Most of what an adversary needs to target you is unclassified. Operations security is the discipline of protecting the harmless-looking fragments that add up to sensitive knowledge — and denying the adversary the picture.
Day 2OPSECCounter-collection
Notes: Day 1 established that the leader is the target and the leverage is upstream. Day 2 opens with the discipline that controls what the adversary can even see.
Lesson 05 · Slide 2
OPSEC is about indicators, not secrets
Your real secrets are already classified and guarded
What leaks are indicators — unclassified observables around the secret
Individually trivial; in aggregate they reveal the secret anyway
OPSEC protects essential secrecy: deny the indicators, protect the decision
The reframe
Stop asking "is this classified?" Start asking "what does this reveal when combined with everything else out there?"
Notes: The core mental shift. Leaders guard documents; adversaries assemble indicators. Reveal one at a time.
Lesson 05 · Slide 3
The aggregation problem
Each fragment below is public and harmless. Press → to add them up.
Calendar invite leaks a city
→
Flight booked, dates known
→
Aide posts a hotel photo
→
Procurement record names a partner
→
Targetable pattern: who, where, when, with whom
Notes: Reveal one node per press. The point lands physically: nothing here is secret, yet the last node is a targeting package. This is why staff and family footprint matters.
Lesson 05 · Slide 4
Which single indicator most helps an adversary build your pattern-of-life?
C. Static facts (A, B, D) barely move an adversary. A live, recurring pattern of where you are and whom you meet tells them when you are predictable and where to intercept you — physically or digitally. Timeliness and repetition are what make an indicator dangerous.
Notes: Many pick A or D. Push the room: targeting needs opportunity in time and space, which is exactly what live pattern-of-life provides.
Lesson 05 · Slide 5
How the adversary collects
OSINT — open sources: your site, social media, registries, leaks, the press
HUMINT — people: staff, suppliers, contacts, elicitation at events
SIGINT — communications and signals: who talks to whom, when, from where
Technical — devices, networks, metadata, side channels
They combine disciplines
No single feed is decisive. The adversary fuses cheap OSINT with a little HUMINT and technical collection until the picture resolves.
Notes: Keep conceptual, not tradecraft. The message: defence must assume fusion across all four, not just "lock the documents."
Lesson 05 · Slide 6
The OPSEC process — five steps
A repeatable loop you can run on any activity. Press → to build it.
1 · Identify critical information
→
2 · Analyse the threat
→
3 · Analyse vulnerabilities
→
4 · Assess the risk
→
5 · Apply countermeasures
Notes: Reveal the cycle step by step. Emphasise it is a loop — you re-run it as activities and threats change.
Notes: Steps 1–2 are the ones executives skip. Naming the critical information is half the battle.
Lesson 05 · Slide 8
Steps 3–4: vulnerabilities and risk
3 · Vulnerabilities
Where do your indicators leak today?
Calendar, travel, staff posts, suppliers, devices
4 · Risk
Likelihood × impact of the adversary connecting them
Prioritise — you cannot close everything
Notes: Risk assessment keeps OPSEC proportionate. Not every indicator is worth a countermeasure.
Lesson 05 · Slide 9
Step 5: countermeasures
Deny — remove or withhold the indicator (tighten calendars, quiet travel)
Disrupt — break the pattern (vary routines, split logistics)
Degrade — reduce fidelity (fewer public details, delayed posting)
Extend the discipline — to staff, family, and suppliers who leak on your behalf
Notes: Countermeasures are cheap when chosen deliberately. The last point is the executive multiplier: your circle is your surface.
Lesson 05 · Slide 10
Counter-collection for leaders
Pattern-of-life — make your movements less predictable and less published
Travel signature — minimise advance public detail; compartmentalise logistics
Digital exhaust — prune the metadata trail you and your apps emit
Your circle — brief aides and family; their posts are your leaks
Leadership move
You set the norm. If your office treats travel and calendars as sensitive, the whole team's signature shrinks.
Notes: Connect to Lesson 03 (aggregation into a principal) and Lesson 07 (travel). Counter-collection is active, not paranoid.
Lesson 05 · Slide 11
Privacy as a counter-collection weapon
In Ukraine, leaders learned that privacy is not comfort — it is defence. Denying the adversary your pattern is a force-protection measure, not a lifestyle preference.
The mindset
Every fragment you withhold is one the adversary must pay to collect elsewhere. Counter-collection raises their cost and lowers your exposure.
Notes: Ties back to Lesson 01's "privacy as counter-collection." Reframes discretion as an operational control.
Lesson 05 · Slide 12
Two-minute drill: map your weekly signature
On paper, list your recurring movements this week — the standing meeting, the commute, the regular trip — and mark which are publicly discoverable. That list is your adversary's starting point.
Notes: Start the timer. This turns the abstract into something personal and uncomfortable — which is the teaching moment. Homework extends it into a full 5-step pass.
Lesson 05 · Slide 13
Recap & what's next
Adversaries assemble unclassified indicators into sensitive knowledge
The five-step OPSEC loop makes protection deliberate, not accidental
Counter-collection extends to your travel, your exhaust, and your circle
Next
Lesson 06 — Personnel & Insider Security: the trusted people inside your surface.
Notes: Bridge: OPSEC controls what the outside can see; insider security controls the trusted inside. Both shrink the surface.