When our boys were young, at the height of the Cold War when we were stationed in Europe, we had a family “OPSEC Plan.” Each of our sons was given a mission to be sure we didn’t reveal anything about our family life we didn’t want the outside world to know. One of the boys checked to be sure we didn’t throw out anything someone could steal from the trash. They delighted in turning the family papers (such as financial statements or personal military documents) over to me so I could shred them at the office. Another was given the job to check for bombs under our car. (Oh yes, there were bombs planted around Europe in those days by political terrorists. One blew up at a military club we liked to visit when a car in the parking lot ‘went off’.) The third was given the job to check the door locks at night and be sure the window shades were lowered. We had a family ‘escape plan’ in case of emergency, complete with passwords to let the boys know the message was really from us.
Taking those proactive planning steps are even more critical for security managers today. With China actively and continually stealing U.S. intellectual property, the way you protect classified information can make the difference in whether you can keep your intellectual property, or see it walk out the door.
Planning for a Classified Meeting
The first step in planning a classified meeting is to verify that all attendees will have a clearance to the appropriate level. But how about checking to be sure each visitor deposits his or her cell phone, or any other electronic device, in a secured area rather than bring it into the briefing zone? What provisions have you made for the briefing papers themselves? Even in these ‘paperless days’ we generate tons of papers.
Consider: Lunchtime rolls around. What do you do with all the classified notes your visitors have taken during presentations? How do you secure the same classified informational notes overnight if your meeting spans several days? Someone has to be designated as responsible for verifying these things. Same meeting, same lunch hour. Where can the visitors go for lunch? Where, if at all, can they be free to discuss in some detail what they’ve heard in the meeting? This means you will need a cleared facility for that, too. Some try to overcome this with a ‘working lunch’ where caterers bring food for distribution to a lot of attendees at their seats. This usually does not work. Think these simple but recurrent problems through and give the responsibility to one of your staff.
Someone will always want a copy of something. Who will make this happen? When the break period comes, your visitors will swarm like starlings to their cell phones. Or will they? This too is something you need to brief ahead of time. It involves time and personnel if you allow it. If you restrict people to a given area, you’ll need to give them access to some form of communications. Make this known ahead of time. Every aspect of your guests’ time is to be planned for.
How to Keep Your Company Safe When Visitors Arrive
Did you think about what identification you will need? If your company is large, you’ll need to have a badging system just to get the people in. Then, these badges will doubtless restrict their movements. You can’t have someone present for a meeting given access to everything in the building. Also, consider shrouding certain protected items if they are too big to move. We dealt with this issue when certain test ban treaties were implemented. Visitors or inspectors from abroad were allowed authorized access to given areas, but not to everything in those areas. Likewise with your visiting cleared guests. They can’t be allowed to wander the halls, dropping in wherever they want. This becomes particularly problematic when a visitor is a former member of your company. They’ll feel obligated to ‘go see the old gang’, but it is up to you to determine if that is authorized. Then you must brief them clearly on what they can do, to whom they can speak, and where they can go in your building.
For this last reason we talk a lot about the ‘clean desk’ policy. This is usually an unenforceable policy, implemented more by cleanliness freaks than meaningful threat prevention. Yet it has been shown to be effective if used judiciously. For instance, if visitors are given authority to go through certain areas, then cleared employees will gladly be sure their areas are secured, cleared, or inaccessible. Short, mission connected policies such as this are workable, and people almost always respond not only helpfully but with a spirit of cooperation. Use it judiciously, however, with clear demarcations of why it is necessary. Employees appreciate being treated as adults.
And don’t forget what to do when your meeting is over. You’ve got a lot on your mind, from the first ‘sweep’ of the room for bugs, to the final check to make sure all documents are gone or accounted for. If you used a computer, was it pre-selected and stand alone? Can you check? Now get rid of all paperwork. Do you have a classified disposal system which is sufficient to burn or shred everything, even a large quantity, no longer needed? This seemingly simple question has many pitfalls. OPSEC shows that loads of unclassified information can be puzzled together to reveal classified information. So get rid of all the paperwork left behind. Be sure your shredding capability can handle the large amounts of material destroyed. One office set off a fire alarm when the masses of materials could not be handled by the shredder!
So now, is it time to say farewell to our cleared visitors? No. How are they going to get the cleared information they’ve gathered home? Have you provided a safe, properly wrapped means of mailing the information back, or better yet, have you got a means of cleared electronically sending the information back to their home bases?
Remember, no job is over until the boss checks. He’ll have a lot less to worry about if all the problems that can be anticipated are identified. Then, each issue is assigned to known, designated personnel, and each does what he or she should do. After a while it becomes second nature. One of our sons still reminds me to lock the doors to the house after we’re in for the night.