Document Security
Document Security
Document Security
Documents Security is that aspect of security which involves the application of security
measures for the proper protection and safeguarding of classified information.
These are information and material (matter), the unauthorized disclosure of which would
cause exceptionally grave damage to the nation, politically, economically or from a security
aspect. This category is reserve for the nation’s closest secrets and is to be used with great
reserve.
Classification Authority
The original classification authority for assignment of TOP SECRET classification rests
exclusively with the head of the department. This power may however, be delegated to
authorized offices in instances when the necessity for such arises. Derivative classification
authority for TOP SECRET classification (authority for) may be granted those officers who are
required to give comments or responses to a communication that necessitates TOP-SECRETS
response.
These Information and material (matter), the unauthorized disclosure of which would
endanger national security, cause serious injury to the interest or prestige of the nation or of any
governmental activity or would be of great advantage to a foreign nation.
These are information and material (matter) the unauthorized disclosure of which, while
not endangering the national security, would be prejudicial to the interest or prestige of the
nation or any governmental activity, or would cause administrative embarrassment or
unwarranted injury to an individual or would be of advantage to a foreign nation.
These are information and material (matter), which requires special protection other than
that determined to be TOP SECRET, SECRET, or CONFIDENTIAL.
Authority to classify shall be the same as for CONFIDENTIAL matter. Reproduction is
authorized. Transmission shall be through the normal dissemination system.
Classified matter originating from another department shall not be disseminated to other
departments without the consent of the originating department.
General Policy. – No person in the government shall convey orally, visually or by written
communication any classified matter outside his own department unless such disclosures has
been processed and cleared by the department head or his authorized representative.
1. Its use shall be solely for the purpose for which the classified matter is requested.
2. It shall be treated or handled in accordance with the classified categories of the
originating office.
3. Handling shall be made by security-cleared personnel.
4. Reproduction and dissemination shall not be made without the consent of the
department head.
Disclosure of classified matter for publication
Classified matter shall be released for public consumption only upon the consent of the
department head or his authorized representative. However, in instances where there is a
demand or need for releasing classified information, extreme caution must be exercised to
analyze in detail contents of the classified matter before release. Normally all information are
released through Public Information Officers. Public Information Officers should be assisted in
the analysis of classified information by the Security Officer.
1. Category A
a. Information which contains reportable time sensitive, order of battle and
significant information.
b. It should be given priority because it is critical information.
c. It must be forwarded without delay.
d. It is critical to friendly operations.
e. It requires immediate action.
2. Category B
a. Anything that contains communications, cryptographic documents, or systems
that should be classified as secret and requires special handling.
b. Higher authorities should declassify it.
3. Category C
a. Other information, which contains something that, could be an intelligence value.
b. Contains exploitable information regardless of its contents.
c. Unscreened materials/documents should be categorized as Category C.
4. Category D
a. No value, yet lower level will classify documents as category D.
b. No decision must be made at the lower echelon that document has no value. It is
the responsibility of the higher Headquarters.
Proprietary information is information that in some special way relates to the status or
activities of the possessor and over which the possessor asserts ownership. In the business
community, proprietary information relates to the structure, products or business methods of the
organization. It is usually protected in some way against causal or general disclosure.
1. Trade Secrets- this consist of any formula, pattern, device or compilation of information
which is used in one’s business and which gives him an opportunity to gain an
advantage over competitors who do not know or us e it. It may be a formula for a
chemical compound a process of manufacturing, treating or preserving materials, a
pattern for machine or device, or a list of customers. It differs from other secret
information as to single or ephemeral events. A trade secret is a process or device for
continuous use in the protection of the business.
1. Requirements for obtaining a patent are specific. To qualify for a patent the invention
must be more than novel and useful. It must represent a positive contribution beyond the
skill of the average person.
2. A much lower of novelty is required of a trade secret.
3. A trade secret remains secret as long as it continues to meet trade secret tests while the
exclusive right to patent protection expires after 17 years.
Realizing that the most serious threat to trade secrets is the employee, a measure of
protection is often realized through the use of employee agreements which restrict the
employee’s ability to disclose information without specific authorization to the company. The
following countermeasures may be adopted:
COMMUNICATION SECURITY
Rules- governing communications security do not in guarantee security, and they do not
attempt to meet every conceivable situation. Communication security rules are a means, not an
ends.
Department heads- are responsible for the maintenance of communication security and
for the promulgation of additional directives as may be necessary to insure proper
communication security control within their jurisdiction.
TRANSMISSION SECURITY:
Communication personnel shall select the means most appropriate to accomplish the
delivery of message in accordance with the specified precedence and security requirements.
Radio Operators shall adhere to the use of correct procedures, circuit discipline and
authentication system as a security measures against traffic analysis, imitative deception and
radio direction finding.
CRYPTOGRAPHIC SECURITY
Code - a system which uses words as the smallest element like the one below.
Cipher - a system that manipulate one, two, or three characters at a time like:
Cipher Plaintext
B 1
C 2
J 3
D 4
Abbreviation
C: code or cipher
P: Plaintext
K: keyword/ key number
Note: Code and cipher may be used interchangeably to mean the same.
Categories of Cipher
EFDH GORA NQBO PETE YTDS RTOU ZESV ITVE SOWM XNIM CTLK HJEA
Example
ADDE DAQD NPCR OOLL TMAT RLOC RATS TKCL MNRA KETI SSTU ARTF
THEE OSET ULCO JEOU TAKE BLFZ IAHF SQUI TIFC ANLL TMZX AEXE
DLGY ZZTI FLOO VWKA TTIM IFTT HATH EEFC ANND FLHA
(Read this by copying out a progressive cipher. Progress 1, 2, 3….)
Note: The plaintext are concealed by “nulls” - are meaningless symbol to fill in and separate
plaintext.
Example
RTRTBS
encipher by droppings every other letter
EUNOAE
C: RTRTBS EUNOAE
Decipher:
P: Return to base
Decipher:
Substitution Method - original message elements, letters, numbers or other symbols are
replaced with alternate symbols.
j 26
4 19
I 16
) 15
* 13
Example 2 - c: x y z a b c d e
p: ABCD EFGH
p: stop icebox
c: VWRS LFHERA
c: FOURSCOREANDSEVENYEARSAGO
p: abcde………………………xyz
What is a Risk?
It is the potential damage or loss of an asset. The level of risk is a combination of two
factors: The value placed on that asset by its owner and the consequence, impact adverse
effect of the loss or damage to that asset and; the likelihood that a specific vulnerability will be
exploited by a particular threat.
What is an Adversary?
An individual, group, organization, or government that conducts activities or has the
intention and capability to conduct activities detrimental to the individual, private or government
entity.
What is Asset?
Any information, facility, material, information, or activity which has a positive value to its
owner whether it is an individual, private or government entity.
What is Probability?
It is the chance or likelihood that a loss will take place. Indicated by a mathematical
statement concerning the possibility of an event occurring
What is Criticality?
It is the impact of a loss as measured in financial terms. How important it is in terms of
the survival or existence of the organization.
1. Risk Avoidance- eliminating or removing the risk totally from the business, government,
or industrial environment for which the risk manager has responsibility
2. Risk Reduction- decreasing the risk by minimizing the probability of the potential loss.
The reduction of criminal opportunity is often accomplished by situational crime
[prevention strategies to discourage, deter, or deny criminal incidents.
3. Risk Spreading- spreading the risk through compartmentation or decentralization to
limit the impact (criticality) of the potential loss
4. Risk Transfer- moving the financial impact of the potential loss-over to an insurance
company.
5. Risk Self-assumption- planned assumption and acceptance of the potential risk by
making a deliberate managerial decision of doing nothing about the threat, or setting
aside resources for use in case of a specific loss incident.
SECURITY HAZARDS
Any act or condition which may result in the compromise of information, loss of life, loss
or destruction of property or disruption of the objective of the installation.
Types of Hazards
1. Natural Hazard- these are hazards which arise from natural phenomena. The following
are types of natural hazards or disasters:
a. Floods caused by typhoons
b. Earthquakes
c. Fire (not caused by human action)
d. Storms (typhoons, cyclones, tornado and hurricane)
e. Lighting storms
f. Extreme temperature and humidity
2. Human-Man made Hazards- These are hazards which are the result of a state of mind,
attitude, weaknesses or character traits of one or more persons. They can be acts of
commission or omission, both overt and covert, which can disrupt operation of a plant or
installation. The following are types of human or man made hazards:
a. Carelessness- accidents and dissatisfaction
b. Disloyalty-subversion and sabotage
c. Espionage, pilferage and theft
d. Vandalism, etc
Description of a Saboteur
1. He is the most dangerous foe whom security will have to deal with while planning and
implementing security measures and techniques.
2. He is an ordinary looking as the next guy but in his mind, he has the training in
deception, knowledgeable in incendiaries, explosives, chemistry, bacteriology,
mechanics and psychology.
3. He can work alone, in-groups, or simultaneously in several places.
Types of Pilferers
1. Casual Pilferer- one who steals due to his inability to resist the unexpected opportunity
and has little fear of detection is no plan or premeditation and he is usually a “loner” on
the job. The temptation to pick up the article is basically due to poor security measure.
The implication of causal pilfering is the big cumulative cost if it remains unchecked.
2. Systematic Pilferer- one who steals with preconceived plans and takes away any or all
types of items or supplies for economic gain. Pilferers of this kind can be employees or
outsiders of the establishment.
The information pertaining to one of the most important security services offered to a
head of office is the conduct of security surveys and security inspections. Every unit chief
desires a security system that will reduce to an absolute minimum the possibility of espionage,
sabotage and compromise of classified information on his office or unit. Since there are many
security countermeasures to be considered, heads of offices should utilized specially trained
personnel, if the efforts of espionage and sabotage agents and other criminal elements are to
be negated. Security is an extremely complex program an objective analysis of an office head’s
security program by security survey and inspection personnel can be of great assistance in
determining the efficiency of any established security program.
It is a check of how well existing security measures and regulations are being carried out
within a command. A security inspection may also include an investigation of alleged or
suspected security violations. Physical security is concerned with forces, entrances and exists,
guards, traffic control, lighting, fire control, and with such other physical measures, which, if
properly established and maintained, will deny access to, unauthorized persons.
The terms “Security Survey” and “Security Inspection” to accentuate the particular
differences between the two types of services, are defined as fallows:
Security Survey is defined as a counterintelligence service to assist heads of office in
determining the security measures required to protect key installations from possible sabotage,
espionage, subversion, and unauthorized disclosures of, or access to, classified information or
material contained therein.
With the exception of the office head, the security officer is more interested in the survey
that any other individual of the office. It is the security officer who is directly responsible to the
head of office for proper maintenance of security of the security program of the office.
The Unit head may request a survey of his entire office or of specific function of a unit
within the office. When higher authorities directs a security survey to be conducted for one of its
subordinate office, an information copy of the correspondence may also be forwarded to the unit
to be surveyed. It must be remembered that a security survey is not conducted solely for the
purpose of establishing a security program of an office. The head of office is directly responsible
for establishing a security system for his office after which a survey may be conducted to
determine if the program is adequate in comparison with the importance of the office to the
overall national objective.
EXECUTIVE/VIP PROTECTION
Executive/VIP Security
Are those measures taken by Agents, Security Officers, Law Enforcement officers or an
Agency /officers to protect heads of state, foreign, national or local dignitaries, civilian or military
against any personal injury, assassination, sabotage, and espionage. These may include the
protection of any government or civilian officials and individual utilized as government
witnesses.
Every phase of security must be carefully in advance, to include the importance of the
individual to be protected, political attitude of the population, obstacles involved, means of
transportation, and duration of the security mission.
Physical protection should consist of a series of protection cordons. These protective cordons
may be composed of a combination of personnel or physical security barriers.
The officer in charge should be given full responsibility for all phases of the security
mission.
Close coordination must be established with all local military and civilian authorities.
Civilian authorities will include police and other interested city, municipal or other local officials.
The agencies responsible for each of the security plan must be clearly defined.
Arrangements should be made for local police to control local inhabitants. All available
intelligence channels should be used to obtain information of potential danger areas, persons,
or groups.
Coordination must be accomplished by an advance party after the official itinerary is
received.
Protective measures must be through but inconspicuous and afford security without
impending the protectee/VIP’s performance of his functions.
The degree of protection is dependent upon the degree of contact with the general public
desired by the protectee.
Plans for a perimeter of protection must be surprise proof and flexible enough to allow a
quick response to any emergency.
Defense-in-Depth Theory
To achieve the ultimate results from a physical security system, it is necessary to add
barrier to barrier, delay time, until sufficient delay time has been accumulated to allow control of
any foreseeable penetration.
Therefore, rather than attempting to achieve exclusion through the use of a single
barrier, security must be built upon accumulated time or a system of “Defense-in-Depth.
Contingency Planning
Security planning should be flexible. Weather conditions, mechanical failures and failure
of lighting systems are three-ever-present potential hazards. The unexpected arrival of large
numbers visitors, audience is another situation frequently encountered. Last-minute changes in
the security plan or schedule of events occur routinely. The security plan therefore must be
sufficiently fluid to cover these and other eventualities, all of which present hazards.
Mission Orientation
Police/Security personnel assigned to these duties are selected to the basis of the
appearance, alertness, and intelligence, as well as their ability to act quickly and correctly in
unforeseen circumstances.
Restriction on the circulation of the individuals should be strictly enforced. Before any person
maybe allowed to get near the protectee or his effects, the person is checked carefully for
identification and the authority for his presence is established.
Use of weapons
There is always the danger of accidental discharge and injury of innocent persons when
weapons are carried. All protective personnel must be qualified to fire the weapons with which
they are armed.
Crowd Control
Protective personnel should understand the principles of crowd control. They should not
show not show prejudice or sympathy, or become involved in any grievances expressed by the
crowd.
Advance Preparations
Motorcades
Select and consider the best motorcade route, preferably the most direct route to
destination. Select a route which affords a chance to have alternate routes if something
happened on the motorcade route.
Review or dry run the route and take notes on the requirements for controlling the crowd
and traffic and deployment of foot patrolmen and motorcycle police at various positions along
the route. Arrange for police or buildings custodian to inspect buildings along the motorcade
routes.
1. Establish screening points to allow only authorized persons access to the protected
area/person and to keep out those who have no valid reasons to enter same.
2. Duty stations or posts should be marked on a floor/ground plan or sketch/map.
3. If an unusually large crowd are expected along a parade route security men may call on
the armed forces to station troops along the line of march.
4. If the VIP travels by train, a pilot engine must run the trucks IN advance of the VIP train.
5. Every manhole and sewer along the route should be sealed.
6. Every single building and all its occupants along the route should be checked.
7. Bellboys, waiters, cooks should be cleared.
8. Food to be cooked must be examined and samples be sent to laboratory for analysis.
9. Inspect for time bombs, radio - active materials and fire hazards.
10. Inspect closets and under the tables.
11. Never allow the VIP to stop his car in a crowd if it can be avoided.
12. Drivers for the VIP can be competent, reliable, well trained in protective driving and must
be alert for dangers and to take instant action.
13. While walking, it is necessary to increase the number of guards because the VIP
becomes an easy target.
14. In case the VIP is going to speak at hasty made stage, its strength and capacity should
be inspected to limit the persons going up to stage.
15. During afternoon sessions, lightning facilities must be checked or installed. It is
estimated that the program may reach up to nighttime.
16. An alternate generator fore emergency use is made available if source of electric power
is from a central source. Designate qualified electrician to watch main source or switch.
17. If traveling by air, close the door of VIP plane when parked and place constant guards
every time.
18. If traveling by watercraft, select boats of type and size capable of facing danger at the
ocean. Thorough inspection should be made on the ship and check the adequacy of
lifesavers and emergency facilities.
19. All non- uniformed men must wear signs or countersigns for identification.
20. Checklist of all security hazards noted in the course of security survey or inspection
should be given to the OIC for reference/planning.
21. Security plans and specific duties of men assigned or details must be stated.
22. All written instructions must be classified SECRET.
Security Formations assist in allowing the VIP to have the best possible protection and
defensible position even for the limited amount of manpower while protectee is mobile/in transit,
or static.
Threat evaluation is to ascertain at varying times and function which will give the best
formation sequence or set. Other considerations are threat levels and type and advance
planning for staff levels.
The Need for Close - in /Escort security officers, such as first aid requirements
(which differs from location to location) and special weapons (a real headache-the less you
need to rely on them, the better), and other logistical needs must be considered. One must have
the ability to use a lot of common sense and attention to detail, to give the possible protection,
without overbearing or on top of the protectee/principal. Fully aware with this information, the
Close-in/Security Escort team will be well equipped, with an understanding of their respective
position, alternatives and functions.
These could be varied hourly, in response to current threat level, and areas of coverage
or occasion in any of the following:
1. Concentrate - concentration do not get loss or be left behind, it takes only a second or
two {to get killed}
2. Anticipation - anticipate your fellow officer/Escort’s moves, you can keep the protective
formation together nice and well coordinated. Because of obstacles, obstructions, and
areas of threats, the movement of Close-in security/Escorts will be spasmodic and
spontaneous.
3. Relaxation/Observation- observation should be done in a relaxed manner. Be very
attentive but looking relaxed.
4. Common sense- common sense comes from using your brain, foresight, experience,
and good training.
Participation within the Team- the team must train together and understand completely what
their job is and their responsibilities. There will be big gaps in the defenses if we do not have
participation within the team.