CLASSIFICATION: UNCLASSIFIED/ ROUTINE R 271649Z FEB 25 MID180001636599U FM SECNAV WASHINGTON DC TO ALNAV INFO CMC WASHINGTON DC CNO WASHINGTON DC SECNAV WASHINGTON DC BT UNCLAS
ALNAV 018/25
MSGID/GENADMIN/SECNAV WASHINGTON DC/-/FEB//
SUBJ/FOREIGN ADVERSARY TARGETING OF UNITED STATES NAVY AND MARINE CORPS PERSONNEL ON SOCIAL MEDIA//
REF/A/MSG/ALNAV/29AUG24// REF/B/DOC/OPNAVINST/14JUN24// REF/C/DOC/SECNAVINST/28OCT19// REF/D//DOC/MCO/12NOV20// REF/E/DOC/DODD/17MAY11//
NARR/REF A IS ALNAV 073/24, DEPARTMENT OF THE NAVY INSIDER THREAT AWARENESS MONTH. REF B IS OPNAVINST 5510.165B, NAVY INSIDER THREAT PROGRAM. REF C IS SECNAVINST 5510.37A, DEPARTMENT OF THE NAVY INSIDER THREAT PROGRAM. REF D IS MARINE CORPS ORDER 5510.21, MARINE CORPS COUNTER-INSIDER THREAT PROGRAM. REF E IS DOD DIRECTIVE 5240.06, COUNTERINTELLIGENCE AWARENESS AND REPORTING.
RMKS/1. Foreign Intelligence Entities (FIE) are using Social Networking Sites (SNS) and applications to target Department of Defense (DoD) and Department of the Navy (DON) personnel and their families to access facilities, systems, equipment, information, or infrastructure in order to damage, disrupt operations, compromise information or commit espionage on behalf of an adversary or competitor. FIE are also using fake personas to obfuscate their intent and affiliation with foreign intelligence services. They have been observed as increasing their use of SNS and seemingly legitimate job offers to elicit sensitive information. These solicitations pose a direct threat to our defense industrial base and undermine the ability of our Department to compete with foreign competitors on the development of critical emerging technologies. The detection and deterrence of these efforts should be a priority for all active duty and civilian members of the DON. The Naval Criminal Investigative Service (NCIS) and the DON's Insider Threat Programs are committed to increasing the awareness of these threats pursuant to references (a) through (d).
Platforms and Tactics. FIE are leveraging SNS to insidiously obtain unclassified and classified information from U.S. military and other U.S. Government (USG) entities and affiliates. FIE have used SNS such as Facebook, LinkedIn, and Indeed to initiate espionage relationships with DoD and other USG personnel by posing as researchers and headhunters and offering jobs and consulting opportunities. Contact requests are initiated with superficially harmless questions in order to establish rapport and determine military affiliation. FIE and those working on their behalf are known to offer all-expense paid trips to their targets for speaking engagements, such as presentations at universities and interviews.
Solicitation Questions. The questions asked may not explicitly or directly include classified information, rather, adversaries may rely on opinion-based queries to gather information. Examples include geopolitical questions on U.S. relations with China, Taiwan, or Ukraine; opinions on the current U.S. military command climate and structure; or opinions on how to improve military operations and/or functions. Adversaries may also offer disproportionately high payments for opinion papers on the aforementioned topics. Although this model of solicitation does not fit the traditional methods of targeting personnel with access to classified information, the threat should not be discounted, regardless of how innocuous the requested information appears.
Contact Methods. Methods of contact include, but are not limited to, social media direct messages, email, phishing attempts, or telephone calls. These contacts appear benign in nature and often do not seem to originate from a hostile nation or government, but rather appear to originate from within the United States or from a friendly nation. The requests have been known to escalate from the sharing of opinions to veiled requests for classified material. All DON personnel are encouraged to remain vigilant to this active and highly complex national security threat.
Financial Solicitations. Additionally, DON personnel and their families should be vigilant for suspected fraudulent financial solicitations. FIE use a combination of fake websites, phishing messages, and malicious apps to trick DON personnel into providing financial data, and/or login credentials used for long-term access to financial accounts which are then exploited for vulnerabilities.
Reporting Requirements. As mandated by reference (e), all DON personnel will report potential FIE threats, to include contacts, activities, indicators, and behaviors, to their organization's counterintelligence (CI) element or the NCIS. When CI support is not available, DON personnel shall report the threat without delay to their security officer, supervisor, or commander - who shall forward reported information to their organizational CI element or NCIS within 72 hours.
All commanding officers and supervisors should mandate prompt threat reporting in order to deter efforts by our adversaries to undermine our military and enhance awareness of established procedures for contacting their respective CI organization and the assigned NCIS Special Agent, servicing NCIS office, or Navy or Marine Corps Insider Threat program representative. Reports can also be submitted to NCIS via the "SUBMIT A TIP" link at the top of the NCIS home page located at https://www.ncis.navy.mil/.
Released by Mr. Terence G. Emmert, Acting Secretary of the Navy.//
BT #0001 NNNN CLASSIFICATION: UNCLASSIFIED/