SEC-02-04
Threat Analysis — Who Is Watching
Naming your adversary and assessing what they can actually do
A threat is not a worst-case scenario — it is a specific adversary with documented capability and credible intent to collect your critical information and act on it. Threat analysis forces you to replace general fear with specific, evidence-based assessment. The output of this step determines which of your indicators are actually vulnerabilities and which are merely observable but irrelevant.
What a Threat Actually Is
The Three-Part Test
For something to constitute a threat in OPSEC terms, it must pass three tests simultaneously. First, there must be a specific adversary — not a category like “bad people” or “the government,” but an identifiable person, group, or organization with an operational reason to want your critical information. Second, that adversary must have the capability to collect the information — the means, access, and skill to actually obtain it. Third, the adversary must have credible intent — an active interest in collecting your critical information for a purpose that would harm you.
If any one of the three is missing, the threat is eliminated for planning purposes. A neighbor who could observe your patterns but has no operational reason to do so is not a threat to your OPSEC plan — they are merely someone with observational access. Recognizing this keeps your countermeasure effort focused.
Intelligence Collection Methods
What Adversaries Can Actually Do
Part of threat analysis is assessing your adversary’s collection capability. Collection methods fall into several categories that you need to evaluate. Open Source Intelligence (OSINT) is available to anyone with internet access: your social media, public records, voter registration, property records, court filings, vehicle registrations, and any publicly accessible content that names or describes you or your group. This is the most accessible collection method and is severely underestimated as a threat vector.
Human Intelligence (HUMINT) refers to information obtained through personal contact — conversations, elicitation, or individuals embedded in or adjacent to your group. Most preparedness groups are far more exposed to HUMINT collection than they realize. Members talk to spouses, children, neighbors, and acquaintances who are not part of the group’s security perimeter.
Physical observation covers surveillance of your location, activities, vehicles, and patterns by someone with physical access to your environment. This requires less technical capability than most people assume — a patient observer with a vehicle parked nearby can build substantial understanding of your group’s size, schedule, and operational patterns over time.
Technical collection includes signals interception (monitoring radio traffic), network intrusion, and other technology-enabled collection. For most civilian preparedness environments, this is a lower-probability threat than OSINT or HUMINT, but it is not zero — particularly for groups with adversaries who are technically sophisticated or who have institutional resources.
Matching threats to the right collection methods
A MAG conducts a threat analysis and identifies two potential adversaries. The first is a local activist group that has targeted preparedness communities in the area; their observable capability is limited to OSINT and social media monitoring, with no evidence of physical surveillance capability. The second is a disgruntled former member who knows several current members personally and has been making statements about exposing the group.
The threat analysis produces different countermeasure implications for each. Against the activist group: remove publicly accessible identifying information, don’t post group activities on social media, don’t allow members to cross-link preparedness affiliations to public profiles. Against the former member: assess what operational information they already possess, identify which remaining critical information they lack access to, and consider whether any current members maintain contact with them.
The same CIL, two different adversaries, two different countermeasure approaches. This is why threat analysis must precede countermeasure selection.
Keeping It Grounded
Threat analysis is where OPSEC practice most often slides into paranoia or disconnection from reality. The discipline requires you to be specific and evidence-based, not imaginative. If you cannot articulate why a specific adversary would want your specific critical information, and what they would do with it, they do not belong in your threat assessment. Threat inflation wastes countermeasure resources and, more importantly, makes the entire OPSEC framework feel unworkable — which causes people to abandon it.
Start with the most likely and most capable threats, not the most catastrophic ones. For most preparedness groups, the realistic threat landscape includes nosy neighbors, social media exposure, and the group’s own members who have not internalized communications discipline — not nation-state actors or sophisticated surveillance programs.
For each entry on your preliminary CIL from Lesson 3, write the name or description of a specific adversary who would benefit from knowing that information. Then assess: does that adversary have capability to collect it, and credible intent to act on it? Remove CIL entries where no specific adversary passes all three tests.
This exercise typically reduces CIL length by 20-30%, which is the intended result.
A group identifies “federal agencies” as their primary OPSEC threat without specifying which agency, what information it would collect, or what it would do with that information. What is wrong with this threat assessment?
I can apply the three-part test (adversary, capability, intent) to assess whether something is a credible threat.
I can name at least three collection methods and describe which threats are likely to use each.
I have identified specific, named adversaries relevant to my CIL entries.
I understand why vague or inflated threat assessments undermine effective OPSEC practice.
Next →Lesson 5 of 7: Indicators and Vulnerabilities