Replies

An Operational Security (OPSEC) Primer
By the U.S. Department of Energy

"Even minutiae should have a place in our collection, for things of a seemingly trifling nature, when enjoined with others of a more serious cast, may lead to valuable conclusion."

— George Washington, known OPSEC practitioner

What is Operational Security (OPSEC)?

The Intelligence Puzzle

Intelligence collection and analysis is very much like assembling a picture puzzle. Intelligence collectors are fully aware of the importance of obtaining small bits of information (or "pieces" of a puzzle) from many sources and assembling them to form the overall picture.

Intelligence collectors use numerous methods and sources to develop pieces of the intelligence puzzle . . .their collection methods range from sophisticated surveillance using highly technical electronic methods to simple visual observation of activities (these activities are referred to as "indicators").

Information may be collected by monitoring radio and telephone conversations, analyzing telephone directories, financial or purchasing documents, position or "job" announcements, travel documents, blueprints or drawings, distribution lists, shipping and receiving documents, even personal information or items found in the unclassified trash.

The Premise of OPSEC

The premise of OPSEC is that the accumulation of one or more elements of sensitive/unclassified information or data could damage national security by revealing classified information.

The Goal of OPSEC

The goal of OPSEC, as a "countermeasures" program, is to deny an adversary pieces of the intelligence puzzle.

ORIGIN OF OPSEC

There is nothing new about the principles underlying OPSEC. In fact, we can trace OPSEC practices back to the colonial days and the Revolutionary War. George Washington, our first president, was a known OPSEC practitioner. General Washington was quoted as saying, "Even minutiae should have a place in our collection, for things of a seemingly trifling nature, when enjoined with others of a more serious cast, may lead to valuable conclusion."

However, OPSEC, as a methodology, originated during the Vietnam conflict when a small group of individuals were assigned the mission of finding out how the enemy was obtaining advance information on certain combat operations in Southeast Asia. This team was established by the Commander-in-Chief, Pacific, and given the code name "PURPLE DRAGON."

It became apparent to the team that although traditional security and intelligence countermeasures programs existed, reliance solely upon them was insufficient to deny critical information to the enemy--especially information and indicators relating to intentions and capabilities. The group conceived and developed the methodology of analyzing U.S. operations from an adversarial viewpoint to find out how the information was obtained.

The team then recommended corrective actions to local commanders. They were successful in what they did, and to name what they had done, they coined the term "operations security."

OPSEC and Government Activities

Over the years it became increasingly apparent that OPSEC had uses in virtually every government program that needed to protect information to ensure program effectiveness. OPSEC professionals modified and improved techniques based on experience gained with many different organizations and in areas far afield from military combat operations.
Today, OPSEC is as equally applicable to an administrative or research and development activity as it is to a combat operation. If OPSEC is not integrated into sensitive and classified activities, chances are that our adversaries will acquire significant information about our capabilities and limitations.
It probably would have been difficult for the "Purple Dragon" team to foresee that, 20 years later, the methodology they developed would become a national program.

OPSEC AT HOME

You have probably been practicing OPSEC in your personal life without knowing it! When you are getting ready to go on a trip have you ever:

Stopped the delivery of the newspaper so that they would not pile up outside and send a signal that you are not home?

Asked your neighbor to pick up your mail so the mailbox would not fill up, also indicating that you are away?

Connected your porch lights and inside lights to a timer so they would go on at preset times to make it look like someone is home?

Left a vehicle parked in the driveway?

Connected a radio to a timer so that it comes on at various times to make it sound like that someone is inside?

Well, guess what you did? You practiced OPSEC!

The critical information here is obvious - we do not want anyone to know the house is unoccupied. None of the actions (countermeasures) listed above directly conceal the fact that your residence is unoccupied. A newspaper on the lawn or driveway does not necessarily mean no one is at home. Newspapers in the yard or driveway are only an indicator to the adversary. That indicator, combined with other indicators, (no internal lights at night, mail stuffed in the mailbox, etc.) will provide the adversary with the information needed to reach a conclusion with an acceptable level of confidence. In this case, the more indicators that the adversary is able to observe, the greater the level of confidence in his/her conclusion. When you eliminate these indicators, you have a much better chance of ensuring that your home is not burglarized while you are away.

The same holds true at your place of work. We must protect our critical information and eliminate indicators available to the adversary.