Attachment 4 - COMSUBLANT-COMSUBPACINST 2075.1D.pdf

DEPARTMENT OF THE NAVY

SUBMARINE FORCE ATLANTIC

1430 M ITSCHERAVENUE

NORFOLK. VA 2355 1-2492

COMMANDER SUBMARINE FORCE

UNITED STATES PACIFIC FLEET

BLDG 619

1430 MORTON STREET

PEARL HARBOR. Hl 96860-4664

COMSUBLANT/COMSUBPAC fNST 2075.1 D N66 20 Feb 201 9

COMSUBLANT/COMSUBPAC INSTRUCTION 2075. ID

From: Commander, Submarine Force Atlantic Commander, Submarine Force, U.S. Pacific Fleet

Subj : PORTABLE ELECTRONIC DEVICE POLICY FOR THE SUBMARINE FORCE

Ref: (a) Committee on National Security Systems Instruction No. 4009, "National Information Assurance Glossary"

(b) DoDM 5200.0 1-Volume 3

(c) Deputy Director of Naval Lntelligence (N2N6I): Department of the Navy Sensitive

Compartmented lnfo nnation Facility Personal Portable Electroni c Devices Clarification Memorandum, dated 26 October 2015

(d) Federal Communications Commission Office of Engineering and Technology Bulletin Number 62, Understanding the FCC Regulations for Computers and Other Digital Devices

(e) DoDD 81 00.02

(f) DoDI 8420.0 I

(g) SECNA V M-55 10.36

(h) SECNA V M-5510.30

(i) ALNAV 001 / 16

(j) ALNA V 01 9/ 16

(k) (S) COMSUBLANT/COMSUBPACINST S2075.2B

(I) Subma1ine Special Security Manual Rev V NP-OOO-d-003 1-1 2 (NOTAL)

(m) CYBER-1 (series)

Encl: ( ! ) Portable Electronic Device (PED) Awareness Placard

(2) Sample Approval fo r Offic ial-Use Portable Electronic Device (OU-PED)

(3) Sample Conm1and Page 13

I. Purpose. To establish procedures consistent with references (a) through (m) fo r the use of portable electronic devices (PEDs) for the Submarine Force. This policy will be in effect for all conunands until a revision is issued.

2. Cancellation. COMSUBLANT/COMSUBPACINST 2075.lC.

COMSUBLANT/COMSUBPACINST 2075.1 D

20 Feb 2019

3. Descriptions. General definitions required to establish a common lexicon are provided below. For a full list of definitions, see paragraph 11:

a. A portable electronic device (PED) is defined as any non-stationary electronic apparatus with singular or multiple capabilities of, but not limited to recording, storing, and/or transmitting data, voice, video, or photo images (e.g., cell phones, laptops, tablets and wearable devices such as fitness bands and smart watches).

b. "Personal" PEDs (P-PEDs) refers to PEDs personally owned by Department of the Navy Sailors, Marines, Civilians and all other support contract personnel (e.g. , Tenders, OSVs, etc.).

c. "Official Use" PEDs (OU-PEDs) refers to PEDs owned by U.S. Government and operated by military, Government Civilian and Government-Contracted organizations (e.g., Shipyards, SPAW AR, NUWC, Progeny, etc.) in the performance of official duties.

d. Commanding Officer (CO) or Officer-in-Charge (OlC) is a generic term used to identify a position of authority at any Department of the Navy (DON) organization, base, station, unit, laboratory, installation, facility, center, activity, detachment, squadron, ship, battalion, regiment, etc.

e. Homeport refers to the port to which a submarine is permanently assigned.

f. Near Field Communication (NFC) connotes a short-range wireless communication system employing radio waves to enable a mobile device to interact with another device or card reader when within 10 cm ( 4 in) of each other, per reference U).

4. Summary of Si!!Ilificant Changes. This revision is a complete reissue of COMSUBLANT/ COMSUBPACINST 20751 C. Significant changes:

a. Specifies that PEDs must not contain prohibited software applications

b. Allows COs to make a determination regarding the classification level of the Submarine during extended availability periods lasting longer than 90 days,

c. Specifies that only the CO may authorize the introduction of OU-PEDs from outside organizations into classified submarine spaces. In such cases the CO will assign a member of ship's company to escort any personnel from external organizations in possession of the authorized OU-PED.

d. Specifies that Submarine riders from external organizations are required to adhere to paragraph 9b. of this instruction and reference (k) and allows CO to place additional restrictions on such external riders.

5. Background. Inappropriate use of PEDs creates a high risk for inadvertent disclosure of sensitive and classified infonnation with required actions in reference (i) for willful violations of classified information or Negligent Discharge of Classified Information (NDCD, and may also

20Feb2019 be applied to Personally Identifiable Information (PII) breaches and Unauthorized Disclosure (UD) of Unclassified Naval Nuclear Propulsion Information (U-NNPI), per reference (i).

a. This instruction authorizes the controlled and managed presence of PEDs with capabilities as listed in references U) and (k) in spaces, as permitted per paragraph 9 of this instruction, where collateral classified or unclassified information is processed, transmitted, stored, or discussed and risk to classified information can be controlled. PEDs shall not be permitted in a Sensitive Compartmented Information Facility (SCIF)/Temporary SCJF (TSCIF) or active Temporary Secure Working Area (TSWA). This authorization is provided in order to support crew morale, access to personal educational and entertainment information, and to support maintenance operations, particularly in specific industrial situations. In submarine spaces with up-postured systems to support Sensitive Compartmented Information (SCI) (control room, combat systems electronic space (CSES), etc.), ship navigation and safety OU-PEDs such as the control voice recorder, bridge to bridge radios, recorders to meet theater Visual Information (VI) requirements,' PEDs associated with temporary carry-on equipment, etc. are allowed to support operations including maneuvering watch and other critical ship evolutions. When not permanently installed, PEDs should be positioned to meet tempest separation requirements from up-postured ship systems if such positioning does not compromise safety and safe navigation.

b. PED use will only be permitted in a responsible and controlled manner that mitigates the threat to National Security Information (NSI).

6. Scope and Applicability. This instruction is applicable to all military, civilian and contract personnel while assigned to any COMSUBLANT/COMSUBPAC or subordinate commands.

Affected commands shall ensure this policy is made available to all maintenance workers, contractors, visitors, riders, and embarked personnel at the earliest opportunity to allow for proper planning and compliance. There are no waivers for uninfom1ed or unprepared visitors.

a. The command-owned camera (command' s camera) is to be controlled per references (I) and (m). However, cameras must comply with the allowances and restrictions within paragraph 9 of this instruction.

b. The following devices are exempt from this policy at all times in non-SCI spaces:

( l) Hearing-aids

(2) Implanted medical devices. The CO may grant approval for medically related PEDs when the capabilities they possess are prohibited by this instruction and the PED will never enter any SCIF. In those instances, the Information System Security Manager (ISSM) will maintain documentation of the CO's approval including the device make/model , the capability presenting risk, any mitigation and the duration of the approval not to exceed the expected duration of the medical requirement.

(3) Installed Program of Record (POR) system components to include those that operate in a wireless mode

(4) Official-Use one-way pagers

(5) Stopwatches

COMSUBLANT/COMSUBPACINST 2075. lD 20 Feb 20 19

(6) Radio Frequency Automotive Key Fob' s. Bluetooth receivers are prohibited.

(7) Command owned TV remote controls

(8) Command owned Metal Detectors

c. The following exceptions apply for Command-Owned OU-PEDs:

(1) The command-owned audio recorder (a.k.a., voice recorder) for documented requirements to record audio communication circuits (e.g., bridge-to-bridge traffic) is authorized for normal usage, but must be appropriately marked, handled, and stored per reference (g).

(2) Command-owned gaming systems, for afloat commands only, may be authorized for use at the CO's discretion, in berthing, common, and messing spaces while underway. These devices will have prohibited capabi lities disabled where possible. Use of wireless remote controls and/or game controllers designed for that system is authorized. Removable flash storage media should not be inserted in these devices. Commercial game cartridges are permitted.

When no longer needed, devices should be destroyed and not released to the public. Command owned recreational computers and gaming systems are not authorized to be used onboard whi le in port. They must be moved to an unclassified location off- hull or the power supplies, batteries, and gaming remote controls must be secured onboard to prevent system usage.

(3) Access Control OU-PEDs used by the command for visitor control (e.g., Personnel Access System (PAS) Laptop) are only to be operated outside the skin of the ship (e.g. , topside and the pier). All prohibited capabilities shall be disabled to the maximum extent possible.

Access Control OU-PEDs shall never be connected to any Department of Defense Information Systems (DOD IS). Special care and protection must be afforded to such devices as they may contain PII. If possible, remove battery while the submarine is underway.

(4) Command-owned hand-held radios (OU-PED) (e.g., Bridge-to-Bridge (BTB), Pacific Land Mobile Radios (PLMR) used for force protection, Global Mobile Radio Service (GMRS)/ Family Service Radio (FSR)) used for command evolutions such as pumping sanitary tanks, mast movements, drills, piloting and contact management. Conm1llnication Security (COMSEC) requirements are not waived by this instruction for these devices.

(5) Command-owned removable media devices (OU-PED) (e.g., removable USB hard drives used for backup or data transfer per reference (m) are approved when each device is listed in the command's portable electronic device instruction.

(6) Iridium Phones. The iridium phone shall be stored in a powered down state in an appropriate container and powered on only for authorized use.

NOTE: For submarines, the Iridium Phone should be stored in the Radio Room. The device should be operated per command Standard Operating Procedures (SOPs) (e.g., for submarines via periscope or approved POR antenna connection or from the bridge).

(7) Command-owned test equipment is always approved for use in order to accomplish authorized scheduled maintenance. Examples include, but are not limited to, multi-meters, oscilloscopes, frequency counters, signal generators, meggers, laptops, electronic logs, and spectrum analyzers.

(8) Command-owned "action camera" (e.g., GoPro). The Command-owned "action camera" must be a controlled item. Prohibited capabilities listed in paragraph 9.a(2), are not authorized to be used onboard at any time. Once brought onboard, the device must be routinely inventoried and secured when not in use. The device is never permitted to leave the ship. The command owned action camera must be physically destroyed as a condition for removal.

7. Duties and Responsibilities. The CO is the local authority with overall responsibility for enforcement of this policy. The Command ISSM is responsible for implementing policy and procedures, operational management, protecting and accounting for all PEDs and execution of this policy.

a. The Command Security Manager (CSM) is responsible for the implementation, maintenance, enforcement, and assessment of physical and personnel security policies and procedures.

b. All P-PED data is the responsibility of the owner. Personnel are advised to back up their devices to a manufacturer provided cloud service prior to all underway periods to prevent loss of data.

8. Action

a. Commanding Officers

(I) Establish and maintain policy per this instruction to ensure that all personnel understand the vulnerabilities associated with the use of PEDs while maintaining prudent security measures through training initiatives to control their use. Additional restrictions or control measures may be imposed at the COs discretion to manage risk including the issuance of a blanket "No PED" policy.

(2) Ensure dissemination and enforcement of this policy, posting the information contained in enclosure (I) (where required), utilizing enclosure (3) for personnel acknowledgement per references (e) and (f), or through physical checks, spot checks and/or physical searches.

(3) Ensure compliance with the security incident reporting requirements ofreferences (b ), (g), (h), and (i). DON personnel who knowingly and willfully violate the requirements in this instruction or subsequent policy established by the command are subject to preliminary inquiry

COMSUBLANT/COMSUBPACINST 2075 .ID

20Feb20 19 and incident reporting in the Joint Personnel Adjudication System, potential loss of information system access, and possible punitive or administrative action.

(4) May approve deviations and enforcement of this policy and will inform !SIC as soon as practical.

(5) Never allow PEDs in a SCIF/TSCIF or active TSW A.

b. DON personnel shall:

( I) Ensure PEDs meet the criteria in paragraph 9 prior to introducing them into areas where collateral classified infom1ation is processed, h·ansmitted, stored, or discussed.

(2) Never pennit PEDs in a SCIF/TSCIF or active TSWA.

NOTE: PEDs are not permitted in Wardrooms/Staterooms when Echo Lan is in use. All areas should be properly sanitized prior to Echo Lan usage.

(3) Obtain approval through the CO for any medically related PEDs prior to introduction into areas where collateral classified information is processed, transmitted, stored or discussed.

( 4) Report loss, theft, or possible compromise of PEDs immediately to the ISSM and CSM. The loss or possible compromise of OU-PEDs will be handled per reference (g).

(5) Not make any attempt to use a device to circumvent information system security measures, access controls or user authorization.

(6) Not make any attempt to transmit classified data to a P-PED or cause an Electronic Spillage (ES) by using an OU-PED across domains of differing classification levels.

(7) Not connect P-PEDs to any government infomrntion system either directly or indirectly using wired or wireless accessories (e.g., Bluetooth dongles and charging cables) for any purpose.

(8) Not make any attempt to synchronize infonnation or make connection to any DoD Information System unless approved by Navy Authorizing Official (NAO) Assessment and Authorization (A&A).

(9) Not make any attempt to use any vulnerability or network-discovery scanning tools unless specifically authorized by the Type Commander (TYCOM).

( I 0) Comply with requirements set forth in reference (k).

9. PED usage criteria for Submarine Force environments.

a. COMSUBFOR ashore commands, submarine tenders, and submarines moored in port

COMSUBLANT/COMSUBPACINST 2075. l D

( 1) PEDs are permitted in DON spaces where collateral classified information is processed, transmitted, stored or discussed when they comply with all of the requirements and responsibilities cited below:

(a) PEDs must be commercially obtained in the U.S. or through a U.S. military exchange and assigned a Federal Communication Commission (FCC) Identifier denoting compliance with the limits for a Class B digital device designated by the FCC, pursuant to Part 15 of the FCC Rules, per reference ( d).

(b) PEDs may contain only vendor-supplied software and receive only updates that do not add any features or capabilities prohibited in this message. PEDs must not contain prohibited software applications (Promulgated SEPCOR).

(c) PEDs may have any or all of the following: Bluetooth, Global Positioning System (GPS) (RECENE-ONL Y), accelerometer, altimeter, gyroscope, heart monitor, vibration, and/or NFC capabilities.

(d) PEDs must have password/pin protections enabled and have up-to-date anti-virus software protection installed, where those capabilities exist.

(e) PEDs must not be prohibited by paragraph 9.a.(2) below.

(2) PEDs are prohibited in DON spaces where collateral classified information is processed, transmitted, stored or discussed when they contain any of the following capabilities.

(a) Cellular and/or Wi-Fi transceivers, Wireless RF/IR computer peripherals such as keyboards, mice and presentation clickers or other technologies not permitted in paragraph 9.a.(l) of this instruction.

(b) Photographic, video capture/recording, microphone and/or audio recording capabilities.

(c) Have removable media installed.

(d) Have the capability to perform radio frequency transmissions at greater than I 00 milliwatts (mW) Equivalent Isotropically Radiated Power (EIRP). Where feasible, EIRP shall be determined using FCC data.

NOTE: It is recommended that commands use lock boxes or other solutions (e.g., plastic tub/bin) to provide temporary storage for PEDs with prohibited capabilities.

(3) P-PEDs are prohibited from being connected to any govenunent infom1ation system either directly or indirectly using wired or wireless accessories (e.g., bluetooth dongles, charging mats, and charging cables).

(4) OU-PEDs from outside organizations must be inspected and authorized for introduction to the classified command environment by the Command Security Manager and Information Systems Security Manager using enclosure (2). All submarine spaces are considered classified spaces with the exception of certain extended availability periods in which classified systems and material have been removed. For submarines in an extended availability lasting longer than 90 days, the CO may make a determination regarding the classification level of the submarine.

(5) Only the CO may authorize the introduction of OU-PEDs from outside organizations into classified submarine spaces. In such cases the CO will assign a member of ship's company to escort any personnel from external organizations in possession of the authorized OU-PED.

Paragraph 9.a.(4) must be satisfied in addition to the CO authorization and escort assignment.

b. COMSUBFOR Submarines underway

( 1) PEDs are permitted in DON spaces where collateral classified information is processed, transmitted, stored, or discussed when they comply with the requirements and responsibilities cited below:

(a) PEDs must be commercially obtained in the U.S. or through a U.S. military exchange and assigned a FCC Identifier denoting compliance with the limits for a Class B digital device designated by the FCC, pursuant to Part 15 of the FCC Rules, per reference (d).

(b) PEDs may contain only vendor-supplied software and receive only updates that do not add any features or capabilities prohibited in this message.

(c) PEDs must have password/pin protections enabled and up-to-date anti-virus software protection installed, where those capabilities exist.

(d) PEDs are never permitted in a SCIF/TSCIF or active TSWA.

(2) PEDs that contain the capability for cellular, Wi-Fi, photographic, video capture/recording, microphone, audio recording and devices with removable media installed or devices with the capability to perform radio frequency transmissions at greater than 100 milliwatts (mW) are to be controlled as follows:

(a) P-PEDs that contain the capability for cellular, Wi-Fi , Wireless RF/IR computer peripherals, photographic, video capture/recording, microphone, audio recording and devices with removable media installed or devices with the capability to perform radio frequency transmissions at greater than 100 milliwatts (mW) may be brought on board no earlier than 72 hours prior to local underways in a powered down state for storage purposes.

(b) Once underway, P-P~D usage is authorized at the discretion of the CO. Prohibited capabilities listed in paragraph 9.a.(2) are not authorized to be used onboard at any time. P-PEDs shall be stored in berthing in a powered-down state (batteries removed if possible) when not in use. Upon return to homeport, P-PEDs controlled in accordance with this paragraph may remain onboard for up to 72 hours provided they remain in a powered down state.

COMSUBLANT/COMSUBPACINST 2075. lD

(c) P-PEDs are authorized to be used only in spaces designated as a ' 'No Classified Discussion Area." These areas are to be clearly marked and are subject to change with the exception of berthing which should always remain as a designated ' 'No Classified Discussion Area" since PEDs are stored within. Examples of "No Classified Discussion Areas" include berthing, Chief Petty Officer (CPO) Quarters, passageways, laundry, galley, messing areas, wardroom pantry, Supply office, countermeasures and the trash disposal unit (TDU) space. The Ship's Office, wardroom and staterooms may be approved for PED usage as long as they are not being used as a TSCIF/ SCIF, an active TSW A or for other classified discussions. The Torpedo Room may be authorized when weapons handling operations are not being conducted, no classified discussions are being conducted, and when not being used as an active TSW A.

(d) P-PEDs are not authorized for use in operational spaces such as Engineering Spaces, Control/Attack Center, CSES, Sonar, Radio, NAY Center, BMC, Auxiliary Machinery Room and other spaces deemed operational by the CO. This includes transiting through operational spaces in route to an approved "No Classified Discussion Area." The CO may authorize digital media players (MP3/CD/DVD) that do not have prohibited capabilities to be used in spaces where exercise equipment is located (e.g., treadmill in the Engine Room, weight benches in AMR2, etc.) and throughout the ship during field day (less the Radio Room). All such devices may transit to the designated area but shall be removed from those operational spaces upon the conclusion of the event (e.g., field day or use of exercise equipment).

(e) Wireless RF/IR devices such as wireless keyboards, headphones, mice and presentation clickers are not authorized for usage on any personally-owned or shipboard system.

However, devices such as key chain car remote entry devices, ship-owned gaming/TV remote controls are allowed onboard. Any remote control used inside a SCIF/TSCIF/TSWA must receive approval by the appropriate SCI Designated Accredited Authority (DAA).

(3) Under special circumstances the command may order all P-PEDs to follow certain guidance set forth in reference (k). For data loss prevention, owners of P-PEDs are cautioned to back up their device(s) prior to all underway periods. Submarines underway shall comply with ref (k).

(4) Submarine riders from external organizations are required to adhere to paragraph 9.b of this instruction and reference (k). COs may elect to place additional restrictions on riders from external organizations such as adding additional usage limitations, restricting physical access to P-PEDs during certain transit times, or disallowing non-crew-owned P-PEDs onboard altogether.

I 0. Enforcement

a. Metal or Wi-Fi detectors may be used by the Petty Officer of the Deck and topside watchstanders conducting random PED searches. Violation of any provision of this instruction subject's military members to disciplinary action under the Uniform Code of Military Justice (UCMJ), criminal penalties under applicable federal statutes, or administrative action. Violation

COMSUBLANT/COMSUBPACfNST 2075.1 D 20 Feb 201 9 of any provision of this instruction may subject non- military members, including DoD personnel and contractors to criminal penalties under applicable federal statutes, administrative sanctions or removal from classified spaces and loss of classified access.

b. Violations of this policy will be handled on a case-by- case basis and are subject to the

UCMJ.

c. All personnel are required to report to the chain of command all unauthorized PED usage they observe. The ISSM or CSM will confiscate devices as necessary from individuals who are in violation of this policy.

( 1) Items confiscated may have their contents and metadata inspected to ensure no security violations have occurred. The discovery of potentially criminal data during such an inspection will be immediately reported to the ship ' s CO, the TYCOM Security Manager and the local NCIS field office. Consent to inspection of all PEDs is a condition of entry.

(2) In some cases, PEDs may be permanently retained or destroyed without compensation. Repeated violations that jeopardize the security of submarines may result in additional administrative or legal actions.

d. P-PEDs found connected to any government in formation system will be immediately surrendered to the Command Information Assurance Manager (IAM) or CSM. An incident report shall be filed with the Navy Cyber Defense Operations Center (NCDOC) per reference (i) and the media will be considered classified at the level of the network on which it was found to be connected. This may result in the PED being shipped to NCDOC for forensic analysis and may result in its non-return.

e. All personnel are respons ible for assisting in the control of and use of PEDs onboard.

Monitoring programs will include at a minimum random entry/exit security checks, possible device and software application inspection and deliberate questioning all aimed at discovering unauthorized removable storage devices or wireless transmitting devices in use. It is the responsibility of every crew member to safeguard classified information and ensure such information is not intentionally or unintentionally stored on or conveyed through a personally owned PED.

f. Areas onboard the submarine that may permit PED usage will be identified with placards reminding crew of the "No Classified Discussion Area" restriction.

g. The introduction of any PED into any secure government space (i.e., a submarine) implies consent to the inspection of that PED.

h. Under special circumstances, the command may order all P-PEDs smart devices to follow specific directives set forth in reference (k). Owners of P-PEDs are cautioned to back up their device(s) prior to all underway periods.

11. Definitions

20Feb2019

a. Authorizing Official. A senior (federal) official or executive with the authority to fom1ally assume responsibility for operating an information system at an acceptable level of risk to organizational operations (including mission, functions , image, or reputation), organizational assets, individuals, other organizations, and the nation. This function is normally filled by the Navy Authorizing Official (NAO).

b. Camera Capable. Any device used to capture/store images as delivered by the factory.

Subsequent alteration of the camera system (e.g., removal/destruction of the lens, filling in camera hole with epoxy, etc.) does not constitute a capability change.

c. Classified Spaces. Spaces where classified conversations, data processing, and storage are authorized, at levels from Confidential to Top Secret SCI. The entirety of all classes of submarines is considered a classified processing space; unclassified spaces do not exist on any operational submarine.

d. Collateral Information. National Security information (including intelligence information) classified Top Secret, Secret or Confidential that is not in the SCI or Special Access Program (SAP) category.

e. Commanding Officer CCO) or Officer In Charge COIC). The CO or OIC is a generic term used to identify a position of authority at any DON organization, base, station, unit, laboratory, installation, facility, center, activity, detachment, squadron, ship, battalion, regiment, etc.

f. Command Security Manager CCSM). Responsible for overseeing the command's security program, to include training, enforcing, and correcting violations and vulnerabilities.

g. Common Space. Any space aboard a submarine used primarily as a passageway between distinct functional locations. This does not include spaces traditionally used for gathering with an operational function (e.g., Control). There is no provision or waiver to allow transportation of any personally-owned PED through any operational space, even while en-route to an authorized space (e.g., Do not walk through control with a Kindle to reach your berthing).

h. Homeport. The term homeport refers to the port to which a submarine is permanently assigned.

1. Information Systems Security Manager CISSM). Responsible for the secure transmittal of infomrntion over government classified systems. Responsibilities are divided between the General Service (GENSER) and SCI IAMs.

j . Near Field Communication (NFC). NFC connotes a short-range wireless communication system employing radio waves to enable a mobile device to interact with another device or card reader when within 10 cm ( 4 in) of each other.

k. Official Use PEDs (OU-PEDs). OU-PEDs refer to PEDs owned and operated by Military, DoD Civilian and Government-Contracted organizations (e.g., Shipyards, SPA WAR, NUWC, Progeny, etc.) in the performance of official duties.

I. "Personal" PEDs CP-PEDs). P-PEDs refer to PEDs personally-owned by DON Sailors, Marines, civilians and support contract personnel.

m. Program of Record CPOR). A directed, funded effort that provides a new, improved, or continuing material, weapon or information system or service capability in response to an approved need.

n. Portable Electronic Device (PED). A portable electronic device (PED) is defined as any non-stationary electronic apparatus with singular or multiple capabilities of, but not limited to, recording, storing, and/or transmitting data, voice, video, or photo images (e.g., cell phones, laptops, tablets, and wearable devices such as fitness bands and smart watches).

o. Sensitive Compartmented Information Facility (SCIF) . Spaces authorized for the storage, use, discussion and/or processing of SCI information or material. May either be a permanent or tactical SCIF. Potential SCIF/TSCIF on SSNs includes the CO/XO/NAV staterooms, Wardroom, Radio, Torpedo Room, Ship's Office and ESM Room (Virginia Class). Potential SCIF/TSCIF spaces on SSGNs are the CO/XO/NA V Staterooms, Officer's Study, Wardroom, Radio, Control Center and Battle Management Center (BMC), MCC (Missile Control Center), Sonar, Torpedo Room and (Data and Equipment Processing Room (DEPR). SSBN Radio Rooms are accredited for TS handling and crypto and will be treated as SCIF spaces for the purposes of this policy.

p. Temporary Secure Working Area (TSWA). Spaces authorized for the handling, di scussion and/or processing of SCI for no more than 40 hours a month . Logs must be maintained ofTSWA usage and SCI storage is NOT authorized.

q. Secure Working Area (SWA). Spaces authorized for the handling, discussion and/or processing but not storage of SCI. Access control is identical to a SClF.

r. Wireless. Technology that permits the active transfer of information involving emanation of energy between separated points without physical connection. Currently wireless technologies include infrared (IR), Wi-Fi, Bluetooth, and Near Field Communication (NFC) but, as technology evolves, wireless could include other methods of transmission.

12. Records Management. Records created as a result of this instruction regardless of format or media, must be maintained and dispositioned for the standard subject identification codes (SSIC) 1000 through 13000 series per the records disposition schedules located on the Department of the Navy/ Assistant for Administration (DON/ AA), Directives and Records Management Division (DRMD) portal page at https://portal.secnav.navy.mil/orgs/DUSNM/ DONAA/DRM/Records-and-Information-Management/Approved%20Record%20Schedules/ F om1s/ Allltems.aspx.

COMSUBLANT/COMSUBPACrNST 2075. lD

13. Review and Effective Date. Per OPNA VINST 5215.17 A, COMSUBLANT and COMSUBPAC will review this instruction annually around the anniversary of its issuance date to ensure app licability, currency, and consistency with Federal, Department of Defense, Secretary of the Navy, and Navy policy and statutory authority using OPNAV 5215/40 Review of Instruction . This instruction wi ll be in effect for 10 years, unless revised or cancell ed in the interim, and will be reissued by the I 0-year anniversary date if it is sti ll required, unless it meets one of the exceptions in OPNA VIN ST 5215.17 A, paragraph 9. Otherwise, if the instruction is no longer required, it will be processed for cancellation as soon as the need for cancellation is known following the guidance in OPNA V Manual 5215.1 of May 2016.

Releasability and distribution:

R. M. GAUCHER

Chief of Staff

This instruction is cleared for release with personnel holding a military Common Access Card (CAC) and is available electronically only via COMSUBLANT/COMSUBPAC NIPR and SIPR websites at: https://usff.navy.deps.mil/sites/csl/directives/default.aspx or https://cffo.fleetforces.navy.smi l.mil/csl/default.aspx.

vi

()1NV1H .Ld31A11VNOI1.N3.LN1 3DVd SIH.L)

6 IOZ q:;i.:1 OZ OT ·~LOZ .LSNI:JVdaDSW0;:)/.LNV1llilSW0;:)

COMSUBLANT/COMSUBPACINST 2075.ID

PORTABLE ELECTRONIC DEVICE CPED) AWARENESS PLACARD

COMSUBFOR ASHORE COMMANDS, SUBMARINE TENDERS AND

SUBMARINES MOORED INPORT

(Consent to inspection of all PEDs is a condition of entry)

PEDs are permitted in DON spaces where collateral classified information is processed, transmitted, stored or discussed when they comply with all of the requirements and responsibilities cited below:

o PEDs must be obtained in the U.S. or through a U.S. military exchange and assigned a Federal Communication Commission (FCC) Identifier denoting compliance with the limits for a Class B digital device designated by the FCC, pursuant to Part 15 of the FCC Rules.

o PEDs must contain only vendor-supplied software and receive only updates that do not add any features or capabilities prohibited in this message.

o PEDs must not contain prohibited software applications.

o PEDs must have password/pin protections enabled and have up-to-date anti-virus software protection installed, where those capabilities exist.

PEDs ARE PROHIBITED in DON spaces where collateral classified information is processed, transmitted, stored, or discussed when they contain any of the following capabilities:

o Cellular and/or Wi-Fi transceivers, Wireless RF/IR computer peripherals such as keyboards, mice, and presentation clickers or other technologies not permitted above "DURING ALL CONDITIONS."

o Photographic, video capture/recording, microphone, and/or audio recording capabilities.

o Have removable media installed.

o Have the capability to perform radio frequency transmissions at greater than l 00 milliwatts (mW) Equivalent Isotropically Radiated Power (ElRP). Where feasible, EIRP shall be determined using FCC data.

Exceptions for submarine commands OU-PEDs while in homeport are listed in COMSUBLANT/COMSUBPACINST 2075.1 (series)

Enclosure (I)

COMSUBFOR SUBMARINES UNPERWA Y

Consent to inspection of all PEDs is a condition of entry.

PEDs that contain the capability for cellular, Wi-Fi, photographic, video capture/recording, microphone, audio recording, and devices with removable media installed or devices with the capability to perform radio frequency transmissions at greater than 100 milliwatts (mW) ARE TO BE CONTROLLED as follows:

o P-PEDs (non-smart devices) that contain the capabilities above may be brought onboard no earlier than 72 hours prior to underways in a powered down state for storage purposes.

o Once underway, P-PED usage is authorized at the discretion of the Commanding Officer. However, Cellular, Wi-Fi, photographic, video capture/recording, microphone, audio recording, removable media and radio frequency transmissions capable of I 00 milliwatts (mW) MAY NOT be used onboard at any time. These features shall be disabled to the maximum extent possible.

o P-PEDs shall be stored in berthing in a powered-down state (batteries removed if possible) when not in use. Upon return to homeport, P-PEDs may remain onboard for up to 72 hours provided they remain in a powered down state.

o P-PEDs are authorized to be used only in spaces designated as a ' 'No Classified Discussion Area ."

These areas are to be clearly marked and are subject to change with the exception of berthing which should always remain as a designated "No Classified Discussion Area" since PEDs are stored within . Examples of "No Classified Discussion Areas" include berthing, CPO Quarters, passageways, laundry, galley, messing areas, wardroom pantry, Supply office, countermeasures, and the TDU space.

The Ship ' s Office, wardroom and staterooms may be approved for PED usage as long as not being used as a TSCIF/SCIF, an active Temporary Secure Working Area (TWSA), or for other classified discussions. The Torpedo Room may be authorized when weapons handling operations are not being conducted, no classified discussions are being conducted, and when not being used as an active TSW A.

o P-PEDs are not authorized for use in operational spaces such as Engineering Spaces, Control/ Attack Center, CSES, Sonar, Radio, NA V Center, BMC, Auxiliary Machinery Room, and other spaces deemed operational by Commanding Officer.

This includes transiting through operational spaces in route to an approved "No Classified Discussion Area." The CO may authorize digital media players

2 Enclosure ( 1)

(MP3/CD/DVD) that do not have prohibited capabilities to be used in spaces where exercise equipment is located (e.g., treadmill in the Engine Room, weight benches in AMR2, etc.) and throughout the ship during field day (less the Radio Room). All such devices may transit to the designated but shall be removed from those operational spaces upon the conclusion of the event (e.g., field day or use of exercise equipment) .

o Wireless RF/IR devices such as wireless keyboards, headphones, mice, and presentation clickers are not authorized for usage on any personally-owned or shipboard system. However, devices such as key chain car remote entry devices, ship-owned gaming/TV remote controls are allowed onboard. Any remote control used inside a SCJF/TSCIF/TSWA must receive approval by the appropriate SCI

DAA.

Exceptions for submarine commands OU-PEDs while underway are listed in COMSUBLANT/COMSUBPACJNST 2075.l (series).

Owners of P-PEDs are cautioned to back up their device prior to all underway periods.

Owners of P-PEDs brought underway will comply with all orders set forth in reference (k)

Owners of P-PEDs should encrypt their device to protect their data in the event the device is lost or stolen on liberty.

3 Enclosure ( 1)

COMSUBLANT/COMSUBPACINST 2075. 1 D

PEDS FROM OUTSIDE ORGANIZATIONS

Consent to inspection of all PEDs is a condition of entry.

All PEDs must be inspected and authorized for introduction to the command environment by the Conunand Security Manager and Infom1ation Systems Security Manager using enclosure (2) of COMSUBLANT/COMSUBPACINST 2075. l (series) .

o P-PEDs must follow all requirements for "COMSUBFOR Ashore Commands, Submarine Tenders and Submarines.

o OU-PEDs from outside organizations:

• Devices that meet the requirements of paragraph 9.a.( l) and contain none of the prohibited capabilities of paragraph 9.a.(2) are permitted. These devices do not inherit any of the "Exceptions for submarine commands OU-PEDs" listed therein.

• Program of Record (POR) OU-PEDs (e.g., laptops and tablets) that have interoperability permission w ith the installed system at the command as stated in the Certification and Accreditation (C&A) document for cormection (e.g., in the boundary diagram or network topology) are allowed without modification of capabilities.

4 Enclosure ( I)

COMSUBLANT/COMSUBPACINST 2075.ID

SAMPLE APPROVAL FOR OFFICIAL-USE PORTABLE

ELECTRONIC DEVICE COU-PED)

MEMORANDUM

From: COMMAND NAME, Command Security Manager To:

Name (Last, First MI) Rank/Rate Via: COMMAND NAME, Command Information Systems Security Manager

Subj: APPROVAL FOR OFFICIAL-USE PORTABLE ELECTRONIC DEVICES

Ref: (a) COMSUBLANT/COMSUBPACINST 2075.l(series)

I. The following device is authorized entrance to the COMMAND NAME from DAY MONTH YEAR to DAY MONTH YEAR in unclassified areas and spaces where collateral classified information is processed, transmitted, stored, or discussed. This device is not allowed in SCIF/T-SCIF or TSW A. The device is authorized to be in the care of the listed representative:

Device Type:

Device Serial#:

Organization/Command:

Representative Name

(CO FOR SUBMARINES):

Representative Signature:

Date

The signature above constitutes a binding agreement that the above representative will adhere to all requirements of reference (a) while visiting the command. Reference (a) will be made available at the time of signing and at any follow-on request by the representative.

2. This document will remain with the device at all times and made available for inspection upon request.

Enclosure (2)

Subj : APPROVAL FOR OFFICIAL-USE PORTABLE ELECTRONIC DEVICES

The device above meets all requirements per reference (a) as indicated below:

INITlAL THE BOX THAT APPLIES

This device meets the requirements of reference (a) paragraph 9.a.(1) and contains none of the prohibited capabilities ofreference (a) paragraph 9.a.(2) and is authorized without disablement of device capabilities.

I I This device has Cellular, Wi-Fi, photographic, video capture/recording, microphone, audio recording, removable media installed or capability to perform radio frequency transmissions at greater than 100 milliwatts (mW) and has had these features disabled to the maximum extent possible as verified by the command's IT POC below:

IT POC Name:

IT POC Signature:

The following escort is assigned to ensure that device is not connected to any DOD IS and to ensure that none of the disabled features are reactivated by the organization's representative:

Escort Name:

Escort Signature:

The signature above constitutes acknowledgement of the escort's duty to prevent the device from connecting to any DOD IS or reactivation of disabled features.

Program of Record (POR) OU-PE Os (e.g., laptops and tablets) that have mteroperabiiity permission with the installed system at the command as stated in the Assessment and Authorization (A&A) documentation for connection (e.g., in the boundary diagram or network topology) are allowed without modification of capabilities.

Command Security Manager

2 Enclosure (2)

COMSUBLANT/COMSUBPACINST 2075. ID

20Feb20 19

SAMPLE COMMAND PAGE 13

FOR COMPLIANCE WITH CSL/CSPINST 2075. 1

ADMINIS TRA TIV E REMARKS

NAVPERS 1070/613 (REV. 08-2012) PREVIOUS EDITIO NS A RE O B SOL ETE SUPPORTING DIRECTIVE MILPl!RSMA N 1070 -320

SHIP OR STATION COMMANDER, SUBMARINE FORCE ATLANTIC

SUBJECT

PORTABLE ELECTRONIC

I PERMANENT I TEMPORAR Y

AUTHORITY (!/: PCRMANCNT)

DEVICE (PED) POLICY

DATE : I UNDERSTAND THAT l AM REQUIRED TO COMPLY WITH THE

COMMAND' S PORT ABLE ELECTRONIC DEVICE (PED) POLICY AND

COMSUBLANT/COMSUBPACINST 2075.1 (SERJES).

MEMBER'S SIGNATURE

WITNESSED:

COMMAND SECURITY MANAGER

ENTERED AND VERIFIED IN ELECTRONIC S ERVICE RECORD·

VERIFYING OFFICIAL RANK OR GRADE<TITLE. I DATE:

SIGNATURE OF VERIFYING OFFICIAL.

I I

NAME (LAST. FIRST. M IDDLE)" SOCIAL SECURITY NUMBER: I BRANCH ANO CLASS:

FOR OFFICIAL U S E ONLY

PRIVACY SEN SITIVE

Enclosure (3)

20Feb 2019

(THIS PAGE INTENTIONALLY LEFT BLANK)

2 Enclosure (3 )