OPSEC and the downfall of New York’s governor
We recently got back from Argentina. One of the delightful things about being there is that a lot of things that seem important in Gringolandia simply don’t make it into the public consciousness at the bottom of the Americas. Thus, in the United States, the news is taken up with scaring the population into being afraid of terrorism, the war in Iraq, troubles in the Mideast, global warming, and the like. There, however, none of these seem to be mentioned at all. On the other hand, we were frequently asked about New York’s governor’s fall from grace, which made the news throughout the world. (One of our other editors was simultaneously being asked the same questions in Mexico and Panama.)
Putting aside all the more-relevant issues, we in the trade were struck by how his being caught revealed a total lack of understanding of OPSEC. Here was a man who, as a prosecutor, angered a lot of people in the private sector, and as governor angered a lot of people in the public sector. It would be a safe guess that a lot of people would be actively watching what he did in hopes of, at the very least, embarrassing him. If you are going to do things you don’t want others to know about, you’d better be thinking OPSEC.
Once it was determined that the activities in question could not be deferred for the duration of his service, could OPSEC have prevented or delayed exposure in this case? Well, OPSEC practitioners have kept much more complex operations from being noticed. However, it is always important to keep in mind the luck factor: You may be able to mask the existence of a new warcraft for a substantial part of its development and implementation, but when one of them crashes in a populated area, your luck has run out. Given the level of scrutiny in this case, it would have been difficult, but it could have been done. Doing so would have required much more planning and much less bad judgment than appears to have actually been in place.
The financial piece was not much of an issue because the sums involved were small for a man of his wealth, and would not have attracted attention coming out of his accounts as cash, and cash does not leave much of a trail. While an investigation of the business involved might eventually have linked the cash payments to him, this was a factor not within his control, and therefore a risk to be factored in. It appears that the latter did not happen, and we deem it unlikely that a SAR would be filed over sums probably less than he spent for lunch in a year.
In the end, those watching him had greater skill and luck, with the luck being, we would posit, largely a factor of his lack of skill and judgment.
