103. Security
Page 1 of 8
103. SECURITY FUNDAMENTALS
References:
[a] SECNAVINST 5510.36, Department of the Navy (DON) Information Security
Program (ISP) Regulation
[b] SECNAVINST 5510.30A, Department of the Navy Personnel Security Program
[c] OPNAVINST 3432.1, Operations Security
[d] OPNAVINST 3300.55, Navy Combating Terrorism Program Standards
103.1 Discuss the following security classification designations: [ref.
a, ch. 4]
a. Top secret: is the classification level applied to information
whose unauthorized disclosure could reasonably be expected to cause
exceptionally grave damage to the national security. Examples include
information
whose
unauthorized
release
could
result
in
armed
hostilities against the U.S. or its allies; a disruption of foreign
relations vitally affecting the national security; the compromise of
vital national defense plans; the disclosure of complex cryptographic
and communications intelligence systems; the disclosure of sensitive
intelligence operations; and the disclosure of significant scientific
or technological developments vital to national security
b. Secret: is the classification level applied to information whose
unauthorized disclosure could reasonably be expected to cause serious
damage to the national security. Examples include information whose
unauthorized release could result in a disruption of foreign relations
significantly
affecting
the
national
security;
the
significant
impairment of program or policy directly related to the national
security; the disclosure of significant military plans or intelligence
operations;
and
the
disclosure
of
scientific
or
technological
developments vital to national security
c. Confidential: is the classification level applied to information
whose unauthorized disclosure could reasonably be expected to cause
damage to the national security. Examples include information whose
unauthorized release could result in disclosure of ground, air, and
naval forces (e.g., force levels and force dispositions); or disclosure
of performance characteristics, such as design, test, and production
data of U.S. munitions and weapon systems.
.2 Define and discuss the following:
a. Clearance [ref. b, ch. 8]
1. The Department of the Navy Central Adjudication Facility (DON
CAF) is designated by the Secretary of the Navy as the single clearance
granting authority for the Department of the Navy. DON CAF issues final
security clearances for civilian and military personnel at the request
of DON commands and activities, upon affirmation that granting the
clearance is clearly consistent with the interests of national security.
Once issued, a security clearance remains valid provided the cleared
individual continues compliance with personnel security standards and
has no subsequent break in service exceeding 24 months.
2, A security clearance is not a de facto authorization for an
individual to access classified information. Authorization to access
classified information is a separate command level determination
dependent on whether an individual who has the requisite security
clearance also has a need for access to classified information in the
performance of official duties. Access to Sensitive Compartmented
Information (SCI) is a separate issue.
Created by LTJG KyungNho "TACO" Kim
Reviewed by LTJG Robert A. Wainscott
103. Security
Page 2 of 8
3. The DON CAF determines the security clearance for DON personnel
using the adjudicative guidelines to assess the loyalty, reliability
and
trustworthiness
issues
documented
in
personnel
security
investigation. Security clearance is initially issued upon adjudication
of the prerequisite security investigation, and is reestablished upon
adjudication of subsequent investigation(s). Certification is provided
to a command when a clearance is required to support local access
determinations. Security clearance will be established at the highest
level supportable by the prerequisite security investigation
b. Need-to-know [ref. a, app. A]
* A determination made by an authorized holder of classified
information that a prospective recipient requires access to specific
classified information in order to perform or assist in a lawful and
authorized U.S. Governmental function.
c. Access [ref. b, ch. 9]
* Access to classified information may be granted only if
allowing access will promote the furtherance of the DON mission while
preserving the interests of national security.
* Access to classified information will be limited to minimum
number of individuals necessary to accomplish the mission and will be
based on need to know. Additionally, the level of access authorized
will be limited to the minimum level required to perform assigned duty.
No one has a right to have access to classified information solely
because of rank, position, or security clearance.
* Granting access is a command responsibility. Access is formally
terminated when it is no longer required in the performance of duties
and / or when the individual’s security clearance is denied or revoked.
* Limiting access is the responsibility of each individuals
possessing classified information. Before allowing others access to
classified information, individuals possessing classified information
must determine that allowing access is justified based on the others’
security clearance eligibility and need to know.
d. Accounting and control [ref. a, app. A]
1. All Top Secret information (including copies) originated or
received by a command shall be continuously accounted for, individually
serialized, and entered into a command Top Secret log. The log shall
completely identify the information, and at a minimum include the date
originated or received, individual serial numbers, copy number, title,
originator, number of pages, deposition (i.e., transferred, destroyed,
transmitted,
downgraded,
declassified,
etc.)
and
date
of
each
disposition action taken.
2. Commanding officers shall establish administrative procedures
for the control of Secret information appropriate to their local
environment, based on an assessment of the threat, the location, and
mission of their command. These procedures shall be used to protect
Secret information from unauthorized disclosure by access control and
compliance with the marking, storage, transmission, and destruction
requirement of this regulation.
e. Classified information [ref. a, app. A]
* Classified National Security Information (or “Classified
Information”): Information that has been determined to require
protection against unauthorized disclosure in the interest of national
Created by LTJG KyungNho "TACO" Kim
Reviewed by LTJG Robert A. Wainscott
103. Security
Page 3 of 8
security and is classified for such purpose by appropriate classifying
authority per the provisions of E.O. 12958 or any predecessor Order.
f. Compromise [ref. b, ch. 12]
* A security violation which has resulted in confirmed or
suspected exposure of classified information or material to an
unauthorized person. A compromise is considered confirmed when
conclusive evidence exists that classified material was compromised. A
compromise is considered suspected when some evidence exists that
classified material has been subjected to compromise.
g. Intelligence [ref. a, app. A]
* The product resulting from the collection, evaluation, analysis,
integration, and interpretation of all available information that
concerns one or more aspects of foreign nations or of areas of foreign
operations, and that is immediately or potentially significant to
military planning and operations.
h. Marking [ref. a, app. A]
* Marking - The physical act of indicating on classified material
the assigned classification, changes in classification, downgrading and
declassification instructions, and any limitations on the use of the
classified information.
i. FOUO [ref. a, ch. 6]
* For Official Use Only: the abbreviation “FOUO” may be used to
designate unclassified portions containing information exempt from
mandatory release to the public. Additionally, place the applicable
abbreviated warning notice(s) and intelligence control marking(s)
directly after the abbreviated classification level of each portion.
* FOUO marks the bottom face and interior pages of documents
containing FOUO information with “FOR OFFICIAL USE ONLY”. Classified
documents containing FOUO do not require any markings on the face of
the document; however, the interior pages containing only FOUO
information shall be marked top and bottom center with ‘FOR OFFICIAL
USE ONLY.” Unclassified letters of transmittal with FOUO enclosures or
attachments shall be marked at the top left corner with “For official
use only attachment.”
j. Transmission security [ref. a, ch. 9]
* Top Secret: Transmit or transport U.S. Top Secret information
only by:
1. Direct contact between appropriately cleared U.S. personnel;
2. The Defense Courier service.
3. The DOS diplomatic courier service
4. Communications protected by a cryptographic system authorized
by director, NSA or a protected distribution system designed all
installed to meet the requirements of reference “Office of management
and Budget, Implementing Directive for E.O. 12958, 32 CFR Part 2001, 13
Oct 95.
5. Appropriately cleared DOD contractor employees or U.S.
military or Government civilian personnel specifically designated to
escort or hand carry the information, traveling on a conveyance owned,
controlled, or chartered by the U.S. Government traveling by surface
transportation
6. And so on.
Created by LTJG KyungNho "TACO" Kim
Reviewed by LTJG Robert A. Wainscott
103. Security
Page 4 of 8
* Secret: Transmit or transport U.S. secret information only by:
* Any means approved for top secret information, except that
secret information may be introduced into the DCS only when U.S.
control cannot otherwise be maintained. This restriction does not
apply to COMSEC and SCI
1. US postal service registered mail within and between the U.S.
and its territories
2. USPS registered mail addressed to U.S. Government agencies
through U.S. Army, Navy, Marine Corps, or Air force postal service
facilities outside the U.S. and its territories
3. USPS and Canadian registered mail with registered mail receipt
between U.S. Government and Canadian government installations in the
U.S. and Canada
4. USPS express mail sent between U.S. Government activities and
cleared DOD contractors within and between the U.S. and its
territories. Use USPS express mail service only when it is the most
cost effective way to meet program requirements. USPS Express mail
service is strictly controlled in the DON and the official command
mail control officer shall approve each use.
5. And so on.
k. NOFORN [ref. a, ch. 6]
* NOT RELEASABLE TO Foreign NATIONALS: Use this marking to
identify intelligence. The originator has determined may not be
disclosed
or
released,
in
any
form,
to
foreign
governments,
international organizations, coalition partners, foreign nationals, or
immigrant aliens without originator approval. This marking is not
authorized for use in conjunction with the “AUTHORIZED FOR RELEASE TO”
(“REL”) marking. The short form of this marking is “NOFORN”; the
abbreviated form is “NF”.
.3 Discuss receipt, custody, and handling requirements for the
following: [ref. a]
a. Top secret, secret, and confidential material [ch. 10]
*
Commanding
officers
shall
ensure
that
all
classified
information is stored in a manner that will deter or detect access by
unauthorized persons. Store Top Secret information by one of the
following methods:
1. In a GSA approved security container with one of the following
supplemental controls;
a. the location housing the security container shall be subject
to continuous protection by cleared guard or duty personnel
b. cleared guard or duty personnel shall inspect the security
container once every 2 hours
c. an intrusion detection system with personnel responding to
the alarm within 15 minutes of the alarm annunciation
d. Security in depth when the GSA approved security container
is equipped with a lock meeting Federal Specification FF-L-2740 or
e. In either of the following 1, an Open storage area (secure
room) or vault when is equipped with an IDS with personnel
responding to the alarm within 15 minutes of the alarm annunciation
if the area is covered by security in depth or a 5 minutes alarm
response if it is not.
* On secret
restriction.
and
classified
material:
Created by LTJG KyungNho "TACO" Kim
the
same
manner
and
less
Reviewed by LTJG Robert A. Wainscott
103. Security
Page 5 of 8
b. CMS materials [app. A]
* The protective measures taken to deny unauthorized persons
information derived from telecommunication of the U.S. Government
related to national security and to ensure the authenticity of such
communications. COMSEC include Crypto security, which results from
providing technically sound cryptosystems and their proper use,
Physical security, which results from physical measures taken to
safeguard COMSEC material, Transmission security, which results from
measures designed to protect transmissions from interception and
exploitation by means other than cryptanalysis, and emission security,
which results from measures taken to deny unauthorized persons
information of value which might be derived from the interception and
analysis
of
compromising
emanations
from
crypto
equipment
and
telecommunications system.
4 State your individual responsibilities in the event you discover a
compromise or suspected compromise of classified material. [ref. a, ch.
12]
* An individual who becomes aware that classified information is
lost or compromised shall immediately notify their commanding officer
or security manager of the incident. If that individual believes their
commanding officer or security manager may be involved in the incident,
notify the next higher echelon of command or supervision. If
circumstances of discovery make such notification impractical, the
individual shall notify the commanding officer or security manager at
the most readily available command or contact the local NCIS office.
.5 Discuss the following as applied to classified material: [ref. a]
a. Classified waste disposal [ch. 10]
* All classified information intended for destruction is
destroyed by authorized means and appropriately cleared personnel.
Classified information that cannot be destroyed shall be reevaluated
and, when appropriate, downgraded, declassified, or retired to a
designated record center.
* Destruction of classified information shall be accomplished by
means that eliminate risk of recognition or reconstruction of the
information.
* Commanding officers should establish at least 1 day each year
“Clean Out” day when specific attention and effort are focused on
disposition
of
unneeded
classified
and
controlled
unclassified
information.
b. Priority of emergency destruction [ch. 10]
* The priorities for emergency destruction are: Priority One-Top
secret information; Priority Two-Secret information; and Priority
Three- confidential information.
c. Methods of emergency destruction [ch. 10]
* Various methods and equipment may be used to destroy classified
information that include burning, cross-cut shredding, wet-pulping,
mutilation, chemical decomposition, or pulverizing.
d. Forms and references used for emergency destruction [ch. 10]
(a) DOD Instruction 3224.3, Physical Security Equipment (PSE):
Assignment of Responsibility for Research, Development, Testing,
Evaluation, Production, Procurement, Deployment, and Support, 17 Feb 89
(NOTAL)
Created by LTJG KyungNho "TACO" Kim
Reviewed by LTJG Robert A. Wainscott
103. Security
Page 6 of 8
(b) OPNAVINST 5530.13B, DON Physical Security Instruction for
Conventional Arms, Ammunition and Explosives
(c) OPNAVINST 5112.5A, Mail Handling and Delivery Procedures for
Mailrooms and Postal service Centers, 17 Jun 87
(d) Title 18, U.S.C., Section 1386, crimes and Criminal
Procedures
(e) OPNAVINST 5530.14C, DON Physical Security and Loss
Prevention, 10 Dec 98
(f)
SECNAVINST
551O.3OA,
DON
Personnel
Security
Program
Regulation, 10 Mar 99
(g) SECNAVINST 5212.5D, Navy and Marine Corps Records
Disposition Manual, 22 Apr 98
(h) CPLV-UL, Cryptographic Security Policy and Procedures
Manual (U), 25 Feb 98 (NOTAL)
(i) CMS-21 Series, Interim CMS Policy and Procedures for Navy
Tier 2 Electronic Key Management System, 30 May 97 (NOTAL)
(j) DOD 5105.21-M-1, DOD Sensitive Compartmented Information
Administrative Security Manual, 3 Aug 98 (NOTAL)
(k) OPNAVINST C551O.1O1D, NATO Security Procedures (U),
(1) NAVSO P-5239-26, Remanence Security Guidebook, Sep 93
(m) SECNAVINST 5510.34, Manual for the Disclosure of DON
Military
Information
to
Foreign
Governments
and
International
Organizations, 4 Nov 93
e. Dissemination [ch. 6]
1. Commanding Officer shall establish procedures for the
dissemination of classified and controlled unclassified information.
2. Classified information originated outside the DOD without the
consent of the originator, except where specifically permitted.
3. Authority for disclosure of classified information to foreign
governments has been centralized in the Director, navy IPO who has
delegated authority to disclose certain classified information to those
commands.
* TOP Secret: TS information originated within the DOD shall not
be disseminated outside the DOD without the consent of the originator
or higher authority.
* Secret and confidential: Unless specifically prohibited by the
originator, secret and confidential information originated within the
DOD may be disseminated to other DOD departments and agencies within
the executive branch of the U.S. Government.
f. Two person integrity [ch. 10]
* Two Person Integrity (TPI) is a system of handling and storing
designed to prevent single-person access to TOP SECRET COMSEC keying
material. TPI requires that at least two persons, authorized access to
COMSEC material, be in constant view of each other and the COMSEC
material requiring TPI whenever that material is accessed and handled.
Each individual must be capable of detecting incorrect or unauthorized
security procedures with respect to the task being performed.
.6 Discuss the maintenance work center secure container requirements.
* If new security storage equipment is needed, procure it from the
GSA Federal Supply Schedule. However, prior to procuring new storage
equipment, conduct a physical security survey of existing equipment and
review classified record% on hand. Coordinate with the records manager
Created by LTJG KyungNho "TACO" Kim
Reviewed by LTJG Robert A. Wainscott
103. Security
Page 7 of 8
to determine if it is feasible to use available equipment or to retire,
return, declassify, or destroy a sufficient volume of records on hand
to make the needed security storage space available. Promptly report
excess
containers
(if
any)
to
property
disposal
and
fulfill
requirements for added equipment through property disposal when that is
more cost effective.
* Security containers conforming to Federal Specifications have a
Test Certification Label on the inside of the control locking drawer.
Container manufactured after February 1962 will also be marked “General
Services Administration Approved Security Container on the outside of
the top drawer. Specifications have been developed for 8 classes of
security containers (Classes 1, 2, 3, 4, 5, 6, 7, and 8.) However, only
6 classes (Classes 1, 2, 3, 4, 5, and 6) are approved for storage of
classified information, and only Classes 5 and 6 are currently on the
GSA schedule. The removal of approved security containers from GSA
schedule does not negate the approval. Previously approved GSA
containers may still be used to store classified information provided
they meet the original level of integrity and have not had the Test
Certification Label removed for cause.
.7 Discuss the importance of OPSEC procedures. [ref. c]
* OPSEC is a critical component of U.S. Navy activities.
“Maintaining the operations security of plans and gaining the fullest
possible surprise” are essential to maintaining freedom of action. The
practice of OPSEC prevents the inadvertent compromise of sensitive or
classified activities, capabilities, or intentions at the tactical,
operational, and strategic levels. OPSEC measures are required:
(1) For those operations and activities relating to the equipping,
preparation, deployment sustainment, and employment of the U.S. Navy in
time of war, crisis or peace that require the maintenance of essential
secrecy; and
(2) For the protection of the information contained in Operations
Plans, Operations Orders, and supporting plans and orders.
* OPSEC Program: Each Navy command and staff will establish a formal
OPSEC program. This program will support the commander by ensuring that
the command or staff actively practices OPSEC to deny critical
information to any potential adversary. Those organizations involved in
joint operations will consider joint OPSEC in the development of their
programs. An OPSEC program provides for planning, training, education,
threat identification, evaluation, and correction of vulnerabilities.
The commander must be actively involved in OPSEC, particularly in
defining OPSEC goals and planning guidance, and in making decisions
regarding the balance of operational and security needs.
* OPSEC is not a security function, it is an operations function.
.8 Discuss the concept of AIS security. [ref. a, ch. 2]
* Automated information system: An assembly of computer hardware,
software
or
firmware
configured
to
collect,
create,
compute,
communicate,
disseminate,
process,
store,
or
control
data
or
information
.9 Discuss the following force protection conditions: [ref. d]
a. ALPHA: THREATCON ALPHA exists when there is a general threat of
possible terrorist activity against installations and personnel. The
exact nature and extent are unpredictable and circumstances do not
justify full implementation of THREATCON BRAVO. However, it may be
Created by LTJG KyungNho "TACO" Kim
Reviewed by LTJG Robert A. Wainscott
103. Security
Page 8 of 8
necessary to implement selected THREATCON BRAVO measures as a result of
intelligence or as a deterrent. THREATCON ALPHA must be capable of
being maintained indefinitely
b. BRAVO: THREATCON BRAVO exists when an increased and more
predictable threat of terrorist activity exists. The measures in this
THREATCON must be capable of being maintained for weeks without causing
hardship, affecting operational capabilities or aggravating relations
with local authorities.
c. CHARLIE: THREATCON CHARLIE exists when an incident occurs or when
intelligence is received indicating that some form of terrorist action
is imminent. Implementation of this measure for longer than a short
period of time will probably create hardship and affect peacetime
activities of a unit and its personnel.
d. DELTA: THREATCON DELTA exists when a terrorist attack has
occurred, or when intelligence indicates that a terrorist action
against a specific location is likely. Normally, this THREATCON is
declared as a localized warning.
MORE QUESTION AND ANSWER PERIOD:
Q. What material requires two person integrity?
A. TOP SECRET keying material only.
Q. Name three things which require TPI Handling.
A. (1) TOP SECRET paper keying material marked or designated CRYPTO. (2) Fill Devices (FD)
containing TOP SECRET key. (3) Equipment containing TOP SECRET key that allows for key extraction.
(4) KSD-64As that contain the KPKL and KEKL build fields when they enable TOP SECRET operations
in the KP.
Q. What is the common denominator in most situations that would require you to report a TPI violation?
A. Single person access.
Created by LTJG KyungNho "TACO" Kim
Reviewed by LTJG Robert A. Wainscott