do not carry bags or other items that identify you as a member of PEO GCS or the Army.

Avoid wearing business logos while traveling.

Don’t put business cards in fish bowls for drawings for free dinners, etc.

Avoid discussing government related work in restaurants, airports, and other public locations.

Secure travel related documents as you would for CUI and disposed properly.

Use a passport instead of military orders whenever possible.

Do not discuss assignments, duties, or reasons for travel unless absolutely necessary (e.g., with security, customs, or immigration personnel).

Comply with PEO GCS Policy for Traveling Outside the Continental United States (OCONUS) with Government Furnished Equipment (GCS-12-007), 24 October 2017.

Computer Security

Vulnerability or Potential Threat OPSEC measure

The nature of PEO GCS operations requires extensive use of computer equipment.

Without adequate security measures, this equipment is susceptible to intrusion or tampering through hardware or software manipulation.

Process classified information on computer systems that have been approved to process that level of classified information. PEO GCS has a SIPR Room located in Bldg 229 and at Enterprise Court can be used for Secret and below information.

Physically protect computer systems from intrusion or tampering or theft.

Don’t leave your laptop exposed in your vehicle. Keep it secured and obscured from view.

Media

Vulnerability or Potential Threat OPSEC measure

Enemy will exploit photos or other media showing results of IED strikes, battle scenes, casualties, destroyed or damaged equipment.

Media requests to be released to the public may contain information that is not owned by PEO GCS or exposed sensitive information to public.

Unauthorized photographs, Facetime, etc capture information other than subject.

Background information can contain sensitive information that should not be released.

Don’t share photos with individuals who do not have need-to-know.

Encrypt email that contain all photos or protect at the appropriate classification level.

Films, documentaries, interviews require the script or questions and answers have OPSEC review completed prior to filming. A SME who is briefed on OPSEC will be present during filming.

Obtained approval from non-PEO GCS owner to release information.

Photographs or live streaming are not authorized in PEO areas.

Badges will not be photographed or copied.

Networked Printers

Vulnerability or Potential Threat OPSEC measure

CUI documents printed and never retrieved are left on printers or can be picked up accidentally by others.

If available, use the “lock” feature to hold print the CUI until you release it at the printer.

Compromising Emanations

Vulnerability or Potential Threat OPSEC measure

Electronic and electromechanical telecommunications and automated information processing equipment can produce unintentional, intelligence-bearing emanations. The study of these emanations is commonly known as TEMPEST.

Interception and analysis of these emanations can disclose information transmitted, received, handled, or otherwise processed by the equipment.

Prior to electronic processing of classified information, a TEMPEST Countermeasure Review must be completed.

Contractors submit requested information through the government Security Manager IAW the DD254 and the scope of work

Government submit requested information through the Security Manager.

Waste Disposal

Vulnerability or Potential Threat OPSEC measure

Unclassified information thrown in the trash or not properly destroyed can release information that can be aggregated/compiled to expose classified information.

Don’t through paper in the trash – shred all paper or use shred-bins. The trash can is for non-informational items only (e.g., food waste, wrappers).

Destroy classified waste -- PEO GCS can shred paper, CDs and DVDs in Building 229, Room 3B237, and the TACOM Life Cycle Management Command (LCMC) G-2 can degauss and destroy hard drives and other media (See Reference (i)).

IMCOM Director of Operations has the capability to destroy paper in Building 230E shipping dock.

Public Release

Vulnerability or Potential Threat OPSEC measure

Loss of information

An aggregation/compilation of information could lead to a compromise of classified information.

All information to be released to the public will undergo a public release review (STA 7114-2

PEO).

Trash is equated to public release. Do not throw government information in the trash, use the Shred-it bins located throughout the facility or use the shredder located in the SIPR rooms.

Website OPSEC Reviews

Vulnerability or Potential Threat OPSEC measure

The internet and intranet allow the increase in distribution of print and broadcast mediums to reach a wider audience.

Verify a valid mission need to disseminate the information to be posted.

Obtain approval via the PEO Public Release process prior to posting information to the website.

Protect information according to its sensitivity, and ensure reviewing officials and webmasters are selected and have received

Nancy.Chaplin2 Text Box Don't throw paper in the trash - shred all appropriate training in security and release requirements IAW Army web policy.

Security Managers, PAOs, and webmasters will use the PEO checklist to review content quarterly on their publicly accessible websites.

Unsolicited Requests for Information

Vulnerability or Potential Threat OPSEC measure

Intelligence collectors often use elicitation as a technique to discreetly gather information that could facilitate future targeting attempts.

Elicitation techniques are usually non-threatening, easy to disguise, deniable, effective, and usable to obtain information on personnel, military installations, and government facilities. The conversation can be in person, over the phone, or in writing.

Do not share information unless you can identify recipient has a valid need.

Be suspicious of people who seek such information.

Politely discourage conversation topics and deflect possible elicitations by—

Referring them to public sources (e.g., websites, press releases)

Ignoring any question or statement you think is improper and changing the topic

Deflecting a question with one of your own

Responding with "Why do you ask?"

Giving a nondescript answer Stating that you do not know Stating that you would have to clear such discussions with your security office

Stating that you cannot discuss the matter

If you believe someone has tried to elicit information from you, especially about your work, report it to your OPSEC Officer.

Shipment of Sensitive Materials

Vulnerability or Potential Threat OPSEC measure

Not only are shipments of sensitive material subject to interception, but labels placed on packaging can sometimes reveal information of analytic value.

Do not place sensitive information on shipping labels or elsewhere on the package.

Classified will be IAW government regulations.

Communications Security

Vulnerability or Potential Threat OPSEC measure

All unsecured telephone conversations are vulnerable to monitoring, and all long-distance microwave transmissions are subject to intercept. Such vulnerabilities provide a rich source of information to intelligence agents.

Classified will not be discussed over an un-secure telephone or network. Use Secure Telephone Equipment (STE) or voice over IP (VOIP) in the encrypted mode for all classified discussions.

Limit verbal communications when discussing CUI in public or uncontrolled areas.

Whenever possible send an encrypted email to transmit the CUI that will limit the verbal exposure of CUI over open lines communication.

Defense Collaboration Services (DCS) is an alternate secure option when used with a headset or in a conference room using the conference room security identified above.

DCS is encrypted to DoD-mandated levels of security and is housed in DISA’s secure computing facilities. DCS is available to anyone with a Common Access Card (CAC) and to individuals sponsored by a CAC holder (with registration).

Don’t talk around classified information. Use secure communications: secure telephone, classified fax, classified email.

Limit release of information until latest possible date or until activities are complete.

Limit distribution to personnel with need to know. Control distribution of non-classified, sensitive information in accordance with distribution markings for technical and operational information.

Using unsecure facsimile, coordinate the transmission and receipt of information prior to faxing to ensure the information does not remain unattended on the receiving end of the transmission.

Transmit CUI via encrypted email or via AMRDEC Safe Exchange.

Insider Threat

Vulnerability or Potential Threat OPSEC measure

Personnel who become disgruntled present an attractive target to foreign intelligence services.

Non-action on the part of personnel who become aware of these situations can be a significant threat, as the individual who is experiencing may be exploited.

Report individuals with personal risk indicators (e.g., marital difficulties, criminal or non-acceptable social behavior, excessive indebtedness, indiscriminate use of alcohol or drugs) to the OPSEC Officer.

Document Markings

Vulnerability or Potential Threat OPSEC measure

Lack of document markings to indicate classification or the presence of CUI can lead to improper protection or dissemination to unauthorized personnel.

All documents will be marked appropriately by the author upon creation to include working papers and draft documents.

Classified information will be marked IAW DoDM 5200.01, Vol. 3 (Reference (c)) to identify the level of protection and dissemination of the information.

Controlled Unclassified Information will be marked For Official Use Only (FOUO) or with a distribution statement for technical information. Marking instructions are in the SCG or DoD Instruction 5230.24, (Reference (b)).

When in doubt, ask Security.

CUI Protection Measures

Vulnerability or Potential Threat OPSEC measure

Controlled Unclassified Information is information which is vulnerable to susceptibility and being acquired by foreign intelligence services.

An aggregation/compilation of information could lead to a compromise of classified information.

Release CUI only to an individual who is a U.S. person and has a valid need for such access in connection with the accomplishment of a lawful and authorized Government purpose.

Handle CUI material to prevent its disclosure to the general public and to limit its circulation to those employees who need the material to perform their work duties.

Do not leave CUI material unattended.

After working hours, store CUI information in locked desks, file cabinets, bookcases, locked rooms, or similar means.

Do not display CUI in public places, such as airports, airplanes, restaurants, etc.

Do not process CUI on public computers (e.g.

those available for use by the general public in kiosks, hotel business centers) or computers that do not have access control, including personally owned computers.

Protect CUI stored electronically on portable devices (e.g., laptops, personal electronic devices, removable media) physically or by using approved Data-at-Rest.

Transmission of CUI through encrypted email (use NIST or NIAP-approved cryptographic products), sent via AMRDEC Safe Exchange or sent via classified networks.

Printed documents and material may be transmitted through mail channels or hand-carried.

FOUO information may be disseminated to DoD personnel and DoD contractors to conduct official business for the program. If dissemination is required outside of DoD personnel or DoD contractors, contact the appropriate OPSEC Officer or Security Manager for approval. Technical data will follow the release instructions identified in the Distribution Statement.

Destroy by any means approved for the destruction of classified information, i.e., cross-cut shredding or other means that would make it difficult to recognize or reconstruct the information to include authorized shred bins.

Past relationships need to remain vigilant in protecting the CUI. Former associates do not have the need-to-know for current operations.

Visitor Control

Vulnerability or Potential Threat OPSEC measure

Unauthorized personnel can see or overhear information (obtain information) while walking through areas to attend meetings.

Posting CUI (technical data or FOUO) in cubicles can be observed by visitors.

Data on glass walls/partitions and monitors can be observed by visitors.

Visitors are individuals who do not have a need-to-know for the program or PEO information.

Areas that cannot control or limit access to visitors without a need-to-know will employ a clean desk policy. Refer to the CUI Protections Measures above.

The OPSEC Officer will provide briefings to remind PEO GCS personnel of the potential for the inadvertent release of information by visual or oral means when visitors are present.

Escorts for Foreign Visitors

Vulnerability or Potential Threat OPSEC measure

Unauthorized personnel can see or overhear information (obtain information) while walking through areas to attend meetings.

Posting CUI (technical data or FOUO) in cubicles can be observed by visitors.

Data on glass walls/partitions and monitors can be observed by visitors.

All foreign visitors (i.e. non-citizens) will have escorts at all times in PEO GCS facilities.

Escorts will be a U.S. Government employee.

The supporting Foreign Disclosure Officer will provide an Escort Briefing prior to escorting any foreign nationals.

OPSEC Officer will send a notification to the workforce prior to the visit of the impending visit, to include the “path” the visitors will take (to remind to limit discussions in hallways, cleaning white boards, etc.) and then the day of the visit.

OPSEC Officer to walk the path immediately prior to the visit.

Contractor Requirements

Vulnerability or Potential Threat OPSEC measure

PEO contractors (and subcontractors) have access to and work with the critical

STA Form 255-PEO version will be used for all requirement packages and scope of work information. PEO contracts need to reflect the requirement for the protection of the CIL.

changes to implement Antiterrorism and OPSEC onto contractors.

Comply with PEO Policy on Security Documents and Templates in Support of PEO GCS Acquisitions (GCS-045).

Contracts that require the contractor to access, process, handle or store Controlled Unclassified Information (FOUO or technical data) or classified information will define the OPSEC requirements in the contract and the scope of work to outline the specific OPSEC needs or to follow and implement the PEO OPSEC Plan. This will include “Guidelines for Protecting Controlled Unclassified Information” as an attachment to the contract or scope language in the contract.

Annex A – The Multidiscipline Collection Threat

General Applicability: Intelligence threats stem primarily from five sources: Human Intelligence (HUMINT), Signals Intelligence (SIGINT), Imagery Intelligence (IMINT), Measurement and Signatures Intelligence (MASINT), and Foreign Intelligence Services and Non-traditional Threats. The worldwide intelligence collection threat is multidiscipline, highly sophisticated, and extremely dedicated. Intelligence collection efforts may use only one discipline or a combination of disciplines to obtain information.

Local threat assessments, such as those published by the Army Counterintelligence Center, contain information critical to unit threat analysis.

Human Intelligence (HUMINT) Threat: Human intelligence describes activities to obtain both classified and unclassified information through the use of human agents.

Endeavors of human agents, both overt and covert, pose a substantial threat if countermeasures to neutralize or minimize their activities are not employed.

1. Overt–Open Source Intelligence (OSINT). Significant quantities of unclassified information, whether in publications, on the internet, or at trade shows and conferences, offer a lucrative target to an adversary. In addition to collecting this information the adversary may make requests for documents either directly or through FOIA. Personnel should report unusual requests for documents or information to Army counterintelligence via 1-800-CALL-SPY or the web based platform iSALUTE, https://www.inscom.army.mil/isalute/.

2. Visitors. Visitors to the facilities include government personnel, subcontractors, vendors, suppliers, contract labor organizations and service groups (repairmen, telephone, janitorial, etc.) who may obtain information of interest to an intelligence service or criminal element. Units are at risk for inadvertent visual and oral disclosures that may occur during these visits.

3. Covert–Espionage. While this aspect of HUMINT is not as common as other forms of intelligence collection, the possibility exists for this method to be employed. An example of covert collection is placing hidden listening devices in working areas where agents have access to sensitive information. Covert operations inflict severe damage and compromise to our country.

Signals Intelligence (SIGINT) Threat: SIGINT describes the capability to capability to obtain classified and unclassified information by monitoring communication systems or by analyzing electromagnetic radiation/emanations from various types of equipment.

This threat includes communications intelligence (COMINT), electronic intelligence (ELINT), and foreign instrumentation signals intelligence (FISINT). This threat targets telephones (including cellular, pagers, and residential), radio transmissions, and facsimile transmissions (both secure and non-secure). Exploitation is much easier when any deviation from standard security practices occurs. The most common error is discussion of sensitive, unclassified information over a non-secure telephone or transmitted via non-secure facsimile. Offshore ships, satellites, and fixed land based sites perform SIGINT collection. Clandestine intelligence personnel with collection equipment sometimes perform signals collection efforts within close proximity of their target.

1. Telephone conversations are especially vulnerable because most are relayed, at some point in transmission, via microwave signals or via satellite, both of which are easily monitored. The use of double-talk and self-generated codes is not effective as a means to protect sensitive information during telephone conversations. Such measures are easily defeated by professional intelligence analysts.

2. Current technology has produced a situation in which telephones in the hung-up (on-hook) position may frequently transmit room conversations occurring in the vicinity of the telephone. The telephone handset acts as a microphone that can pick-up and transmit room electronic signals and voice. This may be the result of accidental or intended modification or because of a design characteristic of the telephone instrument or its associated equipment.

Imagery Intelligence (IMINT) Threat: IMINT describes the capability to derive information from imagery developed over the full range of the electromagnetic spectrum. A distinct danger is seen in the employment of clandestine photography by Intelligence Service representatives. Applications of IMINT include: hand-held photography; satellites, scheduled commercial and private aircraft over-flights that employ advanced photographic techniques and unauthorized use of copying/duplicating equipment imagery of experiments or tests can be obtained from land, sea, air, and space platforms.

Measurement and Signatures Intelligence (MASINT) Threat: MASINT is technically derived intelligence that detects, locates, tracks, identifies, and describes the unique characteristics of fixed and dynamic target sources.