What is OPSEC? One fact the wrong person must not be able to assemble
What is OPSEC? A process for keeping one fact from a person who would use it, by controlling the ordinary traces that point at that fact. Operational security is the everyday name. The manuals, and the Army's 5 February 2026 explainer, title it operations security. They are written for a unit. For a person, the critical information is a name, a source, an address, or a payment.
OPSEC is a process of identifying critical information for mission success by analyzing how adversaries might learn this critical information and taking the countermeasures required to prevent the adversaries from interpreting or piecing together critical information in time to be useful.
The same article then recommends unique passwords, a VPN on public Wi-Fi, two-factor authentication, browser tools, and a cover for the camera. The Defense Department's OPSEC manual, Change 2 of 29 October 2020, says countermeasures are not risk-avoidance measures to be pulled from a list. A list with no adversary on it cannot tell you which fact you were protecting. The camera cover is fine. It is not an answer to who is asking.
Start with the person, not the tool
Someone who lives with you does not need your traffic. The phone is on the table, the mail is on the counter, and they already know what time you are awake. A company that issued the laptop can read what that laptop does. An exchange that took your passport already has the name on the purchase. Those are three different adversaries, and a VPN is the wrong first move for all three.
| The person | What they already have | The change that matches them |
|---|---|---|
| Someone with the keys to the house, or to your unlocked phone | The device, the accounts that stay logged in, the paper on the desk | A second device they do not know about, for the life that has to stay separate. A PIN they have watched you type is not a secret. What a locked phone still gives up is worth reading only if they do not already know the PIN. |
| An employer, a school, or anyone who administers the machine | The login, the network, often the disk | The other life does not get signed in there. Their chat app is their record. A messenger they do not administer is the relevant change, and only for the conversations that are the fact. |
| An exchange, a bank, or a phone company | The legal name, the payout, the number used for recovery | What you do after the payout is a different page. A public chain still shows the payment. A private one does not erase the file the company kept. The phone number on the account is a trace you handed over on purpose. |
| Whoever bought an old breach | A password, an email, sometimes a number, from a leak that already happened | An email check shows some of those old breaches and hides others until you prove the address. Reusing the password is the trace that is still live. The leak itself is not something a new browser undoes. |
| Someone who can watch your connection and the far end | Timing, if they have both | The public cases are collected on the Tor page, and they do not start with someone solving the network. No setting on this page cancels a watcher at both ends. Knowing that is the point of naming them. |
The manual's threat questions are plain: who is the adversary, what do they intend, what can they do, what do they already know. "Hackers" fails the first question. A named person, or a named kind of office, passes it. If you cannot say what they already hold, you are about to add a tool for a stranger you invented.
Critical information is the question they are asking
Critical information, in the manual, is what an adversary wants because it would help them and hurt the thing you are trying to do. The method it recommends is to ask their questions. It calls those questions essential elements of friendly information. The answers are the critical information. For a unit the examples are an attack's time and place, a weapon the other side cannot yet see, a shipment of equipment that would tell them to change tactics. For a person the answers are shorter, and they are usually embarrassing to write down because they are specific.
The legal name behind a pseudonym. The fact that a particular employee talked to a reporter. The street where someone sleeps. The account that still receives the coins. One or two of those. A page of "my data" is not a list of critical information. It is a mood. The manual wants the answers compiled into a list the people involved actually see, and it says the steps need not run in order as long as every element is present. On paper, for one person, the list is a few lines. If you cannot say the fact in a sentence, you do not have one yet.
The Navy's December 2022 manual adds the part people skip: information that is critical in one phase of a job may not be critical in the next. The name of a source matters until the story is published with their consent, and then a different fact matters. The address matters while you still live there. Rewrite the sentence when the situation changes. A list you made in a panic and never looked at again is how last year's fact keeps dictating this year's tools.
The traces are ordinary, and they add up
An indicator, in that Navy manual, is a friendly action or a piece of open information an adversary can detect and then interpret back into the critical fact. One indicator is usually harmless. Several, pieced together with other unclassified information, can reveal the thing you were protecting. The manual's word for the piecing is data aggregation. It quotes Washington on minutiae: things of a trifling nature, joined to others, lead to a conclusion.
The traces a person actually emits are dull, which is why checklists miss them. A username carried from a real-name account into the place that was supposed to be separate. A photograph whose room, window, or badge is still in the frame after the file's hidden data is long gone. A clip of someone's voice on a public page is a trace too, and the use is a phone call to a parent. That call has its own page. The hour you always show up, which is a time zone wearing a habit. A phone number you typed because a form asked for account recovery. A payment that already has your name on the sender's side. The Tor cases that begin with a name the person had already used are this pattern with the court record attached. The network was not the leak. The indicator was.
Privacy, in the narrow sense, is a property of a channel: who can read this message, who can see this address. OPSEC is the decision about which fact that channel was supposed to protect, and which traces are still sitting outside it. A sealed message from an account that has your legal name on the recovery address protected the sentence and published the sender. The Navy manual is explicit that OPSEC does not replace the other security disciplines. It sits beside them and asks what their leftovers still show.
The measure has to be cheaper than the loss, and it can betray you
Once the risk is real, the manual tells you to weigh the measure's effect against its cost in money, time, and effort, and against the damage if you do nothing. It adds a third test people rarely run. The countermeasure itself might be an indicator. A second phone helps if nobody knows it exists. A second phone you explain, label, and charge on the kitchen counter is a new trace that says there is a second life. A hardened setup so unusual that you are the only person on the block with it does the same job. Blending in is sometimes the measure. Looking like a checklist is sometimes the leak.
That is why the Army article's daily list cannot be the practice. Passwords, a VPN, two-factor authentication, and updates are reasonable answers to some adversaries and noise against others. Two-factor authentication stops a stranger replaying an old password. It does nothing about a person who watches you approve the prompt. A VPN is one company that can see the path, which helps on a cafe network and does not help against the employer who owns the laptop. Adding one to Tor is its own decision, and it often fails. Pick the tool when the trace you wrote down is the channel that tool covers. Picking it because the list was ashamed of an empty slot is how you collect indicators.
A few matches, so the refusal is not an excuse to do nothing. If the computer can be taken, what it still shows is the Tails and Whonix choice, and it depends on whether the session has to vanish or the work has to still be there tomorrow. If the phone can be taken and the PIN cannot, the locked-phone page is the one to read, not this one. If the trace is a coin with a name already on the purchase, the crypto pages own what the chain still shows. None of those substitutes for the sentence at the top. They are what line four looks like when a tool really is the answer.
Four lines, before you install anything
Do this on paper. A note in the account you are trying to keep separate from the fact is another indicator.
- The person. A name, or a job: the partner, the employer's admin, the exchange, the office that can ask the exchange. If the line says "hackers," it is blank.
- The fact, in one sentence. What they could do with it, this month, if they had it. A sentence you cannot finish means you are protecting a feeling.
- The traces you are emitting this week that point at the fact. A login, a photograph, an hour, a number, a payment, a machine someone else administers. Enough of them to see how they combine. A list of forty is how you avoid picking one.
- For each trace, stop it, or write down why stopping it costs more than the loss. The manual's comparison is the benefit of the measure against the cost of doing it and the cost of the fact getting out. The refusal is part of the work. A life in which you hide everything is visible as a life that is hiding.
Filled in, for a shape that comes up constantly: a reporter and a source who still has a job. The person is the source's employer. The fact is that this employee is the source. The traces are a work laptop, a work email, and a meeting in a lobby the company cameras. The work account goes. The lobby might stay, if the conversation had to happen in person, and that acceptance gets written down so it is a decision and not a slip. The replacement channel is a messenger the employer does not run, on a device the employer did not issue. Tor, a VPN, and a new browser do not appear, because none of them was the trace.
When the phase changes, the Navy manual says the critical information changes with it, and a measure that worked against one adversary may not work against the next. Redo the four lines when the person changes or the fact does. The Army's sixth step, assess whether it is still working, is that redo. It is not a second shopping list.