What does OPSEC stand for?

OPSEC stands for operations security, often also written as operational security. The term comes from the US military during the Vietnam War. It describes a way of thinking rather than a tool: you look at your own activities the way an adversary would and ask which harmless-looking details, taken together, reveal something you would rather keep to yourself.

What is the five-step OPSEC process?

The five steps were written into a US presidential directive in 1988: identify critical information, analyze threats, analyze vulnerabilities, assess risks, and apply appropriate countermeasures. For an ordinary person that translates to: what do I want to protect, from whom, where does it leak, how bad would it be, and what can I change with reasonable effort.

Is it possible to be completely anonymous online?

Over any length of time, realistically no. Research keeps showing how few data points it takes to single someone out: ZIP code, gender and date of birth were enough for about 87 percent of the US population in one study, and four location points identified 95 percent of people in a large phone dataset. What you can achieve is making your traces harder to connect and visible to fewer people.

What is personal OPSEC?

Personal OPSEC applies the military process to everyday life. Instead of an enemy army, the realistic adversaries are scammers, an abusive ex-partner, nosy strangers or data brokers. The practical side is mostly habits: thinking before you post, delaying location-revealing photos, keeping separate identities for separate parts of your life, and checking privacy defaults.

Does a VPN give you good OPSEC?

Only for one narrow slice. A VPN hides your IP address from the sites you visit and protects you on untrusted Wi-Fi. It does nothing about what you post, which name you log in with, or what your browser reveals about itself. Good OPSEC starts before any tool, with the question of what information you are giving away at all.

What is an example of bad OPSEC?

Posting a photo of your boarding pass is a classic. In 2020 former Australian prime minister Tony Abbott did exactly that on Instagram. Using the booking reference encoded in the barcode plus his surname, a stranger logged into the airline's booking page and found his passport number and phone number in it. The photo looked harmless; the damage came from what it could be combined with.

What is OPSEC? Why you can't vanish, but can be harder to find

On a weekend in late January 2018, a young Australian conflict analyst named Nathan Ruser was scrolling around a map that was meant to be pretty. The fitness app Strava had just published a global heatmap built from its users’ runs and rides, about a billion activities by the company’s own count. In Afghanistan’s Helmand province, where fitness trackers are otherwise rare, faint bright rectangles appeared in the dark: soldiers jogging laps around their bases. The map “looks very pretty”, Ruser tweeted, “but not amazing for Op-Sec. US Bases are clearly identifiable and mappable.”

So what is OPSEC, and why did a fitness map become the textbook case for it? None of those soldiers had posted anything secret. Each had logged a morning run, the way millions of people do every day, and the danger only appeared once all of it was added up.

This piece walks through where the idea comes from, what the five-step process taught to government employees actually means, and why the research is fairly blunt about one thing: nobody is truly invisible online. Then it turns to the part that matters for you. If invisibility is off the table, what is left? Quite a lot, as it happens.

A night-time desert landscape seen from high above, where thin warm lines of light trace the outline of a rectangular compound against otherwise black sand — No single run was secret. Together they drew the outline of a base.

What is OPSEC?

OPSEC is short for operations security, and people use “operational security” for the same thing. It is not a gadget or a piece of software. It is a habit of looking at your own routine from the outside, the way someone who wants to exploit it would.

The idea was born in Vietnam. By the summer of 1966, US commanders had a nagging problem. B-52 strikes, codenamed Arc Light, were hitting areas where ground sweeps afterwards found far lighter enemy losses than expected. Were the raids being leaked? A team codenamed Purple Dragon was sent to find out. According to the National Security Agency’s own history of the program, the team decided to “put ourselves in the position of the adversary and study our operations step by step, from conception through execution to completion and beyond.” They paid special attention to small, seemingly insignificant details.

One likely leak turned out to be paperwork. Under international aviation rules, aircraft crossing from one air traffic control zone into the next had to file flight plans, and the receiving centre broadcast the altitude, route and timing to neighbouring stations. For the pilots it was routine. For North Vietnamese listeners it was an early warning. In December 1966, two North Vietnamese radio stations alerted 34 percent of Arc Light missions, on average eight and a half hours ahead. Once Purple Dragon’s recommendations were in place, that fell to five percent by April 1967, with less than thirty minutes’ notice.

The process spread across the US military. On January 22, 1988, National Security Decision Directive 298 turned it into a national program and required every federal agency handling sensitive work to run one. That directive is why today’s search results for OPSEC are full of .mil and .gov training pages.

An old dark wooden shortwave radio sits on a table with only its tuning dial glowing a warm amber, the rest of the room in darkness — The warning went out over the radio, fed by entirely ordinary paperwork.

The OPSEC process, translated for normal people

NSDD 298 lists five steps that still appear in every government training course. They read like bureaucracy, but they map almost directly onto an ordinary life. The Electronic Frontier Foundation’s Surveillance Self-Defense guide asks nearly the same questions in plain language, so the table below borrows from both.

Official step	The question for you	An everyday example
Identify critical information	What should a stranger never learn?	Home address, your kids’ school route (see sharenting), when the house is empty
Analyze threats	Who might actually care?	Scammers, an ex-partner, data brokers, a coworker
Analyze vulnerabilities	Where does it leak out?	Real-time vacation photos, a fitness app, an old forum handle
Assess risks	How likely is it, and how bad would it be?	A break-in while you travel: unlikely, but expensive
Apply countermeasures	What can I change at a cost I’ll accept?	Post the vacation photos after you get home

The step people skip is the second one, and it does most of the work. Without a specific adversary in mind there is nothing to weigh. Try to defend against everyone at once and you either panic or give up within a fortnight. Know that your realistic worry is a scammer working from a purchased list, and you can keep your phone.

The EFF adds a question you won’t find in any directive: how much trouble are you willing to go through? That is a practical question, not a confession of weakness. A measure you switch off after three days protects you less than a smaller one you actually keep.

Why you can’t be invisible online

The hope behind a lot of privacy advice is that the right tools will take you off the map. Turn on a VPN, use a fake name, done. Research going back to 2000 says otherwise, for a simple reason: people are remarkably unique in their combinations.

In 2000, computer scientist Latanya Sweeney worked through US census data and found that 87 percent of Americans, 216 million out of 248 million, could likely be singled out by just three facts: five-digit ZIP code, gender and date of birth. No name, no Social Security number. Three fields that countless forms ask for in passing.

In 2013, Yves-Alexandre de Montjoye and colleagues looked at fifteen months of mobile phone data covering 1.5 million people. The locations were coarse, only as precise as the nearest cell tower and rounded to the hour. Four random points in place and time were still enough to pick out 95 percent of individuals. Being near one tower in the morning and another in the evening is a pattern you share with almost no one else.

Six years later the same group went further. Writing in Nature Communications, Luc Rocher, Julien Hendrickx and de Montjoye estimated that 15 demographic attributes would correctly re-identify 99.98 percent of Americans in a dataset that had supposedly been anonymized. Their warning was aimed at companies and regulators: even heavily sampled data rarely meets the bar for true anonymization.

Three plain dark puzzle pieces lie on a matte surface, two already joined together, the third resting just beside them and caught by a stripe of warm light — Each fact on its own is dull. Together they fit exactly one person.

The same goes for devices. In 2010 the EFF collected data from 470,161 web browsers through a test site: screen size, installed fonts, time zone, plugins. 83.6 percent were unique on that basis alone, and these were mostly privacy-minded visitors. How much a browser gives away today, and how much of it you can tame, is covered in our guide to browser fingerprinting.

For the question of invisibility, the direction is enough. Nobody needs your ID number to recognize you. A handful of habits, places and technical quirks will do. None of that makes protection pointless. It just moves the goal. The aim is to control how many of those pieces a stranger gets hold of and whether they line up.

Four OPSEC failures, one pattern

The heatmap from the opening is not an outlier. The cases below come from very different worlds, and they look strikingly alike.

The boarding pass, March 2020. Former Australian prime minister Tony Abbott posted a photo of his boarding pass and baggage tag on Instagram. Programmer Alex Hope decoded the booking reference from the barcode, typed it into the Qantas “Manage Booking” page together with Abbott’s surname, and was in. Tucked into the page’s underlying code were Abbott’s passport number, his phone number and internal airline notes. Hope reported it to the Australian Signals Directorate two days later. Qantas told him the underlying bug was fixed by July, and he published the story that September, once the hole was closed.

The conference call, February 2024. Four senior German air force officers discussed on Webex how Taurus cruise missiles might be used in Ukraine. Russian state media published the recording on March 1. Germany’s defence minister Boris Pistorius later said one participant had dialled in from Singapore over an open, unauthorized connection, during an aviation trade show that drew European military brass and, by his account, broad Russian eavesdropping. The breach was probably a chance catch from casting a wide net.

The group chat, March 2025. On March 11, Jeffrey Goldberg, editor of The Atlantic, received a Signal connection request from a user named Michael Waltz, then the US national security adviser. Two days later he was added to a group called “Houthi PC small group”, where cabinet-level officials went on to discuss upcoming strikes in Yemen. Goldberg assumed it might be a hoax until the bombs fell on schedule. Signal’s encryption did exactly what it promises. Someone had simply added the wrong person, and nobody in the room checked who was reading.

Case	The harmless detail	What it exposed	What was missing
Strava heatmap, 2018	Logged jogging routes	Location and layout of bases	A look at the sum of all runs
Boarding pass, 2020	A photo with a barcode	Passport number, phone number	Knowing what the barcode contains
Taurus call, 2024	Dialling in over an open line in Singapore	A confidential military discussion	Thinking about where you are
Signal group, 2025	One contact too many	Strike plans before the strikes	A glance at the member list

In none of these was the tool the weak point. Strava, Qantas, Webex and Signal all did what they were built to do. What failed were habits, in places that felt safe. That is where OPSEC does its work.

A blank, unprinted slip of paper lies on a dark wooden table next to a dark smartphone with a black screen, warm side light, the background falling into shadow — A slip of paper, a photo, a post. The harm came afterwards.

Building your own threat model

Security people call step two a threat model. It sounds corporate, but for an individual it is about fifteen minutes of honest thinking. You do not need to be a spy’s target to benefit. For most people only a few adversaries are realistic, and each one wants something different.

Who	What they want	Where they get it	What helps most
Scammers and phishing crews	Name, phone, bank, family details	Data breaches, social media, list sellers	Fewer public contact details, call back on known numbers
An ex-partner or stalker	Home, workplace, daily routine	Photos, location sharing, mutual friends	Audit location sharing, post with a delay
Employers and the public	Opinions, private life, old posts	Search engines, old profiles, forums	Separate identities, clear out old accounts
Data brokers and ad firms	Movements, interests, spending power	Apps, advertising IDs, loyalty cards	Cut app permissions, reset or delete the ad ID
Governments	Varies hugely by country and situation	Carriers, platforms, devices	End-to-end encryption, expert help when it is serious

Most readers will find themselves in the top three rows. That is good news, because habits and settings go a long way against those groups. If you genuinely fear being targeted by a state, say as a journalist or activist under an authoritarian government, you need more than a blog post. The EFF and press freedom groups offer dedicated help for exactly that.

Personal OPSEC: habits that hold up

Every case above could have been stopped by a moment’s thought. That suggests a few habits that cost very little.

Look with a stranger’s eyes before you post. What is in the background? A street sign, a house number, a school crest, a barcode? Photos also often carry hidden extras such as the place they were taken. What hides in there and how to strip it out is covered in our piece on what your files reveal.

Post with a delay. Vacation photos once you are home, the cafe shot after you have left. It changes almost nothing for you and a great deal for anyone looking for you right now. Live location belongs only with people you truly want to have it. Finding and ending forgotten shares is explained in how to stop sharing your location.

Keep identities apart. Your banking email need not be the one you use for giveaways, and your gaming handle need not match your LinkedIn. A single name used everywhere is the easiest thread for a stranger to pull, as our guide to username searches shows. For one-off signups there are disposable addresses and aliases.

Break routines now and then. The Strava runners stood out through repetition. Publicly logging the same loop at the same time every Tuesday announces an appointment. Keep the activity private, or hide the first and last stretch from the public map.

Distrust defaults. Plenty of apps start out public. Going through the privacy settings of your main accounts once a year may be the most productive half hour you spend on this. The same applies to the advertising identifier on your phone, which is how location data ends up for sale, as our article on the advertising ID documents.

Search yourself. Once a year, put your name, phone number and old usernames into a search engine. What turns up is roughly what a curious stranger finds in ten minutes. How to go about it, and what you can have removed, is in how to search yourself online. If you want to understand the other side’s methods, start with our overview of OSINT.

Where OPSEC hits its limits

Honestly, not everything is in your hands. Friends tag you in photos, your club posts the team list, a retailer loses your customer record in a breach. Those traces can only be contained after the fact, for instance by requiring approval for tags or asking for deletion.

Then there is the past. Whatever was public ten years ago may live on in archives, search caches or purchased datasets. Deleted does not mean unseen, which is one more reason to focus on what you do from now on rather than chase every old post.

And every measure has a price. A phone with everything switched off is very private and close to useless. The skill is finding the two or three places where the most leaks out in your case and working there. Even the hardware in your pocket has such spots, which is why phones now rotate their MAC address. A VPN helps somewhere else again and replaces none of the thinking above.

A heavy curtain half drawn across a window at night, warm room light spilling through the gap into the darkness outside — Fully closed is rarely necessary. What matters is where the gap is left open.

The bottom line

OPSEC is, in the end, a habit the US military developed in the 1960s from an embarrassing finding: the enemy did not need a spy when routine paperwork already pointed the way. For you it means switching perspective from time to time and looking at your life the way a patient stranger would.

You won’t become invisible. The studies from Sweeney to Rocher leave little doubt about that, and anyone promising otherwise is probably selling something. What you get instead is a smaller target whose pieces don’t fit together so easily: the vacation photo without your address next to it, a forum name that leads to no employer. Against nearly every real-world adversary, that is the difference between being easy and being a nuisance. Nuisances usually get skipped.

Sources: The Guardian, Alex Hern, Fitness tracking app Strava gives away location of secret US army bases, January 28, 2018 · National Security Agency, Center for Cryptologic History, Purple Dragon: The Origin and Development of the United States OPSEC Program (1993, declassified 2007) · The White House, National Security Decision Directive 298: National Operations Security Program, January 22, 1988 · Electronic Frontier Foundation, Surveillance Self-Defense, Your Security Plan · Latanya Sweeney, Simple Demographics Often Identify People Uniquely (PDF), Carnegie Mellon University, 2000 · Yves-Alexandre de Montjoye et al., Unique in the Crowd: The privacy bounds of human mobility, Scientific Reports, March 25, 2013 · Luc Rocher, Julien M. Hendrickx, Yves-Alexandre de Montjoye, Estimating the success of re-identifications in incomplete datasets using generative models, Nature Communications, July 23, 2019 · Peter Eckersley, How Unique Is Your Web Browser? (PDF), PETS 2010 · Alex Hope, When you browse Instagram and find former Australian Prime Minister Tony Abbott’s passport number, September 16, 2020 · tagesschau, Pistorius: Russische Abhöraktion wegen „Anwendungsfehler” möglich (German), March 5, 2024 · The Atlantic, Jeffrey Goldberg, The Trump Administration Accidentally Texted Me Its War Plans, March 24, 2025

Frequently asked questions

What does OPSEC stand for?: OPSEC stands for operations security, often also written as operational security. The term comes from the US military during the Vietnam War. It describes a way of thinking rather than a tool: you look at your own activities the way an adversary would and ask which harmless-looking details, taken together, reveal something you would rather keep to yourself.
What is the five-step OPSEC process?: The five steps were written into a US presidential directive in 1988: identify critical information, analyze threats, analyze vulnerabilities, assess risks, and apply appropriate countermeasures. For an ordinary person that translates to: what do I want to protect, from whom, where does it leak, how bad would it be, and what can I change with reasonable effort.
Is it possible to be completely anonymous online?: Over any length of time, realistically no. Research keeps showing how few data points it takes to single someone out: ZIP code, gender and date of birth were enough for about 87 percent of the US population in one study, and four location points identified 95 percent of people in a large phone dataset. What you can achieve is making your traces harder to connect and visible to fewer people.
What is personal OPSEC?: Personal OPSEC applies the military process to everyday life. Instead of an enemy army, the realistic adversaries are scammers, an abusive ex-partner, nosy strangers or data brokers. The practical side is mostly habits: thinking before you post, delaying location-revealing photos, keeping separate identities for separate parts of your life, and checking privacy defaults.
Does a VPN give you good OPSEC?: Only for one narrow slice. A VPN hides your IP address from the sites you visit and protects you on untrusted Wi-Fi. It does nothing about what you post, which name you log in with, or what your browser reveals about itself. Good OPSEC starts before any tool, with the question of what information you are giving away at all.
What is an example of bad OPSEC?: Posting a photo of your boarding pass is a classic. In 2020 former Australian prime minister Tony Abbott did exactly that on Instagram. Using the booking reference encoded in the barcode plus his surname, a stranger logged into the airline's booking page and found his passport number and phone number in it. The photo looked harmless; the damage came from what it could be combined with.