Attachment_0007_AFV_OPSEC_WITH_PEO_PLAN.pdf

DEPARTMENT OF THE ARMY

PROGRAM EXECUTIVE OFFICE

GROUND COMBAT SYSTEMS

6501 E. ELEVEN MILE ROAD

WARREN, MICHIGAN 48397-5000

SFAE-GCS-F 2 October 2014

MEMORANDUM FOR RECORD

SUBJECT: Project Manager Armored Fighting Vehicles (PM AFV) Operations Security (OPSEC) Plan

1. References:

a. PEO GCS OPSEC Plan, 14 February 2013.

b. AR 530-1, Operations Security (OPSEC), 19 April 2007.

c. AR 381-12, Threat Awareness and Reporting Program, 4 October 2010.

2. General. This OPSEC Plan is a supplement to the PEO GCS OPSEC Plan.

a. Applicability. This PM AFV OPSEC Plan is applicable to all personnel (military, civilian, and contractor) working with the PM AFV program. It outlines actions to ensure protection of Program Information from an adversary’s observation and collection. This Plan is appropriately nested and not meant to replace or circumvent the PEO GCS OPSEC Program or Reference 1.a.. OPSEC compliments and reinforces other security program disciplines by eliminating, concealing, or reducing indicators that can compromise critical information. PM AFV will implement the principles outlined in this OPSEC Plan in concert with the other security program disciplines.

b. PM AFV Mission. Develop, acquire, and support the world’s best war machines-allowing American Solders to dominate the battlefield of tomorrow.

c. Purpose. The purpose of this OPSEC Plan is to control sensitive information and to protect operations and activities that, if exploited, could seriously degrade or defeat current or future plans and activities. To eliminate or mitigate the possibility of exploitation, it is imperative that all personnel are knowledgeable of and apply these procedures during the conduct of their daily mission planning tasks and activities.

3. Responsibilities.

a. Project Manager (PM):

(1) Implement an OPSEC program.

(2) Approve an OPSEC Plan specific to the operation of the Project

Management Office (PMO) as a supplement to the PEO OPSEC Plan.

SFAE-GCS-F

SUBJECT: Project Manager Armored Fighting Vehicle (PM AFV) Operations Security

(3) Appoint an OPSEC Officer or Coordinator for the PMO who will perform the requirements of the OPSEC Officer appropriate for the PMO.

(4) Ensure appropriate OPSEC measures are taken within the PMO to preserve essential secrecy.

(5) Plan for and implement OPSEC before, during, and after operations or other activities, including research and development testing and evaluation (RDT&E) that affect the combat capability of the U.S. Army. OPSEC will be part of the PM’s initial planning guidance.

(6) Provide annual reminders of the importance of sound OPSEC practices.

These reminders will include OPSEC news releases in publications, OPSEC information bulletins, and OPSEC awareness briefings.

b. OPSEC Officer:

(1) Direct and implement the OPSEC program.

(2) Plan for and implement OPSEC before, during, and after operations or other activities, including RDT&E that affect the combat capability of the U.S. Army.

(3) Chair the PM AFV-level OPSEC Working Group (OWG) to coordinate OPSEC actions across the PM AFV on a consistent basis.

(4) In conjunction with other staff officers, develop the PM AFV Critical Information List (CIL) or Essential Elements of Friendly Information (EEFI).

(5) Develop and recommend OPSEC measures to be implemented in PM AFV.

(6) Conduct OPSEC reviews of operational plans and reports to ensure adherence to OPSEC policies and procedures.

(7) Conduct OPSEC self-assessment using the published OPSEC guidance to determine whether the PMO is implementing its own OPSEC policies and procedures.

The OPSEC Officer will submits a written assessment with results and recommendations to the assessed PM and PEO OPSEC Officer.

(8) Ensure that training exercises include realistic OPSEC considerations and that any evaluation of a training exercise includes an evaluation of OPSEC procedures.

Further, ensure that pre-exercise briefings include OPSEC, incorporating the threat, CIL/EEFI, and OPSEC measures.

(9) Coordinate with the Public Affairs Officer (PAO) and Freedom of Information Act (FOIA) Officer to ensure an OPSEC review is conducted before the release of information concerning any programs or projects.

(10) Ensure OPSEC training is conducted in accordance with Reference 1.b. and this OPSEC Plan.

(11) Integrate intelligence, counterintelligence, force protection, and Information Operations (IO) into OPSEC planning and practice as appropriate.

(12) Monitor the OPSEC programs of subordinate organizations by reviewing OPSEC Plans, survey results, exercise evaluations, and Inspector General reports.

(13) Conduct an annual OPSEC assessment.

(14) Prepare for PM signature an annual (by Fiscal Year) OPSEC Program Status Report to be submitted to the PEO OPSEC Officer.

(15) Perform other duties and responsibilities as defined in Reference 1.b., Appendix H.

c. All personnel:

(1) Implement OPSEC measures as determined by the PM.

(2) Receive Operations Security Level I training to—

(a) Understand how OPSEC complements traditional security programs to maintain essential secrecy of U.S. military capabilities, intentions, and plans

(b) Learn how to apply OPSEC to their daily tasks

(c) Learn why OPSEC is important to the organization

(d) Understand how adversaries aggressively seek information on U.S.

military capabilities, intentions, and plans

(e) Become knowledgeable of the local multidiscipline adversary intelligence threat

(f) Become knowledgeable of PM AFV’s CIL and how to protect it by applying OPSEC measures to prevent inadvertent disclosure.

(3) Maintain need-to-know and telephone security.

(4) Limit distribution.

(5) Avoid talking about work in public locations.

(6) Safeguard unclassified technical data (also known as Controlled

Unclassified Information [CUI]).

(7) Be familiar with this OPSEC Plan and where to obtain additional OPSEC guidance as needed.

(8) Handle any attempt by unauthorized personnel to solicit sensitive or critical information per Reference 1.c.. Report all facts immediately to the nearest supporting counterintelligence office and inform the chain of command.

4. OPSEC Security Considerations. All personnel will consider OPSEC when preparing policies, procedures, and doctrine; designing systems; or prescribing logistic or administrative practices. The OPSEC process applies to all phases of an activity, function, or operation. The five fundamental steps in the OPSEC process are as follows:

a. Identification of CIL or EEFI. Critical information is information associated with PM AFV operations and activities that, individually or in the aggregate, reveals details about capabilities and intentions of planned or ongoing program activities. If an adversary obtains this information, it could prevent or seriously degrade mission success. Based on the information included EEFI/CIL can be classified or unclassified, though unclassified//FOUO EEFI/CIL preferred to facilitate internal dissemination. EEFI is simply CIL posed in the form of a question. It is imperative to understand that an answer to an EEFI is critical information and will be protected at all times Appendix 1 is the PM AFV CIL/EEFI.

b. Analysis of Threats. Adversaries may conduct collection of information concerning PM AFV activities using various intelligence collection methods. When aggregated, this information can provide an accurate portrayal of friendly intentions or operations. The aim is to neutralize or manipulate the threat. Collection threats are described in the PEO GCS OPSEC Plan; however, for detailed information about specific intelligence threats, the four questions that must be answered in relationship with threat analysis are as follows:

(1) What critical information is already known by the adversary?

(2) What gaps exist in the adversary information base that prevents it from deriving our critical information?

(3) What intelligence collection assets are available that will enable the adversary to exploit friendly actions?

(4) What are our potential OPSEC vulnerabilities?

c. Analysis of Vulnerabilities. This step identifies tentative OPSEC measures required to maintain essential secrecy. The most desirable OPSEC measures combine the highest protection with the least effect on PM AFV operational effectiveness.

Appendix 2 is a list of potential PM AFV vulnerabilities and OPSEC measures.

d. Assessment of Risk. Because implementation of OPSEC measures usually presents a risk to operational, logistic, or procedural effectiveness, the OPSEC Officer will analyze them prior to the implementation decision. The OPSEC Officer makes recommendations on each measure based on the following three questions:

(1) What is the risk to operational effectiveness if this OPSEC measure is implemented?

(2) What is the risk to operations and the command mission success if this OPSEC measure is not implemented?

(3) What risk will result if this OPSEC measure fails to be effective?

d. Application of Appropriate OPSEC Measures. The OPSEC Officer will select OPSEC measures based on the previous steps. OPSEC measures aid in the elimination of indicators or the vulnerability of actions to exploitation by an adversary.

The OPSEC measures in Appendix 2 apply to all PM AFV personnel, and all personnel will adhere to them at all times. The PM will approve each OPSEC measure based on the OPSEC Officer’s recommendations and the answers to the questions in paragraph 4.d. OPSEC measures are methods and means used to gain and maintain essential secrecy about critical information. The following categories apply:

(1) Action Control. The objective is to eliminate indicators or the vulnerability of actions to exploitation by adversary intelligence systems. Select what actions to undertake; decide whether or not to execute actions and determine the who, when, where, and how for actions necessary to accomplish tasks.

(2) Countermeasures. The objective is to disrupt effective adversary information gathering or prevent their recognition of indicators when collected materials are processed. Use diversions, camouflage, concealment, jamming, threats, police powers, and force against adversary information gathering and processing capabilities.

(3) Counter-analysis. The objective is to prevent accurate interpretations of indicators during adversary analysis of collected materials. Confuse the adversary analyst through deception techniques such as covers.

e. Conclusion. PM AFV will continually monitor the OPSEC posture via OPSEC assessments and comparing personnel actions to the requirements of this OPSEC

Plan. Additionally, the OPSEC Officer will remain abreast of the current threat situation by liaison with other intelligence and security elements in the PEO.

5. The point of contact for this OPSEC Plan is Gioacchino (Jack) Ciraulo, commercial

(586) 282-0330.

Encls JAMES W. SCHIRMER

1. CIL/EEFI Colonel, AR

2. Vulnerabilities and OPSEC Project Manager, Measures Armored Fighting Vehicles

PM AFV Operations Security (OPSEC) Plan

Appendix 1: PM AFV Critical Information List or Essential Elements of Friendly Information

Critical information consists of specific facts about friendly intentions, capabilities, and activities vitally needed by adversaries for them to plan and act effectively to guarantee failure or unacceptable consequences for friendly mission accomplishment.

The Operations Security (OPSEC) Officer, in conjunction with a working group, develops the PM AFV Critical Information List (CIL) or Essential Elements of Friendly Information (EEFI) for approval by the Project Manager. It is the PM’s intent that all personnel (military, civilian, and contractors) are aware of this CIL so they can better apply OPSEC to their daily tasks.

The CIL/EEFI is as follows:

Critical Information:

Testing information for the AFV-Programs compromising location, date, time and method of transportation for components, vehicles, and/or equipment.

AFV specific technology development activities relating to milestones, technology readiness, goals, and funding activities.

Specific and projected system vulnerabilities PM AFV is working on enhancing vehicle survivability and sustainability. Be wary of announcing what specific areas on Survivability, Intelligence or Combat Improvements, Electronic Warfare, C4ISR, Mission Command upgrades.

AFV information systems; electronics; lasers, optics, command, control, communications, computers, intelligence, surveillance, reconnaissance (C4ISR);

modeling/simulation; and sensors.

Operational readiness or specific equipment on a vehicle that is causing any operational issues of AFV units deployed or being deployed. If in the future wireless downloading of vehicle data is authorized, download of a single vehicle’s data will be FOUO but download of entire unit’s data could identify a vulnerability or limitation for combat operations.

Photos of or information about vehicles or equipment that have been damaged by Threats. Combat damage photos of any vehicle should not be commented on, noted or discussed in open forum. No discussion of what type of IED Jammers or IED defeat systems being worked on. Any information or threat or threat comments on anything that hits and penetrates our vehicles should not be posted on NIPR or open source.

Specific friendly force technology areas of details, organizational initiatives, and Operational procedures designed to counter IEDs. This includes IED CONOPS, IED

TTPs, IED Counter Devices, Counter IED Capabilities or Limitations, Ongoing Counter IED upgrades.

AFV system requirements, capabilities, threshold/objective specifications, and performance measures. This would also include future, projected or targeted capabilities.

Identification of reliability or effectiveness, operational limitations, and vulnerabilities against ballistic, non-ballistic, nuclear, chemical, biological, and electronic warfare disclosing vulnerabilities and limitation of the AFV.

Custom computer software/unique algorithms used in the AFV. This includes Vetronics, Fire Control, VICTORY, Wireless capabilities and limitations, Information Assurance and Crypto requirements. Each Systems Real Time Operating Environment and Computer Language requirements.

Identification of Critical Program Information (CPI) and Program Protection Plan (PPP) within the AFV and associated critical functions, Program Protection procedures, and anti-tampering implementation methods.

OPSEC Indicators. OPSEC indicators are data derived from openly available information or detectable activities that an adversary can piece together or interpret to reach conclusions or estimates concerning program intentions, capabilities, or activities.

The success of OPSEC depends on knowledge of how we are viewed from an adversary’s perspective. If necessary, we will modify our actions, which will in turn change the perspective of an adversary.

The following list of OPSEC indicators should not be considered all-inclusive.

Budget data that provide insight into objectives and scope of the AFV R&D.

Solicitations for subcontractors to perform portions of the work.

Unique design of the AFV.

AFV information on test and exercise schedules that allows adversaries to better plan tests and exercises through the use of their intelligence collection assets.

AFV testing conducted on the same location.

List of AFV personnel that handle classified information.

AFV equipment or system hardware itself.

Unusual security clearance requirements.

Use of words indicating irregular activity (e.g. Critical, Rush, Priority, Sensitive).

Canceling leaves/recalling personnel to organization.

Posting of schedules, orders, flight itineraries, organizational charts, etc.

Discussing personnel, intelligence, operations, logistics, and plans over non-secure equipment.

Unusual or increased levels of TDY and conferences by senior officials and staff members.

Discussing problems or adverse personnel actions of individuals over non-secure equipment.

Security clearances annotated on TDY orders.

Conducting rehearsals for special activities.

Coordination with personnel at different locations.

Increased volume and priority of requisitions.

Planning for AFV conferences, symposia, and internal professional forums.

AFV rehearsals and drills concerning reactive armor.

AFV package or container labels that show the name of an operation, program designation and the classification.

Appendix 2 – PM AFV Vulnerabilities and OPSEC Measures

1. Vulnerabilities. Vulnerabilities exist when an adversary can collect OPSEC indicators of critical information, correctly analyze the information, decide on an action, and execute the action. Their goal is to either prevent mission accomplishment or adversely affect mission success.

The following vulnerabilities were derived by comparing the intelligence collection threat against the PM AFV daily work routine.

a. Failure to use proper e-mail security when transmitting CUI (FOUO, technical data, or Personal Identifiable Information (PII)) or critical information. CUI is susceptible to compromise when e-mailed without the proper security settings activated (must be digitally signed and Common Access Card (CAC) encrypted).

b. Information left unattended. Program information that is left in a conference room, vehicle, or hotel becomes susceptible to compromise or loss. Information that can be viewed, lost or compromised may provide an adversary with valuable data that would allow them to develop systems to defeat our efforts, vehicles or equipment. In the same respect, PII that is left in a conference room, vehicle or hotel can lead to an individual becoming the victim of identity theft. Examples of PII information that if left unattended could lead to identity theft are: banking information, identification cards, medical paperwork, and personal data that has your social security number.

c. Unauthorized disclosure of test schedules, locations, and purpose allow Foreign advocates to target our activities with HUMINT, IMINT, MASINT, and SIGINT resources. A lack of adequate OPSEC considerations during test planning and execution, to include movement of people and vehicles and site preparation could disclose test objectives, and other classified or unclassified program information.

d. Information disclosed during Industry Days, Symposiums, Meetings, or Professional Conferences must have an OPSEC review. Personnel are susceptible to elicitation and exploitation of information when attending these events by fellow participants or personnel from foreign countries. Personnel may also inadvertently make themselves a target for intelligence agency with a point of contact for future information gathering attempts. Collection efforts may range from innocuous questions to actual blackmail by intelligence agents.

e. Conference Room or Defense Connect on Line (DCO) Security. Unauthorized or inadvertent release of PM AFV information to non PM AFV personnel supporting the effort. PM AFV currently operates in a competitive environment and all material should be handled appropriately and protected at the classification level assigned.

The host of all DCO meetings and the U.S. Government participants need to be diligent in ensuring that our contractor’s completion of sensitive FOUO information is not compromised. The DCO Host will not allow individuals logging in as “guest.”

Users must log in as registered users. This will stop guest entering fake names as their log-in and will ensure that users logging in at all times have a need to know.

f. PM AFV CUI information (via the internet, media, meetings, etc.) that has not gone through the public release process is not authorized for public release. Information that is release without authorization may provide valuable information regarding PM AFV equipment and platform capabilities, vulnerabilities, limitations, and requirements. Such information would allow an adversary to develop systems to defeat our equipment in development.

g. Lack of OPSEC awareness. PM AFV personnel do not fully realize their OPSEC responsibility in the protection of PM AFV information. Personnel are not fully aware of the intelligence value of unclassified information and the adversary’s capability to decipher important intelligence data from seemingly non-critical information.

h. Communications/Transmissions: All unsecured telephone conversations (including cellular phones) are vulnerable to monitoring, and all long distance microwave transmissions are subject to intercept. Such vulnerabilities provide a source of information for intelligence agents. Communications supporting computer systems and faxes are equally vulnerable. Mailing program information is susceptible to interception or loss.

i. Teleconference and passcodes: PM AFV is currently operating in a competitive environment; therefore all information will be handled in a secure way.

Teleconferences are an excellent way to share information, but we must ensure the communication process is done properly. The information discussed in teleconferences should be on a need to know basis and protected by all participating users. Facilitators, in order to keep the information secured do not share passcodes or passwords. Also, change passwords at least every six months. All teleconference participants must be registered users, guest users will not be allowed access to safe guard information.

2. OPSEC Measures. OPSEC measures are methods and means used to gain and maintain essential secrecy relative to the PM’s critical information. The most desirable OPSEC measures provide needed protection with the least amount of cost and impact on mission effectiveness and efficiency.

All personnel should know and employ the following OPSEC measures during their daily work routines. Application of these measures will prevent or mitigate the possibility of compromising critical information. The OPSEC Officer will develop additional OPSEC measures for crisis activities or as required.

a. All e-mails containing CUI, FOUO, PII or critical information will be encrypted or posted on the PM AFV Knowledge Center, PM AFV Information Data Environment or AKO.

b. When PII or PM AFV information is not in use, it should be secured and out of plain view.

c. When testing is involved with the AFV, OPSEC considerations need to be part of the testing process. An approved OPSEC briefing must be given prior to the test being conducted to all authorized personnel participating in the testing.

d. When participating in Industry Day, Symposiums, Meetings, or Professional Conferences, constant OPSEC awareness of potential threat and environment must be considered. Make sure that the facility is cleared (SECRET, Controlled Unclassified Information or Unclassified) for discussions or cleared to handle the information presented. Do not leave CUI or FOUO information unattended. When no longer needed, CUI, FOUO information must be shredded, to make unreadable or turned in to the security support staff for proper destruction. Make sure that you wear your ID badge only during the event. Secure badge from view when leaving the event. Report lost, or stolen badges immediately to the security support staff.

Restrict AFV conversations to designated areas (i.e. conference rooms). Report any suspicious activity or contacts to Army Military Intelligence, if activity is off DoD installations contact the local police, FBI, 902nd or G2, TACOM LCMC.

e. In addition to security training, employees are also provided OCONUS Travel Training. This training is administered prior to the employee’s travel to or through foreign countries. If available, receive an OPSEC threat briefing from G2, TACOM LCMC or the local Army Military Intelligence servicing that particular region prior to the activity.

f. Ensure that only authorized personnel associated with the program that have a need to know are only in attendance during a conference or when using DCO. Non PM AFV personnel (i.e. SETA contractors not supporting PM AFV, hotel/conference center staff, other government employees that do not have a need to know, etc.) will not be present in the room or dialed in during the conference session(s). Room set up and catering service will be done prior to the conference start or during breaks.

While the conference is in session, all doors will remain closed and entry into the room monitored. Attendees will refrain from using cell phone while the conference is in session. Laptops and handout materials will be secured from unauthorized viewing during or while not in session.

g. PM AFV information (documents, presentations, photos, videos, etc.) that is intended to be presented outside the PEO GCS, PM AFV and the DoD must be submitted and approved for public release. The public release process will consist of an OPSEC Review and technical review of the information to be presented to the general public to ensure that the information is current and accurate. Release of information outside PEO GCS, PM AFV or DoD must be submitted for OPSEC review and to validate the receiving entity can protect the information commensurate with DoD, PEO GCS and PM AFV protection measures. Information that is CUI will not be approved for public release.

h. Visitors to PM AFV facilities are required to process through established checkpoints for verification of identity, citizenship, personnel security clearances, appropriate certification of purpose of visit, and inspection of articles being brought into and out of the facility, before classified or unclassified information will be released. Visitors to PM AFV facilities or areas will be escorted at all times. Escorts for visitors shall be advised of proper escort procedures, limitations on disclosure, and other applicable controls involved in the visit. Personnel within the area should be made aware of the visitor and reminded to secure CUI information from visitor view. Personnel should also be mindful of the visitor’s presence during telephone conversations. Be aware of custodial and maintenance personnel within the area.

Foreign national visitors may not access areas before the security representative and export focal have been informed. Prior to a foreign national visit, an e-mail will be sent to all personnel notifying them of the pending visit and to implement appropriate OPSEC procedures for the protection of PM AFV information. In some cases foreign visitors may be in a different part of the building but share common areas with program personnel. OPSEC procedures should be implemented so program information is not discussed in open areas. Foreign visitors are limited to the restrictions identified on the foreign visit request and must be escorted by a trained escort at all times.

i. Security education will include awareness among AFV personnel concerning the use of communications devices. Discussions of a classified nature via unsecured telephone are absolutely prohibited. For CUI data exchanges outside DoD networks, use only NIST/NIAP compliant solutions. Landline communications for telephone conversations are more secure than cellular and should be utilized whenever available for DoD, PEO GCS or PM AFV CUI discussions. All printed media and faxes will be retrieved immediately.

j. Use the STA Form 7114 to conduct OPSEC reviews and AT/OPSEC Coversheet to conduct contract reviews.

Program Executive Office

Ground Combat Systems (PEO GCS) Operations Security (OPSEC) Plan

14 March 2013

PREPARED BY: Security Office, PEO GCS, SFAE-GCS-CIO/ms 505, 6501 East Eleven Mile Road, Warren, MI 48397-5000

OPERATIONS SECURITY (OPSEC) PLAN

VERSION 1.0

14 MARCH 2013

SUBMITTED BY

NANCY CHAPLIN

Senior Security Officer

APPROVAL

SCOTT J. DAVIS

Program Executive Officer, Ground Combat Systems

PEO GCS OPSEC P lan

Version 1.0 14 March 2013

Change History

OPSEC Plan Control Information

Document ID:

GCS_ OPSEC_Plan

Document Owner:

Security Officer

Document Approver:

PEO

Date Effective:

20130314

Version:

1.0

Retention Period:

Review Annual

Archive Location:

PEO GCS Portal

The following Change History log contains a record of changes made to this document:

Published / Revised Date

Version

Author (optional)

Section / Nature of Change

03/14/2013 1.0 Chaplin, Nancy Initial i

Table of Contents

PEO GCS Mission Statement

Assignment of OPSEC Responsibilities OPSEC Definition

OPSEC Concept

OPSEC Compromise

Penalties

Limits on Secrecy

Individual Responsibilities

Program Executive Officer (PEO)

Senior Security Officer

OPSEC Officer

Public Affairs Officer (PAO)

PEO Webmaster

Project Managers (PM)

Assistant Program Executive Officers

All personnel

OPSEC Considerations

Critical Information

OPSEC Measures OPSEC Awareness

Administrative/Personnel

Waste Disposal

Conferences/Symposia

Conference Room Security

Unsolicited Requests for Information

Compromising Emanations

Communications Security

Computer Security

Employee Travel

Shipment of Sensitive Materials

Public Release

Web site OPSEC Reviews

Employee Disaffection

Document Markings

Protection Measures for CUI

Visitor Control

Escorts for Foreign Visitors

Contractor and Subcontract Requirements

Annex A – The Intelligence Collection Threat Foreign Intelligence Service Threat

Terrorist Threat

Insider Threat

Criminal Threat (Outsider)

Environmental Threat ii

Military Threat

Human Intelligence (HUMINT)

Signals Intelligence (SIGINT)

Measurement and Signatures Intelligence (MASINT)

Imagery Intelligence (IMINT)

Open Source Intelligence (OSINT)

Computer Intrusion for Collection Operations

Terrorism

Technology Transfer

Professional Conferences/Symposiums

Personnel Disaffection

Annex B – Vulnerability Assessment Information Security Vulnerabilities

Operations Security Vulnerabilities

Physical Security Vulnerabilities

Information System (IS) Vulnerabilities

Annex C – PEO OPSEC Program Matrix

Annex D – OPSEC Checklist

Annex E – Terms

Annex F – References

PEO GCS Mission Statement

Execute life cycle management of the world’s best ground combat systems in a collaborative learning environment by developing, acquiring, and supporting modernized and affordable systems with common integrated capabilities, always focusing on the needs of the Joint Warfighter.

Assignment of OPSEC Responsibilities

This publication specifically addresses the common features of a functional, active and documented Operations Security (OPSEC) program. This publication assigns OPSEC responsibilities and requirements within the Program Executive Office, Ground Combat Systems (PEO GCS) to plan for and implement OPSEC; a systematic approach to developing necessary OPSEC measures; implementation of OPSEC training;

requirements for the review of OPSEC measures and reporting; and cross-command and interagency support to the PEO GCS OPSEC program, which includes reviews, assessments, and survey training. It is designed to provide a basic understanding of OPSEC functions and how to apply them within PEO GCS. Each Project Management Office (PMO) of the PEO may require a unique approach to OPSEC depending on the PMO function. Each PMO will write an OPSEC Plan to address considerations not addressed in this PEO Plan. The basic concepts set forth herein are essentially the same for every organizational element of the PEO. OPSEC is applicable to all aspects of work, from daily routine planning through testing, exercise, and evaluation phases to force deployment, recovery, and reconstitution.

PEO OPSEC Officer: Nancy Chaplin, 586-282-9648

This OPSEC Plan documents the policies and procedures needed to meet the specific OPSEC program requirements of PEO GCS and to support the OPSEC programs of higher echelons.

The overall purpose of OPSEC is to strengthen our traditional security procedures by identifying existing vulnerabilities or weaknesses and applying measures to protect sensitive technologies. The goal is to deny our adversaries access to any critical information. Critical information includes technologies and information desired by an adversary that is sensitive and the disclosure of which could seriously impact our programs. Technology or information does not have to be classified to be of value to an adversary. An adversary can learn a lot about our programs by piecing together obtainable unclassified information. Therefore, in our attempts to shield our activities, it is not only important to follow normal security practices but also to implement OPSEC measures. This OPSEC Plan will discuss the five-step process:

1. Identifying Critical Information

2. Analysis of Threats

3. Analysis of Vulnerabilities

4. Assessment of Risks

5. Application of OPSEC Measures.

OPSEC applies to all organizations within PEO GCS. All information identified as critical information will be reviewed for OPSEC before being released to Government agencies outside PEO GCS. All information, regardless of whether it is critical, will be reviewed for OPSEC before its release to the public in any manner.

OPSEC Definition

OPSEC is a process of identifying critical information and subsequently analyzing friendly actions attendant to military operations and other activities to—

1. Identify actions that can be observed by adversary intelligence systems.

2. Determine indicators that hostile intelligence systems can obtain that could be interpreted or pieced together to derive critical information in time to be useful to adversaries.

3. Select and execute measures that eliminate or reduce to an acceptable level the vulnerabilities of friendly actions to adversary exploitation.

OPSEC Concept

Many activities normal to daily functioning will convey information and indicators to adversaries in spite of routine security measures (personnel, physical, document, cryptographic, computer) to protect classified information. Information available from detectable friendly activities, when combined with other information held by an adversary will, in unknown ways, shape the adversary's appreciations and perceptions of friendly intentions, military capabilities, actions, and possible weaknesses, all of which will provide answers to adversary intelligence questions. During classified or sensitive unclassified undertakings (e.g., operations, exercises, field tests of military systems), acting routinely can result in adversaries gaining harmful appreciations by piecing together observable critical indicators.

Intelligence systems function worldwide. Even if PEO GCS is vigilant, other organizations that provide support may conduct activities that convey pertinent PEO GCS information or indicators of intentions, capabilities, limitations, and vulnerabilities.

Therefore, planning for primary and supporting operations and other activities (e.g., a test administered by the Army Test and Evaluation Command [ATEC]) must include systematic examination to determine potential disclosures that would cause cancellation or failure of the primary undertaking. Subsequently, one must plan and execute protective measures that permit operations and activities to proceed effectively while preserving requisite essential secrecy. OPSEC is the process designed to do this.

An OPSEC vulnerability exists when an adversary can collect indicators of critical information, process the information, and react in a way harmful to the United States.

The most serious problem facing PEO GCS in this respect is that critical information collected by an adversary today may allow the adversary to develop a technological advantage in the future. Collection capabilities used to obtain information from accessible activities generally depend on some form of target cooperation. For example, throwing any information in the trash allows it to be retrieved by an adversary who will gain information about our activities, and releasing information into the public domain allows the adversary to obtain useable information at no risk to their assets. The detection of predictable actions depends on our acting in stereotyped ways. Thus, if proper OPSEC measures are applied, it is often possible to eliminate or control many detectable indicators of critical information about our intentions, capabilities, limitations, and activities. Remember; trash cans are for non-informational items only (e.g., food waste, wrappers). All unclassified informational material will be placed in the secure shred boxes located throughout PEO GCS facilities.

The key objective of OPSEC is to ensure mission effectiveness. Some protective measures to eliminate information conveyed by an activity may unacceptably reduce effectiveness. For example, telemetry and communications are often needed in tests;

and personnel, equipment, and material movements are unavoidable in the execution of operations and other activities. In these instances, it may be possible to deny information by acting against the collectors or analysts, rather than stopping the actions.

Denial actions include the use of jamming, obscurants, weather, camouflage, environmental conditions, covers, or military deception (MD) to influence adversary perceptions and conclusions (e.g., cover operations to explain observable activities, diversions to draw collection and analytical interest elsewhere, creating conditioning to cause activities to be ignored, multiple impressions to confuse interpretation of information). In Joint operations, OPSEC is an element of command and control warfare (C2W). Countering the adversary command and control (C2), and protecting friendly C2 are functions of OPSEC.

Planning for secrecy must extend beyond exposure of raw information and consider possible assumptions and estimates made by an adversary. Logical conclusions based on generally available information, trend analysis based on historical data or technical possibilities, and broad experience of adversary planners and decision makers must be factored in to planning. Military deception may be required to mislead adversary analysts to maintain essential secrecy.

The following are examples of unclassified information that could alert an adversary to the existence of a classified project, existence or application of advanced technology, or a new tactic or technique unknown to adversaries:

Unclassified agreements between government agencies or their association in a project or operation that outlines methods, procedures, and current U.S.

Government intentions or future objectives.

Special or unique requests providing special instructions that could reveal capabilities or the technology of a new weapon system.

Public relations release describing aspects of technological or operational cooperation between the U.S. and other nations.

Announcements of formation of specialized groups, special elements, or organizations, which could signal special intentions, activities, or capabilities.

Consolidated budget execution for specific projects, testing of items or tactics, and monies spent that are intended for future acquisition.

OPSEC Compromise

An OPSEC compromise is the disclosure of critical or sensitive information that jeopardizes PEO GCS’s ability to execute its mission or to adequately protect its personnel or equipment. Good OPSEC practices can prevent these compromises and allow us to maintain essential secrecy about our operations.

Critical or sensitive information that has been compromised and is available in open sources and the public domain should not be highlighted or referenced publicly outside of intragovernmental or authorized official communications, because these actions provide further unnecessary exposure of the compromised information. Report any known or suspected OPSEC compromise to the PEO Security Office immediately.

Penalties

Failure to comply with these orders, directives, or policies may be punished as violations of a lawful order under Article 92 of the Uniform Code of Military Justice (UCMJ) or under other disciplinary, administrative, or other actions as applicable.

Personnel not subject to the UCMJ who fail to protect critical and sensitive information from unauthorized disclosure may be subject to administrative, disciplinary, contractual, or criminal action.

Limits on Secrecy

Take care in determining the required degree of secrecy for undertakings. Too much secrecy can harm effectiveness; too little can result in mission or system failure. Broad factors to consider include the following:

Adversaries must have some knowledge of friendly capabilities and intentions so they will perceive threats.

The public must have some knowledge of military capabilities to foster recruitment of required personnel, gain internal political support, ensure understanding of defense budgeting requests, and support defense alliances.

The U.S. must rigorously test systems, procedures, doctrine, and tactics in realistic environments.

Planners must thoroughly understand activities to realize optimal coordination and effectiveness of their undertakings.

http://www.au.af.mil/au/awc/awcgate/ucmj.htm

Individual Responsibilities

Every individual is ultimately responsible for the security of the information to which he or she has access. Each piece of information that an adversary can get access to fills in one more piece of the puzzle as it relates to our overall plan of action.

Program Executive Officer

Issue orders, directives, and policies to protect PEO GCS critical and sensitive information to clearly define the specific OPSEC measures that all PEO personnel should practice.

Ensure that the OPSEC program and OPSEC measures are coordinated and synchronized with security programs, e.g., information security (INFOSEC), information assurance (IA), physical security, and force protection.

Ensure that all official information released to the public, to include information released on the World Wide Web, receives an OPSEC review prior to dissemination.

Establish a documented OPSEC program that includes as a minimum, OPSEC Officer appointment orders and an OPSEC Plan.

Appoint an OPSEC officer in writing with responsibility for supervising the execution of proper OPSEC within the organization.

Ensure that the appointed OPSEC Officer is of appropriate grade or rank, and receives appropriate training in accordance with (IAW) Army Regulation (AR) 530-1, Operations Security (OPSEC), 19 April 2007.

Approve the PEO GCS Critical Information List (CIL) and circulate it to all subordinates as widely as security permits.

Provide guidance and direction to ensure that each subordinate organization understands, adapts, and applies the CIL to its mission and provides feedback.

Weigh the risk in the mission against the costs of protection and decide what OPSEC measures to implement; and publish such measures in the OPSEC Plan.

Senior Security Officer

Serve as the principal staff officer for overall management of the security and OPSEC program. The Senior Security Officer is the proponent for OPSEC, but the entire organization will integrate OPSEC into planning and execution of the organization’s activities.

Ensure the integration and synchronization of the OPSEC program with the OPSEC program of the Assistant Secretary of the Army for Acquisition, Logistics, and Technology (ASA(ALT)).

OPSEC Officer

Direct and implement the OPSEC program.

https://armypubs.us.army.mil/epubs/dr_pubs/DR_c/pdf/r530_1.pdf

Plan for and implement OPSEC before, during, and after operations and other activities, including RDT&E that affect the combat capability of the Army; ensure that OPSEC is part of the PEO’s initial planning guidance.

Chair the PEO-level OPSEC Working Group (OWG) to coordinate OPSEC actions across PEO GCS on a consistent basis.

Develop the PEO’s CIL in conjunction with other staff officers.

Develop and recommend OPSEC measures to be implemented within PEO

GCS.

Conduct OPSEC reviews of operational plans and reports to ensure adherence to OPSEC policies and procedures.

Conduct OPSEC assessments, in writing, of PMOs using the published OPSEC guidance to determine whether the PMO is implementing PEO-directed and their own OPSEC policies and procedures; recommend corrective actions as necessary.

Ensure that training exercises include realistic OPSEC considerations and that evaluation of training exercises includes evaluation of OPSEC procedures.

Further, ensure that pre-exercise OPSEC briefings incorporate the threat, CIL, and OPSEC measures.

Coordinate with the Public Affairs and Freedom of Information Act (FOIA) Officers to ensure that information concerning PEO GCS programs and projects is reviewed for OPSEC before being released.

Ensure that all OPSEC training is IAW AR 530-1 and this OPSEC Plan.

Integrate intelligence, counterintelligence, force protection, and Information Operations (IO) into OPSEC planning and practice.

Monitor the OPSEC programs of subordinate organizations by reviewing OPSEC Plans, survey results, exercise evaluations, and Inspector General reports.

Conduct an annual OPSEC assessment.

Prepare for the PEO’s signature the annual (by Fiscal Year) OPSEC Program Status Report to be submitted to the Army OPSEC Support Element (OSE).

Perform other duties and responsibilities as defined in AR 530-1, Appendix H.

Public Affairs Officer

Comply with Federal, Department of Defense (DoD), and Department of the Army (DA) website administration policies and implementing content-approval procedures that include OPSEC.

Consider OPSEC in preparation of all public releases of official information.

Coordinate with the OPSEC Officer before updating or posting information on all Web sites, IAW AR 25-2, Information Assurance, Rapid Action Revision (RAR) 001, 23 March 2009, paragraph 4-20.g.(11).

Ensure that in addition to the OPSEC Officer, the webmaster and other appropriate designees (e.g., command counsel, force protection, intelligence) have properly cleared information prior to posting to the web, unclassified intranet, or to Army Knowledge Online (AKO) areas accessible to all account types.

https://armypubs.us.army.mil/epubs/dr_pubs/DR_c/pdf/r530_1.pdf https://akocomm.us.army.mil/usapa/epubs/DR_pubs/DR_c/r530_1.pdf http://www.apd.army.mil/pdffiles/r25_2.pdf

Coordinate directly with the OPSEC Officer on all questionable releases and for additional guidance on any release, IAW AR 530-1, paragraph 2-3.a.(15).

Ensure that all military, civilian, or contractor personnel who post or maintain information (e.g., documents, spreadsheets) in the public domain for official PEO GCS purposes (also including OPSEC Officers and PAO personnel) complete “Social Media and Operations Security” training at Information Assurance Training Center or DISA’s Social Network Course; or such similar courses that may be required in the future

Ensure that all PEO personnel are aware of and support the OPSEC program, including OPSEC reviews IAW AR 530-1.

Consider OPSEC in all public affairs planning and execution procedures in support of antiterrorism (AT) efforts IAW AR 525-13, Antiterrorism, 11 September 2008, Appendix D.

Provide unclassified information about the Army and its activities to the public with maximum disclosure and minimum delay. Do not release information that would adversely affect national security, threaten the personal safety, or invade the privacy of members of the Armed Forces, IAW AR 360-1, The Army Public Affairs Program, 25 May 2011, paragraph 2-3.d.(5).

Webmaster

Comply with Federal, DoD, and DA website administration policies and implement content-approval procedures that include OPSEC and PAO reviews before updating or posting information on all websites IAW AR 25-2, paragraph 4-20,g.(11).

Conduct annual OPSEC reviews of all organizational websites and provide these results to the OPSEC Officer for inclusion in the annual OPSEC report IAW AR 25-2, paragraph 4-20.g. (15).

Coordinate directly with the OPSEC Officer for additional guidance on any questionable website posting.

Take the Social Media and Operations Security training course at Information Assurance Training Center or DISA’s Social Network Course.

Program Managers

Implement an OPSEC program.

Approve an OPSEC Plan specific to the operation of the PMO as a supplement to the PEO GCS OPSEC Plan.

Appoint an OPSEC Officer or Coordinator to perform those requirements of the OPSEC Officer that are appropriate for the PMO.

Ensure appropriate OPSEC measures are taken within the PMO to preserve essential secrecy.

Plan for and implement OPSEC before, during, and after operations and other activities, including RDT&E that affect the combat capability of the Army; ensure that OPSEC is part of the PM’s initial planning guidance.

https://armypubs.us.army.mil/epubs/dr_pubs/DR_c/pdf/r530_1.pdf https://ia.signal.army.mil/sms.asp https://ia.signal.army.mil/sms.asp http://iase.disa.mil/eta/sns_v1/sn/launchpage.htm https://armypubs.us.army.mil/epubs/dr_pubs/DR_c/pdf/r530_1.pdf https://armypubs.us.army.mil/epubs/dr_pubs/dr_b/pdf/r525_13.pdf http://www.apd.army.mil/jw2/xmldemo/R360_1/head.asp http://www.apd.army.mil/pdffiles/r25_2.pdf http://www.apd.army.mil/pdffiles/r25_2.pdf http://www.apd.army.mil/pdffiles/r25_2.pdf https://ia.signal.army.mil/sms.asp https://ia.signal.army.mil/sms.asp http://iase.disa.mil/eta/sns_v1/sn/launchpage.htm

Provide annual reminders of the importance of sound OPSEC practices, including but not limited to OPSEC news releases in publications, OPSEC information bulletins, and OPSEC awareness briefings.

Assistant Program Executive Officers

Ensure appropriate OPSEC measures are taken within the staff or section to provide maximum protection of all functions and activities.

Assist the OPSEC Officer with integrating OPSEC into all organizational activities.

All Personnel

Implement OPSEC measures as determined by the PEO.

Receive Operations Security Level I training IAW AR 530-1, Chapter 4, to— o Understand how OPSEC complements traditional security programs to maintain essential secrecy of U.S. military capabilities, intentions, and plans.

o Learn how to apply OPSEC to daily tasks.

o Learn why OPSEC is important to the organization.

o Understand how adversaries aggressively seek information on U.S.

military capabilities, intentions, and plans.

o Become knowledgeable of the local multidiscipline adversary intelligence threat.

o Become knowledgeable of PEO GCS critical information and how to protect it by applying OPSEC measures to prevent inadvertent disclosure.

Maintain need-to-know and telephone security.

Limit distribution.

Avoid talking about work in public locations.

Safeguard unclassified technical data…