Attachment_03_-_MPF_OPSEC_Plan.pdf

DEPARTMENT OF THE ARMY

PROGRAM EXECUTIVE OFFICE

GROUND COMBAT SYSTEMS

6501 E. ELEVEN MILE ROAD

WARREN, MICHIGAN 48397-5000

SFAE-GCS-P 11 Sep 2017

SUBJECT: Project Manager Mobile Protected Firepower (PM MPF) Operations Security (OPSEC) Plan

1. References:

a. AR 530-1, Operations Security (OPSEC), 26 Sep 2014.

b. PEO GCS OPSEC Plan, 14 Feb 2013

2. General. This Operations Security (OPSEC) Plan is a supplement to the PEO GCS OPSEC Plan.

a. Applicability. The PM MPF OPSEC Plan is applicable to all personnel (military, civilian, and contractor) working with the MPF program. It outlines actions to be conducted to ensure protection of Program Information from an adversary’s observation and collection. This Plan is appropriately nested and not meant to replace or circumvent the PEO GCS OPSEC Program and Plan as referenced above. OPSEC compliments and reinforces other security program disciplines by eliminating, concealing, or reducing indicators that can compromise critical information. The principles outlined in this OPSEC Plan will be implemented in concert with the other security program disciplines.

b. PM MPF Mission. Rapidly deliver the Mobile Protected Firepower System that is lethal, survivable and adaptable in multi-domain combat operations.

c. Purpose. The purpose of this OPSEC Plan is to control sensitive information and to protect operations and activities which, if exploited, could seriously degrade or defeat current or future plans and activities. In order to eliminate, and/or mitigate the possibility of exploitation, it is imperative that all personnel are knowledgeable of, and apply these procedures during the conduct of their daily mission planning tasks and activities.

3. Responsibilities.

a. The Project Manager (PM) will:

(1) Implement an OPSEC program.

(2) Approve an OPSEC Plan specific to the operation of the Project Management Office (PMO) as a supplement to the PEO OPSEC Plan.

(3) Appoint an OPSEC Officer or Coordinator for the PMO who will perform the requirements of the OPSEC Officer appropriate for the PMO.

Matt.Dolecki Typewritten Text

Matt.Dolecki Typewritten Text

Matt.Dolecki Typewritten Text Attachment 03

SFAE-GCS-P

SUBJECT: PM MPF Operations Security (OPSEC) Plan

(4) Ensure appropriate OPSEC measures are taken within their PMO to preserve essential secrecy.

(5) Plan for and implement OPSEC before, during and after operations and other activities to include RDT&E that affect the combat capability of the U.S. Army. OPSEC is part of the PM’s initial planning guidance.

(6) Provide annual reminders of the importance of sound OPSEC practices.

These reminders consist of OPSEC news releases in publications, OPSEC information bulletins, and OPSEC awareness briefings.

b. OPSEC Officer will:

(1) Direct and implement the OPSEC program.

(2) Plan for and implement OPSEC before, during and after operations and other activities to include RDT&E that affect the combat capability of the U.S. Army. OPSEC is part of the commander’s initial planning guidance.

(3) Chair the PM MPF-level OPSEC Working Group (OWG). At PM MPF level, the OPSEC Officer develops a PM MPF-level OPSEC working group to coordinate OPSEC actions across the PM MPF on a consistent basis.

(4) In conjunction with other staff officers input, develop the PM MPF’s Critical Information List (CIL).

(5) Develop and recommend OPSEC measures to be implemented within the PM

MPF.

(6) Conduct OPSEC reviews of operational plans and reports to ensure adherence to OPSEC policies and procedures.

(7) Conduct OPSEC assessments using the published OPSEC guidance to determine if the PMO is implementing their own OPSEC policies and procedures. The OPSEC Officer submits a written assessment with results and recommendations to the assessed PM and PEO OPSEC Officer.

(8) Ensure training exercises include realistic OPSEC considerations and any evaluation of a training exercise includes an evaluation of OPSEC procedures. Further, ensure pre-exercise OPSEC briefings are conducted incorporating the threat, CIL, and OPSEC measures.

(9) Coordinate with the Public Affairs and Freedom of Information Act officers to ensure an OPSEC review is conducted before the release of information concerning PM MPF programs/projects.

(10) Ensure OPSEC training is conducted in accordance with AR 530-1 and this OPSEC Plan.

Matt.Dolecki Typewritten Text Attachment 03

Matt.Dolecki

11 Sep 2017

(11) Integrate intelligence, counterintelligence, Force Protection, and Information Operations (IO) into OPSEC planning and practice as appropriate.

(12) Monitor the OPSEC programs of subordinate organizations by reviewing OPSEC Plans, survey results, exercise evaluations, and Inspector General reports.

(13) Conduct an annual OPSEC assessment.

(14) Prepare an annual OPSEC Program Status Report, to be submitted to the PEO OPSEC Officer. The reporting period is from 1 October to 30 September of the prior fiscal year.

(15) Perform other duties and responsibilities as defined in AR 530-1, Appendix H.

c. All personnel will:

(1) Implement OPSEC measures as determined by the PM.

(2) Receive Operations Security Level I training in accordance with AR 530-1, Chapter 4, to:

(a) Understand how OPSEC complements traditional security programs to maintain essential secrecy of U.S. military capabilities, intentions, and plans;

(b) Learn how to apply OPSEC to their daily tasks;

(c) Learn why OPSEC is important to the organization;

(d) Understand how adversaries aggressively seek information on U.S.

military capabilities, intentions, and plans;

(e) Become knowledgeable of the local multidiscipline adversary intelligence threat; and,

(f) Become knowledgeable of PM MPF’s Critical Information List and how to protect it by applying OPSEC measures to prevent inadvertent disclosure.

(3) Maintain need-to-know and communication security.

(4) Limit distribution to those with a need to know.

(5) Do not talk about work in public locations.

(6) Safeguard unclassified technical data (also known as Controlled Unclassified Information).

(7) Be familiar with this OPSEC Plan and where to obtain additional OPSEC guidance as needed.

Matt.Dolecki Typewritten Text 11 Sep 2017

Matt.Dolecki

(8) Handle any attempt by unauthorized personnel to solicit sensitive or critical information as a TARP incident per AR 381-12. Report all facts immediately to the nearest supporting counterintelligence office and inform the chain of command.

4. OPSEC Security Considerations. OPSEC must be considered when preparing policies, procedures, and doctrine, when designing systems, and when prescribing logistic and administrative practices. The OPSEC process applies to all phases of an activity, function, or operation and is used in the development of OPSEC plans. The five fundamental steps in the OPSEC process are:

a. Identification of Critical Information List (CIL). Critical information is information associated with PM MPF operations and activities which, individually or cumulatively, reveal details about capabilities and intentions of planned or ongoing program activities.

If an adversary obtains this information, mission success could be prevented or seriously degraded. (See Appendix 1 for a list of PM MPF CIL).

b. Analysis of Threats. Collection of information concerning PM MPF activities may be conducted by adversaries using various intelligence collection methods. When aggregated, this information can provide an accurate portrayal of friendly intentions or operations. The aim is to neutralize or manipulate the threat. Collection threats are described in the PEO GCS OPSEC Plan; however, for detailed information about specific intelligence threats, the four questions that must be answered in relationship with threat analysis are:

(1) What critical information is already known by the adversary?

(2) What gaps exist in the adversary information base that prevents him/her from deriving critical information?

(3) What intelligence collection assets are available that will enable adversaries to exploit friendly actions?

(4) What are potential OPSEC vulnerabilities?

c. Analysis of Vulnerabilities. Vulnerability analyses identify tentative OPSEC measures required to maintain essential secrecy. The most desirable OPSEC measures combine the highest protection with the least effect on PM MPF operational effectiveness. (See Appendix 2 for a list of potential PM MPF vulnerabilities and OPSEC measures)

d. Assessment of Risk. Because implementation of OPSEC measures usually presents a risk to operational, logistic, or procedural effectiveness, an analysis must be made prior to the decision to implement measures. The PM MPF OPSEC Officer makes recommendations on each measure based on three questions:

(1) What is the risk to operational effectiveness if an OPSEC measure is implemented?

Matt.Dolecki Typewritten Text 11 Sep 2017

Matt.Dolecki

(2) What is the risk to operations and the command mission success if an OPSEC measure is not implemented?

(3) What risk is likely to result if the OPSEC measure fails to be effective?

e. Application of Appropriate OPSEC measures. OPSEC measures are selected based on decisions in the previous steps. OPSEC measures eliminate indicators or the vulnerability of actions to exploitation by an adversary. The OPSEC measures listed in Appendix 2 apply to all PM MPF personnel and will be adhered to at all times. The Project Manager is responsible for approving each OPSEC countermeasure based on the recommendations and answers to the questions listed in paragraph 4.d. OPSEC measures are methods and means used to gain and maintain essential secrecy about critical information. The following categories apply:

(1) Action control. The objective is to eliminate indicators or the vulnerability of actions to exploitation by adversary intelligence systems. Select what actions to undertake; decide whether or not to execute actions and determine the "who", "when", "where", and "how" for actions necessary to accomplish tasks.

(2) Countermeasures. The objective is to disrupt effective adversary information gathering or prevent their recognition of indicators when collected materials are processed. Use diversions, camouflage, concealment, jamming, threats, police powers and force against adversary information gathering and processing capabilities.

(3) Counter-analysis. The objective is to prevent accurate interpretations of indicators during adversary analysis of collected materials. This is done by confusing the adversary analyst through deception techniques such as obfuscation.

f. Conclusion. The PM MPF will continually monitor the OPSEC posture. This will be accomplished by OPSEC assessments and comparing personnel actions to the requirements of this OPSEC Plan. Additionally, the PM MPF OPSEC Officer will remain abreast of the current threat situation by liaison with other intelligence and security elements within the PEO.

5. The point of contact for this OPSEC Plan is Ms. Learline Taylor at 586-282-0330 or learline.taylor.civ@mail.mil.

David J. Dopp, Jr.

Project Lead, Mobile Protected Firepower

Appendices

1. Critical Information List (CIL)

2. Vulnerabilities and OPSEC Measures

Matt.Dolecki Typewritten Text 11 Sep 2017

Matt.Dolecki

PM MPF Operations Security (OPSEC) Plan

Appendix 1 PM MPF Critical Information

Critical information consists of specific facts about friendly intentions, capabilities, and activities vitally needed by adversaries for them to plan and act effectively to guarantee failure or unacceptable consequences for friendly mission accomplishment.

The OPSEC Officer, in conjunction with a working group, develops the organization’s overall critical information list which is then approved by the Project Manager Mobile Protected Firepower (PM MPF). It is the PM’s intent that all organization personnel (military, civilian, and contractors), be aware of the organization’s critical information so that they can better apply OPSEC to their daily tasks.

The Critical Information List (CIL) is as follows:

Critical Information:

MPF system requirements, capabilities, threshold/objective specifications, and performance measures. This would also include future, projected or targeted capabilities.

MPF specific technology development activities relating to milestones, technology readiness, goals, and specifics of technology funding activities.

MPF Program testing information compromising location, date, time and method of transportation for components, vehicles, and/or equipment.

Custom computer software or unique algorithms used in the MPF. This includes Vetronics, Fire Control, VICTORY, Wireless capabilities and limitations, Information Assurance and Crypto requirements. Each Systems Real Time Operating Environment and Computer Language requirements.

MPF information systems; electronics; lasers, optics, command, control, communications, computers, intelligence, surveillance, reconnaissance (C4ISR);

modeling/simulation; and sensors.

Identification of reliability or effectiveness, operational limitations, and vulnerabilities against ballistic, non-ballistic, nuclear, chemical, biological, and electronic warfare disclosing vulnerabilities or limitations of the MPF.

Identification of Critical Program Information (CPI) and Program Protection Plan (PPP) within the MPF and associated critical functions, Program Protection procedures, and anti-tampering implementation methods.

OPSEC Indicators. OPSEC indicators are data derived from openly available information or detectable activities that an adversary can piece together or interpret to reach conclusions or estimates concerning program intentions, capabilities, or activities.

The success of OPSEC depends on knowledge of how we are viewed from an

Matt.Dolecki Typewritten Text 11 Sep 2017

Matt.Dolecki adversarial perspective. If necessary, we must modify our actions, which will in turn, change the perspective of an adversary.

The following list of OPSEC indicators should not be considered all inclusive. However, consideration must be given to how we conduct our daily work routines.

Use of words indicating irregular activity (e.g. Hot, Critical, Rush, Priority, Sensitive).

Unusual security clearance requirements.

Canceling leaves/recalling personnel to organization.

Posting of schedules, orders, flight itineraries, organizational charts, etc.

Discussing personnel, intelligence, operations, logistics, and plans over non-secure and/or non-approved equipment.

Unusual or increased levels of TDY and conferences by senior officials and staff members.

Security clearances annotated on TDY orders.

Conducting rehearsals for special activities.

Coordination with personnel at different locations.

Increased volume and priority of requisitions.

Budget data that provides insight into objectives and scope of the MPF R&D.

Solicitations for contractors to perform portions of the work.

Unique design of the MPF.

MPF information on test and exercise schedules that allows adversaries to better plan tests and exercises through the use of their intelligence collection assets.

List of MPF personnel that handle classified information.

MPF equipment or system hardware itself.

Discussing problems or adverse personnel actions of individuals over non-secure and/or non-approved equipment.

Planning for MPF conferences, symposia, and internal professional forums.

MPF package or container labels that show the name of an operation, program designation and the classification.

Matt.Dolecki Typewritten Text 11 Sep 2017

Matt.Dolecki

PM MPF Operations Security (OPSEC) Plan

Appendix 2 – PM MPF Vulnerabilities and OPSEC Measures

1. Vulnerabilities. Vulnerabilities exist when an adversary can collect OPSEC indicators of critical information, correctly analyze the information, decide on an action, and possesses the capability to execute that action. Their goal is to either prevent mission accomplishment or adversely affect mission success.

The following vulnerabilities were derived by comparing the intelligence collection threat against the PM MPF daily work routine.

a. Failure to use proper e-mail security when transmitting CUI (FOUO, technical data, or Personal Identifiable Information (PII)) or critical information. CUI is susceptible to compromise when e-mailed without the proper security settings activated (must be digitally signed and encrypted).

b. Information left unattended. Program information that is left in a conference room, vehicle, or hotel becomes susceptible to compromise or loss. Information that can be viewed, lost or compromised may provide an adversary with valuable data that would allow them to develop systems to defeat our efforts, vehicles or equipment. In the same respect, PII that is left in a conference room, vehicle or hotel can lead to an individual becoming the victim of identity theft. Examples of PII information that if left unattended could lead to identity theft are: banking information, identification cards, medical paperwork, and personal data that has your social security number.

c. Unauthorized disclosure of test schedules, locations, and purpose allow foreign advocates to target our activities with Human Intelligence (HUMINT), Imagery Intelligence (IMINT), Measurement and Signature Intelligence (MASINT), and Signals Intelligence (SIGINT) resources. A lack of adequate OPSEC considerations during test planning and execution, to include movement of people and vehicles and site preparation, could disclose test objectives, and other classified or unclassified program information.

d. Information disclosed during Industry Days, Symposiums, Meetings, or Professional Conferences must have an OPSEC review. Personnel are susceptible to elicitation and exploitation of information when attending these events by fellow participants or personnel from foreign countries. Personnel may also inadvertently make themselves a target for intelligence agency with a point of contact for future information gathering attempts. Collection efforts may range from innocuous questions to actual blackmail by intelligence agents.

e. Conference Room or Defense Collaboration Services (DCS) Security.

Unauthorized or inadvertent release of PM MPF information to non PM MPF personnel supporting the effort. PM MPF currently operates in a competitive environment and all material should be handled appropriately and protected at the classification level assigned. The host of all DCS meetings and the U.S. Government participants need to be diligent in ensuring that our contractor’s competition of sensitive FOUO information is not compromised. The DCS host will not allow individuals logging in as “guest.” Users

Matt.Dolecki Typewritten Text 11 Sep 2017

Matt.Dolecki must log in as registered users. This will stop guest entering fake names as their log-in and will ensure that users logging in at all times have a need to know.

f. PM MPF CUI information (via the internet, media, meetings, etc.) that has not gone through the public release process is not authorized for public release. Information that is released without authorization may provide valuable information regarding PM MPF equipment and platform capabilities, vulnerabilities, limitations, and requirements.

Such information would allow an adversary to develop systems to defeat our equipment in development.

g. Lack of OPSEC awareness. PM MPF personnel who do not fully realize their OPSEC responsibility in the protection of PM MPF information. Personnel who are not fully aware of the intelligence value of unclassified information and the adversary’s capability to decipher important intelligence data from seemingly non-critical information.

h. Communications/Transmissions: All unsecured telephone conversations (including cellular phones) are vulnerable to monitoring. Such vulnerabilities provide a source of information for intelligence agents. Communications supporting computer systems and faxes are equally vulnerable. Mailing program information is susceptible to interception or loss.

i. Teleconference and passcodes: PM MPF is currently operating in a competitive environment; therefore, all information will be handled in a secure way. Teleconferences are an excellent way to share information, but we must ensure the communication process is done properly. The information discussed in teleconferences should be on a need to know basis and protected by all participating users. In order to keep the information secured, passcodes and/or passwords should not be shared. Additionally, passwords should be changed at least every six months. All teleconference participants must be registered users.

2. OPSEC Measures. OPSEC measures are methods and means used to gain and maintain essential secrecy about critical information. The most desirable OPSEC measures provide needed protection with the least amount of cost and impact on mission effectiveness and efficiency.

All personnel are required to know and employ the following OPSEC measures during their daily work routines. Application of these measures will prevent and/or mitigate the possibility of compromising critical information. Additional OPSEC measures will be developed for crisis activities, or as required.

a. All e-mails containing CUI, FOUO, PII or critical information will be encrypted, moved via AMRDEC SAFE, or posted on the PM MPF Knowledge Center.

b. When PII or PM MPF information is not in use, it should be secured and out of plain view.

Matt.Dolecki Typewritten Text 11 Sep 2017

Matt.Dolecki

c. When testing is involved with the MPF, OPSEC considerations need to be part of the testing process. An approved OPSEC briefing must be given prior to the test being conducted to all authorized personnel participating in the testing.

d. When participating in Industry Day, Symposiums, Meetings, or Professional Conferences, constant OPSEC awareness of potential threat and environment must be considered. Make sure that the facility is cleared (SECRET, Controlled Unclassified Information or Unclassified) for discussions or cleared to handle the information presented. Do not leave CUI or FOUO information unattended. When no longer needed, CUI and FOUO information must be shredded, to make unreadable or turned in to the security support staff for proper destruction. Make sure that you wear your ID badge only during the event. Secure badge from view when leaving the event. Report lost, or stolen badges immediately to the security support staff. Restrict MPF conversations to designated areas (i.e. conference rooms). Report any suspicious activity or contacts to Army Military Intelligence, if activity is off DoD installations, contact the local police, FBI, 902nd or G2, TACOM LCMC.

e. In addition to security training, employees are also provided OCONUS Travel Training. A country-specific OPSEC threat briefing is administered by TACOM LCMC Operations, G3, prior to the employee’s travel to or through foreign countries.

f. Ensure that only authorized personnel associated with the program that have a need to know are only in attendance during a conference or when using DCS. Non PM MPF personnel (i.e. SETA contractors not supporting PM MPF, hotel/conference center staff, other government employees that do not have a need to know, etc.) will not be present in the room or dialed in during the conference session(s). Room set up and catering service will be done prior to the conference start or during breaks. While the conference is in session, all doors will remain closed and entry into the room monitored.

Attendees will refrain from using cell phone while the conference is in session. Laptops and handout materials will be secured from unauthorized viewing during or while not in session.

g. PM MPF information (documents, presentations, photos, videos, etc.) that is intended to be presented outside the PEO GCS, PM MPF and the DoD must be reviewed and approved for release, and marked for appropriate distribution. The public release process will consist of an OPSEC Review that includes review and release by public affairs, legal, contracts, security and technical of the information to be presented to the general public to ensure that the information is current, accurate and appropriate.

Release of non-public information outside PEO GCS, PM MPF or DoD must be submitted for program security review and to validate the receiving entity can protect the information commensurate with DoD, PEO GCS and PM MPF protection measures.

Information that is CUI will not be approved for public release.

h. Visitors to PM MPF facilities are required to process through established checkpoints for verification of identity, citizenship, personnel security clearances, appropriate certification of purpose for visit, and inspection of articles being brought into and out of the facility, before classified or unclassified information can be released.

Matt.Dolecki Typewritten Text 11 Sep 2017

Matt.Dolecki

Visitors to PM MPF facilities or areas will be escorted in accordance with area signage.

Escorts for visitors shall be advised of proper escort procedures, limitations on disclosure, and other applicable controls involved in the visit. Personnel within the area should be made aware of the visitor and reminded to secure CUI information from visitor view. Personnel should also be mindful of the visitor’s presence during telephone conversations. Be aware of custodial and maintenance personnel within the area.

i. Foreign national visitors may not access areas before the Program Security Manager (PSM) and Foreign Disclosure Officer (FDO) have been informed. Prior to a foreign national visit, an e-mail will be sent to all affected personnel notifying them of the pending visit and to implement appropriate OPSEC procedures for the protection of PM MPF information. In some cases, foreign visitors may be in a different part of the building but share common areas with program personnel. OPSEC procedures should be implemented so program information is not discussed in open areas. Foreign visitors are limited to the activities identified on the foreign visit request and must be escorted by a trained escort at all times.

j. Security education will include awareness among MPF personnel concerning the use of communications devices. Discussions of a classified nature via unsecured telephone are absolutely prohibited. For CUI data exchanges outside DoD networks, use only NIST/NIAP compliant solutions. Landline communications for telephone conversations are more secure than cellular and should be utilized whenever available for DoD, PEO GCS or PM MPF CUI discussions. All printed media and faxes will be retrieved immediately.

k. Use the STA Form 7114 to conduct OPSEC reviews and AT/OPSEC Coversheet to conduct contract reviews.

Matt.Dolecki Typewritten Text 11 Sep 2017

Matt.Dolecki