Att._4_-_FAFB_OPSEC_Information.pdf

FAFB OPSEC 2

Fairchild AFB Contractor OPSEC Level 2 Measures

1. The Operations Security (OPSEC) program reduces potential vulnerabilities of Air Force missions to hostile intelligence collection by preventing exposure of sensitive information.

OPSEC applies to all activities that prepare, sustain, or employ forces during both peacetime and wartime operations.

2. As your organization is contracted to perform work in support of the Fairchild AFB mission, you are responsible to protect this information. Sensitive, or Critical Information includes specific facts about U.S. Air Force operational intentions, capabilities or activities that are vitally needed by potential enemies to plan and act against US military mission accomplishment.

3. Contractor employees who visit Fairchild AFB or remote FAFB installations, or remotely monitor or maintain Fairchild AFB infrastructure will:

a. Within 30 days of reporting for duty become familiar with each item of the Fairchild

AFB Critical Information List below:

- Current and future operations and/or exercises

- Vulnerabilities, degradation, outages of critical infrastructures / telecommunications

- Key personnel/VIP schedules and travel itineraries

- Personnel, acquisition and logistics information

- Emergency response or base defense plans

- Freedom of Information Act (FOIA) Information

- Perceived changes to, or details of, normal operating procedures

b. Protect the information from disclosure to unauthorized people. These include other employees that are not part of the contracted work project, associates, family members and members of the news media.

c. Prevent disclosure of critical and sensitive information in any public domain to include but not limited to the Internet and other public forums.

d. Avoid publishing photographs, blogs, tweets that describe or display sensitive operations.

Examples include but are not limited to military formations and exercises, drills, emergency response procedures, and the protective measures of military facilities.

e. Destroy (burn, shred, etc.) critical and sensitive information that is no longer needed to prevent the inadvertent disclosure or reconstruction of this material.

f. Actively encourage others (including family members) to protect critical and sensitive information.

f. Consult with the Fairchild AFB Public Affairs office or installation OPSEC Program

Manager for an OPSEC review prior to publishing or posting Fairchild AFB- or USAF-related information in a public forum. This includes, but is not limited to letters, resumes, articles for publication, electronic mail (e-mail), Web site postings, web log (blog) postings, discussion in

Internet information forums, discussion in Internet message boards or other forms of dissemination or documentation.

g. Process, store, or transmit critical sensitive information in a manner to protect that information.

FA462018QA075

Attachment 4

Fairchild AFB Contractor OPSEC Level 2 Measures – 2

(1) DOD computer systems may be monitored for all lawful purposes, to ensure that their use is authorized, for management of the system, to facilitate protection against unauthorized access, and to verify security procedures, survivability, and operational security. Network monitoring is done in accordance with AFR 33-129.

(2) Unauthorized use of a DOD computer system may subject the user to criminal prosecution. Evidence of unauthorized use collected during monitoring may be used for administrative, criminal or other adverse action. Use of a DOD computer system constitutes consent for all lawful purposes.

(3) When an encryption feature is available on unclassified networks, encrypt email messages containing sensitive information. Encryption serves as an OPSEC measure to protect sensitive information transmitted over unclassified networks.

NOTE. Contract employees who fail to protect critical information from unauthorized disclosure may be subject to adverse administrative, disciplinary or contractual action.

4. Contract employees will consider attempts by unauthorized personnel to solicit critical information or sensitive information as a human intelligence (HUMINT) against the U.S. Air

Force.

5. Contract employees will consider attempts by unauthorized personnel to solicit critical information or sensitive information as a human intelligence (HUMINT) incident against the

U.S. Air Force. If you have been involved in, or have knowledge of, a possible HUMINT incident, please report all facts immediately to the Fairchild Office of Special Investigations

(AFOSI). If AFOSI is not readily available, report HUMINT incidents to the supported organization’s security manager, commander, or one of the other offices listed below:

Commercial DSN

Air Force Office of Special Investigation (509) 247-2591/2592 657-2591/2592

Fairchild Antiterrorism Office (509) 247-9498 657-9498

92 ARW OPSEC Program Manager (509) 247-3012/5258 657-3012/5258

Fairchild Information Protection Office (509) 247-2144/2076 657-2144/2076

Fairchild AFB

OPERATIONS SECURITY

(OPSEC)

“In the wild, the wolf studies his prey;

prowling and studying until he finds a vulnerability - then he attacks.”

What is OPSEC?

Operation Security is a process to deny adversaries information about friendly intentions and capabilities, which they need to make effective and timely decisions. It denies our adversaries classified information

“Like a wolf, America’s enemies are looking for vulnerabilities and waiting to attack us.”

Who’s the adversary?

Our adversaries are no longer the traditional threat from the Cold War era. Granted there is still the Foreign Intelligence Services

(FIS) threat from the different countries around the world, but our adversaries come from all sources. Some examples include but not limited to:

Competitors

Hackers

Criminals

Insiders

Terrorists

Basically anybody who has the intent and ability to collect and use our information against us is an adversary.

What are they after?

According to an Al Qaeda training manual, their operatives are to acquire any information regarding:

Details of future operations/exercises

Defensive tactics

Unit strengths

Names/photographs/travel plans of VIPs

Present and future US capabilities

Supply inventories

Training deficiencies

FACT: Over 80% of all terrorist planning information was provided by the target.

Foreign Intelligence Services are increasingly likely to target members of the technical community including engineers, regardless if they have a security clearance or not. The US spends millions of dollars in research and development on new technology. Why would another country spend that much for the same product when they could just obtain the information at a fraction of the cost or for free from the people working with it?

An adversary country or group takes that information and reproduces a cheaper product than the US, because they do not have to try to recover the research and development costs. This results in loss of revenue and ultimately jobs, even yours.

Then again, it does not just have to be a foreign country; it could be a business rival.

FAFB OPSEC Tri-Fold 2018

FACT: More than 80% of our adversaries’ intelligence needs come from unclassified sources.

In today’s world of global acquisition where so much information is available at a stroke of a key, unclassified information has taken on an entirely new importance. The internet is not the only source our adversaries use to collect on us. Other open sources available are:

Social Engineering

Newsletters

Television

Surveillance

Trash / recycling content

OPSEC has never been more important than it is today and will be in the future. It is what helps us to protect and maintain the technological advantage we have.

Remember: All military operations depend upon some form of technological advantage we currently have for mission success!

This is especially true since more and more of the US military systems have become more technological. The loss of militarily critical technology can result in surprise on the battlefield and a loss of US lives from our own technology. The acquisition of sensitive technology by our adversaries has led to the significant enhancement of their military-industrial capabilities at the expense of the US and our most precious resource, our warfighter!

“With every glimpse we give them, they gain an advantage. To ensure America’s victory over her adversaries, we must think like them – like the wolf.”

What can I do?

There are many things that you could do to apply OPSEC in your everyday procedures.

Things like:

- Shred Sensitive but Unclassified paperwork, such as alert rosters, work orders or technical manuals.

- Report suspicious activities on or near the installation to the Unit Security

Manager.

- Avoid wearing your security badge outside the installation.

- Practice “Need-to-Know”. Only share information with those that have a need to know the information in accomplishing our mission.

- Don’t photograph exercises or operations without authorization

- Don’t post sensitive information, to include photos, to the Internet

Mind you that we cannot and should not attempt to keep everything secret, but those bits of information that are “nice to know” for our adversaries need to be limited as much as possible. Remember, the adversary doesn't need just classified information; the disclosure of certain types of unclassified information can be just as damaging to our operation. OPSEC incorporates everyone, from the commander to the individual on an assembly line. The warfighter depends on us to give them the technological edge!

For Additional OPSEC information, contact your OPSEC Officer at 247-3012/5258.

Reference:

AFI 10-701, Operations Security

Fairchild AFB Basic Critical Information List May 2018

The following list describes types of sensitive (critical) information that may be of use to adversaries of the United States Air Force or Fairchild AFB. Do not discuss or transmit details of the following categories of information in non-secure areas or via non-secure means. Do not disclose them to people who do not possess a need-to-know – those who are not directly involved in you project.

Prior to any public release (articles, social media, web sites, blogs, etc.), contractor personnel will consult Public Affairs, the unit or wing Operations Security (OPSEC) specialists to ensure compliance. For further information contact the following offices:

Air Force Office of Special Investigations (AFOSI) (509) 247-2591/2592

Fairchild Antiterrorism Office (509) 247-9498

92 ARW OPSEC Program Manager (509) 247-3012/5258

FAFB Basic Critical Information List

Details of:

Current and future operations / exercises

Vulnerabilities, degradation /outages of critical infrastructures or telecommunications

Key personnel/VIP schedules and travel itineraries

Personnel, acquisition and logistics information

Emergency response or contingency plans

Freedom of Information Act (FOIA) Information

Operations Security (OPSEC) Provisions within Fairchild AFB OPSEC Level

2 and 3 Contracts (2018)

SECURITY.

OPERATIONS SECURITY (OPSEC).

OPSEC is a military capability which aims to influence the adversary’s behavior and actions by protecting friendly operations and activities. Per AFI 10-701, Operations Security, contract personnel who have access to mission critical or sensitive information will be provided standardized OPSEC training and education.

Failure to properly implement OPSEC measures can result in serious injury or death to our personnel; damage to weapons systems, equipment and facilities; loss of sensitive technologies;

and mission degradation or failure. As OPSEC is integrated into the execution of all Air Force operations and supporting activities, all DoD contractors will:

Be familiar with their organization’s critical information.

Protect critical and/or sensitive information from disclosure. When publicly posting or publishing work-related information that potentially contains critical or sensitive information airmen are encouraged to solicit the advice of their immediate supervisor, security office and/or

OPSEC Program Manager/Coordinator. This advice will aid in preventing disclosure of critical and/or sensitive information within the public domain.

The scope of critical and/or sensitive information includes, but is not limited to letters, resumes, articles, electronic mail (e-mail), web site postings, web log (blog) postings, internet message board discussions, or other forms of dissemination or documentation.

Encrypt all e-mail messages that contain critical information, OPSEC indicators, and other, sensitive information.

Refrain from publicly disseminating, or publishing, photographs that display critical and/or sensitive information. Examples include but are not limited to: Battle scenes, casualties, destroyed or damaged equipment, personnel killed in action (both friendly and adversary), and the protective measures of military facilities.

Actively encourage others (including family members and family readiness groups) to protect critical and/or sensitive information.

Destroy (burn, shred, etc.) critical and/or sensitive unclassified information no longer needed to prevent the inadvertent disclosure and/or reconstruction of this material.

Implement protection measures as ordered by the commander, director, or an individual in an equivalent position.

Know who their organization’s OPSEC Program Manager / Coordinator is and contact them for questions, concerns, or recommendations for OPSEC or signature management related topics.

Network Security and OPSEC Provisions within Fairchild AFB Contracts

Contract personnel will consider attempts by unauthorized personnel to solicit critical and/or sensitive information as human intelligence (HUMINT) gathering and consider it a HUMINT incident.

Contract personnel who have been involved in or have knowledge of a possible incident will report all facts immediately to the nearest supporting AFOSI office as required by AFI 71-101, Vol 4, Counterintelligence.

If these offices are not readily available, HUMINT incidents will be reported to the organization’s security manager or commander who will ensure that, without exception, reports are relayed as securely and expeditiously within 24 hours to the nearest AFOSI organization.