Bring out your dead! Bring out your dead!
Monty Python fans will recall the scene in Monty Python and the Holy Grail where bodies of the dead are being collecting during The Black Death. Visions of this flashed across our mind when we read that the University of Medicine and Dentistry of New Jersey – well, actually the Public Health Research Institute, which apparently leases space from the university’s facility inNewark– had misplaced three mice infected with Yersinia pestis, which most of us know as the plague.
The good news is that the Public Health Research Institute, founded in 1941 by New York City Mayor Fiorello LaGuardia to study infectious diseases, has lots of experience in this arena, and it is most likely that the missing mice were eaten by other mice. It is therefore no surprise there have been no reports of plague in the area. Plus, while the plague might have wiped out a third of the population of Europe in the 1300s, we haven’t had a plague epidemic in the U.S since the Los Angeles episode in mid 1920s. And, if detected in time, the plague can be dealt-with using modern antibiotics.
That aside, how does this incident relate to OPSEC? OSEC helps you identify those who want information that would be used to their advantage, as well as the information they want (as opposed to information you think is valuable to you).
In this day and age, information relating to the location of pathogens is of potential interest to a wide variety of people. An indicator that these pathogens may not be adequately protected is likely to be of even wider interest to potential enemies.
What does this mean in practical terms (and we race to point out that we have no actual knowledge of either the potential risks of what PHRI has or the measures taken to protect whatever they have)? Well, if we had pathogens that might be perceived as being useful for bad purposes, we would, following this adverse publicity, be re-evaluating all security measures against possible outside scrutiny.
This incident points out how important the OPSEC process is: It really is critical that you identify information – and indicators of information – that would be of value to your competitors and adversaries. And that you identify your competitors and adversaries. Putting aside SEC requirements to do this, simple common sense should tell you it is important.
