Think Like the Wolf

Is your fire department involved in hazardous materials or weapons of mass destruction (WMD) responses, criminal investigations, counterterroism planning, terrorism responses or planning for special events? Is this information sensitive and, if so, how do you keep it away from terrorists and other criminals? How does Operations Security (OPSEC) apply to public-safety agencies?

For fire departments, other public-safety agencies and special operations teams that are involved in planning and training for special events and terrorist incidents, it is critical that OPSEC be used in planning and training efforts. OPSEC is a five-step risk-management process used by military and security professionals to protect sensitive information that adversaries could use to their advantage and your disadvantage. OPSEC does not replace other security measures; it supplements them. As our society becomes more complex and gives rise to many intricate problems, first responders must gain additional knowledge and understanding to protect themselves, their families and the public we are sworn to protect.

Here are examples of why you and your department need to look at implementing an OPSEC program. Is your department involved in:

•Public-safety training and field exercises? (Exercises help us improve, but they also reveal our weaknesses.)
•Emergency management or infrastructure planning and protection?
•WMD and hazmat planning and training?
•Planning for and managing VIP visits such as the President?
•Planning for and managing special events?
•Criminal investigations?
•The Clandestine Drug Lab Task Force?
•A local terrorism task force?
•A local arson task force?
•A special operations team?
•A local tactical medical support team?

Terrorists and organized criminals can take weeks and even months to select their targets and plan their operations. To be successful, they need specific information about personnel, response plans, capabilities and infrastructures. Public-safety managers must look at their organization through the eyes of a potential adversary or "bad guy" and ask themselves, "If I were a terrorist or criminal, could I use this information to harm the agency or disrupt its mission?"

The information that is often used against public safety agencies is not classified; rather, it is information that is openly available to anyone who knows where to look and what to ask. We in public safety don’t always realize how much we are giving away by our predictable behavior, casual conversations and Internet information.

According to an Al Qaeda training manual for Jihad that was recovered in Afghanistan, "Using public sources openly and without resorting to illegal means, it is possible to gather at least 80% of the information about the enemy." According to U.S. Department of Defense (DOD) sources, "For Official Use Only" and other sensitive but unclassified information – such as concepts of operations, operation plans and standard operating procedures – continues to appear on public DOD websites.

In 2002, reviewers found more than 1,500 such discrepancies in government websites. Open-source information is the source of the bulk of adversaries’ intelligence. Internet websites are just one example, along with news reports, telephone directories, travel orders, job announcements, budget documents and newsletters. Bits of information from open sources can be pieced together to form a more complete picture.

An adversary can be anyone who is collecting information about you and your organization and intends to use this information to defeat your operations or plan an attack against you and your resources. This can include terrorists, extremists, organized criminals, drug traffickers and computer hackers. It appears that criminals and terrorists are more determined, violent and heavily armed than ever before, and crisis situations such as terrorist events, organized crimes, active shooters, barricaded subjects and hostage-takings are occurring with alarming frequency.