(c)1300722753-DD254signed.pdf

Please wait...

If this message is not eventually replaced by the proper contents of the document, your PDF viewer may not be able to display this type of document.

You can upgrade to the latest version of Adobe Reader for Windows®, Mac, or Linux® by visiting http://www.adobe.com/go/reader_download.

For more assistance with Adobe Reader visit http://www.adobe.com/go/acrreader.

Windows is either a registered trademark or a trademark of Microsoft Corporation in the United States and/or other countries. Mac is a trademark of Apple Inc., registered in the United States and other countries. Linux is the registered trademark of Linus Torvalds in the U.S. and other countries.

NUWCDIVNPTINST 3070.1B

1053:CAM

23 February 2016

NUWCDIVNPT INSTRUCTION 3070.1B

From: Commanding Officer

Subj: OPERATIONS SECURITY

Ref: (a) NAVSEAINST 3432.1 (series), Naval Sea Systems Command (NAVSEA)

Operations Security (OPSEC) Program Instruction

(b) OPNAVINST 5510.161 (series), Withholding of Unclassified Technical Data from

Public Disclosure

(c) OPNAVINST 3432.1 (series), OPSEC

(d) OPNAVINST 5513.1 (series), Department of the Navy Security Classification Guides

(e) DoD Directive 5205.02, DoD OPSEC Program

(f) 5 U.S.C. Section 552a, Privacy Act of 1974

(g) Naval Undersea Warfare Center Division Newport Critical Information List

Encl: (1) Naval Undersea Warfare Center Division Newport (NUWCDIVNPT) Operations

Security (OPSEC) Plan

1. Purpose. This instruction establishes the policy and assigns the responsibilities for carrying out the NUWCDIVNPT OPSEC plan as directed by references (a) through (e).

2. Cancellation. NUWCDIVNPTINST 3070.1A is cancelled.

3. Administration. This constitutes a major revision and should be read in its entirety.

4. Objective. The objective of this instruction is for the administration of the Command OPSEC program.

5. Scope. This instruction applies to all personnel and activities of NUWCDIVNPT, tenant organizations, contractors, and all range/laboratory/test facility users whether Department of the Navy (DoN), Department of Defense (DoD), or non-DoD.

6. Action. All NUWCDIVNPT personnel, military, civilian, onsite and support contractors, and others assigned to duty at NUWCDIVNPT and its detachments are individually responsible for compliance.

7. Records Management. Records created by this instruction, regardless of media and format, shall be managed per Secretary of the Navy (SECNAV) Manual 5210.1.

HOWARD S. GOLDMAN

Enclosure (1)

NAVAL UNDERSEA WARFARE CENTER DIVISION NEWPORT (NUWCDIVNPT)

OPERATIONS SECURITY (OPSEC) PROGRAM

Enclosure (1)

PREFACE

Operations Security or OPSEC is defined in National Security Decision Directive 298 as the process of denying adversaries information about friendly capabilities and intentions by identifying, controlling, and protecting indicators associated with planning and conducting sensitive government activities.

The goal of OPSEC is to deny our adversaries information that is of value to them; in effect, information that furthers an adversary’s military, technological, economic, and political objectives against the United States. Techniques were developed during the Vietnam conflict that have been refined and put into practice in OPSEC concept and process methodology.

This plan discusses that methodology and its genesis in detail and shall be used as a basis for the development of OPSEC programs tailored to the special concerns of individual operations at Naval Undersea Warfare Center Division Newport (NUWCDIVNPT), including all ranges, sites, and detachments.

Enclosure (1) i

TABLE OF CONTENTS

SECTION PAGE

1 INTRODUCTION

1.1 Background

1.2 The Opsec Process

1.3 Purpose

2. OPSEC PLANNING GUIDANCE/REQUIRED PLANS

2.1 Requirements for Secrecy

2.2 Required Plans

3 CRITICAL INFORMATION

3.1 Sensitive Information

3.2 Sources of Information

4 THE HOSTILE INTELLIGENCE THREAT

5 VULNERABILITIES

6 COUNTERMEASURES

6.1 For Official Use Only (FOUO) Information

6.2 OPSEC Countermeasures

7 TRAINING PROGRAM

7.1 Basic Orientation

7.2 Continuing Awareness

7.3 OPSEC PM Training

APPENDIX A—TERMINOLOGY............................................................................................ A-1

APPENDIX B—OPSEC PROCESS .......................................................................................... B-1

APPENDIX C—VULNERABILITIES ...................................................................................... C-1

APPENDIX D—SAMPLE OPSEC PLAN (ANNEX) .............................................................. D-1

APPENDIX E—OPSEC SURVEYS ........................................................................................... E-1

Enclosure (1) 1

1. INTRODUCTION

1.1 BACKGROUND

a. One of the prime objectives of the U.S. intelligence community is to acquire critical information (CI) regarding the research, development, testing, and evaluation (RDT&E) of foreign military weapons systems and associated hardware. Conversely, there is no doubt that potential U.S. adversaries are also very interested in our military systems development efforts.

b. The purpose of hostile foreign intelligence collection efforts is to determine general developmental trends of future U.S. weaponry; to obtain data about specific weapons in order to devise countermeasures and counter-tactics, and to acquire advanced technology that could possibly reduce developmental time and money associated with their own military hardware programs. The development and initial testing phases of a weapon system is a prime target for hostile intelligence collection.

c. OPSEC is the process that shall be used in the RDT&E community to maintain the element of surprise regarding the development of U.S. weapon systems. OPSEC focuses on identifying and protecting the specific information needed by an adversary to undermine the effectiveness of a specific operation or fielded weapon system.

d. As applied to the RDT&E community, OPSEC is the identification and protection of the specific CI needed by an adversary to develop countermeasures and counter-tactics, or that could be crucial in the transfer of technology; determining where the CI is vulnerable; and implementing countermeasures to the exploitation of those vulnerabilities. The CI that must be protected need not be classified and often is seemingly innocent and unimportant when examined in isolation.

e. It is also vital that the NUWCDIVNPT OPSEC program develop training and awareness programs to raise the consciousness and capabilities of NUWCDIVNPT personnel to the protection of this information.

f. OPSEC remains the functional responsibility of the military commander, the program manager, and those who direct government operations and functions. In the R&D environment, a good OPSEC program will prolong the useful or competitive life of new weapons, high-technology systems, and sensitive programs.

g. The methodology used to implement OPSEC at RDT&E facilities and in specific programs is the OPSEC survey (Appendix E) or vulnerability assessment, per reference (e).

Surveys are conducted per Appendix E. Vulnerability assessments shall be conducted annually.

Enclosure (1) 2

1.2 THE OPSEC PROCESS

OPSEC is a continuous systematic process, encompassing security and common sense. It can be applied to any program, plan, or operation. The five basic steps below are explained in detail in Appendix B:

1. Identifying Critical Information

2. Threat Analysis

3. Vulnerability Analysis

4. Risk Assessment

5. Countermeasures

1.3 PURPOSE

a. The purpose of this directive is to provide NUWCDIVNPT personnel with a better understanding of the threat posed by hostile intelligence collection, to identify NUWCDIVNPT vulnerabilities that could be exploited by an adversary, and to identify countermeasures that can be implemented to counter the threat.

b. This directive discusses the OPSEC methodology in detail and shall be used as a basis for the development of individual OPSEC plans and actions tailored to the special concerns of all codes, programs, projects, and contractors conducting operations at NUWCDIVNPT.

Appendixes A through E provide a list of terms, a five-step OPSEC analysis, a list of known vulnerabilities, a sample OPSEC Plan (Annex), and OPSEC survey information. Site-specific detachment OPSEC plans are available from the respective program managers or the NUWCDIVNPT OPSEC Program Manager (PM) (Code 1053).

2. OPSEC PLANNING GUIDANCE/REQUIRED PLANS

2.1 REQUIREMENTS FOR SECRECY

a. The primary purpose of NUWCDIVNPT is to acquire, process, and distribute information associated with the RDT&E of military devices and systems associated with underwater weapons, acoustics, communications systems, and other related systems. Much of this information is potentially vulnerable to unauthorized interception.

b. The interception of military data can enable hostile governments to devise similar capabilities at much reduced cost and/or develop defensive systems and devices to nullify the effectiveness of new weapons before they become operational. The protection of information about NUWCDIVNPT capabilities, operations, and other activities from interception is essential for preservation of our military advantage.

Enclosure (1) 3

2.2 REQUIRED PLANS

When required by the NUWCDIVNPT OPSEC PM, projects, programs, events, and functions initiated, planned, conducted, and/or supported by elements of NUWCDIVNPT that have sensitive unclassified aspects will have specific, detailed OPSEC plans. These plans will ensure unclassified information (of military significance that could be of intelligence value to a hostile government) shall be properly protected and disseminated only on a strict need-to-know basis. Appendix B provides a five-step process for developing OPSEC plans. Intelligence value is knowledge that can be evaluated and interpreted, or give knowledge of where and/or how such knowledge can be obtained, to provide indicators of U.S. military capabilities, limitations, vulnerabilities, and/or probable intentions. Appendix D presents a sample format to assist in the development of individual OPSEC plans.

3. CRITICAL INFORMATION

CI is defined as information important to the successful achievement of objectives and missions, or that may be of use to an adversary. An alternate valid definition is as follows: CI is information about friendly activities, intentions, capabilities, or limitations that an adversary needs in order to gain a military, political, diplomatic, or technological advantage, per references (a), (c), and (e) through (g). Such information, if released to an adversary prematurely, may prevent or forestall mission accomplishment, reduce mission effectiveness, or cause loss of lives and/or damage to friendly resources.

3.1 SENSITIVE INFORMATION

a. Information whose loss, misuse, unauthorized access to, or modification of, could adversely affect the national interest, the conduct of federal programs, or the privacy to which individuals are entitled under 5 U.S.C. Section 552a (the Privacy Act) reference (f), but that has not been specifically authorized under criteria established by an Executive Order or an Act of Congress to be kept safeguarded in the interest of national defense or foreign policy.

b. All CI is considered sensitive information as defined above. A listing of CI that may have application to activities at NUWCDIVNPT is maintained in a separate document. The Critical Information List (CIL), reference (g), shall be updated annually.

3.2 SOURCES OF INFORMATION

In addition to the covert gathering of information by hostile intelligence collectors, there are open sources of information and detectable activities that may totally or partially answer Essential Elements of Friendly Information (EEFI). The NUWCDIVNPT CIL helps personnel better understand how sensitive information can be of value to an Intelligence Collector, and can be provided through open sources. It will also be of value to persons preparing OPSEC plans.

Enclosure (1) 4

4. THE HOSTILE INTELLIGENCE THREAT

a. The primary hostile intelligence collection capability facing NUWCDIVNPT is the ability of hostile intelligence services (HOIS) to actively collect classified and/or sensitive unclassified information.

b. Frequent, well-publicized cases of espionage serve as ample evidence that hostile elements go to considerable effort to obtain information about U.S. weapons systems. Thus, it would be foolhardy and negligent not to assume that an important RDT&E facility, such as NUWCDIVNPT, would not be targeted by a foreign intelligence service.

c. Due to the concentration of high technology industries and military operations in the eastern U.S., it is estimated that HOIS are very active in this area. The current threat is multidimensional, highly sophisticated, and extremely dedicated. HOIS have the ability and motivation to collect classified and sensitive information utilizing human intelligence (HUMINT), signal intelligence (SIGINT), and imagery intelligence (IMINT) resources.

d. Collection of information concerning a technology or its application to a weapon system or other military capability can be compared to putting together the pieces of a puzzle.

Any or all of the various intelligence collection methods may be used to identify these pieces and their place in the puzzle. To alert personnel associated with NUWCDIVNPT operations and programs to the multidimensional intelligence collection threat, an examination of each of the three major collection disciplines and their subcategories follows.

(1) HUMINT: Intelligence derived from information collected or provided by human sources. Typical HUMINT activities consist of interrogations and conversations with persons having access to information. HUMINT can provide several kinds of information. It can provide observations during travel or other events from travelers, refugees, etc. It can provide data on things about which the subject has specific knowledge, which can be another human subject or, in the case of defectors and spies, sensitive information to which they had access. Finally, it can provide information on interpersonal relationships and networks of interest.

(2) SIGINT: Intelligence-gathering by interception of signals, whether communications between people, “communications intelligence” (COMINT), or from electronic signals not directly used in communication, “electronic intelligence” (ELINT).

Sensitive information is often encrypted. As such, SIGINT often involves the use of cryptanalysis to decipher the messages. Traffic analysis, the study of who is signaling whom and in what quantity, is also used to derive information. Since the invention of the radio, the international consensus has been that radio waves are no one’s property, thus the interception itself is not illegal. However, there can be laws on who is allowed to collect, store, and process radio traffic and for what purpose.

(3) IMINT: Intelligence derived from the collection and exploitation of visual photography, infrared sensors, lasers, electro-optics, and radar sensors such as synthetic aperture radar wherein images of objects are reproduced optically or electronically on film, Enclosure (1) 5 electronic display devices, or other media. IMINT can be derived from sources ranging from personal cameras, pictures from open source documentation, Open Sky fly-overs, publicly available satellite imagery such as Google Maps, and government owned spy satellites.

5. VULNERABILITIES

OPSEC vulnerabilities are weaknesses in security measures, operational practices, and procedures that can be exploited by, and are accessible to, a hostile intelligence attack. OPSEC vulnerabilities reflect the most lucrative source of information normally targeted by hostile intelligence collection operations. Known common vulnerabilities among RDT&E facilities are provided in Appendix C.

6. COUNTERMEASURES

a. A countermeasure is any action taken to eliminate or reduce a vulnerability to hostile collection. Per references (a) and (c), when developing countermeasures, consideration should be given to on-the-spot corrections that effectively minimize or neutralize identified vulnerabilities. Low-cost/no-cost solutions should be sought and emphasized. Such recommendations may be of a temporary or permanent in nature. Temporary recommendations to neutralize vulnerabilities usually relate to an event, when the event has concluded, or further action is usually no longer required. Where extensive corrections must be taken or high costs are involved, recommendations should be prioritized to permit an incremental approach for adoption that is phased over a period of time.

b. The decision on what countermeasures to implement relates directly to risk versus cost/benefit. The countermeasures identified herein are not all inclusive, and any organization, contractor, or subcontractor in support of programs/projects at NUWCDIVNPT that may require additional countermeasures shall contact the OPSEC PM.

6.1 FOR OFFICIAL USE ONLY (FOUO) INFORMATION

a. Access to FOUO material shall be limited to those employees who need the material to do their job. FOUO material shall be handled in a way to preclude its disclosure to the general public and to limit its circulation.

b. The marking “FOR OFFICIAL USE ONLY” shall be stamped or marked in bold letters at least 3/16 of an inch in height at the top and bottom of those pages that contain FOUO information. The abbreviation FOUO shall not be used for marking purposes.

6.2 OPSEC COUNTERMEASURES

Enclosure (1) 6

The application of OPSEC countermeasures could involve any of the issues discussed previously in this directive. In addition, there are a number of significant areas that have not been addressed to this point as they do not specifically fall into any of the categories in this plan.

These miscellaneous countermeasures have been grouped here under OPSEC:

a. Contracts. All contracts involving classified work shall include language ensuring the application of OPSEC principles per reference (c) and this instruction. All contracts, whether involving classified work or not, that require onsite contractors at NUWCDIVNPT shall require the contract language to ensure onsite contractors receive all necessary training in OPSEC principles per reference (c) and this instruction commensurate with the training that government personnel receive. The details of contracts either generated or performed at NUWCDIVNPT can be of value to HOIS. Contract information, even though unclassified, needs to be restricted in its dissemination to the minimum number of recipients possible.

b. Public Release. No material shall be given public release without an OPSEC review being conducted according to established procedures, per references (a) through (c), and (e) through (g). The NUWCDIVNPT Public Affairs Office is the only authorized releasing official.

(1) Contractors shall clear all releases through project offices or with the NUWCDIVNPT Contracting Officer’s Representative, who shall ensure established NUWCDIVNPT procedures are followed.

(2) Information published in any public media, government media, technical journals, speeches, etc., that has no restrictions or controls on who may receive the material is to be considered a “Public Release.”

c. Technology Transfer. Strict adherence to NUWCDIVNPT guidelines in the release or transfer of critical technology data is mandatory. Material information or data controlled by the Militarily Critical Technology List, the International Traffic in Arms Regulation, the Commodities Control List, or the United States Munitions List can be released under controlled conditions as specified by each respective source.

d. Miscellaneous Issues. In most cases, any activity or function can have OPSEC applied in some fashion. It is not possible to cover in this plan all instances where OPSEC could be utilized. With a little thought and common sense, those activities with OPSEC potential that do not fall into one of the categories previously covered should be apparent. For example:

(1) The supply function can be a lucrative source of information on NUWCDIVNPT activities. The kind of parts, equipment, and services procured can be a clear indicator of activities, operational capabilities, projects, and programs.

(2) Personnel actions (recruitments, transfers, training, etc.) can furnish valuable information relating to NUWCDIVNPT projects, programs, and the types of technologies underway or planned.

Enclosure (1) 7

(3) Finance and management information can be very sensitive. Program and project level effort and priorities can be clearly deduced by analyzing financial data.

(4) Travel information reflecting types of meetings, contacts, and subject areas for key NUWCDIVNPT personnel should be controlled. Such information can be of value to HOIS analysts.

(5) Corporate plans (long-range and short-range), standard operating procedures (SOPs), emergency plans, etc., may all have OPSEC potential. Planners must keep in mind that their products, even though unclassified, need to be reviewed for OPSEC application throughout the planning process.

7. TRAINING PROGRAM

For OPSEC to be effective, all personnel at NUWCDIVNPT shall understand the concept of OPSEC and apply that knowledge and awareness in the performance of assigned tasks. For the OPSEC training program to be meaningful over the long term, it shall be relevant to the jobs assigned per reference (c) and (e).

7.1 BASIC ORIENTATION

Each new employee (military and civilian) assigned to an organizational element at NUWCDIVNPT shall receive an OPSEC briefing as part of NUWCDIVNPT’s “New Employee Security Orientation Program.” This briefing shall occur within 60 days of reporting on board.

7.2 CONTINUING AWARENESS

Ongoing OPSEC awareness programs shall be provided for all personnel (military and civilian). OPSEC awareness programs shall be updated continuously to ensure the most current information is available on OPSEC-related issues. The continuing awareness program shall utilize the all-hands electronic messages/article systems. All training requirements shall be coordinated through the Naval Sea Systems Command (NAVSEA) and NUWCDIVNPT Workforce Development Branch.

7.3 OPSEC PM TRAINING

The OPSEC PM shall attend OPSE 2380 (OPSEC Analysis Course) and OPSE 2390 (OPSEC Program Management Course) within 90 days of appointment. Although there are no prerequisites for this training, the OPSE 1301 (OPSEC Fundamentals) course is recommended.

Online training is provided by the Interagency OPSEC Support Staff (IOSS).

Enclosure (1) 8

7.4 OPSEC COORDINATOR TRAINING

The coordinators shall complete the OPSE 1301 course upon appointment by their respective Department Head. Online training is provided by the IOSS.

Enclosure (1) A-1

APPENDIX A

TERMINOLOGY

1. Access or Accessibility. Access or accessibility refers to the ability and opportunity to obtain knowledge of classified or sensitive unclassified information. An individual may have access to information by being in a place where such information is kept, if the security measures that are in force do not prevent that person from gaining knowledge of the information.

2. Appreciations. Appreciations are assumptions, estimates, and facts about an opponent’s intentions and military capabilities that are used in planning and decision making:

a. Desired Appreciations. Adversary estimates that result in adversary intentions and military capabilities to friendly advantage.

b. Essential Secrecy. Specific unknowns or uncertainties that prevent or hinder adversary derivation of accurate estimates or knowledge of facts, and effective planning and decision making.

c. Harmful Appreciations. Adversary assumptions or estimates to provide for unknowns or uncertainties, or necessary and sufficient known facts that result in adversary intentions and military capabilities to friendly disadvantage.

3. Authorized Persons. Authorized persons have a need-to-know for the information involved and have been cleared for the receipt of such information. Responsibility for determining whether a person’s duties require that they possess, or have access to, any information, and whether they are authorized to receive it, rests on the individual who has possession, knowledge, or control of the information involved, and not on the prospective recipient.

4. Classification Guide. A classification guide is a document issued by an authorized original classifier that prescribes the level of classification and appropriate declassification instructions for specified information to be classified derivatively.

5. Classified Information. Classified information is information or material that is: (a) owned by, produced by or for, or under the control of the U.S. Government; (b) determined under Executive Order 13526 or prior orders to require protection against unauthorized disclosure; and

(c) so designated.

6. Command, Control, Communications, Computers, Collaboration, and Intelligence (C5I). C5I are the capabilities required by commanders to exercise command and control of their forces, including capabilities to:

a. Obtain, report, communicate, process, analyze, synthesize, display, and disseminate information to support command planning and decision making.

b. Formulate alternative courses of action.

Enclosure (1) A-2

c. Exercise decision making roles.

d. Communicate orders to subordinates and receive the results of actions and the status of forces.

7. Communications Security (COMSEC). A component of Information Assurance that deals with measures and controls taken to deny unauthorized persons information derived from telecommunications and to ensure the authenticity of such telecommunications. COMSEC includes cryptographic security, transmission security, emissions security, and physical security of COMSEC material:

a. Cryptographic Security. The component of COMSEC that results from the provision of technically sound crypto-systems and their proper use.

b. Transmission Security. Measures (security controls) applied to transmissions in order to prevent interception, disruption of reception, communications deception, and/or derivation of intelligence by analysis of transmission characteristics such as signal parameters or message externals.

c. Emission Security. The component of communications security that results from all measures taken to deny unauthorized persons information of value that might be derived from intercept and analysis of compromising emanations from crypto equipment and information systems.

d. Physical Security. All physical measures necessary to safeguard classified and sensitive unclassified equipment, material, and documents from access thereto or observation thereof by unauthorized persons.

8. Compromise. Disclosure of information to unauthorized persons, or a violation of the security policy of a system in which unauthorized intentional or unintentional disclosure, modification, destruction, or loss of an object may have occurred.

9. Compromising Emanations. Unintentional signals that, if intercepted and analyzed, would disclose the information transmitted, received, handled, or otherwise processed by telecommunications or information systems equipment.

10. Controlled Information. Information and indicators deliberately conveyed or denied to foreign targets in order to evoke invalid official estimates that result in foreign official actions advantageous to U.S. interests and objectives.

11. Countermeasures. Anything that effectively negates or mitigates an adversary’s ability to exploit vulnerabilities.

Enclosure (1) A-3

12. Cover. Cover is military deception that causes misinterpretation of and minimal concern or curiosity about observables that are generated by operations and other activities. Covers are targeted not only at adversaries, but also at random observers and sometimes at personnel with access to classified information.

13. Critical Information (CI). Information about friendly activities, intentions, capabilities, or limitations that an adversary needs to gain a military, political, diplomatic, or technological advantage.

14. Deception Means. Deception means are methods, resources, and techniques that can be used to convey or deny information:

a. Administrative Means. Resources, methods, and techniques designed to convey or deny oral, pictorial, documentary, or other physical evidence.

b. Physical Means. Activities and resources used to convey or deny selected information.

(Examples: military operations, including exercises, reconnaissance, training activities, and movement of forces; the use of dummy equipment and devices; tactics; bases, logistic actions, stockpiles, maintenance, and repair activities; and test and evaluation activities.)

c. Technical Means. Military material resources and their associated operating techniques used to convey or deny selected information through the deliberate radiation, re-radiation, alteration, absorption, or reflection of energy; the emission or suppression of chemical or biological odors; and the emission or suppression of nuclear particles.

15. Document. A document is any recorded information, regardless of its physical form or characteristics, exclusive of machinery, apparatus, equipment, or other items of material. The term includes, but is not limited to, the following: all written material (whether handwritten, printed, or typed); all photographs, negatives, exposed or printed films, and still or motion pictures; all data processing files, cards, or tapes; maps; charts; paintings; drawings; engraving;

sketches; working notes and papers; all reproduction of the foregoing by whatever process reproduced; and sound/voice of electronic recordings in any form.

16. Electronic Intelligence (ELINT). Technical and geolocation intelligence derived from foreign non-communications transmissions (e.g., radar) by other than nuclear detonations or radioactive sources.

17. Electronic Security (ELSEC). ELSEC is the protection resulting from all measures designed to deny unauthorized persons information of value that might be derived from their interception and study of non-communications electromagnetic radiations, (e.g., radar).

18. Emission Control. Emission control is the selective and controlled use of electromagnetic, acoustic, or other emitters to optimize command and control capabilities (while minimizing, for OPSEC, detection by enemy sensors); to minimize mutual interference among friendly systems;

and/or to execute a military deception plan.

Enclosure (1) A-4

19. Enterprise Protection Risk Management (EPRM). EPRM is a Secure Internet Protocol Router Network (SIPRNET)-based program that provides commands and commanding officers the ability to view enterprise-wide assessments across multiple functional areas to help make informed decisions on where to best allocate resources.

20. Essential Elements of Information. In the context of “friend or foe,” these are specific pieces of information that are likely to be sought by friendly planners about specific adversaries’ intentions, capabilities, and activities.

21. Essential Elements of Friendly Information (EEFI). In the context of “friend or foe,” these are specific pieces of information regarding friendly intentions, capabilities, and activities that are likely to be sought by adversaries.

22. Essential Secrecy. The condition achieved from the denial of critical information to adversaries.

23. Foreign:

a. Of, relating to, or derived from another country or nation; not native.

b. Of, or relating to, contact or dealings with other countries; connected with foreign affairs.

c. External to one’s own country or nation.

d. Carried on abroad, or with other countries.

e. Belonging to, or coming from another district, province, etc.

f. Located outside a specific district, province, etc.

24. Human Intelligence (HUMINT). HUMINT is the collection of information for intelligence purposes through the use of human sources. It is commonly gathered either covertly by espionage agents with placement and access or overtly through information readily available to the general public.

25. Imagery Intelligence (IMINT). Intelligence derived from the collection and exploitation of visual photography, infrared sensors, lasers, electro-optics, and radar sensors such as synthetic aperture radar wherein images of objects are reproduced optically or electronically on film, electronic display devices, or other media.

26. Industrial Security. That portion of internal security that is concerned with the protection of classified information in the hands of U.S. industry.

Enclosure (1) A-5

27. Information Categories

a. Controlled Information. Information conveyed or denied to an adversary to evoke desired appreciations.

b. Protected Information. Information accorded protections prescribed for classified matters.

c. Indicators. Data obtained from open sources of information or derived from detectable activities that can be synthesized or interpreted with respect to background knowledge to make estimates.

d. Observables. Actions that convey indicators, and that shall be carried out to plan, prepare for, and execute operations and other activities that are exploitable by foreign intelligence organizations are called observables.

28. Information Security (INFOSEC). The result of any system of administrative policies and procedures for identifying, controlling, and protecting from unauthorized disclosure information;

the protection of which is authorized by executive order or statute.

29. Information Sources

a. Secret Sources and Methods. Personnel, documents, material, and other matters that are knowledgeable of, or embody classified information and abilities to process classified matters.

Secret sources and methods result from weaknesses in security protections for classified matters and hostile success in exploiting those weaknesses through espionage, human sources elicitation, theft, crypto-analysis, and code breaking.

b. Open Sources of Information. Oral, documentary, pictorial, and physical materials accessible by the public. Open sources of information result from administrative actions and include such things as technical articles, public affairs releases, contract awards, budgets, speeches, awards, schedules, phone books, commercial advertisements, notices to mariners or airmen, flight plans, biographies, job descriptions, motel reservations, briefings to families and visitors, personnel orders, cargo manifests, and sales to foreign countries.

c. Detectable Activities. This includes emissions that can be intercepted and physical actions or matters that can be observed, imaged, or detected by active sensors. Detectable activities result from physical and technical actions and include such things as ship or aircraft presence; senior officers present in an area; supply movements; presence or absence of vendors;

use of radars or sonars; telemetry emissions; infrared sources; other phenomena that can be sensed; test equipment in area; physical layout of an area; departure of aircraft, ships, or vehicles from an area; new construction; and weapons stock in the open.

30. Intelligence. Intelligence is the product resulting from the collection, evaluation, analysis, integration, and interpretation of all available information that concerns one or more aspects of foreign nations or of areas of foreign operations and that is immediately or potentially significant to military planning and operations.

Enclosure (1) A-6

31. Military Deception. Military deception is an action executed to mislead foreign decision makers causing them to derive and accept desired appreciations of military capabilities, intentions, operations, or other activities that evoke foreign actions that contribute to the originator’s objectives.

32. Need-to-Know. A determination made by an authorized holder of classified or proprietary information as to whether or not a prospective recipient requires access to specific information to perform or assist in a lawful and authorized governmental function.

33. Official Information. Official information is information owned by, produced for or by, or is subject to the control of the U.S. Government.

34. Operations Security (OPSEC). OPSEC is the process of denying adversaries information about friendly capabilities and intentions by identifying, controlling, and protecting indicators associated with planning, conducting military operations, and other activities.

35. OPSEC Indicators. Any detectable activity and/or information that, when looked at by itself or in conjunction with something else, allows an adversary to obtain critical or sensitive information.

36. Physical Security. This is the application of physical barriers and control procedures as countermeasures against threats to resources and sensitive information. The security discipline concerned with physical measures that is designed to safeguard personnel; prevent unauthorized access to equipment, installations, material, and documents; and to safeguard them against espionage, sabotage, damage, and theft.

37. Sensitive Information. Information whose loss, misuse, unauthorized access to, or modification of, could adversely affect the national interest or the conduct of federal programs, or the privacy to which individuals are entitled under 5 U.S.C. Section 552a (the Privacy Act), but that has not been specifically authorized under criteria established by an Executive Order or an Act of Congress to be kept safeguarded in the interest of national defense or foreign policy.

38. Signal Security (SIGSEC). SIGSEC is the protection resulting from all measures taken to deny to unauthorized persons information of intelligence value obtained from all friendly electromagnetic radiations other than nuclear detonations. Signal security is a generic term that includes communications security and electronic security.

39. Telemetry Intelligence (TELINT). TELINT is derived from the interception and analysis of electronically transmitted data containing measured parameters of performance, either mechanical or human.

40. TEMPEST. TEMPEST is an unclassified short name referring to investigations and studies of compromising emanations from telecommunications and information systems equipment.

Enclosure (1) A-7

41. Transmission Security. Transmission security is that component of security that results from all measures designed to protect communication transmissions from interception and traffic analysis.

42. Unauthorized Person. This includes any person who is not authorized to have access to specific information or an area per the provisions of any official regulation.

43. Vulnerabilities. Vulnerabilities are any information protection system inadequacies (weaknesses) that allow the loss of sensitive information damaging to national security.

Enclosure (1) B-1

APPENDIX B

OPSEC PROCESS

The OPSEC process is a risk management instrument that enables the manager or commanding officer to view an operation or activity from the perspective of an adversary. The key feature of this approach is to look at our own methods and activities from the adversary’s viewpoint by putting ourselves in an adversary’s shoes.

The OPSEC process traditionally involves five interdependent phases:

1. Identification of Critical Information. Critical information is factual data about an organization’s intentions, capabilities, and activities that the adversary needs to plan and act effectively to degrade operational effectiveness or place the potential for organizational success at risk. The OPSEC process identifies critical information and determines when that information may cease to be critical in the life-cycle of an operation, program, or activity.

2. Analysis of Threats. Threat analysis consists of determining the adversary's ability to collect, process, analyze, and use information. The objective of threat analysis is to know as much as possible about each adversary and their ability to target the organization. It is especially important to tailor the adversary threat to the actual activity and, to the extent possible, determine what the adversary’s capabilities are with regard to the specific operations of the activity or program.

3. Analysis of Vulnerabilities. Vulnerability analysis requires the OPSEC analyst to adopt an adversarial view of the activity requiring protection. The analyst attempts to identify weaknesses or susceptibilities that can be exploited by the adversary’s collection capabilities.

The vulnerability analysis process must identify the range of activities that can be observed by the adversary, the type of information that can be collected, and the specific organizational weaknesses the adversary can exploit. Based on this knowledge, the OPSEC analyst determines what critical information the adversary can derive based on the known threat and assessed vulnerabilities.

4. Assessment of Risk. Risk assessment is the heart of the OPSEC process. In a risk assessment, threats and vulnerabilities are compared to determine the potential risk posed by adversary intelligence collection activities targeting an activity, program, or organization. When the level of vulnerability is assessed to be high and the adversary threat is evident, then adversary exploitation is expected, and risks are assessed to be high. When the vulnerability is slight, and the adversary’s collection ability is rated to be moderate or low, the risk may be determined to be low, and no protective measures may be required. Based on the assessed level of risk, cost/benefit measures can be used to compare potential countermeasures in terms of their effectiveness and cost.

5. Application of Appropriate Countermeasures. In the final step, countermeasures are developed to protect the activity. Ideally, the chosen countermeasures eliminate the adversary threat, the vulnerabilities that can be exploited by the adversary, or the utility of the information. In assessing countermeasures, the impact of the loss of critical information on

Enclosure (1) B-2 organizational effectiveness must be balanced against the cost of implementing corrective measures. Possible countermeasures should include alternatives that may vary in terms of feasibility, cost, and effectiveness. Based on the probability of collection, the cost effectiveness of various alternatives and the criticality of the activity, appropriate countermeasures are then selected by the program manager. In some cases, there may be no effective means to protect information because of cost or other factors that make countermeasure implementation impossible. In such cases, the program manager must decide to accept the degradation of effectiveness or cancel the activity.

While OPSEC is not a cure-all, it is a vital, easy-to-use tool that ideally is instituted at the very onset of an activity. If the personnel involved develop an “OPSEC mindset,” effectiveness is enhanced and mission success is more likely. OPSEC is neither difficult nor time-consuming;

instead, it can easily become a “matter-of-course” process.

Enclosure (1) C-1

APPENDIX C

VULNERABILITIES

The following is a list of vulnerabilities known to be common among RDT&E facilities.

This is the most complete list currently available. It is provided to assist preparers of OPSEC plans to ensure as many factors as possible are included during plan preparation.

1. Telephone Security. The telephone is an integral part of everyone’s office. The handset of a telephone acts as a microphone that picks up and transmits both electronic signals and normal-volume conversations that can be covertly monitored even with the receiver on the hook.

Furthermore, many people constantly try to talk around classified information on an unsecured telephone and/or create “homemade” codes.

2. Unsecure Data/Communications Links. The transmission of unprotected sensitive and classified information via various data and communication links offers the adversary an excellent opportunity to exploit the efforts of the national defense.

3. Contractor SIGSEC Vulnerability. Without proper application of counter-SIGSEC measures, contractors can be a source of compromised critical data regardless of how well the DoD manages its internal counter-SIGSEC program. The inclusion of contractors into OPSEC planning is essential. This includes contractor work accomplished at NUWCDIVNPT or at the contractor’s facility.

4. Planning and Policy for Information Systems. Information systems are dense repositories of valuable and sensitive data and as access becomes easier, the potential abuse and misuse of those systems becomes greater. This problem can result in (a) loss, modification, and/or compromise of sensitive data, (b) greater cost and less effectiveness in instituting security as a retrofit, and (c) more elapsed time before systems can be reliably operated.

5. Interactive Graphics. The increased use of computer-aided graphics for weapon and component design, as well as documentation, has serious security implications as sensitive databases are networked between users (both government and contractor). Without properly integrated security systems existing to protect the information cataloged, this condition can result in (a) undetected loss of sensitive data, (b) creation of sensitive designs from unclassified material, and (c) abrogation of responsibility for protecting contractor proprietary information.

6. Technology Transfer. The open academic environment existing within the RDT&E community (plus a desire to pass information in the interest of scientific and technology sharing among the scientific community) provides a lucrative target to the hostile intelligence collector with regards to acquiring both classified and sensitive unclassified information. Guidelines are available to assist with issues of technology transfer.

7. Photography and Imagery. The inadvertent or intentional release of visual photography or imagery can provide an adversary access to indicators of classified or sensitive information.

This can include anything from security protective measures to images of classified equipment.

This vulnerability usually results from the inadvertent inclusion of some object in the

Enclosure (1) C-2 background of the image such as the evacuation plan on the wall which displays the floorplans for the building. Another example is a photo of a building that shows the fence line and security camera placement in the background.

8. Program Management Vulnerabilities. Sensitive unclassified information is often released without full knowledge of the adverse impact this may create. The release of sensitive unclassified data may lead to the compromise of an individual program or some aspect of the program.

9. Public Affairs Officer. There is little specific information protection guidance available for the information specialists who typically release unclassified RDT&E information to the public.

Sensitivity to OPSEC principles is important within the public affairs function.

10. Protection of Information Concerning RDT&E Initiatives. Established guidance by definition is often not directly applicable to a new initiative, and therefore, much information can be released before the concept is proven or the item is tested and found to be valid or effective. The result is any protection is largely ineffective because all the development data have already been published or otherwise not protected.

11. Increased Enforcement Capability (TEMPEST). Changing or relocating previously TEMPEST-certified systems, or replacing certain components without proper notification, violates the control designs implemented to meet TEMPEST requirements. Such actions increase the risk of compromising the security of the system used to process or transmit classified data. Any alteration or movement of a TEMPEST-certified system of any type must be coordinated with the Automated Information Systems (AIS) Security Office.

12. Planning for System Installation (TEMPEST). Early consideration of TEMPEST requirements and involvement by the AIS Security Office is important.

13. New Construction. The inclusion of security issues and consultation with security personnel is not always considered during new-construction planning for government facilities.

Security Officers must be included in initial preliminary planning.

14. RANKIN System. The Retrieval and Analysis of Navy Classified Information (RANKIN) system was established to provide standard formatting, central recording, and promulgation of DoN Classification guidance. The INFOSEC Branch is available to assist with the application of the RANKIN system.

15. Industrial OPSEC Program. A significant proportion of systems development support is performed by private contractors. It is vital the contractor have an effective industrial OPSEC program in place when sensitive data are developed by, or passed to, that contractor.

16. Risk and Threat Analysis. Risk and threat assessments of RDT&E centers, or their program activities, are very important and mandatory in some cases. Without a risk assessment being performed, the proper countermeasures may not be implemented, thereby increasing the potential for damage to national security.

Enclosure (1) C-3

17. Open Sources. Open sources where documents are published and distributed without required security reviews.

18. RDT&E Range Documents. Documents generated at RDT&E ranges are often not provided FOUO considerations. FOUO information may be excluded from public release, as long as the criteria falls under one of the nine exemptions listed in the Freedom of Information Act (FOIA) is valid and legally defensible.

19. RDT&E Distribution Statements. Limited distribution statements are often not provided on RDT&E-generated technical documents as required by DoD Directive 5200.20.

20. Disposal of Sensitive Trash. Trash receptacles can be lucrative sources of information.

Sensitive operations can be disclosed by the improper disposal of sensitive paper waste.

21. Lack of Awareness. Lack of awareness as to the hostile intelligence threat to RDT&E operations may cause employees to become careless as to their security responsibilities.

22. Inadequate Security Review.