Operations Security (OPSEC)

What is OPSEC & EEFI?

Operations Security (OPSEC) is a process of identifying and protecting critical information and analyzing friendly actions to deny adversaries the information they need to cause harm. This critical information is codified as Essential Elements of Friendly Information (EEFI). EEFI is specific, key information that adversaries are actively looking for (e.g., troop movements, capabilities, or vulnerabilities).

The Five-Step OPSEC Process

1. Identify Critical Information: Determine the EEFI that would be valuable to an adversary.
2. Identify the Threat: Who is the adversary, and what are their capabilities for collecting information?
3. Analyze Vulnerabilities: Where are the gaps in our security that an adversary could exploit?
4. Assess Risk: Determine the level of risk and whether it is acceptable to the mission.
5. Apply Countermeasures: Implement measures to eliminate or reduce vulnerabilities.

Social Media and OPSEC

• Social media is one of the biggest OPSEC vulnerabilities today:
• Never post specific deployment dates, locations, or unit movements.
• Disable geotagging on photos and devices.
• Do not discuss operations, missions, or training details online.
• Be careful about posting photos that inadvertently reveal equipment, locations, or unit identifiers in the background.
• Remind family members that OPSEC rules apply to their social media as well.

Board Tips

Know the Regulations: AR 530-1 and ATP 3-37.34. Know the five steps of the OPSEC process in exact order. Memorize the acronym EEFI (Essential Elements of Friendly Information) — if OPSEC comes up, expect to define it. Scenario: 'You see a Soldier posting their deployment location on social media — what do you do?' Answer: 'I would instruct the Soldier to delete the post immediately, counsel them on OPSEC violations, notify the chain of command if EEFI was compromised, and use it as a training opportunity for the rest of the squad.'