MySpace - an OPSEC Nightmare Published March 6, 2008 By Tech Sgt Carlos Garcia AFOSI Det 810 Los Angeles Air Force Base -- I'm guessing that if you're reading this article, you have a MySpace account. If you don't have one, your wife/husband, girlfriend/boyfriend or someone in your family does. MySpace is a social website with about 212 million users and growing, which makes it the number one social host on the internet. If you don't have a MySpace account, then surely you have one with Facebook, the number two site, which has about 60 million users. Surely if you don't have any of these accounts, you must have a YouTube account, the number one video posting site with 150 million users and with 100 million videos being watched daily. By the way, YouTube was bought by Google in October 2006. Surely you must have an account with Slide, the largest personal media network on the internet with about 134 million users. If you're not part of any of the above social websites, you must have a Photobucket account, the number one photo hosting site on the internet. How many pictures? Try about 2.6 billion of them. Yes, I know Flickr is out there too but they're number two at about 15 million users and only 200 million photos posted. Believe me, there are many others. Where does OPSEC fall into this? Let me create a couple scenarios. Let's say I had a MySpace account and used it for what it's intended for, to "meet" people and "network," listing my name, date of birth, you know the whole birthday reminder thing, hometown, names of family members, girlfriends, boyfriends, in other words, your friends list, locations of where you've lived/served - you get the point. Scenario number two, let's say I found a site that said it's only for Air Force members and wants to reunite me with my buddies. I post all my personal information on there too. Let's also say that they assured me that it's for "military only, secure and self policing." Now my information is there for anyone with a member account to target me. You may think posting on social web pages is your private life and the military has no business in it. Yes you have freedom of speech and have the right to do what you want on your own time, on your own ISP (Internet Service Provider) since you pay for it, as long as it breaks no laws. Unfortunately the line is crossed when dealing with OPSEC and when they have every right to intervene. Since we work for the military, we are bound by all governing directives, in this case AFI 35-101, Public Affairs Policies and Procedures, para. 2.14.1 which states, "...each Air Force member or employee is responsible for obtaining the necessary review and clearance, starting with Public Affairs, before releasing any proposed statement, text or imagery to the public. This includes any digital products being loaded on an unrestricted web site." In short, you must get approval from Public Affairs before posting anything related to the Air Force, or military for that matter. This applies not only to military personnel but to civilians and contractors alike. Now back to my scenarios, both of these actually happened. Last year, MI5 (British Intelligence) uncovered a plot to kidnap a British soldier who had recently returned from service abroad with the intent to behead him and post the video on the Internet. This was attempted via social web pages. On my second scenario, there exists a website called airforcetogetherweserved.com. This site has no ties to the Air Force or the military. They currently have over 50,000 members and counting. Items have been posted which include deployment locations, military grades, AFSCs and assignment histories, giving the page maintainer full access to all the information and virtually the same access to anyone who's a member of that website, so don't do it. The site is located, owned and maintained by someone in Germany. We are all proud to be in the military and sometimes want to express ourselves. Frankly, this is quite different than wearing Air Force t-shirts and applying stickers on your car. These websites have the potential to facilitate you becoming a target at many different levels. The objective of this article is to educate, educate, and educate every one of this emerging, fast moving and potentially dangerous threat. Please educate them as well, it's your duty. If you don't believe my scenarios - Google them.