The moment armies transmitted, their operations were being exposed as unclassified observations. In theory this was a risk since the first ever conflict, yet in practice we see a turning point with modern radio because of the sheer scale of the problem. And that’s arguably where a hacker history of OPSEC starts.
August 1914 seems the foundational moment in doctrines of modern secrecy. Russia’s Second Army under General Samsonov marched into East Prussia sending its orders by radio, often in the clear, and the German staff officers under Max Hoffmann simply listened. They knew where the Russians were going before the Russians arrived, and the result was the encirclement at Tannenberg, one of the most lopsided defeats of the war.
Two months later the British Admiralty stood up its famous Room 40 to do the listening professionally, and within two years both sides had learned that an enemy transmits far more than the words in its messages. Which station talks to which, how often, from where, and in what rhythm all reveal the future of battle. That craft became known as traffic analysis, and defending against it demanded what would much later get a name: operational security, or OPSEC.
By the end of WWI all sides were using radio silence discipline, call-sign rotation, dummy traffic, as well as entire state censorship regimes, such as DORA in Britain from 1914, or the Espionage Act and Creel Committee apparatus of 1917.
Of course WWII brought it all back into practice again, analysis of one’s own operations from the view of the enemy’s eyes.
Deception programs were built around the observation of the enemy’s behavior, such as the unbelievably successful Allied Operation Bertram, which fed the German Panzerarmee’s intelligence staff a false picture of the timing and axis of the October 1942 attack at El Alamein; Rommel himself had left for Berlin to party with Hitler (receive a field marshal’s baton, star at a Sportpalast rally, and assure the press that Germany held the door of Egypt in its hand, before he settled into the Heereskurlazarett relaxation at the Semmering resort). Hitler’s desperate midnight phone call pulled his “fox” out of an “alpine cure” (spa treatment) as his men were being out-observed into a total rout.
The London Controlling Section came by 1942 and then the American equivalent Joint Chiefs’ Joint Security Control in 1944. BODYGUARD, the 1944 deception plan covering the Normandy invasion, treated every convoy schedule, radio net, and press release as a signature to be shaped. The same war supplied the canonical failure, B-Dienst reading the convoy traffic of the Atlantic, and the state-level Office of Censorship from December 1941 and the careless-talk campaigns from 1942, evolving into posters on high-risk American defense office walls well into the 1980s. I remember seeing some still hanging in 1994 even, the genesis of my own award-winning security awareness campaigns.
The Vietnam War offers an interesting footnote. American bombers kept arriving over targets where the enemy was already waiting, both the B-52 strikes called ARC LIGHT and the long air campaign against the North called ROLLING THUNDER. In 1966 a joint investigation team codenamed Purple Dragon went looking for the spies and found none. The giveaways were all in plain view: refueling tankers launched hours ahead and circled in predictable orbits, strikes ran on stereotyped schedules, and radio warnings meant to keep friendly aircraft clear of the target also told anyone listening where the target was. The enemy just watched and counted, which is the Tannenberg lesson of WWI and the wartime method of the Joint Security Control all over again.
NSA’s own declassified history is unsparing about the causes of failure, calling it ignorance of history, and the team coined the term OPSEC precisely so the lesson would finally have a name that would land and stick. Unsurprisingly, briefings on the subject like to reach back to Washington’s letter of 26 July 1777 to Elias Dayton, on how even the smallest trifles of information are worth collecting, as evidence that nobody should be claiming novelty on a practice as old as conflict itself.
Then, fast forward to 1987, with personal computers now settled onto corporate desks, when the monthly journal of the American Society for Industrial Security, Security Management, ran an article on control selection that introduced its readers to the Department of Defense methodology of OPSEC. On page 81 of volume 31 the “operations security” pioneered by the department was made applicable to corporate control planning, and defined:
OPSEC denies information to adversaries by identifying, controlling, and protecting indicators
This was simply Defense doctrine of that period; JCS Pub 18 had set joint operations security policy on 25 October 1974. DoD Directive 5205.2 established the department-wide program in 1983 so the transition to civilian information security four years later was reasonable. NSDD 298 carried the same identifying, controlling, and protecting language into national policy a few months after the article ran, on 22 January 1988, creating the Interagency OPSEC Support Staff. The trade press was circulating the formula and then the White House standardized it. This was somewhat common knowledge within hacker circles, not least of all because of all the news about the 414s, such as the cover of Newsweek in 1983; two years after the Security Management article, “Hagbard” of the KGB hacking case disappeared, leaving only a ring of fire in a remote German forest.
The civilian readership was arguably prepared also by military service. The Air Force pamphlet You and OPSEC went through the U.S. Government Printing Office in 1975, fourteen pages of second-person instruction distributed to airmen. U.S. Army Intelligence and Security Command published A Road Map to OPSEC: The 902d Military Intelligence Group in 1984, seventeen pages describing the counterintelligence unit’s OPSEC survey services. Federal depository distribution put this material out in the open for everyone to see; the digitized copy of the 1984 guide is on the shelves at the University of Illinois at Urbana-Champaign, famous for its role in early Web development. The genre descends from the wartime information campaigns that had been teaching the same silence discipline to the whole population a generation earlier. Security Management’s audience in 1987 included the veterans and cleared-facility officers that this material had trained over the preceding decade. Nobody really forgets the best OPSEC training, which is the whole point.
A second commercial thread then starts to flourish in the early 1990s, oriented to that era’s fears around economic dominance and threats of espionage. Protecting Corporate America’s Secrets in the Global Economy, published by the American Institute for Business Research in 1992 (253 pages, Cornell’s depository copy), applies the acronym within a threat model of foreign intelligence services collecting U.S. business information. The surrounding institutional activity becomes an OPSEC Professionals Society formed in 1990. IOSS ran industry outreach under NSDD 298 throughout this time, and Congress passed the Economic Espionage Act in 1996. In the same way corporations were starting to adopt encryption from the military, they also adopted the OPSEC that the military ran in the original doctrine, including foreign services as a shared adversary.
Methodology as Merchandise
Some may remember the moment Check Point launched its partner program in 1997 under the clever OPSEC brand. It was promoted through the company’s own SEC filings as their Open Platform for Secure Enterprise Connectivity, but the appropriation wasn’t subtle. Dan Blacharski’s Network Security in a Mixed Environment, a 1998 trade manual, shows how the acronym bled into eight long and dense pages of firewall coverage, starting page 400. Even Phrack started talking like this too, looking at issue 56, May 2000, which is a reference-list pointing back at the Check Point platform instead of the OPSEC it was referring to. Through the early 2000s the acronym registers in InformationWeek as well. And Network Magazine took that marketing baton and ran with it across twenty pages in early 2003 alone, as Check Point’s partner certification exploded and made OPSEC into standard product-coverage vocabulary. Meanwhile, actual practitioners of security operations continued preserving the real meaning; JP 3-13 counted OPSEC as a capability of information operations in October 1998, and the Journal of Information Warfare was writing it into volumes 3 and 4 in 2004.
Hacker publications of course talked about the practice of hiding tracks, yet they tended to not adopt large institutional military vocabulary. Agent Steal’s guide to federal prosecution, bylined in the text “From Federal Prison, 1997” and published in Phrack 52 in January 1998, covers source protection, informants, wiretaps, and sentencing without sounding like it’s from the government. The term had been in continuous commercial print for a quarter century by the time a hacker conference speaker started promoting it as being novel at Ekoparty in September 2012, while also admitting he had overheard ex-government hackers (e.g. NSA) using the term. Phrack finally absorbed this all in issue 69 of 2016, as if it had been there all along.
And so the oldest discipline, re-branded after multiple military lessons of the first half of the 20th century, was known as OPSEC in computer hacking circles since the 1980s. This blog was writing about “Ctrl-Alt-Del when you leave your seat” in January 2006, not because it was ahead but because it was so late. Usage simply depended on how much someone wanted to reveal knowledge/alignment with state-based military culture, like a civilian who says FUBAR, klicks instead of kilometers, or asks for a SITREP instead of an update. For many, it’s poor OPSEC to say OPSEC.
