The New OPSEC regulation.

I'll start with my BLUF (Bottom Line Up Front):

My senior PAO buddy provided for me that which is the "quotation of the rotation."

The funniest quote I've seen so far is some specialist in today's Stars/Stripes who basically said, if the Army plans on enforcing this like they enforce height and weight standards, then I'm not that worried.

It's problematic to discuss the regulation in detail, as the regulation itself is classified FOUO, and I hold a clearance, so I'm covered by that FOUO marking. This is true even though it's out there in the wild, since it was forwarded to me by a journalist. I told him, that as someone with a security clearance, regretfully I would be unable to return his .pdf and would have to drop it off at my local classified digi-shredder.

There's been lots of bloviating on the subject. For a good one-stop shop on the subject, go visit Noah Schachtman at his Wired blog, Danger Room. Of particular interest would be these bits:

First, a discussion (including your's truly) on the initial release is here.
To read Noah's interview of the author of the reg, Major Ray Ceralde, go here.

Here's my take, and in keeping with my muddle-of-the-road squishiness, I don't think the sky is falling. It will only be tiles of the sky falling, in those areas governed by weak commanders, who will default to requiring approval for everything because they are timid and risk-averse, or worse, the ones who see any post as a threat - mostly because they, themselves, might be the subject of unflattering commentary. Of course, they will then end up banning everything because they won't be able to keep up with the flow. No one could.

Most Commanders will try to find a happy medium, and as long as the troops are making a good honest effort to comply with the perfectly legitimate requirements of OPSEC, they will make a good honest effort to keep the Heavy Hand of Censorship and the UCMJ laying dormant in the desk drawer.

*That* said... I feel sorry for Major Ceralde, as he finds himself in the middle of this and tries to spin his way through things that the simple wording of the regulation contradict.

I'm with Army Lawyer on this, and I think that Noah was a little surprised by my take that this wasn't as bad as many people think - although the devil is in the details.

My response has been more along the lines of... the Army shot itself in the foot, needlessly, and... because the Army *still* does not understand the Internet and the revolution in communications therein represented and facilitated. Sadly, our enemy understands it much better than we do.

When the reg was staffed, either Big Army PAO was not included, or they were asleep at the switch. I don't know which is true - but I do know a "senior Army PAO official" the guy who provided the opening quote for this post.

My initial perspective is that this

1-couldn't have come at a worse time, right before the milbloggers conference. In particular, I'm afraid that our young CENTCOM Cpt gets his a$$ kicked by an angry mob who doesn't fully appreciate that this guy is as blindsided as anyone.

This refers to Captain Tony Deiss, who will be on my panel tomorrow at the Milblogger Conference - keep in mind, everybody - CPT Deiss didn't write the reg, doesn't know much more about it than we do - and is CENTCOM's rep, not Big Army's.

2- [This] isn't something we going to enforce proactively, we don't have the time or resources, so we're going to rely on punishing one or two people as an example to reach our real goal...a "chilling effect" on others.

I agree, completely. We'll be very French, ala Voltaire in Candide "Dans ce pay-ci, il est bon de tuer de temps en temps un amiral pour encourager les autres. "In this country it is good to kill an admiral from time to time, to encourage the others." Heh. Betcha weren't expecting Voltaire to rear his head this morning, were ya? Ain't a classic education grand?

3-We seem to forget that we have punished people already for violating OSPEC and made changes (see CB's comments on water and ammo and the results thereof).

Exactly.

4-it's like asking for extra gun control...when laws against murder won't stop killers, what makes us think that laws against guns will? Well, the real goal is an unarmed populace...the same thing seems to be going on here. It would "just be easier if those damn bloggers would stop altoghether."

The gun-controller's answer to that question is "But it will make people feel safer. Not a great basis for policy, but a powerful incentive, nontheless, and actually a key component of British efforts at gun control. But that's a different post for a different time.

The Army has scrambled and put out an official response:

Fact Sheet Army Operations Security: Soldier Blogging Unchanged

Summary:
o America’s Army respects every Soldier’s First Amendment rights while also adhering to Operations Security (OPSEC) considerations to ensure their safety on the battlefield.
o Soldiers and Army family members agree that safety of our Soldiers are of utmost importance.
o Soldiers, Civilians, contractors and Family Members all play an integral role in maintaining Operations Security, just as in previous wars.

That's unobjectionable

Details: • In no way will every blog post/update a Soldier makes on his or her blog need to be monitored or first approved by an immediate supervisor and Operations Security (OPSEC) officer. After receiving guidance and awareness training from the appointed OPSEC officer, that Soldier blogger is entrusted to practice OPSEC when posting in a public forum.

I've made this point before in discussions of the subject - the key here is the commander and how he or she defines their Essential Elements of Friendly Information, which define those topics that relate to OPSEC. The fact remains, however, that the reg allows a commander the default position of any item posted to a public forum.

In other words - Blackhawk or MajMike wants to post a comment on this blog. Technically, under the reg, the commander has the ability to require they submit it for approval. In practice, not practical, and if the EEFI has been defined properly, sufficient guidance will have been provided that will allow both of those soldiers to screen their post themselves - which I believe is the *intent* of the regulation.

• Army Regulation 350-1, “Operations Security,” was updated April 17, 2007 – but the wording and policies on blogging remain the same from the July 2005 guidance first put out by the U.S. Army in Iraq for battlefield blogging. Since not every post/update in a public forum can be monitored, this regulation places trust in the Soldier, Civilian Employee, Family Member and contractor that they will use proper judgment to ensure OPSEC.

o Much of the information contained in the 2007 version of AR 530-1 already was included in the 2005 version of AR 530-1. For example, Soldiers have been required since 2005 to report to their immediate supervisor and OPSEC officer about their wishes to publish military-related content in public forums.

o Army Regulation 530-1 simply lays out measures to help ensure operations security issues are not published in public forums (i.e., blogs) by Army personnel.

• Soldiers do not have to seek permission from a supervisor to send personal E-mails. Personal E-mails are considered private communication. However, AR 530-1 does mention if someone later posts an E-mail in a public forum containing information sensitive to OPSEC considerations, an issue may then arise.

• Soldiers may also have a blog without needing to consult with their immediate supervisor and OPSEC officer if the following conditions are met:
1. The blog’s topic is not military-related (i.e., Sgt. Doe publishes a blog about his favorite basketball team).
2. The Soldier doesn’t represent or act on behalf of the Army in any way.
3. The Soldier doesn’t use government equipment when on his or her personal blog.

I would note that last three bullets apply to me by my employer. Just substitute my company's name for Army/Government and that reads like our corporate policy.

• Army Family Members are not mandated by commanders to practice OPSEC. Commanders cannot order military Family Members to adhere to OPSEC. AR 530-1 simply says Family Members need to be aware of OPSEC to help safeguard potentially critical and sensitive information. This helps to ensure Soldiers’ safety, technologies and present and future operations will not be compromised.

Nor did the reg read like it did require commanders to try to exercise that non-existent authority - but it did push commanders to make sure that family members were included in the understanding of what OPSEC was and why it was important, and if you've read some milspouse blogs... well, you understand 1st IO's concerns in that regard. This has been a touchy issue for decades - like I said to Noah, though I was talking about soldier-to-soldier conversation - the change is that we used to have these discussions with each other sitting at the bar in the O'club. Then the Army killed the club system by killing their alcohol sales... and the commentary went to the bars downtown and now, on the Internet. And because the discussion is on the Internet, it's now a conversation being held to a world-wide audience, which is the problem underlying the regulation.

• Just as in 2005 and 2006, a Soldier should inform his or her OPSEC officer and immediate supervisor when establishing a blog for two primary reasons: 1. To provide the command situational awareness. 2. To allow the OPSEC officer an opportunity to explain to the Soldier matters to be aware of when posting military-related content in a public, global forum.

• A Soldier who already has a military-related blog that has not yet consulted with his or her immediate supervisor and OPSEC officer should do so.

• Commands have the authority to enact local regulations in addition to what AR 530-1 stipulates on this topic.

The deer in the headlights look of the Army PAO and poor ol' Major Ceralde simply support my contention that the Army, unlike our enemies in the Long War, still just doesn't get the Internet. I commend to them the CENTCOM PAO, who has been working to find a good modus vivendi.

Most commanders understand a key rule of leadership: Don't give orders you *know* won't be obeyed. Commanders who go medieval on their soldiers regarding this will simply shut down the supportive and thoughtful voices, and leave the battlefield to the angry and disenchanted. Exactly the opposite of what 1st Information Operations Command wants, if they are thinking strategically. As in this discussion from the Small Wars Council:

This sounds alot more like a Super FOB [Forward Operating Base] IO [Information Operations] strategy. We'll build these walls around us and communicate only on approved internal lines of communication with internal approval of approved internal discussions so that we can ensure we are discussing approved questions with approved solutions which we will then disseminate at approved CTC and publications. The latency will be huge! The timeliness of useful information which can be placed in the correct context so that it can be applied will be largely neutralized. But we will be safe.

OK - this may not have been the intent - but that may not matter if someone does not clarify the directive - remember perceptions are reality.

I'd argue that while the enemy is prosecuting a very effective IO campaign and use of the Internet, we are tightening the chastity belt for fear of misuse. There probably has been some screw ups - but how do you measure the subjective value vs. risk? We are a quantitative bunch at heart facing a foe who is willing to be subjective. Are we fighting the fight we have or wishing for the one we'd like? Is developing a real information warfare capability vs a better bank vault beyond us? I know people who sit on information for total fear they will be held accountable for its release - they are largely inn effective, but they are safe. They are not concerned about the mission any where near as much as they are self preservation and will often use it as an excuse for lethargic behavior.

While the risks must be known and mitigated / minimized, don't assume the enemy will operate under any restrictions. How much terrain does a defensive position control - only what it can see and reach - and these days that is very limited given that the key terrain is Human.

You can read the rest of that by clicking here. Blackfive holds forth here, and there's a bunch of stuff over at Milblogs.

Update: Entropic Memes is, ahem, not impressed by the PAO release. Nice bit of snark, fellas.

It’s not a policy statement. It’s not a clarification of orders for DA personnel. It’s, as the Brits might say, bumpf. Disingenious bumpf, at that, which is directly contradicted in no less than four places by the actual text of Army Regulations 530-1. It’s a PR stunt, and I think everyone so far recognizes it as such, because even the most gung-ho milblogs to print the text of the “fact sheet” so far have neglected to include the final bullet point, found on page two - “Commands have the authority to enact local regulations in addition to what AR 530-1 stipulates on this topic” (emphasis mine.)

I would note *this* gung-ho milblogger posted the final bullet point...