text: Appendix C
  training to improve their units’ resilience and ability to mitigate risk, coordinate with appropriate partner
  organizations, and respond effectively.
  C-5. While a threat’s use of lethal capabilities to target the U.S. homeland or deploying forces is unlikely
  before a crisis or the commencement of armed conflict, it may choose to use other methods to surveil and
  disrupt Army forces during competition. Russia, China, and other threats possess wide-ranging capabilities
  to conduct cyberspace attacks, disrupt space capabilities, and conduct information warfare to influence the
  perceptions and behavior of target audiences. Attribution for these malign activities is challenging.
  Adversaries take steps to deliberately obscure the source of these activities, and they take full advantage of
  the ambiguity provided by operating below the threshold of armed response. Cyberspace attacks can be used
  to compromise government, private sector, and military capabilities, potentially targeting military
  dependencies on civilian infrastructure. Disruption of space capabilities can be used to hamper
  communication and navigation capabilities of both military forces and the civilian infrastructure they rely
  upon. Information warfare, including dissemination of or support for disinformation and misinformation, can
  be used to attempt to fracture bonds among elements of society. This may include seeking to create or
  exacerbate divisions between the military, government, private sector, and the public, both nationally and in
  local municipalities.
  C-6. Peer threats use a variety of means to understand and predict U.S. and allied force projection, including
  open source and cyberspace collection. Army leaders should understand threat collection capabilities to
  reduce the chance of effective detection. Different ways threat forces are able to collect on a division’s
  deployment are described in this notional scenario.
  Notional Threat Open Source and Cyberspace Collection
  A division has received prepare to deploy orders. Division leaders considered this
  deployment routine, and they failed to address operations security or force protection
  at home station during the planning process. As a result, threat forces are able to
  understand many details of the pending deployment through open-source and
  cyberspace collection.
  Threat intelligence agencies read aircraft tail numbers arriving and departing from air
  bases that typically support division operations, analyzing observations posted by
  hobbyists to assess likely missions and cargo. They also analyze publicly available
  movement contracts for taking unit equipment from fort to port. Increased availability
  of rental residences near the installation indicates that Soldiers are invoking
  deployment clauses in their leases, and decreased availability of personal storage
  units indicates Soldiers are storing their belongings for a deployment. Commercially
  available applications and databases that track food ordering, cell phone presence and
  activity, and other data are used to show a continued staff presence after normal
  business hours at the division headquarters.
  As the deployment gets closer, Soldier and family member social media posts increase
  in volume and provide information about upcoming deployment timelines and
  locations. Threat agents go through financial transactions and credit card data stored
  on accessible servers to better understand specific unit and key leader timelines and
  vulnerabilities. Threat agents also comb through Soldier and family member personal
  data collected as part of application and device user agreements. Some of this data,
  normally sold for advertising purposes, was purchased through shell companies on the
  open market. Other credit, banking, and identity data was illegally obtained on the dark
  web or through other illicit methods.
  C-7. Threat forces will conduct information warfare operations to slow or otherwise degrade force
  projection. These campaigns can vary in scope and size, and may target local communities, Service members,