Operations Security (OPSEC) At A Crossroads: Part II      

by Jack Emanuelson   

When formal OPSEC developed during the Vietnam War (see Operations

Security [OPSEC] At A Crossroads: Part I, in the February issue of The Risk Communicator), the practice was confined primarily to the military and national security environment. But it wasn't long before others, including law enforcement and private industry, found that the OPSEC concept was useful to them as well, and the practice has since proven valuable to organizations and individuals far beyond those with complex security requirements.

Even at the national security level, for instance, OPSEC policy as described in NSDD 298[i] limited its scope to U.S. government national security activities, capabilities or intentions. These national level interests have always included such activities as State Department treaty and economic negotiations. However, events in the recent past necessitate expanding the scope of the National OPSEC Program to encompass, at a minimum, the terrorist threat, security of the nation's borders, protection of national critical infrastructures and the war on drugs.   

Likewise, while the United States' National OPSEC Program has been expanding, the risks to private-sector assets have also increased. An organization involved in research or production of goods and services must recognize its adversaries and the critical information they seek. This is especially true in today's global economy. The quality of private sector intelligence gathering is increasingly professional and robust, and is often directly supported by a country's formal intelligence service.

A crossroads offers two or more routes to take, and in the case of OPSEC one approaches it from the well-worn path of traditional OPSEC, using the five-step risk management process: 1. Identification of the asset to be protected; 2. Analysis of the threat in terms of the opponent's intent and capabilities; 3. A search for vulnerable information that could lead the adversary to piece together or infer critical information through open sources and observation; 4. Leadership analysis of the acceptable level of risk and, if necessary, approval of OPSEC measures to lower risk; and 5. Implementation of the approved OPSEC measures and continuous monitoring of all risk components to detect change and respond accordingly.   

The issue is not whether to expand the use of OPSEC. That is a given. Rather, the question is whether to use OPSEC as a systematic risk management tool to support decision-makers or to let it morph into something else. Some would create a new definition of OPSEC that covers all activities associated with security (i.e., physical, virtual, personal, organizational or anything else that might provide protection of an asset). This proposed new version of OPSEC would not be the highly focused process that has only one purpose: To identify critical information and limit the adversary's capability to deduce the critical information from open sources or observation.   

Where did this idea of a modified OPSEC come from? The answer begins with a quick look at NSDD 298, in particular with the introduction of the term "sensitive." The directive states:

"Each Executive department and agency assigned or supporting national security missions with classified or sensitive activities shall establish a formal OPSEC program..."[ii]

There is no definition of "sensitive" given in the policy. Therefore, if an organization has anything to do with national security and has any sensitive activities, it must have an OPSEC program. A sensitive activity might be interpreted as any function involving sensitive information, such as processing payroll information with names, social security numbers and salaries. While protections of this information may be warranted, there is no need to employ the OPSEC risk management process -- following established laws, regulations and procedures to protect the easily identifiable sensitive information should be sufficient.

The second issue with NSDD 298 is that parts of the policy are often taken separately and totally out of context. The classic example of this is the wording at the very end of the OPSEC process description:

"OPSEC thus is a systematic and proved process by which the U.S. Government and its supporting contractors can deny to potential adversaries information about capabilities and intentions by identifying, controlling and protecting generally unclassified evidence of the planning and execution of sensitive Government activities."[iii]

The above wording does not refer to the previous portions of the directive that note that OPSEC protects classified activity and helps prevent the inadvertent compromise of classified U.S. government activities, capabilities or intentions. This is a crucial element of the proposed changes. One often hears planners say, "OPSEC has nothing to do with classified information." The phrase emanates from people not reading the basic NSDD policy and understanding what critical information is. While critical information may be either classified or otherwise sensitive, it must meet the criterion of being the core information that an adversary needs to defeat or gain an advantage over the organization. Just because information has been declared "For Official Use Only" does not mean that it is critical information worthy of an OPSEC analysis.

The meaning of OPSEC is acquired knowledge, and for many their understanding is based on little more than hearsay. Most current members of government and private sector leadership have never had an exposure to the OPSEC risk management methodology or practical involvement in the process. When OPSEC enters their milieu, they are given some version of the above out-of-context description of OPSEC and are expected to understand the concept in its entirety. As a result of this continued misunderstanding, there stands a good chance that the OPSEC risk management process may be damaged by a future revision to National OPSEC Policy, based on misconceptions about OPSEC risk management, and be supplanted by what have in the past been nothing more than good security practices. The two, OPSEC and security, must function in concert but remain distinct operations.

There is no easy answer to this problem. The OPSEC risk management process obviously needs to continue as an essential element of risk decision-making. But what of all the other issues that the "new" OPSEC is supposed to cover? If only there was a term to describe the collective security afforded an operations or activity. It could be "operational security," but this would not clear the air (i.e., the two terms are too similar and the acronym for operational security would also be labeled OPSEC). One possibility is to stick with "security" to describe the collective protection given an operation or activity. When the application of the OPSEC risk management process is determined to be essential to overall security, OPSEC becomes a contributing factor.

At a minimum, the solution to the crossroads issue must contain the provision that, when using the term OPSEC, it only be applied to critical information identified through the risk management process. As stated by the U.S. Marine Corps: "Without understanding the critical information which should be protected, there can be no specific determination that OPSEC vulnerabilities [i.e., exploitable indicators that may lead to the critical information] exist."[iv]

Jack Emanuelson is an independent contractor specializing in OPSEC and information assurance. He earned his BS in Business Administration from the American University and an MBA from George Washington University, and is a graduate of the U.S. Army Command & General Staff College. He previously occupied the David G. Boak Operations Security Chair at the National Cryptologic School. Jack is retired from the U.S. Civil Service and is a Lieutenant Colonel, AUS (Ret).

SARMA continues to support the needs of the security community by providing added value and keeping our membership rates as low as possible. In particular, we support federal, state and local government employees with a reasonable Government Member rate, and seek to encourage the education of students in the security analysis field by keeping the Student Member rate at an affordable level.

New in 2012, the enhanced SARMA membership program includes the following: 

• Welcome letter and personalized membership certificate

• 10% discount on all event registrations

• An expanded event schedule
• Annual Conference
• SARMA Advisory Council meetings
• Networking socials
• Educational events
• Job fairs
• Webinars
• Policy forums

• Monthly SARMA newsletter

• Exclusive and free members-only events and webinars

• Board meetings, networking socials
• Annual meeting
• Monthly committee meetings

• Access to exclusive information   
• Annual Conference speaker presentations 
• Conference attendee lists
• SARMA member directory ("opt-in" only)
• Free digital subscription to partner organization newsletters
• Detailed calendar of third-party events of interest to the security risk community

• Opportunities to become involved in various SARMA committees and efforts benefiting the security risk community