Threat Awareness Briefing

1. Threat Awareness Briefing

2. The protection of classified and sensitive unclassified information and systems containing this information, is the responsibility and obligation of all {company name} employees The consequences for not protecting this information or systems Leads to management review Possible termination Punishable under Federal laws - to include imprisonment and fines Obligations

3. Threat AwarenessWhy are we here? • To secure the assistance of all personnel in the deterrence and detection of intelligence and terrorist threats to the {company name},its sponsors, and the government • Increase awareness about threats • Define the why, what, who, and how • Educate on recognizing, reacting, and reporting security incidents

4. Threat Awareness Why, What, Who, and How? Why are you and the United States a target? You possess or have access to sensitive or classified information and/or technology that are highly sought after by competitors and foreign entities The U.S. is a dominant political, economic, and military force in the world which makes it the number one target for foreign espionage Individuals in both government and industry conduct espionage against the U.S. for one or more reasons: It competes with the U.S. for global or regional political and economic influence It is a developing country that believes its economic future is dependent upon the rapid acquisition and development of new technologies by any means It competes with U.S. companies in the global marketplace for the sale of advanced technologies or military weaponry  It feels threatened by a hostile neighbor and seeks to develop or obtain the most advanced military technology or ways to influence U.S. policy, toward itself and the neighboring country You are the first line of defense in protecting sensitive or classified information and technologies!

5. Threat Awareness • Why, What, Who, and How? (cont.) What is the Threat? Any person who lacks the proper security clearance and need-to-know, but still seeks to gain unauthorized access to classified or sensitive information Foreign Intelligence Service (FIS) networks (including those of “friendly countries”) are worldwide and ever present, and they want our technology or want to sabotage our progress FIS networks obtain critical information and technology through open sources, friendships, and recruitment of U.S. citizens with access to the information they want Human intelligence (HUMINT) gathering is the foremost threat, since all espionage recruitment begins with individuals

6. Other sources of the threats to sensitive and classified information include: Foreign or multinational corporations Foreign government-sponsored educational and scientific institutions Freelance agents (some of whom are unemployed former intelligence officers) Computer hackers Terrorist organizations Revolutionary groups Extremist ethnic or religious organizations Drug syndicates Organized crime • Threat Awareness • Why, What, Who and How? (cont.)

7. Threat Awareness • Why, What, Who and How? (cont.) Top Targeted People and Industries Top Targeted Technology • Aerospace and defense industries • Cleared or accessed employees • Military personnel • Commercial enterprises (economic) • Visitors • Family, friends or neighbors • Foreign Nationals • Students • Information Systems and Security • Laser, Optics and Sensors • Aeronautics Systems • Electronics • Marine Systems • Positioning, Navigation and Time • Space Systems • Materials and Processes • Ground Systems • Armaments and Energetic Material

8. Counterintelligence identifies and deals with foreign intelligence threats to the U.S. The core concern is with foreign intelligence services (FIS) and similar organizations of non-state actors (e.g., transnational terrorist groups) Counterintelligence has two missions Defensive Mission: Protecting the nation's secrets and assets against foreign intelligence penetration Offensive Mission: Discovering foreign intelligence organizations plans to better defeat them • Threat Awareness • Counterintelligence

9. Threat Awareness • Counterintelligence (cont.) • Foreign Intelligence Services assign intelligence officers to work throughout the world • They are sent under the cover of an official position or as a visitor • They in turn operate “agents,” who collect information on behalf of the foreign government • The main objective of intelligence services is to obtain • Sensitive or classified information • Advanced U.S. technology • Economic intelligence • Foreign Intelligence Officers are frequently evaluating individuals for potential recruitment • Different recruitment techniques or approaches are used • The promise of financial gain • Blackmail • Gaining trust through personal relationships • Seeking out disgruntled employees

10. Threat Awareness • Counterintelligence Collection Techniques • Foreign Intelligence Services (FIS) use every technique possible to gather sensitive or classified information to include: • Unsolicited requests for information e.g., telephone, fax, email, social media, or in person) • Acquisitions of technology and companies • Solicitation of marketing services • Exploitation of • Relationships • Dissatisfactions or personal problems • Foreign visits • Cultural commonality or mutual interest • Conventions, seminars and exhibits • Terrorism and Blackmail • Suspicious internet activity (Hackers or Viruses) • Foreign employees and/or intelligence officers

11. Threat AwarenessPhishing Attempts • Phishing originally used to describe email attacks designed to steal online banking logon credentials • Now used to describe any email-based attacks • Attackers pretend to be from someone or something you know or trust (e.g., your friends, bank or favorite online store) • Phishing uses social engineering, a technique used to fool you into taking an action • Click on a link • Open an attachment • Respond to a message • Phishing attacks work one of four ways: • Harvesting Information (e.g., login credentials, credit card or bank account numbers) • Infecting your computer with malicious links (directing you to an infected site) • Infecting your computer with malicious attachments (e.g., PDF or Microsoft office documents) • Scams (e.g., lottery, charities, disasters)

12. Threat AwarenessPhishing Attempts (cont.) • Ways to protect the{company name} and yourself • Be suspicious of emails • That are urgent or require immediate attention • Addressed using generic salutations (e.g., “Dear Customer”) • Containing poor grammar or spelling mistakes • Do not click on links • Copy and paste the into your browser or type the destination name into your browser • Hover your mouse over the link to verify the true destination of the link • Be suspicious of attachments • Only open expected attachments or verify with the sender via a known telephone number • Use common sense, if the email seems odd or too good to be true, it most likely is an attack • Whenever possible, use a digital signatures and request senders to do the same • Digital signatures verify email is from the sender and has not been altered

13. Threat AwarenessPhishing Attempts – Email #1 (Targeted) Insert example of real emails received at your company and show the detection points within the email. Spoofed email that was crafted to look like it came from senior management or co-workers

14. Threat AwarenessPhishing Attempts – Email #2 (Not Targeted) Insert example of real emails received at your company and show the detection points within the email. Typical spoofed FedEx/UPS email that is received frequently and fools a large number of people expecting packages

15. Threat AwarenessPhishing Attempts Reporting Requirements • Reporting • Report phishing attempts to the Security Department • Use the “Forward as Attachment” function of your email client • Help Desk • Ticket generated and assigned to an analyst • Notification of receipt sent to user • Actions • Determine Recipients • Identify Source • Resolve Links • Identify Attachments • Block URL’s and Sender/IP’s • System Forensics • Outside Agency Notification

16. {Company name} employees are expected to demonstrate responsible use of social media sites Unfavorable and inappropriate information posted in these public forums may potentially cause damage to the {company name}’s reputation and research efforts Use must be consistent with current state/federal laws and {company name} policies, procedures, and guidelines You are prohibited from posting {company name} information that has not been approved for public release Any information posted in public forums must comply with the {company name}’s confidentiality and disclosure of proprietary data policies Social media is a cybercriminal haven for: Stealing personal or company information Obtaining personal information for illicit purposes Spreading malware, viruses, and false information Convincing or scaring people into buying fake security products Phishing attempts, fraud, etc. • Threat Awareness • Social Media

17. Some of the most common gateways to hacker attacks, information theft, viruses and other damaging incidents: Carelessness with passwords Willingness to open unexpected email attachments Ignorance about the risks posed by wireless, mobile devices Naiveté towards social engineers asking seemingly innocent questions Laptop loss due to theft or carelessness Reduced emphasis on physical security of personal work space and materials Cavalier attitude towards security policy and procedures What do they all have in common? They all involve people. • Threat Awareness • Social Media (cont.)

18. Threat Awareness • Social Media (cont.) • Social Media Survey (Help Net Security, 25 Jun 09) • How much of personal information are people willing to compromise? • 1,100 members of Facebook, LinkedIn, MySpace, Twitter and other popular social networks surveyed • Uncovered numerous behaviors that put social networkers' identities and finances at risk: • Two-thirds do not restrict their profile from being visible through public search engines • Over half are not sure who can see their profile • One third include at least three pieces of personally identifiable information • Over one third use the same password across multiple sites • One quarter accept "friend requests" from strangers

19. Threat Awareness • Social Media Defensive Measures • Do • Log off the sites when you are finished • Cancel unused accounts • Avoid clicking on unknown links or downloading files • Mark your profile "private" and not open to public view • Limit use of personal identifiable information (birth date, address, employer, etc.) • Be aware that people can easily assume identities of people you trust in order to gain your confidence • Remember that you are a representative of the {company name} • Don’t • Use the same password for multiple sites • Share your passwords with anyone or cache or save passwords • Use untrusted third-party applications or add-ons • Use your work email address • Share {company name} sensitive or classified information

20. Threat AwarenessForeign Visitors • Visits by foreign nationals to cleared contractors are a common method of operation used to target U.S. technologies • Foreign visitor techniques • Peppering escorts/personnel with questions • Wandering • Practicing “divide and conquer” • Switching visitors • Making last minute additions to the visit request • Switching topics • Purporting to be “distraught”

21. Threat Awareness • Foreign Travel • Industrial and economic espionage is on the rise • As a {company name} employee, you are a potential target for contact and exploitation by foreign intelligence services while on travel • Foreign • Domestic • Basic personal information (e.g., name, areas of expertise/interest and other related facts) are easily discovered by foreign intelligence services • Increased awareness is essential

22. Threat Awareness • Foreign Travel • Collection techniques • Assessment: Friendly discussion with local contacts who assess whether you have information of value and seek to identify any personal attitudes, beliefs, problems or needs that could be exploitable • Elicitation: A ploy whereby seemingly normal conversation is contrived to extract intelligence information of value • Eavesdropping: Listening to other peoples' conversations to gather information in person or using concealed audio and visual devices • "Bag” Operations: Surreptitious entry into someone's hotel room to steal, photograph, or photocopy documents or magnetic media; or download from mobile devices • Surveillance: Following you to determine your contacts and activities. Tracking activities via transactions and internet usage. • Theft: Stealing documents, briefcases, laptop computers or sensitive equipment • Intercepting Electronic Communications: Telephones, fax machines, and computers can all be monitored electronically

23. Threat Awareness • Foreign Travel Defensive Measures • Effective countermeasures before and during your travel abroad include: • Plan and prepare well before your travel • Develop a personal travel plan and give it to your office and family • Learn about the culture, customs, and laws of countries you visit • Maintain a low profile; do not attract attention to yourself, {company name}, or any official U.S. Government affiliation • Be cautious about providing information to anyone you do not know • Refrain from bringing portable electronic devices unless it is mission critical • Only store the information needed for the mission on password protected devices • Use encrypted removable media or hard drives • Maintain personal cognizance of portable electronic devices • Use inconspicuous carrying cases

24. Threat Awareness • Foreign Travel Defensive Measures (cont.) • Remain alert and vigilant • Don’t mention, discuss, or imply involvement in special or classified projects or activities • Never take sensitive or classified material outside of the U.S. without written approval from the Security Department • Avoid moral indiscretions or illegal activity which could lead to compromise or blackmail • Don’t accept letters, photographs, material or information to be smuggled out of the country • Be careful making statements which could be used for propaganda purposes • Don’t sign petitions, regardless of how innocuous they may appear • Remember that all mail is subject to censorship • Be careful not to divulge personal or business matters which could be used for exploitation or propaganda purposes • Never attempt to photograph military personnel or installations or other restricted/controlled areas • Beware of overly friendly people (e.g., guests, interpreters, waitresses, hotel clerks, etc.) whose intentions may go beyond being friendly • Carefully avoid any situation that would provide a foreign service the means for exerting coercion or blackmail • Report any suspicious incidents and contact with foreign nationals to the Security Department

25. Threat Awareness • Terrorism • Terrorism has recently become the most significant threat to our way of life (Foreign and Domestic) • United States primary target of terrorism since 1971 • More than 600 DoD-affiliated persons injured or killed • Property damage in the Millions • Top-level terrorists receive training in Foreign Languages, Principles of Espionage, Counterintelligence, Code Making and Deciphering • Some terrorist training schools include in their curriculum • Irregular naval warfare techniques such as Ship Mining, Sabotage and Civil Aviation Terrorism • Espionage and counterespionage techniques which helps “graduates” run clandestine terrorist networks overseas

26. Threat Awareness • Terrorism (cont.) • Tactics • Bombing (67% of all attacks) • Assassination • Armed raids • Hostage-taking • Kidnapping • Hijacking • Target Selection • Vulnerable • Predictable • Soft Target • Techniques • Surveillance (e.g., foot, vehicle, or combination) • Information Gathering (e.g., public records, coworkers, or trash)

27. Threat Awareness • Terrorism Defensive Measures • Be alert and aware at all times • Know current political climate • Know customs, culture, and geography • Learn important phrases and emergency phone numbers • Don’t advertise your DoDaffiliation • Watch for signs of surveillance • Travel in conservative clothing and keep a low profile • Don’t let your luggage out of your sight • If a terrorist attack occurs • Do not volunteer your identity • If confronted, do not lie • Remain calm and keep a low profile • Avoid street-level rooms • Identify escape routes • Report suspicious behavior to the Security Department • Unattended packages • Unauthorized visitors • Persons taking pictures/videos • Suspicious questions

28. Threat Awareness • Insider Threats - Espionage • A trusted insider • Anyone with legitimate access to information, personnel, or facilities that may intentionally or unintentionally pose a threat • Espionage • Act of obtaining, delivering, transmitting, communicating, or receiving national defense information with an intent to injure the U.S. or provide an advantage to any foreign nation • Common Themes and Motivations • Financial gain for self or others • Disgruntled • Personal entitlement • Embarrass employer by releasing information • Did not realize it was wrong • Those who volunteer to commit espionage represent the greatest source of sensitive and classified information loss

29. Threat Awareness • Insider Threats – Espionage (cont.) • Known Behaviors Not Reported: • Living beyond means • Alcohol Issues • Unusual travel and vacation patterns • Working off-hours and removing packages • Disregard for Security policies • Carelessness • Unreported foreign contacts • Perceived barriers to reporting* • Social influences • Transfer of responsibility • Fear of reaction • Conflict and confidentiality • Disbelief • Fear of being paranoid * From the DoD Personnel Security Research Center

30. Threat AwarenessInsider Threat Indicators Transmittal Suspicious Behaviors Collection Recruitment • Engaging in illegal activity • Failure to report an offer of financial assistance by a foreign national • Failure to report a request for classified • Contact with foreign intelligence, security, or terrorist organizations • Removing classified or sensitive material without authorization • Using unclassified methods to transmit classified information • Improperly removing classification markings • Discussing classified information on non-secure phones or email • Attempting to conceal foreign travel • Operating unauthorized recording devices and PEDs in secure areas • Accessing information systems without authorization • Unusual requests for protected information • Requests to “pencil-whip” destruction documents • Unauthorized classified information storage • Attempting to gain unauthorized access to sensitive information • Attempting to expand access to classified information by volunteering for assignments repeatedly • Extensive use of copy, fax, or computer equipment to reproduce classified material • Repeated or unnecessary work outside of normal duty hours • Unexplained affluence • Attempts to compromise DoD personnel • Unusual trips

31. Former Central Intelligence Agency counter-intelligence officer and analyst Indicators Disgruntled employee Living above means of income Vulnerabilities Greed Professionally unsatisfied Methods and Techniques Contacted Soviet embassy officials Stole classified information Conviction and Sentence Received Pled guilty to charge of espionage Sentenced to Life in prison without parole Threat AwarenessCase Study #1 – Aldrich Ames

32. Former Boeing Engineer Indicators Foreign travel Extensive collection activity Unreported foreign bank accounts/investments Messy office and personal appearance Vulnerabilities Disregard for Security policies Methods and Techniques Exploited unsecure USB port on classified network Copied information to thumb drive and transferred to home systems and media Conviction and Sentence Received Pled guilty to federal felony charge of unauthorized possession of defense information Sentenced to 3 years probation and $25,000 fine Threat AwarenessCase Study #2 – Abraham Lesnik

33. Former FBI Agent Indicators Disgruntled employee Living above means of income Vulnerabilities Ego and greed Methods and Techniques Approached Soviet Union (Russia) Intelligence Agency and offered services Used aliases versus real name Used coded messages Passed intelligence and received payments at drop locations selected by him Conviction and Sentence Received Pled guilty to 15 counts of espionage Sentenced to 15 consecutive life sentences without parole Threat AwarenessCase Study #3 – Robert Hanssen

34. Former U.S. Navy Intelligence Analyst Indicators Extensive collection activity Disregard for Security policies Repeatedly making false statements Unexplained affluence Vulnerabilities Greed Illegal drug use Methods and Techniques Contacted foreign governments Removed classified data and provided to Israel Conviction and Sentence Received Pled guilty to charge of espionage Sentenced to Life in prison Threat AwarenessCase Study #4 – Jonathan Pollard

35. Former U.S. Navy Chief Warrant Officer Indicators Contact with foreign intelligence Unexplained affluence Unreported foreign travel Vulnerabilities Financially distressed Methods and Techniques Contacted Soviet embassy officials Deciphered over one million encrypted naval messages Organized a spy ring to collect classified data Conviction and Sentence Received Pled guilty to charge of espionage Sentenced to Life in prison Threat AwarenessCase Study #5 – Jonathan Walker

36. Former Senior Analyst for Defense Intelligence Agency Indicators Openly expressed dissatisfaction with government Vulnerabilities Ideology (disagreed with U.S. policy) Methods and Techniques Utilized position and influence to misdirect government officials Memorized details and typed them up at home Transferred information onto encrypted disks Communicated through encrypted messages Sent coded numeric pager messages Used water-soluble paper Conviction and Sentence Received Pled guilty to charge of espionage for Cuba Sentenced to 25 years of prison and 5 years probation Threat AwarenessCase Study #6 – Ana Montes

37. Threat AwarenessCase Study #7 – Dr. John Reese Roth Retired University of Tennessee professor Indicators On-going trips to China Affiliations for Chinese education institutions Vulnerabilities Disregard for Security policies and management instructions for not sharing information Arrogance and ignorance Methods and Techniques Allowing foreign national students access to data and equipment Transmitted technical data related to USAF contract for munitions-type UAV to China Conviction and Sentence Received Convicted of 18 counts of conspiracy, fraud, and violating the Arms Export Control Act Sentenced to 4 years imprisonment

38. Threat Awareness • Targeting and Recruitment • Recruitment is obtaining cooperation from an individual to provide sensitive or classified information • Recruiters make careful assessments and remain patient in their cultivation of the target • Prior to making offers to the target they are confident of the targets willingness to cooperate • If the target agrees, he/she becomes and asset (spy) • Recruitment methods • Spot and assess • Place in compromising position • Aid in personal vulnerabilities • Collect biographic data • Evaluate recruitability

39. Threat Awareness • Targeting and Recruitment (cont.) • Contact methods • Email and telephone • Request for information by pretending to be from universities/colleges or business partners • Social Media • Sending friend request in the hopes you will not verify who they are • Pretending to be friends of friends • Assuming the identity of people you know • Social gatherings • Personal contacts • Joint ventures and research provide opportunities to build rapport and elicit information • Seeking employment • Solicitation or marketing services • Research and academic solicitation • Students attempting to work on research projects or working on research papers

40. Threat Awareness • Targeting and Recruitment (cont.) • Recognizing Intelligence Interest • Repeated contact by individuals not involved in the visit purpose • Individuals appearing at every social or business function you attend • Close relationships with individuals working for foreign governments • Accidental “casual” encounters with an unknown individuals • Wants to practice English • Talk about your country, employment, or politics • Buy you a drink because they like you • What to do if you believe you are being solicited for information • Never let your guard down • Practice authorized responses to questions concerning your job Never feel obligated to answer uncomfortable questions • Change the topic, if the conversation is too probing • Maintain professional composure

41. Threat Awareness • Targeting and Recruitment (cont.) • Conferences, Conventions, and Trade Shows • Target rich environments for collectors due to the abundance of technology, engineers, and technical personnel in attendance • Collection Techniques • Elicitation of classified or export restricted information from subject matter experts • Theft of technology on display • Photography • Collection of business cards and other personal information • Gaining access to unattended personal or business electronic devices

42. Threat Awareness • Targeting and Recruitment Defensive Measures • Avoiding Intelligence Interest • DON’T do anything which might be misconstrued or reflect poorly on your personal judgment, professional demeanor, or be embarrassing to you, your employer, or your country • DON’T carry, use, or purchase any illegal drugs. • Keep copies of doctor medication prescriptions; check local restrictions and requirements • DON’T let a friendly ambiance or alcohol override common sense • DON’T engage in "black market" activities (e.g., illegal currency exchange, purchasing local stolen antiquities) • DON’T accept or deliver anything from or to unknown individuals • DON’T engage in any type of political, religious, or offensive activities • DON’T ask for special favors or permits from local government (e.g., permission to travel to a restricted area) • DON’T photograph anything associated with the military or security of the country (e.g., airports, ports, or military installations)

43. Threat Awareness • Trash and Recycle Information • Trash intelligence (TRASHINT) is an easy way to obtain critical information about a target (e.g., individuals, businesses, military or government entities) • Recycling, in particular, may be outsourced, even to other countries • Multiple opportunities for information to be intercepted after being discarded • Trash and recycle containers • Trash and recycle transport vehicles • At destination (trash dump, recycling facility) • A specific document or item, in itself, may not be significant, but when joined with other information, it could be extremely damaging • Finding a single invoice would not necessarily reveal a complete customer list, but several weeks, months ,or years worth may

44. Threat Awareness • Trash and Recycle Information (cont.) • Potential harm to businesses include: • Customer invoices, packing lists, and order confirmations reveal customer and price list • Purchase orders, reveal suppliers and prices paid • Employee and payroll records, expose sensitive personal information • Internal white papers, reports, memos, and printed emails • Internal employee directories • Marketing and development plans • Sales, accounts receivable or payable reports • Potential harm to military and government include: • Deployment rosters and schedules • Maintenance records, showing current deficiencies or increased schedules • Pre-deployment or exercise deliveries and deliverables • Unit strength information • Internal memos and training schedules • {Company name} or military personnel information • Documents showing intent or capabilities

45. Threat Awareness • Trash and Recycle Information (cont.) • Potential harm to private individuals include: • Phone bills • Credit card receipts and other financial records • Personal correspondence • Vacation plans (e.g., printed receipts, ticket confirmations, etc.) • Family records and other information • Employment information • Receipts from recent major purchases • Digital media (e.g., thumb drives, CD’s, etc) • School records • Information that reveal regular schedules (e.g., church fliers, sporting event schedules, etc.)

46. Defensive Measures • Operations Security (OPSEC) • OPSEC process • Identifies, controls, and protects sensitive information that can be interpreted or pieced together by an adversary to derive critical or sensitive information • Top collection techniques include: • Unsolicited requests for information • Acquisitions of technology and companies • Solicitation of marketing services • Exploitation of relationships • Suspicious internet activity • Exploitation of foreign visits • Targeting at conventions, seminars and exhibits • Cultural commonality • Foreign employees

47. Defensive MeasuresWhen can OPSEC be used? • Planning and Forecasts • Planning for Special Events • Special Training Exercises • Plans and Standard Operating Procedures • Methods, Sources, and Technical Tradecraft • At home and on vacation • To supplement existing security procedures • Contracts/Bidding Processes • Software and Source Code • New designs, technical drawings, blueprints

48. Pathways or detectable activities that lead to specific information that, when looked at by itself or in conjunction with something else, allows an adversary to obtain sensitive information or identify a vulnerability An indicator is a “clue” Any information that can be exploited to gain further information, or be combined with other indicators to build a more complete profile of your operations Work schedule What you do at work Financial transactions Presence of specialized equipment Increase or decrease in personnel activity (e.g., meetings, travel, overtime, training, etc.) Sudden changes in procedure Staging of cargo or vehicles Before releasing information, consider the potential value to your adversaries Defensive MeasuresFive OPSEC Elements – Indicators

49. Defensive MeasuresFive OPSEC Elements • Identify Critical and Sensitive Information • What are we trying to protect? • Analyze Threats • Who wants or needs our information or technology? • Who is our adversary (not necessarily an enemy)? • Determine Vulnerabilities • How does our activity actually work, not how we think it works? • Assess Risks • Does the possible loss of information warrant taking steps to reduce or negate the adversary’s potential efforts? • Apply Countermeasures • What solutions can be employed to reduce risks to an acceptable level, whether by eliminating indicators or vulnerabilities, disrupting the effective collection of information, or by preventing the adversary from accurately interpreting the data? • Completing the OPSEC process once is not enough - it must be applied on every project and repeated throughout the project lifecycle

50. Critical or sensitive information, if known by an adversary, can be used to cause a negative impact (e.g., loss of business, liability, or financial failure) {Company name}, Sponsors, Government, Business Partners Critical information (e.g., employee safety, facility design, security vulnerabilities, management decisions) Procedural information (e.g., security requirements, logistics, and personnel or financial statistics) Activity information (e.g., upcoming tests, marketing strategies, release plans, travel plans, and operating locations) Internal information (e.g., Memos, Schedules, Annual Reviews, Org Charts, Job Announcements, Management Reports Financial information (e.g., Projections, Justifications, Financial Plans, procurement plans, Special Purchases, Budget and Contracts, and Supplemental Requests) Logistical information (e.g., unusual equipment, volume or priority requisitions, boxes labeled with operation or mission name) Operational information (e.g., VIP visits, schedules, activities, increased mission-related training, abrupt changes in normal operation) Defensive MeasuresFive OPSEC Elements – Critical Information