Facilitator Notes & Model Answers — Lesson 05
For instructors and self-study · Model OPSEC analysis and poll rationale
Model OPSEC analysis — Principal M
| Step | Model output |
|---|---|
| 1 · Critical information | Which decisions M is about to make; when and where M travels next; who M is meeting; which suppliers M relies on |
| 2 · Threat | A hostile service (wants decisions & relationships; strong OSINT + technical) and a criminal group (wants access & money; OSINT + HUMINT) |
| 3 · Vulnerabilities | Widely shared calendar; advance-published travel; aide photos with location; procurement records naming partners; mixed personal/corp devices |
| 4 · Risk | Highest: live calendar + travel signature (predictable interception). Next: aide posts (confirm location). Lower: static bio |
| 5 · Countermeasures | Deny: restrict calendar detail/audience. Disrupt: vary routes/timing; compartmentalise logistics. Degrade: brief aides to delay/scrub location posts |
Why the poll answer is C (recurring calendar & travel, in real time)
- A — job title: useful context but static and already public; it does not create opportunity.
- B — old photo: low value; dated and non-actionable.
- C — live recurring pattern: tells the adversary when you are predictable and where to intercept — the ingredient targeting actually needs. Timeliness and repetition are what make an indicator dangerous.
- D — laptop brand: minor technical detail; rarely decisive on its own.
Teaching point: participants over-weight static, "sensitive-sounding" facts and under-weight live, mundane patterns. Opportunity in time and space is the currency of targeting.
Homework — what good looks like
Task 1
A strong analysis names non-obvious indicators (e.g., the aide who confirms arrival by posting) and ends in owned countermeasures, not vague "be careful." The best submissions assign the behaviour change to a specific person.
Task 2
Good wording is concrete and framed as protection: "Could you hold off posting our location until we've left? It helps keep the team's movements private." Blame-free and actionable beats "stop posting."
Task 3
Any real setting change counts; the learning is recognising that apps publish pattern-of-life by default.