24. July 2009 by Revelator.

My friends, it is time once again for a guest blogger to put in his two-cents. This entry has a significantly higher military quotient than most of mine and I must say it brings back good memories for this retired GI. The gentleman who wrote this is a good friend (and an ex-boss) - and I consider him one of the premier OPSEC Planners on the planet. Read and heed my friends…Rev

“Everything I learned about really good OPSEC planning for a big operation I learned from dipping snuff,” he said. Not quite sure he was serious, I responded, “You’ve got to be kidding me!” The lack of expression on Sam’s face, as he removed the black plastic lid and spit into his McDonalds’ coffee cup, led me to believe he was serious.

We were on a break from the Joint Planning Group session at a particular US combatant command headquarters, hanging around in the break room engaged in professional Information Operations (IO) discourse and partly solving dilemmas elsewhere on the planet.

Born Samuel T. Cogley five decades ago in rural Arkansas, “Books,” as he was known throughout the IO and Naval Aviation communities, was the most experienced military planner I had ever known. He had been brought in from a “Center of Excellence” to provide electronic warfare subject matter expertise to the combatant commander’s core joint planning group. Now retired, he was working as a defense contractor and did his best to impart IO knowledge on anyone who showed any interest in becoming enlightened.

I was this combatant command’s OPSEC Officer and doubled as the OPSEC planner for the J3’s IO Cell. With most of the folks in the IO Cell away TDY, I actually just happened upon this planning group by shear accident and had no idea that a plan was in work. That is until I heard the constant throat clearing voice of brand new Lieutenant Colonel McClin.

“Major! Major Patrick!”

I had just walked past one of our many conference rooms – which were seemingly always in use – and turned my head. Looking down at a clipboard, Lieutenant Colonel McClin pushed his glasses up the bridge of his nose and asked, “Are you”…ah-hem…“Major Jonathan Patrick”…ah-hem…”Jonathan Patrick IV,”…ah-hem…”the OPSEC dude?”
Not sure where this was going, I hesitated in responding. “Yes, I am. But you can call me JP4, everyone else does.”

“Okay…ah-hem…JP4; I am Lieutenant Colonel McClin, everyone calls me…ah-hem…Chilly Mac, but since I am a Lieutenant Colonel…ah-hem…in the United States Army, and you…ah-hem…are just a Major, you should call me…ah-hem…Colonel. Please go in and have a seat, the Joint…ah-hem…Planning Group is getting ready to start. I could…ah-hem…cover the OPSEC stuff since… ah-hem…I have done it Iraq before, but since you are here…ah-hem…you can be the OPSEC planning rep.”

As I entered the conference room, I heard someone from the back corner calling out in a loud whisper, “JP4, over here!” It was Books. I went over and sat next to him. “Man, it’s a good thing you showed up, I was afraid I was going to have to cover for your sorry rear end and do the OPSEC planning duties,” Books said. “Hey, give me a break! I didn’t even know about this. Besides, what about that Chilly Mac guy? He told me he could do it, he knows OPSEC…at least he says he’s done it before.”

“Oh, please!”

So, after about an hour, we went on our first break, initially arguing about how zombies were not getting a fair shake in the entertainment world, especially when compared to vampires and werewolves, but somehow came back to OPSEC planning.

I responded to Books’ comment, “What exactly do you mean? How on earth can anyone compare smokeless tobacco to OPSEC planning? Besides, it is such a disgusting habit!
“What, OPSEC planning?”
“No! That stuff you are putting in your mouth!”
“Oh.”
“Wait a minute, how can you even contemplate that OPSEC planning is disgusting?”

“Um, well, not exactly that way, I was actually thinking that most of the time I’ve seen planners wait until the plan is almost complete and ready for execution or the boss’s signature before someone thinks about OPSEC. Kind of like, ‘oh, can you OPSEC folks “sprinkle” a little OPSEC on this before we go to print?’ That’s disgusting from a professional standpoint; kind of sad really.”

“So what do you mean?” I inquired.

Books began his lesson on dipping snuff and equating it to OPSEC planning. “Getting in on the beginning is the key. I need to do my analysis and find out what is allowed in the planning room and what is not. Usually, the command will allow beverages. I mean how can you really do effective military planning without caffeinated beverages?

Sometimes, there will be signs posted that forbid the use of tobacco products. So, I show up with a coffee cup – with a lid – and overtly show everyone that I drink coffee. I mingle, sit in on working groups, I want everyone to recognize I am a coffee drinker. Later, when the time is right, I go away and put in a dip and return with my coffee cup and lid.”
“For me, and I hate to admit this, I cannot do effective military planning without my nicotine, especially if we are doing 12+ hour sessions. If I show up with the regular observable indicators of a dipper of snuff, then I am at risk of getting busted.”

I interrupted, “You mean like Major Sweet, that Marine that walks around everywhere with that old, worn-out, plastic Ozarka water bottle full of spit juice?”
“Yep, exactly!” Books said. “He is never a happy camper when the anti-tobacconists ask him to leave.”

Books continued, “And speaking of the anti-tobacconists, the next part of my analysis of this “threat” – still taking advantage of showing up early – is to scope out the room where we will be planning and find the optimum location to sit and be out of easy purview of the folks looking for dippers.”

“Like where we’re sitting in the conference room today?” I asked. “You’re catching on, JP4, you’re catching on.” “But I never see you spit in there!” I charged. “Ha! You don’t know when to look. Or rather, I know the times when the “bad guys” aren’t looking. Like during slide transitions or when someone asks a question. Their “collection capabilities” are diverted elsewhere and I take advantage of the moment.”

I was still somewhat puzzled. “Okay, so what does this have to do with OPSEC?”

“I’m getting there,” Books responded. “In the grand scheme of things, Major Sweet takes a risk of getting caught, or better yet, doesn’t acknowledge the vulnerability his observable indicators create nor does he appreciate the risk of being seen by the anti-tobacconists. You would probably agree with me that his risk would be rated as HIGH.”

“I, on the other hand, take simple, cost effective mitigation measures to protect my indicators based on a current and thorough threat analysis.”

“The same thing goes for OPSEC planning. If you can get in on the planning early, and see where the plan is headed, you can then take measures and assign tasks far enough in advance to effectively mitigate indicators that reveal friendly intent, capabilities, timing, etc.” “If you show up late to the planning effort, OR, if you get the proverbial request to sprinkle some OPSEC fairy dust on the plan at the last minute, you’re out of position to make anything happen and the bad guys will pick up on the indicators.”

“We know the bad guys look for changes in our routines. We need time to adjust events to keep routines from highlighting what we are up to and you can’t just simply do that on the eve of the operation and you definitely can’t do it after the fact.”

“If I walk in on the last day of planning, I won’t be able to get an optimum seat; all eyes will be on me; and I will either have to go with just drinking coffee or…” “Or take the risk and just go about with your nasty habit ala Major Sweet,” I imparted. I think I’m getting it now…so if a plan depended on moving a specific unit out of particular location, say using C-17s…”

It was Books’ turn to interrupt now, “And the only time C-17s showed up was to move that unit, then that would be a huge indicator. That is unless you set up “random” C-17 flights earlier in the timeline, prior to actual execution.” “That kind of sounds like a military deception plan to me,” I said “Is it?” Books asked.

After a pregnant pause, he continued. “Remember the definition of MILDEC, and who the target audience is. OPSEC has a much broader target audience, and in your example we are not doing it necessarily to cause someone to take, or not take, action. However, you do bring up a valid point; and I must add that I am impressed with the way you think.”

“We can talk the finer points of MILDEC planning and execution later, but in a way you’re correct because OPSEC can use MILDEC as a mitigator to help make it harder for the bad guys to find the real indicators. I guess it really depends who initiates the task and if it was tasked as part of a larger MILDEC plan.”

“You can also kind of make the same correlation with Electronic Warfare and conditioning jamming before an operation. Is that MILDEC? Or is it OPSEC? The EW planner would tell you he is just being the consummate EW professional. Either way, it goes to not highlighting a routine that would give something away to the bad guys. I would like to think that a good OPSEC planner that got in on the planning early would be in a good position to help that EW guy and that deceptionist mitigate those kind of things.”

“Okay, okay, I get it,” I said. But I still had a few more questions.

“Books, I have to ask; why is the lid so important?”

Books smiled as he took another spit. “Cost effective mitigation to overhead surveillance – passersby to you JP4 – plus it doubles as a safety device. I wouldn’t want this to spill. I do have some couth you know!”

“Good point,” I replied. “But is there a tie in with snuff and the Critical Information List? Does dipping itself make you a better OPSEC planner?”

About this time Chilly Mac walked into the break room. Books noticed him before I did and slowly turned to avoid any eye contact with him.

Sensing his desire to stay clear of Chilly Mac, Books softly spoke, “Let’s get back into the conference room. We can talk about Critical Information on the next break.”

Don Sidro
The Godfather of OPSEC

Keep the Faith!
Revelator

Posted in Indicators, OPSEC Plans, Planning | Print | No Comments »

23. May 2008 by Revelator.

     When I was an OPSEC Program Manager in the military I can’t tell you how much I appreciated when the boss called me in and told me that the “secret” deployment was in two days and they needed me to give the OPSEC okay to the plan.  Yeah, that was always fun - and rewarding too.  And then while I was in the corporate world I really enjoyed being told by a corporate honcho that the new product will be released tomorrow and do I want to look over the press releases that have already been sent out.  You know…just to make sure they’re all OK from a security perspective.  Ahhhhh, good times - good times.  That always made the job worthwhile for me.  I mean, what can bring more job satisfaction than knowing that you’re being brought into a mission or project at the precise moment that anything you might do will be a total waste of time?  Boy, it doesn’t get much better than that.  Assuming you have caught all the sarcasm that’s dripping off these words then I guess you’ve been there - done that - got the t-shirt - wore it - washed it - gave it to the “Poor OPSECers Fund Drive” - claimed it on your taxes.

     But when should OPSEC be put into our processes or our missions?  Is it during the planning phase?  It is sandwiched between planning and execution?  Does it happen during market research?  Does it come after product release or deployment?  Boy, this is a complicated decision.  So many factors, issues and considerations.  So many things to deliberate, considerate, cogitate, meditate and contemplate.  Seriously, there are just too many variables for me to answer that question.  Except maybe this way…OPSEC begins at birth!

     Every concept, idea or plan has an inception.  And from there it has a defined life cycle.  OPSEC must be considered in every step of the life cycle.  We don’t wait until our children are five years old and then start to protect them.  We don’t wait a year before we buy car insurance and we don’t wait until we’re wheels up before we start to add in some OPSEC.

     Now, I understand that if you’re a regular reader of this blog you most likely are a fairly seasoned OPSECer and you’re probably hip to this little pearl of insight.  So your challenge now is to educate your leadership and develop ways to ensure that you, as the OPSEC Manager, get invited to all those planning meetings that you’ve been missing.  So get out there and bang down some doors.  You need to be there - OPSEC needs to be there.  Make it so.

Keep the Faith!

Revelator

Posted in OPSEC Plans, Planning, Program Management | Print | No Comments »