What Is OPSEC? Operations Security and Its Origins

What is OPSEC? Operations security is the discipline of preventing an adversary from inferring intentions or capabilities from seemingly harmless, unclassified information. It does not protect secrets locked in a safe — that is information security — but the scattered clues: schedules, routines, orders, photos and conversations that, taken together, say too much.

Short definition

OPSEC is the process of identifying what critical information your own activities reveal and reducing those indicators to an acceptable level of risk.

Before the term: “Loose lips sink ships”

The idea is old. During the Second World War, poster campaigns in the United States (“Loose lips might sink ships”) and Britain (“Careless talk costs lives”) urged civilians and service members not to discuss ship or troop movements. It was security through awareness, still without a method.

The founding case: Purple Dragon, Vietnam (1966)

The modern term was born in the Vietnam War. US commanders noticed that North Vietnamese forces often seemed to anticipate B-52 strikes during Operation Rolling Thunder, as well as ground operations. A team known as Purple Dragon examined the problem and found no master traitor: the enemy was reconstructing plans from observable patterns — predictable communications, notices to civil aviation, logistics routines — without access to classified documents.

According to the history published by the NSA's Center for Cryptologic History, that team coined the phrase “operations security”. The lesson was uncomfortable: a perfect classification system was useless if behaviour itself gave the plan away.

From military lesson to national programme

In 1988 President Reagan's National Security Decision Directive 298 established the US National OPSEC Program and the Interagency OPSEC Support Staff, extending the discipline to other agencies and contractors. Joint doctrine (Joint Publication 3-13.3) describes a high-level five-step process: identify critical information, analyse threats, analyse vulnerabilities, assess risk and apply countermeasures. It is a risk-management framework, not a technical manual.

Modern case: the Strava heatmap (2018)

In January 2018 it emerged that the global activity heatmap released by fitness app Strava in November 2017 hinted at the perimeters and routine routes of military bases in conflict zones, because personnel logged their runs on connected devices. No secret was leaked; public data in aggregate was enough. The US Department of Defense later restricted geolocation features in operational areas.

Modern case: social media at the front

Open-source investigators such as Bellingcat documented, from 2014 onwards, Russian service members in eastern Ukraine using photos the soldiers posted themselves, despite Moscow's official denials. Since 2022 both sides in the war in Ukraine have regulated phone use because signals and posts can reveal positions. It is the flip side of OSINT: whatever an analyst can find, so can the enemy.

Lessons from the case

1. Unclassified information, aggregated, can be as revealing as a secret document.
2. Predictable routines are vulnerabilities: adversaries watch patterns, not just messages.
3. Consumer technology has multiplied the clues each person emits without noticing.
4. OPSEC is organisational culture more than a tool: it works only if people understand why it matters.