Executive OPSEC & Counter-Collection

Reading time ~12 minutes · No technical prerequisites · Day 2, Module 2.1

Day 1 established an uncomfortable premise: you are personally the target, and the leverage an adversary needs sits upstream of your secrets, in the ordinary details of your life and work. Operations security — OPSEC — is the discipline that addresses exactly that premise. It is not about locking away classified documents, which are already guarded. It is about protecting the unclassified indicators that, assembled together, reveal the very things you are trying to keep secret.

Indicators, not secrets

The central idea of OPSEC is essential secrecy: there is some critical information an adversary must not learn, and around it sits a cloud of observable indicators — none secret on its own. A calendar entry, a flight booking, an aide's hotel photograph, a procurement record. Each is harmless. Fused together they can disclose your location, your timing, your relationships, and your intentions. The mental shift for a leader is to stop asking "is this classified?" and start asking "what does this reveal when combined with everything else already in the open?"

How adversaries collect

Hostile collection draws on several disciplines at once. Open-source intelligence harvests your public website, social media, registries, breach data, and press coverage. Human intelligence works through people — staff, suppliers, and contacts — including casual elicitation at conferences and events. Signals intelligence looks at communications patterns: who talks to whom, how often, and from where. Technical collection targets devices, networks, and the metadata they emit. No single feed is decisive; the adversary fuses cheap open sources with a little human and technical collection until the picture resolves. Effective defence must therefore assume fusion across all of these, not just document control.

The five-step OPSEC process

OPSEC is a repeatable loop you can run against any activity. First, identify your critical information — the decisions, plans, locations, relationships, and timing an adversary must not know. Second, analyse the threat: who wants that information and what can they realistically collect? Third, analyse your vulnerabilities: where do your indicators leak today — calendars, travel, staff posts, suppliers, devices? Fourth, assess the risk by weighing the likelihood and impact of the adversary connecting those indicators, so you can prioritise. Fifth, apply countermeasures. Because it is a loop, you re-run it whenever your activities or the threat change.

Nothing here is classified — yet assembled together it is a targeting package. OPSEC protects the picture, not just the pieces.

Countermeasures and counter-collection

Countermeasures come in a few flavours. You can deny an indicator by removing or withholding it, disrupt a pattern by varying routines and splitting logistics, or degrade fidelity by reducing public detail and delaying disclosure. For an executive, the highest-leverage move is to extend the discipline to the people who leak on your behalf: aides and family whose posts publish your movements, and suppliers whose records name your partners. Counter-collection means actively managing your pattern-of-life, your travel signature, and your digital exhaust so that the adversary must pay to collect what you would otherwise give away.

Privacy as defence

Leaders operating under sustained threat — as in Ukraine — learn quickly that privacy is not a comfort or a lifestyle preference; it is force protection. Every fragment you withhold is one the adversary must collect elsewhere, at cost. Discretion, treated as an operational control rather than a personality trait, raises the adversary's price and lowers your exposure. That reframing — from "being private" to "denying collection" — is what turns OPSEC from a poster on the wall into a habit that actually shrinks your attack surface.