FORT CARSON, Colo. -- "An adversary does not need a big picture. They take small pieces of information and put them together to form a bigger picture," said the man whose job it is to teach operations security at Fort Carson.
Raymond Dunn, plans officer for the Directorate of Plans, Training, Mobilization and Security (DPTMS), said that Soldiers, Family members and civilians at Fort Carson must keep operations security (OPSEC) in mind and be careful about what they talk about online, on social media sites and via email.
"Officially, (OPSEC is) a process to deny potential adversaries information about capabilities and/or intentions by identifying, controlling and protecting unclassified information," he said. "It's the process of identifying what information within your organization is critical and protecting it."
The problem, though, is that information that may not seem critical or that may not seem like a big enough piece to keep quiet about can be used against the U.S.
"A bunch of people don't think that the adversary looks at Facebook," Dunn said. "They're not stupid. They know exactly where to get the information. They know exactly how to get it, and they will exploit that to no end.
"They will actively search for military members," he added. "Once they find that military member with the page that's not locked down, they can go to every single friend that they have, and on any page that is not locked down, they can see everything."
Dunn said when it comes to online communication and social networking, nothing related to a Soldier's job should be posted to any personal page, not by the Soldier, his Family members or his friends.
"Anything that has to do with the job, with the Army, with mission, with personnel, anything that goes out in print has to be vetted by Public Affairs. To put it out there as an individual, it's bypassing the vetting process, and it's also putting information out there that the adversary could use," Dunn said.
He added, though, that mission-related information isn't the only data that social media users should be careful about.
"Think about security of not only the Army's mission but of the Family and the Army community as a whole," said Dunn. "The adversary looks for any information that he can get by any means available."
In one of Dunn's OPSEC briefings, he quotes an al-Qaida terrorist training manual that was captured in England in 2000. It states, "Using public sources openly and without resorting to illegal means, it is possible to gather at least 80 percent of information about the enemy."
The handbook instructs trainees to look for information about government personnel, officers, important personalities and all matters related to them including their residence, workplace, time of leaving and returning and their children.
"Another thing about Facebook is that OPSEC applies outside the workplace, too," said Dunn. "When you're going on vacation. Putting financial information out there. You know you can tag yourself in different places, so people can track your movements.
"One of the critical things about Facebook," he said, "is that a lot of people don't realize that if you posted it on Facebook, you give Facebook the right to use your post as they see fit. You can delete it, but in fact you're not actually deleting it. You're simply removing it from your profile."
He said that another OPSEC safety concern with regard to the social media site is that an adversary doesn't have to become Facebook friends with the person he wants to glean information from. He can instead become friends with one of his target's acquaintances, and then his target's information is open to him.
For example, let's use a Soldier named Bill and his wife, Sally. Bill's unit is gearing up for a deployment, and Bill has had a week of long hours, hard work and frustration. Sally understands she's not supposed to talk about the upcoming deployment, but she thinks if she keeps her Facebook posts generic, she can talk about what Bill's going through.
"Bill's been working a lot of extra hours this week. He's exhausted!" she posts.
Sally's friend Karen comments, writing, "I hope Bill gets a little time off before he leaves! He'll be gone for so long."
Seems innocuous, doesn't it? However, Karen has accepted a friend request from Greg. She doesn't know Greg in real life, but Greg said he knew some of her obscure Facebook friends. Perhaps he told her they'd gone to college together but she just didn't remember him.
In reality, Greg is working with an adversary. Now that he's friends with Karen, he can see what she's talking to Sally about. Even though Sally thinks she has her Facebook privacy settings locked down tight, Greg can see she's related to Bill, and Bill has a profile picture of himself in uniform. Greg now knows from Sally and Karen's innocent conversation that a unit of Soldiers has been working a lot of extra hours and is getting ready to go somewhere, possibly deploying.
Greg isn't the only person out there mining data for his organization.
Others are doing the same thing he's doing -- friending people on Facebook, following people on Twitter and Instagram -- and together, they can put together pieces they can use to build a picture of what a unit's plans are with no one from that unit actually laying out specific details.
Dunn said the Army has actually studied and proven that adversaries use this puzzle method to gain information.
"As a matter of fact, in Vietnam the Army ran an operation called Purple Dragon," he said. "They ran this operation after a series of failed missions that were meticulously planned. They couldn't figure out why the mission wasn't achieving the results they thought they would achieve.
"This operation Purple Dragon determined that the enemy was getting information about missions not by finding stuff but just because Joe couldn't keep his mouth shut," he said. "All it takes is for me and you to have a conversation, for the guy sitting right next to us, an adversary, to hear it. Talking to the bartender, talking to the waitress, the checkout clerk at the (convenience store), it doesn't matter."
Dunn said Purple Dragon found mission failure was because of small leaks of information.
"It doesn't take an (operations) order for the adversary to say, 'Oh, this is what's going on.' It takes two or three different pieces of information until they start building and putting together pieces of the puzzle."
Dunn said it's also important for social media users to think about the photos they post and to pay attention to the background.
"In my OPSEC brief I have a series of slides that have photographs of seemingly unthreatening information being put out, but when you blow the picture up … (a Soldier) has a whiteboard behind him that has unit call signs on it in a theater of operations," he said. "People, they just don't think."
When it comes to unit information, Dunn said Soldiers need to know about their organization's critical information list.
"That's a list that the commander determines should be safeguarded even if it's not classified. It's a list of information the commander deems critical to unit mission readiness that should not be leaked," he said.
"Family members are privy to a lot more information than the general public just by the nature of being married to a Service member," Dunn said. "But again, on that critical information list, it needs to be disseminated to the lowest levels."
Dunn said it's possible that Soldiers may sit through meetings where they discuss the critical information list, but it's overshadowed by discussion of operational items that seem more like an immediate need.
"Immediate training priorities kind of override long-term security goals," he said, adding that security goals always need to be in the forefront.
Dunn really wants social media users to think about the information they share.
"Just understand that anything military-related should not be put in a public forum even if (you) think it's safe to do so, because it must may not be.
"If the information you put out there … will help your friend to get a better picture of what's going on, it will help someone that is not your friend just as much, sometimes more," he said.
Social Sharing