Menu
Home
People
Places
Arts
History
Plants & Animals
Science
Life & Culture
Technology
Reference.org
Intelligence cycle security
open-in-new
<h2 id="changes-in-doctrine-for-protecting-the-entire-intelligence-cycle">Changes in doctrine for protecting the entire intelligence cycle?</h2> <p>The US definition of counterintelligence, however, is narrowing, while the definition of Operations Security (OPSEC) seems to be broadening. The manuals of the early 1990s describedCI as responsible for overall detection of, and protection from, threats to the intelligence cycle. With the 2005-2007 National Counterintelligence Strategy statements, it is no longer clear what function is responsible for the overall protection of the intelligence cycle. In this recent US doctrine, although not necessarily that of other countries, <a href="/facts/Counterintelligence/MDAxLaSh">counterintelligence</a> (CI) is now seen as primarily a counter the Human Intelligence <a href="/facts/HUMINT/1QlDb5jn">HUMINT</a> to Foreign Intelligence Service (FIS). FIS is a term of art that covers both nations and non-national groups, the latter including terrorists, or organized crime involved in areas that are considered fundamental threats to national security </p><p>The National Counterintelligence Strategy of 2005<a class="footnote-ref" id="fnref:8" href="#fn:8"><sup>8</sup></a> states the CI mission as: </p> <ul><li>counter terrorist operations</li> <li>seize advantage:</li> <li>protect critical defense technology</li> <li>defeat foreign denial and deception</li> <li>level the economic playing field</li> <li>inform national security decisionmaking</li> <li>build a national CI system</li></ul> <p>The 2007 US joint intelligence doctrine<a class="footnote-ref" id="fnref:9" href="#fn:9"><sup>9</sup></a> restricts its primary scope to counter-HUMINT, which usually includes counter-terror. It is not always clear, under this doctrine, who is responsible for all intelligence collection threats against a military or other resource. The full scope of US military counterintelligence doctrine has been moved to a classified publication, Joint Publication (JP) 2-01.2, <i>Counterintelligence and Human Intelligence Support to Joint Operations</i>, so publicly it is unknown if that problem is clarified there. </p> <h2 id="countermeasures-to-specific-collection-disciplines">Countermeasures to specific collection disciplines</h2> <p>More specific countermeasures against intelligence collection disciplines are listed below </p> CI roles against Intelligence Collection Disciplines, 1995 doctrine (FM34-60)<table><tbody><tr><th>Discipline</th><th>Offensive CI</th><th>Defensive CI</th></tr><tr><td>HUMINT</td><td>Counterreconnaissance, offensive counterespionage</td><td>Deception in operations security</td></tr><tr><td>SIGINT</td><td>Recommendations for kinetic and electronic attack</td><td>Radio OPSEC, use of secure telephones, SIGSEC, deception</td></tr><tr><td>IMINT</td><td>Recommendations for kinetic and electronic attack</td><td>Deception, OPSEC countermeasures, deception (decoys, camouflage)<p>If accessible, use SATRAN reports of satellites overhead to hide or stop activities while being viewed</p></td></tr></tbody></table> <h3>Counter-HUMINT</h3> <p>See additional detail on <a href="/facts/Counterintelligence/MDAxLaSh">Project Slammer</a>, which was an effort of the Intelligence Community Staff, under the Director of Central Intelligence, to come up with characteristics of Project Slammer, an Intelligence Community sponsored study of espionage. </p><p>Aspects of physical security, such as guard posts and wandering guards that challenge unidentified persons, certainly help with counter-HUMINT. Security education, also part of <a href="/facts/OPSEC/j5BkXkog">OPSEC</a>, is important to this effort. </p> <h3>Counter-SIGINT</h3> <p>Military and security organizations will provide secure communications, and may <a href="/facts/Signals_intelligence/Iwzvw6AW">monitor</a> less secure systems, such as commercial telephones or general Internet connections, to detect inappropriate information being passed through them. Education on the need to use secure communications, and instruction on using them properly so that they do not become vulnerable to <a href="/facts/Signals_intelligence/Iwzvw6AW">specialized technical interception</a>. Methods of including <a href="/facts/Encryption/16q29Fdv">encryption</a> and <a href="/facts/Traffic_flow_security/ReJ8of8l">traffic flow security</a> may be needed in addition to, or instead of, specialized shielding of the equipment. </p><p>The range of methods possible in counter-SIGINT cover a wide range of what is appropriate in a combat zone to what can be done in a research laboratory. At the combat end, if an enemy SIGINT interception antenna can be targeted, thoroughly bombing it and its associated electronics will definitely end its career as a SIGINT threat. In slight less dramatic fashion, it can be taken under <a href="/facts/Electronic_attack/fu0m3qqp">electronic attack</a>, and strong enough electromagnetic signals directed at it to conceal any friendly signals, and perhaps to overload and destroy the electronics of the SIGINT facility. SIGINT protection for office buildings may require a room to be electronically shielded. </p> <h3>Counter-IMINT</h3> <p>The basic methods of countering IMINT are to know when the opponent will use imaging against one's own side, and interfering with the taking of images. In some situations, especially in free societies, it must be accepted that public buildings may always be subject to photography or other techniques. </p><p>Countermeasures include putting visual shielding over sensitive targets or camouflaging them. When countering such threats as imaging satellites, awareness of the orbits can guide security personnel to stop an activity, or perhaps cover the sensitive parts, when the satellite is overhead. This also applies to imaging on aircraft and UAVs, although the more direct expedient of shooting them down, or attacking their launch and support area, is an option in wartime. </p> <h3>Counter-OSINT</h3> <p>While the concept well precedes the recognition of a discipline of <a href="/facts/OSINT/GzCXep9r">OSINT</a>, the idea of <a href="/facts/Censorship/gwTgKVuv">censorship of material directly relevant to national security</a> is a basic OSINT defense. In democratic societies, even in wartime, censorship must be watched carefully lest it violate reasonable freedom of the press, but the balance is set differently in different countries and at different times. </p><p>Britain is generally considered to have a very free press, but the UK does have the <a href="/facts/DA-Notice/JSnpN39x">DA-Notice, formerly D-notice</a> system. Many British journalists find that this system is used fairly, although there always be arguments. In the specific context of counterintelligence, note that <a href="/facts/Peter_Wright_(MI5_officer)/7AFBwlbp">Peter Wright</a>, a former senior member of the <a href="/facts/MI5/mI3nc0YP">Security Service</a> who left their service without his pension, moved to Australia before publishing his book <a href="/facts/Spycatcher/5ApWrNx2">Spycatcher</a>. While much of the book was reasonable commentary, it did reveal some specific and sensitive techniques, such as <a href="/facts/Operation_RAFTER/uj2607pl">Operation RAFTER</a>, a means of detecting the existence and setting of radio receivers. </p> <h2 id="operations-security">Operations Security</h2> <p>Even though the principles of OPSEC go back to the beginning of warfare, formalizing OPSEC as a US doctrine began with a 1965 study called PURPLE DRAGON, ordered by the Joint Chiefs of Staff, to determine how the North Vietnamese could get early warning of ROLLING THUNDER fighter-bomber strikes against the North, and ARC LIGHT B-52 missions against the South.<a class="footnote-ref" id="fnref:10" href="#fn:10"><sup>10</sup></a> </p><p>The methodology used was to consider what information the adversary would need to know in order to thwart the flights and the sources from which the adversary might collect this information. </p><p>It became apparent to the team that although traditional security and intelligence countermeasures programs existed, reliance solely upon them was insufficient to deny critical information to the enemy—especially information and indicators relating to intentions and capabilities. The group conceived and developed the methodology of analyzing U.S. operations from an adversarial viewpoint to find out how the information was obtained. </p><p>The team then recommended corrective actions to local commanders. They were successful in what they did, and to name what they had done, they coined the term "operations security." </p> <h3>Establishment within DOD</h3> <p>After the Vietnam War ended in 1973 the JCS adopted the OPSEC instruction developed by the CINCPAC OPSEC branch and published it as JCS Publication 18, “Doctrine for Operations Security”. Originally classified, an unclassified version was published the following year. The JCS published the first JCS OPSEC Survey Planning Guide, and distributed this publication within DOD and to other Federal agencies. </p><p>The JCS began presenting a series of annual OPSEC conferences for representatives throughout government. Attendees discussed ways to adapt the OPSEC concept developed for combat operations to the peacetime environment. Throughout the late 1970s, the military services established their own OPSEC programs and published implementing directives and regulations. By the end of the decade, they were conducting their own surveys. </p> <h3>Establishment outside DOD</h3> <p>After the Vietnam War, a number of the individuals who had been involved in the development or application of the OPSEC concept were either already working for, or went to work with the National Security Agency (NSA). As a result, NSA played a major role in adapting OPSEC to peacetime operations, and in informally communicating OPSEC concepts to other agencies. Thus, non-DoD agencies began to establish their own programs, and OPSEC was on its way to becoming a national program. </p> <h3>Establishment within DOE</h3> <p>DOE began to assume a role in the peacetime application of OPSEC by participating in the JCS OPSEC conferences and interfacing with other Federal agencies. In 1980, DOE began establishing its own OPSEC program and, by 1983, the Department had the only formal OPSEC program outside DOD. Since that time, DOE has continued to refine and adapt the OPSEC concept to meet the specific needs of its mission. </p><p>In 1983, DOE was a member of the Senior Interagency Group for Intelligence (SIG-I), an advisory group of the National Security Council. SIG-I proposed the establishment of a national policy on OPSEC and the formation of a National OPSEC Advisory Committee (NOAC). </p><p>In 1988, President Ronald Reagan issued National Security Decision Directive 298 (NSDD-298) that established a national policy and outlined the OPSEC five-step process. Also mandated within NSDD-298, was the establishment of the Interagency OPSEC Support Staff (IOSS). The IOSS mission is to assist in implementing the national-level OPSEC program as directed by the President. The NSDD directs IOSS to provide or facilitate OPSEC training and act as a consultant to Executive departments and agencies required to have OPSEC programs. Operations security (OPSEC), in a widely accepted meaning,<a class="footnote-ref" id="fnref:11" href="#fn:11"><sup>11</sup></a> relates to identifying the information that is most critical to protect regarding future operations, and planning activities to: </p> <ul><li>Identifying those actions that can be observed by adversary intelligence systems</li> <li>Determining indicators that adversary intelligence systems might obtain that could be interpreted or pieced together to derive critical information in time to be useful to adversaries</li> <li>Designing and executing measures that eliminate or reduce to an acceptable level the vulnerabilities of friendly actions to adversary exploitation.</li></ul> <p>Contrary to the <a href="/facts/US_Department_of_Defense/dWAvf7e3">US Department of Defense</a> definition, a 2007 webpage of the US Intelligence Board<a class="footnote-ref" id="fnref:12" href="#fn:12"><sup>12</sup></a> describes (emphasis added) "the National Operations Security (OPSEC) Program - a means to identify, control, and protect unclassified information and evidence associated with U.S. national security programs and activities. If not protected, such information often provides an opportunity for exploitation by adversaries or competitors working against the interests of the US." </p><p>Even though there are legitimate concerns about adversaries exploiting open societies, there must be vigilance that a broader definition of OPSEC has created concerns that national security may be used to conceal the politically embarrassing or marginally legal, rather than protecting legitimate functions. </p><p>What constitutes OPSEC? A Presidential-level National Security Decision Directive formalized it<a class="footnote-ref" id="fnref:13" href="#fn:13"><sup>13</sup></a> as five steps, the details of which have been expanded upon by the Department of Energy<a class="footnote-ref" id="fnref:14" href="#fn:14"><sup>14</sup></a> </p> <ol><li>Identification of the critical information to be protected: Basic to the OPSEC process is determining what information, if available to one or more adversaries, would harm an organization's ability to effectively carry out the operation or activity. This critical information constitutes the "core secrets" of the organization, i.e., the few nuggets of information that are central to the organization's mission or the specific activity. Critical information usually is, or should be, classified or least protected as sensitive unclassified information.</li> <li>Analysis of the threats: Knowing who the adversaries are and what information they require to meet their objectives is essential in determining what information is truly critical to an organization's mission effectiveness. In any given situation, there is likely to be more than one adversary and each may be interested in different types of information. The adversary's ability to collect, process, analyze, and use information, i.e., the threat, must also be determined.</li> <li>Analysis of the vulnerabilities: Determining the organization's vulnerabilities involves systems analysis of how the operation or activity is actually conducted by the organization. The organization and the activity must be viewed as the adversaries will view it, thereby providing the basis for understanding how the organization really operates and what are the true, rather than the hypothetical, vulnerabilities.</li> <li>Assessment of the risks: Vulnerabilities and specific threats must be matched. Where the vulnerabilities are great and the adversary threat is evident, the risk of adversary exploitation is expected. Therefore, a high priority for protection needs to be assigned and corrective action taken. Where the vulnerability is slight and the adversary has a marginal collection capability, the priority should be low</li> <li>Application of the countermeasures: Countermeasures need to be developed that eliminate the vulnerabilities, threats, or utility of the information to the adversaries. The possible countermeasures should include alternatives that may vary in effectiveness, feasibility, and cost. Countermeasures may include anything that is likely to work in a particular situation. The decision of whether to implement countermeasures must be based on cost/benefit analysis and an evaluation of the overall program objectives.</li></ol> <h3>OPSEC Scope</h3> <p>OPSEC complements (emphasis in (NSDD 298)) physical, information, personnel, computer, signals, communications, and electronic security measures. Note that this does <i>not</i> include counter-HUMINT or counter-IMINT. If the definition of <a href="/facts/Counterintelligence/MDAxLaSh">counterintelligence</a> is redefined to cover counter-HUMINT, a scope begins to emerge, although an official term still seems lacking to deal with the totality of security against all threats. This series of articles simply tries to define it for the security of intelligence. </p><p>Another way of describing the scope was coined, by Kurt Haase, OPSEC Program at the DOE Nevada Operations Office in order to simplify the understanding of OPSEC; it is titled the "Laws of OPSEC": </p> <ul><li>1. If you don't know the threat, how do you know what to protect? Although specific threats may vary from site to site or program to program. Employees must be aware of the actual and postulated threats. In any given situation, there is likely to be more than one adversary, although each may be interested in different information.</li> <li>2. If you don't know what to protect, how do you know you are protecting it? The "what" is the critical and sensitive, or target, information that adversaries require to meet their objectives.</li> <li>3. If you are not protecting it (the critical and sensitive information), the adversary wins! OPSEC vulnerability assessments, (referred to as "OPSEC assessments" - OA's - or sometimes as "Surveys") are conducted to determine whether or not critical information is vulnerable to exploitation. An OA is a critical analysis of "what we do" and "how we do it" from the perspective of an adversary. Internal procedures and information sources are also reviewed to determine whether there is an inadvertent release of sensitive information</li></ul> <h3>OPSEC techniques</h3> <p>OPSEC measures may include, but are not limited to, counterimagery, cover, concealment, and deception. </p><p>According to (NSDD 298), the Director, National Security Agency, is designated Executive Agent for interagency OPSEC training. In this capacity, he has responsibility to assist Executive departments and agencies, as needed, to establish OPSEC programs; develop and provide interagency OPSEC training courses; and establish and maintain an Interagency OPSEC Support Staff (IOSS), whose membership shall include, at a minimum, a representative of the Department of Defense, the Department of Energy, the Central Intelligence Agency, the Federal Bureau of Investigation, and the General Services Administration. The IOSS will: </p> <ul><li>Carry out interagency, national level OPSEC training for executives, program managers, and OPSEC specialists;</li> <li>Act as a consultant to Executive departments and agencies in connection with the establishment of OPSEC programs and OPSEC surveys and analyses; and</li> <li>Provide an OPSEC technical staff for the SIG-I.</li></ul> <p>Nothing in this directive: </p> <ul><li><i>Is intended to infringe on the authorities and responsibilities of the Director of Central Intelligence to protect intelligence sources and methods, nor those of any member of the Intelligence Community as specified in Executive Order No. 12333;</i> or</li> <li>Implies an authority on the part of the SIG-I Interagency Group for Countermeasures (Policy) or the NOAC to examine the facilities or operations of any Executive department or agency without the approval of the head of such Executive department or agency.</li></ul> <p>NSDD 298 preceded the creation of a Director of National Intelligence (DNI), who assumed some responsibilities previously held by the Director of Central Intelligence (DCI). The Director of Central Intelligence was no longer the head of the intelligence community, and was retitled the Director of the Central Intelligence Agency (DCIA). The National Counterintelligence Executive (NCIX), reporting directly to the DNI, also was created after NSDD 298. It is not clear, therefore, if the italicized responsibilities (above) of the DCI may have moved to the DNI or NCIX. </p> <h2 id="communications-security">Communications security</h2> <p><a href="/facts/Communications_security/tp0Q3jHp">Communications security</a> forms an essential part of counterintelligence, preventing an adversary to intercept sensitive information that is transmitted, especially through free space, but also through wired networks capable of being wiretapped. It includes several disciplines, both including those for protecting the hostile acquisition of information either from the <a href="/facts/Traffic_flow_security/ReJ8of8l">patterns of flow of messages</a>, or the content of messages (e.g., <a href="/facts/Encryption/16q29Fdv">encryption</a>. It also includes a number of disciplines that protect against <a href="/facts/Signals_intelligence/Iwzvw6AW">the inadvertent emanation of unprotected information</a> from communications systems. </p> <h2 id="physical-security">Physical security</h2> <p>This article discusses physical security in the context of information cycle security; see <a href="/facts/Physical_security/zMmzXW4w">Physical security</a> for a more general view of the topic. Protection of both sensitive information in human-readable form, as well as of cryptographic equipment and keys, is the complement of communications security. The strongest cryptography in the world cannot protect information that, when not being sent through strong cryptographic channels, is left in an area where it can be copied or stolen. </p><p>It's useful to look at some of the extremes of physical security, to have a standard of reference. A U.S. Sensitive Compartmented Intelligence Facility (SCIF) is a room or set of rooms, with stringent construction standards,<a class="footnote-ref" id="fnref:15" href="#fn:15"><sup>15</sup></a> to contain the most sensitive materials, and where discussions of any security level can take place. A SCIF is not a bunker, and might slow down, but certainly not stop, a determined entry attempt that used explosives. </p><p>There can be individual variations in construction based on specific conditions; the standards for one inside a secure building inside a military base in the continental US are not quite as stringent as one in an office building in a hostile country. While, in the past, it was assumed that the SCIF itself and a good deal of electronics in it needed specialized and expensive shielding, and other methods, to protect against eavesdropping—most of these are under the unclassified code word <a href="/facts/Tempest_(codename)/geLPqTp2">TEMPEST</a>, TEMPEST has generally been waived for facilities in the continental U.S. At the other extreme, the secure conference and work area in the US Embassy in Moscow, where the new building was full of electronic bugs, had extra security measures making it a "bubble" inside as secure a room as was possible. In each case, however, the plans must be preapproved by a qualified security expert, and the SCIF inspected before use, and periodically reinspected. </p><p>Facilities for less sensitive material do not need the physical protection provided by a SCIF. While the most recent policies should be consulted, TOP SECRET needs both an alarmed (with response) high-security filing cabinet with a combination lock; SECRET may relax the alarm requirement but still require the same high-security filing cabinet; CONFIDENTIAL may accept a regular filing cabinet, which has had a bracket welded to each drawer, and a strong steel bar run through the brackets and secured with a combination padlock. </p><p>Other security measures might be closing drapes or blinds over the window of a room where classified information is handled, and might be photographed by an adversary at a height comparable to that of the window. </p><p>No matter how physically secure a SCIF may be, it is no more secure than the people with access to it. One severe security breach was by a clerk, <a href="/facts/Christopher_John_Boyce/mM7bGD5Y">Christopher John Boyce</a>, who worked inside the SCIF that held communications equipment and stored documents for a <a href="/facts/TRW_Inc./PBxh9uWH">TRW</a> facility in Redondo Beach, California. At this facility, among other sensitive programs, TRW built U.S. reconnaissance satellites for the <a href="/facts/National_Reconnaissance_Office/Rnh04L8L">National Reconnaissance Office</a> and <a href="/facts/Central_Intelligence_Agency/U7urmQYL">Central Intelligence Agency</a>.<a class="footnote-ref" id="fnref:16" href="#fn:16"><sup>16</sup></a> Boyce stole documents and gave them to a drug dealer, <a href="/facts/Andrew_Daulton_Lee/0I47Vrpc">Andrew Daulton Lee</a>, who sold them to the Soviet <a href="/facts/KGB/ommGANo5">KGB</a>. Personnel security measures are as important as physical security. Counter-HUMINT measures might have detected the documents being transferred and taken to the Soviet Embassy in Mexico City. </p> <h2 id="personnel-security">Personnel security</h2> <p>Many of the greatest enemy penetrations of a country's secrets came from people who were already trusted by that government. Logically, if your service desires to find out your opponent's secrets, you do not try to recruit a person that would have no access to those secrets – unless the person you recruit gives you access to such a person. </p><p>The general process of determining whether a person can be trusted is <a href="/facts/Security_clearance/d34w9Ksj">security clearance</a>; the British term, used in many Commonwealth countries, is <a href="/facts/Classified_information_in_the_United_Kingdom/sTH6MXKF">positive vetting</a>. In the most sensitive positions, clearances are periodically renewed. Indications of possible compromise, such as spending patterns that are inconsistent with one's known income, are supposed to be reported to personnel security officers. </p><p>Security clearance is a starting point, but, while respecting individual rights, a certain amount of monitoring is appropriate. Some of the worst US betrayals, of recent years, have been money-driven, as with <a href="/facts/Counterintelligence_failures/P51wIVqP">Aldrich Ames</a> and <a href="/facts/Counterintelligence_failures/P51wIVqP">Robert Hanssen</a>. Electronic reviews of financial records, raising flags if there are irregularities that need to be checked, may be among the least obtrusive means of checking for unexplained income. There are cases where such checks simply revealed an inheritance, and no further questions were raised. </p><p>Detecting other vulnerabilities may come from things that are simply good management. If someone is constantly clashing with colleagues, it is good people management, not uniquely security management, for a manager to talk with the individual, or have them talk to an Employee Assistance Program. It is not considered a disqualification to seek mental health assistance; it may be considered excellent judgement. For people with especially high security access, it may be requested that they see a therapist from a list of professionals with security clearance, so there is not a problem if something sensitive slips or they need to discuss a conflict. </p> <h2 id="references">References</h2> <ol> <li id="fn:1"><p>Dulles, Allen W. (1977). The Craft of Intelligence. Greenwood. ISBN 0-8371-9452-0. Dulles-1977. <a href="0-8371-9452-0" target="_blank">0-8371-9452-0</a> <a href="#fnref:1" class="footnote-back-ref">↩</a></p></li> <li id="fn:2"><p>Wisner, Frank G. (22 September 1993). "On The Craft of Intelligence". CIA-Wisner-1993. Archived from the original on 15 November 2007. Retrieved 2007-11-03. <a href="https://web.archive.org/web/20071115004339/https://www.cia.gov/library/center-for-the-study-of-intelligence/kent-csi/docs/v08i1a07p_0004.htm" target="_blank">https://web.archive.org/web/20071115004339/https://www.cia.gov/library/center-for-the-study-of-intelligence/kent-csi/docs/v08i1a07p_0004.htm</a> <a href="#fnref:2" class="footnote-back-ref">↩</a></p></li> <li id="fn:3"><p>US Department of the Army (15 January 1991). "Field Manual 34-37: Echelons above Corps (EAC) Intelligence and Electronic Warfare (IEW) Operations". Retrieved 2007-11-05. <a href="https://fas.org/irp/doddir/army/fm34-37/toc.htm" target="_blank">https://fas.org/irp/doddir/army/fm34-37/toc.htm</a> <a href="#fnref:3" class="footnote-back-ref">↩</a></p></li> <li id="fn:4"><p>US Department of the Army (3 October 1995). "Field Manual 34-60: Counterintelligence". Retrieved 2007-11-04. <a href="https://fas.org/irp/doddir/army/fm34-60/" target="_blank">https://fas.org/irp/doddir/army/fm34-60/</a> <a href="#fnref:4" class="footnote-back-ref">↩</a></p></li> <li id="fn:5"><p>Interagency OPSEC Support Staff (IOSS) (May 1996). "Operations Security Intelligence Threat Handbook: Section 2, Intelligence Collection Activities and Disciplines". IOSS Section 2. Retrieved 2007-10-03. <a href="https://fas.org/irp/nsa/ioss/threat96/part03.htm" target="_blank">https://fas.org/irp/nsa/ioss/threat96/part03.htm</a> <a href="#fnref:5" class="footnote-back-ref">↩</a></p></li> <li id="fn:6"><p>US Army (May 2004). "Chapter 9: Measurement and Signals Intelligence". Field Manual 2-0, Intelligence. Department of the Army. FM2-0Ch9. Archived from the original on 2007-07-26. Retrieved 2007-10-03. <a href="https://web.archive.org/web/20070726155819/https://atiam.train.army.mil/soldierPortal/atia/adlsc/view/public/10536-1/FM/2-0/chap9.htm" target="_blank">https://web.archive.org/web/20070726155819/https://atiam.train.army.mil/soldierPortal/atia/adlsc/view/public/10536-1/FM/2-0/chap9.htm</a> <a href="#fnref:6" class="footnote-back-ref">↩</a></p></li> <li id="fn:7"><p>Matschulat, Austin B. (2 July 1996). "Coordination and Cooperation in Counerintelligence". CIA-Matschulat-1996. Archived from the original on 10 October 2007. Retrieved 2007-11-03. <a href="https://web.archive.org/web/20071010091345/https://www.cia.gov/library/center-for-the-study-of-intelligence/kent-csi/docs/v13i2a05p_0001.htm" target="_blank">https://web.archive.org/web/20071010091345/https://www.cia.gov/library/center-for-the-study-of-intelligence/kent-csi/docs/v13i2a05p_0001.htm</a> <a href="#fnref:7" class="footnote-back-ref">↩</a></p></li> <li id="fn:8"><p>Van Cleave, Michelle K. (April 2007). "Counterintelligence and National Strategy" (PDF). School for National Security Executive Education, National Defense University (NDU). USNDU-Van Cleave-2007. Archived from the original (PDF) on 2007-11-28. Retrieved 2007-11-05. <a href="https://web.archive.org/web/20071128125326/http://www.ndu.edu/inss/books/2007/SNSEE.pdf" target="_blank">https://web.archive.org/web/20071128125326/http://www.ndu.edu/inss/books/2007/SNSEE.pdf</a> <a href="#fnref:8" class="footnote-back-ref">↩</a></p></li> <li id="fn:9"><p>Joint Chiefs of Staff (22 June 2007). "Joint Publication 2-0: Intelligence" (PDF). US JP 2-0. Retrieved 2007-11-05. <a href="/wiki/Joint_Chiefs_of_Staff" target="_blank">/wiki/Joint_Chiefs_of_Staff</a> <a href="#fnref:9" class="footnote-back-ref">↩</a></p></li> <li id="fn:10"><p>"History of OPSEC" (PDF). Archived from the original (PDF) on 2013-05-21. Retrieved 2005-11-05. <a href="https://web.archive.org/web/20130521082242/http://205.254.131.69/HQSecOp/operations_security/History_of_OPEC.pdf" target="_blank">https://web.archive.org/web/20130521082242/http://205.254.131.69/HQSecOp/operations_security/History_of_OPEC.pdf</a> <a href="#fnref:10" class="footnote-back-ref">↩</a></p></li> <li id="fn:11"><p>US Department of Defense (12 July 2007). "Joint Publication 1-02 Department of Defense Dictionary of Military and Associated Terms" (PDF). Archived from the original (PDF) on 23 November 2008. Retrieved 2007-10-01. <a href="/wiki/US_Department_of_Defense" target="_blank">/wiki/US_Department_of_Defense</a> <a href="#fnref:11" class="footnote-back-ref">↩</a></p></li> <li id="fn:12"><p>US Intelligence Board (2007). "Planning and Direction". USIB 2007. Archived from the original on 2007-09-22. Retrieved 2007-10-22. <a href="https://web.archive.org/web/20070922230018/http://www.intelligence.gov/2-business_cycle1.shtml" target="_blank">https://web.archive.org/web/20070922230018/http://www.intelligence.gov/2-business_cycle1.shtml</a> <a href="#fnref:12" class="footnote-back-ref">↩</a></p></li> <li id="fn:13"><p>"National Security Decision Directive 298: National Operations Security Program". July 15, 2003. NSDD 298. Retrieved 2007-11-05. <a href="http://www.ioss.gov/nsdd298.html" target="_blank">http://www.ioss.gov/nsdd298.html</a> <a href="#fnref:13" class="footnote-back-ref">↩</a></p></li> <li id="fn:14"><p>Department of Energy. "An Operational Security (OPSEC) Primer". Archived from the original on 2007-10-28. Retrieved 2007-11-05. <a href="https://web.archive.org/web/20071028141247/http://www.defendamerica.mil/articles/a021202b.html" target="_blank">https://web.archive.org/web/20071028141247/http://www.defendamerica.mil/articles/a021202b.html</a> <a href="#fnref:14" class="footnote-back-ref">↩</a></p></li> <li id="fn:15"><p>Director of Central Intelligence Directive (18 November 2002). "Physical Security Standards for Sensitive Compartmented Information Facilities". DCID 6/9. Retrieved 2005-11-05. <a href="https://fas.org/irp/offdocs/dcid6-9.htm" target="_blank">https://fas.org/irp/offdocs/dcid6-9.htm</a> <a href="#fnref:15" class="footnote-back-ref">↩</a></p></li> <li id="fn:16"><p>Lindsey, Robert (1979). The Falcon and the Snowman: A True Story of Friendship and Espionage. Lyons Press. ISBN 1-58574-502-2. <a href="1-58574-502-2" target="_blank">1-58574-502-2</a> <a href="#fnref:16" class="footnote-back-ref">↩</a></p></li> </ol>