Military reference books and manuals (2009-2023, Volume 6) - page 35
TB 380-41
HEADQUARTERS
DEPARTMENT OF THE ARMY
Washington, D.C., 03 July 2003
TECHNICAL BULLETIN
SECURITY: PROCEDURES FOR SAFEGUARDING, ACCOUNTING AND SUPPLY
CONTROL OF COMSEC MATERIAL
TB 380-41, July 2003, is changed from October 1994 as follows:
(Remove the old TB in its entirety and replace with the July 2003 edition.)
1. Added a chapter to address specific AKMS issues (Chapter 6).
2. Added a chapter specific to Incidents and their reporting (Chapter 7).
3. Included newer information about shredders.
4. Changed reporting time frames to cause all accounts to be the same (National Guard
and Reserves still have an extension on time).
5. Added information on deployment issues.
6. Reduced the amount of samples and included more charts.
7. Eliminated the COMSEC account numbering system, as the account number no
longer identifies the type of account.
8. Incorporated changes to the MARKS.
9. Incorporated ALC 6/7 key issues.
10. Eliminated specific issues concerning CLSFs, as they will no longer be handled
differently from other accounts.
ii
FOR OFFICIAL USE ONLY
TB 380-41
TABLE OF CONTENTS
Chapter/Paragraph
Page
CHAPTER 1 GENERAL
1-1
1.1
PURPOSE
1-1
1.1.1
(U) Objective
1-1
1.1.2
(U) Scope
1-1
1.1.3
(U) References, Abbreviations and Terms
1-1
1.2
APPLICABILITY
1-1
1.3
AVAILABILITY OF FORMS
1-1
1.4
RESOLUTION OF CONFLICTS
1-2
1.5
ARMY COMSEC WHOLESALE LOGISTICS MANAGEMENT PROGRAM
1-2
1.6
COMMENTS AND RECOMMENDATIONS
1-2
1.7
INTRODUCTION OF ELECTRONIC KEY MANAGEMENT SYSTEM (EKMS)
1-3
1.8
SERVICE AUTHORITY
1-3
CHAPTER 2 COMSEC FACILITY, CMCS, ACCOUNTS, AND CUSTODIAN REQUIREMENTS
2-1
2.1
COMSEC MATERIAL CONTROL SYSTEM (CMCS)
2-1
2.1.1
(U) Army CMCS Structure
2-3
2.1.2
(U) CMCS Addresses
2-5
2.1.3
(U) COMSEC Directory Service (formerly COMSEC Activity Address Directory
2-6
2.2
COMSEC FACILITY
2-6
2.2.1
(U) Approving Office For the COMSEC Facility
2-6
2.2.2
(U) COMSEC Facility Approvals
2-6
2.2.3
(U) Request for Approval
2-7
2.2.4
(U) Action by Approving Authority
2-7
2.3
ESTABLISHING A COMSEC ACCOUNT
2-8
2.4
COMSEC ACCOUNT NUMBERING SYSTEM
2-8
2.4.1
(U) COMSEC Account Number/EKMS ID Structure
2-8
2.4.2
(U) Hand Receipt Numbers (Local Element)
2-8
2.5
COMSEC ACCOUNT REGISTRATION PACKET (CARP)
2-8
2.5.1
(U) COMSEC Account Registration Packet (CARP) Distribution
2-9
2.5.2
(U) Reporting COMSEC Account Data Changes
2-9
2.5.3
(U) Completion of the CARP
2-9
2.5.4
(U) Fund Code DODAAC
2-9
2.6
SUPERVISION OF COMSEC FACILITIES
2-11
2.7
COMSEC CUSTODIAN AND ALTERNATE REQUIREMENTS
2-11
2.7.1
(U) Custodian and Alternate Appointments
2-11
2.7.2
(U) Custodian/Alternate and Witness Duties
2-12
iii
FOR OFFICIAL USE ONLY
TB 380-41
Chapter/Paragraph
Page
2.8
COMSEC CUSTODIAN ABSENCE
2-14
2.9
RELIEF FROM ACCOUNTABILITY
2-15
2.10
MOVEMENT OF COMSEC ACCOUNTS
2-15
2.10.1
(U) Traditional Account Custodian Actions
2-15
2.10.2
(U) AKMS Account Custodian Actions
2-16
2.10.3
(U) COR Processing Actions
2-16
2.11
CLOSING OF COMSEC ACCOUNTS
2-16
2.11.1
(U) Commander’s Actions
2-16
2.11.2
(U) COR Procedures Upon Closure of COMSEC Accounts
2-17
2.11.3
(U) Closing of Accounts Due to Inactivity
2-17
2.12
CONTINGENCY DEPLOYMENT OF A COMSEC ACCOUNT…………………………….…….2.17
2.12.1
(U) Traditional COMSEC Account Contingency Deployment…………………………..2.17
2.12.2
(U) AKMS COMSEC Account Contingency Deployment………………………………..2.18
2.12.3
(U) Additional Requirements for Deploying COMSEC Accounts……………………….2.18
2.12.4
(U) CSLA Responsibilities to the Deployed Account…………………………………….2.19
2.13
UNIT DEPLOYMENT WITHOUT COMSEC ACCOUNTS
2-19
2.13.1
(U) Mission Support
2-19
2.13.2
(U) Suspension of a COMSEC Account
2-19
2.13.3
(U) Unit Return to Home Station
2-20
2.13.4
(U) CSLA Responsibilities for a Suspended Account
2-21
CHAPTER 3 SUPPLY AND CONTROLLING AUTHORITY PROCEDURES
3-1
3.1
IDENTIFYING COMSEC MATERIAL
3-1
3.2
REQUISITION FUNDING AND RETURNS
3-1
3.2.1
(U) Requisitions
3-1
3.2.2
(U) Customer Returns
3-2
3.2.3
(U) Customer Assistance
3-3
3.3
REQUISITIONING OF COMSEC MATERIAL
3-3
3.3.1
(U) General COMSEC Requisition Procedures and Applicable Publications
3-3
3.3.2
(U) Initial Issue of COMSEC Publications
3-3
3.3.3
(U) Identification Plates/Labels
3-4
3.3.4
(U) Equipment Alteration
3-5
3.4
NEED FOR CRYPTOSYSTEMS AND AUTHENTICATION SYSTEMS
3-5
3.4.1
(U) Information Security
3-5
3.4.2
(U) Authentication Systems
3-5
3.4.3
(U) Operations Security (OPSEC)
3-5
3.4.4
(U) Approved Systems
3-5
3.4.5
(U) Selection and Use
3-5
3.5
CRYPTONETS
3-5
3.5.1
(U) Cryptonet Elements
3-5
3.5.2
(U) Types of Cryptonets
3-6
3.5.3
(U) Cryptonet Size
3-6
3.5.4
(U) Cryptonet Expansion
3-6
iv
FOR OFFICIAL USE ONLY
TB 380-41
Chapter/Paragraph
Page
3.6
ESTABLISHMENT OF CRYPTONETS
3-6
3.6.1
(U) Requests for Key Tapes
3-10
3.6.2
(U) AKMS Accounts
3-13
3.6.3
(U) Requests to Hold Other Services or Agencies Cryptonets Key
3-13
3.6.4
(U) Requests for Foreign Release
3-13
3.7
CONTROLLING AUTHORITY
3-13
3.7.1
(U) Management Responsibilities
3-13
3.7.2
(U) Operational Responsibilities
3-14
3.7.3
(U) Logistics Support
3-15
3.7.4
(U) Key Material Compromises
3-16
3.7.5
(U) Defective Keying Material
3-17
3.7.6
(U) Key Material Reviews
3-17
3.7.7
(U) Designating Contingency Keying Material
3-18
3.7.8
(U) Disposition Instructions for Keying Material………………………………………….3-18
3.8
COMSEC KEY
3-18
3.8.1
(U) Authorization to Receive COMSEC Key
3-18
3.8.2
(U) Establishing Cryptonets and Initial Issue of COMSEC Key Material
3-18
3.8.3
(U) Shipment of Physical COMSEC Key
3-18
3.8.4
(U) Transfer Reports for COMSEC Key
3-18
3.8.5
(U) Excess and Unserviceable COMSEC Key
3-18
3.8.6
(U) Resupply Procedures for COMSEC Key
3-18
3.8.7
(U) Processing Requests
3-19
3.8.8
(U) Classification
3-19
3.9
DETERMINING COPY COUNT REQUIREMENTS
3-23
3.9.1
(U) Excessive Use of Manual and Auto-manual Cryptosystems
3-23
3.9.2
(U) Rapid Net Expansion
3-23
3.10
USER HOLDINGS OF KEY MATERIAL
3-23
3.10.1
(U) Amount of Key to be Held by COMSEC Accounts
3-23
3.10.2
(U) Number of Holders/Pages Per System
3-23
3.10.3
(U) Joint/Combined Operations
3-23
3.10.4
(U) Exceptions
3-23
3.10.5
(U) Amount of Key Issued to Users
3-24
3.11
EMERGENCY REQUIREMENTS FOR KEY
3-24
CHAPTER 4 ACCOUNTING AND REPORTING PROCEDURES
4-1
4.1
GENERAL
4-1
4.2
COMSEC MATERIAL ACCOUNTING LEGEND CODES (ALC)
4-2
4.3
FILES, FORMS AND REPORTS
4-2
4.3.1 COMSEC Accounting Reports Guide
4-4
4.4
RECEIPT INSPECTION AND INVENTORY OF COMSEC MATERIAL
4-8
4.4.1
(U) General
4-8
4.4.2
(U) TOP SECRET Key
4-8
4.4.3
(U) Package/Container Examination
4-8
4.4.4
(U) Transfer Reports SF 153
4-8
4.4.5
(U) Page Checking Keying Material
4-9
v
FOR OFFICIAL USE ONLY
TB 380-41
Chapter/Paragraph
Page
4.4.6
(U) Page Checking COMSEC Publications (KAM, KAO, ETC,)
4-9
4.4.7
(U) Inventory of Sealed Material, Packages and Shipping Containers
4-9
4.5
ASSIGNMENT OF COMSEC MATERIAL VOUCHER NUMBERS
4-10
4.6
PRE PARATION OF VOUCHER CONTROL REGISTER (DA Form 4669-E)
4-12
4.6.1
(U) Use of DA Form 4669-E
4-12
4.6.2
(U) DA Form 4669-E Completion Instructions
4-12
4.7
ITEM REGISTER (IR) CARDS………………………………………………………………………4-14
4.7.1
(U) General Instructions
4-14
4.7.2
(U) DA Form 2011-E COMSEC Aids Items Register
4-14
4.7.3
(U) DA Form 2011- 1-E COMSEC Equipment Items Register
4-17
4.8
CONTROL OF KEY TAPE SEGMENTS
4-21
4.8.1
(U) Digraph Code for COMSEC Key
4-21
4.8.2
(U) Local Accounting for COMSEC Key
4-21
4.8.3
(U) Authorized Exposure of Keying Material
4-23
4.9
PREPARATION OF COMSEC MATERIAL REPORT (SF 153)
4-26
4.9.1
(U) General
4-26
4.9.2
(U) SF 153 General Completion Instructions
4-26
4.10
TRANSFER OF COMSEC MATERIAL
4-31
4.10.1
(U) Transfer of COMSEC Material Between COMSEC Accounts
4-31
4.10.2
(U) Responsibilities
4-31
4.11
LOCAL ACCOUNTING FOR COMSEC MATERIAL
4-31
4.11.1
(U) Responsibilities
4-31
4.11.2
(U) ALC 1 and 2 COMSEC Material
4-31
4.11.3
(U) Hand Receipting COMSEC Material
4-32
4.12
INVENTORY REQUIREMENTS FOR COMSEC MATERIAL
4-34
4.12.1
(U) Inventory Requirements for COMSEC Accounts
4-34
4.12.2
(U) CLSF Inventory Procedures
4-35
4.12.3
(U) Daily and Shift-to-Shift Inventory of Key Material
4-35
4.13
REPORTING PROCEDURES FOR INVENTORIES
4-39
4.13.1
(U) COMSEC Account Semiannual Inventory Report (SAIR) for
Traditional (Manual) Accounts
4-39
4.13.2
(U) COMSEC Account Semiannual Inventory Report (SAIR) for
AKMS Accounts
4-42
4.13.3
(U) COMSEC Account Change of Custodian Inventory Report (CCIR) for
Traditional Accounts
4-42
4.13.4
(U) COMSEC Account Change of Custodian Inventory Report (CCIR) for
AKMS Accounts
4-43
4.13.5
(U) Inventory of ALC 4 COMSEC Material
4-43
4.13.6
(U) Procedures to Change Alternate Custodians
4-44
4.13.7
(U) Special Inventory Report
4-44
4.14
CONVERSION AND SPECIAL POSSESSION REPORTS
4-44
4.14.1
(U) Conversion Report
4-44
4.14.2
(U) Special Possession Report
4-45
vi
FOR OFFICIAL USE ONLY
TB 380-41
Chapter/Paragraph
Page
4.15
ACCOUNTING FOR AND ENTERING AMENDMENTS TO COMSEC PUBLICATIONS
4-45
4.15.1
(U) Interim Amendments
4-45
4.15.2
(U) Reproductions of Interim Amendments
4-45
4.15.3
(U) Official Amendments
4-45
4.16
ACCOUNTING FOR ALC 4 MATERIAL
4-46
4.17
REPRODUCTION OF COMSEC MATERIAL
4-47
4.17.1
(U) Accountable Publications
4-48
4.17.2
(U) Destruction of Reproducible Extracts
4-48
4.17.3
(U) Publications Prohibiting Reproduction
4-48
4.18
MODIFICATION AND FABRICATION OF COMSEC MATERIAL
4-49
4.19
DESTRUCTION OF COMSEC MATERIAL
4-49
4.19.1
(U) Routine Destruction Procedures
4-49
4.19.2
(U) Scheduled Destruction
4-50
4.19.3
(U) Destruction Procedures
4-51
4.19.4
(U) Destruction of Paper-Based and Keying Material (& Mylar Key Tape)
4-51
4.19.5
(U) Destruction of Other COMSEC Material
4-53
4.19.6
(U) Destruction of Accountable COMSEC Material On Hand Receipts
4-53
4.20
AUDIT/INSPECTION OF COMSEC ACCOUNTS
4-54
4.20.1
(U) Basis for Audit
4-54
4.20.2
(U) Notification of Audit
4-54
4.20.3
(U) Scope of the Audit
4-54
4.20.4
(U) Suggested Local Pre-Inspection Checklist
4-55
4.20.5
(U) Audit Report
4-55
CHAPTER 5 SAFEGUARDING COMSEC MATERIAL
5-1
5.1
GENERAL
5-1
5.2
CLASSIFICATION GUIDELINES FOR COMSEC INFORMATION
5-1
5.2.1
(U) Foreign Release
5-1
5.2.2
(U) Handling and Release of Unclassified COMSEC Information
5-1
5.2.3
(U) FOR OFFICIAL USE ONLY Application
5-1
5.2.4
(U) Compilations
5-2
5.2.5
(U) Use of Caveat “CRYPTO”
5-2
5.2.6
(U) Marking of COMSEC Equipment
5-2
5.2.7
(U) Controlled Cryptographic Items (CCI)
5-3
5.2.8
(U) COMSEC Classification Guidance
5-3
5.2.9
(U) Classification Duration
5-3
5.3
PHYSICAL SECURITY MEASURES
5-3
5.4
ACCESS TO AND IDENTIFICATION OF COMSEC FACILITY
5-4
5.5
PROTECTION OF FIXED COMSEC FACILITIES
5-5
5.5.1
(U) Installation of On-Line Crypto-equipment
5-5
5.5.2
(U) Secure Room Operations
5-5
5.5.3
(U) General Area Operations
5-5
5.5.4
(U) Devices (other than COMEC equipment) Used Within a COMSEC Facility
5-5
5.5.5
(U) Electronic Access Control Devices
5-5
vii
FOR OFFICIAL USE ONLY
TB 380-41
Chapter/Paragraph
Page
5.6
SECURITY CHECKS
5-6
5.6.1
(U) Types of Security Checks
5-6
5.6.2
(U) Area Security
5-6
5.7
PROTECTION OF MOBILE AND TRA NSPORTABLE COMSEC FACILITIES
5-6
5.7.1
(U) Protection
5-7
5.7.2
(U) Minimum Mobile COMSEC Facility Protection
5-7
5.8
USE OF GUARDS
5-7
5.9
EMPLOYMENT OF COMSEC EQUIPMENT AT UNATTENDED SITES
5-8
5.10
STORAGE OF COMSEC MATERIAL
5-8
5.10.1
(U) Storage of Classified CRYPTO Key
5-8
5.10.2
(U) Storage of Unclassified CRYPTO Key
5-9
5.10.3
(U) Storage Restrictions
5-9
5.10.4
(U) Storage of COMSEC Equipment and Components
5-10
5.11
TRANSPORTATION OFCOMSEC MATERIAL
5-12
5.12
KEYING MATERIAL MARKED “CRYPTO”
5-12
5.12.1
(U) Preparation for Shipment
5-12
5.12.2
(U) Methods of Shipment
5-13
5.13
COMSEC EQUIPMENT AND COMPONENTS
5-13
5.13.1
(U) Use of U.S. Commercial Passenger Airlines
5-13
5.13.2
(U) Protecting Classified COMSEC Equipment While in Transportation Channels
5-14
5.13.3
(U) Packaging
5-15
5.13.4
(U) Contents Identification
5-15
5.14
CRYPTOLOGIC MEDIA
5-16
5.15
SHIPMENT OF CLASSIFIED WITH UNCLASSIFIED COMSEC MATERIAL
5-16
5.16
COURIERS
5-16
5.16.1
(U) Courier Requirements
5-16
5.16.2
(U) Courier Responsibilities
5-17
5.16.3
(U) Airdrop of COMSEC Material
5-17
5.17
EMERGENCY PLANS AND PROCEDURES
5-17
5.18
PREPARATION OF EMERGENCY PLANS
5-18
5.18.1
(U) Provisions
5-18
5.18.2
(U) Coordination
5-19
5.19
RECOMMENDED EMERGENCY TASK CARDS
5-19
5.19.1
(U) Task Cards
5-19
5.19.2
(U) Sample Task Cards
5-19
5.20
EMERGENCY MEASURES
5-19
5.20.1
(U) Emergency Evacuation
5-19
5.20.2
(U) Secure Storage During an Emergency
5-19
5.20.3
(U) Emergency Destruction
5-20
5.20.4
(U) Priorities
5-20
viii
FOR OFFICIAL USE ONLY
TB 380-41
Chapter/Paragraph
Page
5.21
EMERGENCY DESTRUCTION METHODS AND MATERIALS…………………………
5-20
5.21.1
(U) Key and COMSEC Documents
5-20
5.21.2
(U) Shredders
5-20
5.21.3
(U) Sodium Nitrate Destructors
5-21
5.21.4
(U) Destruction of COMSEC Equipment
5-24
5.21.5
(U) Destruction in Aircraft
5-26
5.22
DESTRUCTION OF COMSEC MAINTENANCE MANUALS
5-26
5.23
ACTIONS AFTER AN EMERGENCY
5-27
5.24
PRECAUTIONARY ACTIONS
5-28
CHAPTER 6 ARMY KEY MANAGEMENT SYSTEM (AKMS)
6-1
6.1
GENERAL
6-1
6.1.1
(U) Primary Tier 1 Sites (PT1S)
6-1
6.2
LOCAL COMSEC MANAGEMENT SOFTWARE (LCMS) WORKSTATION
6-1
6.2.1 (U) Purpose
6-1
6.2.2 (U) LCMS Workstation
6-1
6.2.3 (U) LCMS Functional Elements
6-1
6.2.4 (U) LCMS Power Requirements
6-2
6.3
ACCOUNTABILITY OF THE LCMS WORKSTATION
6-2
6.4
INVENTORY REQUIREMENTS
6-2
6.4.1
(U) COMSEC Account Semiannual Inventory Report (SAIR)
6-2
6.4.2
(U) COMSEC Account Change of Custodian Inventory Report (CCIR)
6-2
6.4.3
(U) Special Inventory Report (SIR)
6-3
6.4.4
(U) Change of Account Location Inventory Report
6-3
6.4.5
(U) AKMS Daily and Shift Change Inventory Requirements
6-3
6.4.6
(U) ALC 4 Inventory Requirements
6-3
6.5
LOCAL ACCOUNTING FOR COMSEC MATERIAL
6-5
6.5.1
(U) Hand Receipts (HR)
6-5
6.5.2
(U) Inventory Maintenance
6-5
6.5.3
(U) Accounting for Superseded Key
6-5
6.5.4
(U) Issue of ALC 4 Material Within AKMS
6-6
6.5.5
(U) Clearing Typographical Errors (in LCMS)
6-6
6.5.6
(U) Recording STU -III Key Conversions in AKMS
6-6
6.5.7
(U) Five Digit Outgoing Voucher Number
6-7
6.5.8
(U) Destruction “Certification Statements”
6-7
6.5.9
(U) Inadvertent Destruction of COMSEC Material
6-7
6.5.10
(U) Account Transactions to COR
6-7
6.6
GENERAL INFORMATION ON AKMS ELECTRONIC KEY DISTRIBUTION AND DESTRUCTION
……………………………………………………………………………………………………………6-7
6.6.1
(U) Electronic Key Distribution
6-7
6.6.2
(U) Electronic Key Destruction
6-8
ix
FOR OFFICIAL USE ONLY
TB 380-41
Chapter/Paragraph
Page
6.7
ACCESSIBILITY TO THE LMD/KP
6-8
6.7.1
(U) CIK AND PIN Number Storage
6-8
6.7.2
(U) LMD/KP “Disaster Recovery Kit”
6-8
6.7.3
(U) Archiving and Key Processor (KP) Changeover
6-9
6.7.4
(U) Accountability for KSD-64 Transit CIKS
6-9
6.7.5
(U) AKMS KP Settings
6-10
6.7.6
(U) AKMS User Deletion
6-10
6.8
STORAGE OF LCMS WORKSTATION
6-11
6.9
ASSOCIATED EQUIPMENT AND REQUIREMENTS
6-11
6.9.1
(U) STU-III Connectivity
6-11
6.9.2
(U) Laser Printers
6-11
6.9.3
(U) DTD
6-11
6.9.4
(U) Data Cartridge
6-11
6.10
TRAINING
6-12
6.10.1
(U) LCMS Operator Training Criteria
6-12
6.11
LCMS MAINTENANCE
6-12
6.11.1
(U) LMD Accountability
6-12
6.11.2
(U) Depot Level Repair
6-12
6.11.3
(U) Replacement KP
6-12
6.12
ADDITIONAL ARMY PUBLICATIONS
6-12
6.12.1
(U) LMD Software Upgrade
6-12
6.12.2
(U) Doctrine
6-13
6.13
COMMUNICATIONS
6-13
6.14
AKMS ACCOUNT INVENTORIES
6-13
CHAPTER 7 COMSEC COMPROMISES AND INCIDENTS
7-1
7.1
COMPROMISES AND INCIDENTS
7-1
7.2
REPORTING COMSEC INCIDENTS
7-4
7.2.1
(U) Responsibilities
7-5
7.2.2
(U) Controlling Authority Limitations
7-6
7.3
COMSEC INCIDENT REPORTS……………………………………………………………….…….7-6
7.3.1
(U) Report Contents………...…………………………………………………….………….7-6
7.3.2
(U) Reporting Incidents………….……………………………………………….…………..7-6
7.3.3
(U) Report Precedence……….………………………………………………….…………..7-6
7.4
ROUTING OF INCIDENT REPORTS
7-7
7.4.1
(U) Incident Reports Involving Joint-Staff Position Control Material…………………….7-7
7.4.2
(U) Satellites and Space Vehicles
7-7
7.4.3
(U) Discovery of Listening Devices
7-9
7.4.4
(U) Compromising Emanations
7-9
7.5
TRANSMISSION DURING MINIMIZE AND “IN-THE-CLEAR”
7-9
x
FOR OFFICIAL USE ONLY
TB 380-41
Chapter/Paragraph
Page
7.6
PHYSICAL INCIDENTS
7-9
7.6.1
(U) Physical Incident Reports
7-9
7.6.2
(U) Missing Material
7-10
7.6.3
(U) Temporary Loss
7-10
7.6.4
(U) Damaged Packages
7-10
7.6.5
(U) Unauthorized Access
7-10
7.6.6
(U) Material Left Unprotected
7-11
7.6.7
(U) Aircraft Crashes
7-11
7.6.8
(U) Combat Conditions
7-11
7.6.9
(U) Unauthorized Photography
7-11
7.6.10
(U) Satellites
7-11
7.6.11
(U) Controlled Cryptographic Items (CCI)
7-11
7.7
PERSONNEL INCIDENTS
7-12
7.7.1
(U) Definitions
7-12
7.7.2
(U) Personnel Incident Reports
7-12
7.7.3
(U) Captured or Presumed Captured Personnel
7-12
7.7.4
(U) Personnel Absence
7-12
7.7.5
(U) Revocation or Suspension of Clearance for Cause
7-13
7.8
CRYPTOGRAPHIC INCIDENTS
7-13
7.8.1
(U) Equipment Malfunctions
7-13
7.8.2
(U) Unauthorized Cryptoperiod Extension
7-13
7.9
ADMINISTRATIVE INCIDENTS……………………………………………………………………..7-13
7.10
INVESTIGATIONS
7-14
7.11
EVALUATIONS
7-14
7.12
INCIDENT CASE FILES……………………………………………………………………………...7-14
7.13
REVIEWING AND MARKING COMPROMISED MESSAGES
7-14
7.13.1
(U) Reviewing Messages
7-14
7.13.2
(U) Marking Messages
7-15
7.14
RELIEF FROM ACCOUNTABILITY
7-15
7.14.1
(U) Relief from CMCS Accountability
7-15
7.14.2
(U) Relief from Property Accountability
7-15
xi
FOR OFFICIAL USE ONLY
TB 380-41
APPENDIXES
Appendix
Number
Title
Page
APPENDIX A - REFERENCE REGULATIONS AND FORMS
A-1
APPENDIX B - ABBREVIATIONS AND TERMS
B-1
APPENDIX C - COMSEC NOMENCLATURE SYSTEMS
C-1
APPENDIX D - LOCALLY REPRODUCIBLE FORMS
D-1
APPENDIX E - COMSEC ACCOUNT REGISTRATION PACKET (CARP)
E-1
APPENDIX F - ARMY STRUCTURE FOR COMSEC SUPPORT COMSEC MATERIAL
CONTROL SYSTEM (CMCS)
F-1
APPENDIX G - LOCAL PRE-INSPECTION CHECKLIST
G-1
LIST OF ILLUSTRATIONS
Figure
Title
Page
Figure 2-1 EKMS Architecture
2-1
Figure 2-2 COMSEC Material Control System
2-2
Figure 2-3 COMSEC Facility Approval Request (CFAR)
2-10
Figure 3-1 Request to Establish a Cryptonet
3-9
Figure 3-2 Request for Resupply of Key
3-20
Figure 3-3 Request for Resupply of Key when Key Usage Changes
3-21
Figure 3-4 Request for Redistribution of Key
3-22
Figure 4-1 COMSEC Material Voucher Control Register (Outgoing)
(DA Form 4669-E)
4-13
Figure 4-2 COMSEC Material Voucher Control Register (Local)
(DA Form 4669-E)
4-13
Figure 4-3 COMSEC Aid Items Register (ALC 1 Material)
4-16
Figure 4-4 COMSEC Aid Items Register (ALC 4 Material)
4-17
Figure 4-5 COMSEC Equipment Items Register. Example for ALC 1 Equipment Accountable
by Serial Number
4-19
Figure 4-6 COMSEC Equipment Items Register. Example for ALC 2 Items Accountable
by Quantity
4-20
Figure 4- 7 COMSEC Material Disposition Record (DA Form 5941-E)
4-25
Figure 4-8 COMSEC Material Report (SF 153)
4-30
Figure 4- 9 COMSEC Account - Daily Shift Inventory (DA Form 2653-E)
4-37
Figure 4- 10 COMSEC Account - Daily Shift Inventory (TPI) (DA Form 2653-E)
4-38
Figure 4-11 Preprinted Semiannual Inventory Report (SAIR) C&C Page
4-41
Figure 4-12 Sample Completed CCIR COMSEC Aids Item Register (ALC 4)
(DA Form 2011-E)
4-43
Figure 4-13 Sample of Aids Item Register ALC 4 Local Annual Inventory
(DA Form 2011-E)
4-44
Figure 4-14 Local Accounting of Reproduced COMSEC Accountable Publication
(DA Form 2011-E)
4-48
Figure 7-1 Unclassified Example - Physical COMSEC Incident Report
7-16
Figure 7-2 Unclassified Example - Personnel COMSEC Incident Report
7-17
Figure 7-3 Unclassified Example - CCI Incident Report
7-18
xii
FOR OFFICIAL USE ONLY
TB 380-41
List of Tables
Table
Title
Page
Table 3-1 Digraph for Systems
3-12
Table 4-1 Accounting Forms
4-3
Table 4-2 Accounting Reports
4-4
Table 4-3 Transfer/Receipt Reports
4-5
Table 4-4 Destruction Reports
4-6
Table 4-5 Inventory Report (Traditional Accounts)
4-7
Table 4-6 Modification of Other Services Voucher Numbers
4-12
Table 4-7 COMSEC Material Report (SF 153)
4-28
Table 6-1 Inventory Reports (AKMS Accounts)
6-4
Table 6-2 Deletion of an AKMS User Account from an LCMS Workstation
6-10
Table 7-1 Reportable COMSEC Incidents
7-2
Table 7-2 Incident Reporting Addressees…………...……………………………………………………...7-8
xiii
FOR OFFICIAL USE ONLY
TB 380-41
THIS PAGE HAS BEEN LEFT BLANK INTENTIONALLY
xiv
FOR OFFICIAL USE ONLY
TB 380-41
CHAPTER 1
GENERAL
1.1 PURPOSE.
1.2 APPLICABILITY.
1.1.1
(U) Objective. This Technical Bulletin
(U) This TB shall be used by:
(TB) provides Communications Security
a.
(U) Personnel. All personnel within the
(COMSEC) information regarding custodianship
active Army, Army Reserve (USAR), Army
of accounts, accounting/reporting procedures,
National Guard (ARNG), Army Reserve Officers'
safeguarding material supply procedures, and
Training Corps (ROTC), civilian government
Controlling Authority (CONAUTH)
employees of the Army, and Army contractors
responsibilities in accordance with (IAW)
who are responsible for COMSEC material
COMSEC policy set forth in Army Regulation
activities.
(AR) 380-40.
b.
(U) COMSEC Accounts. The
1.1.2
(U) Scope. This TB includes the
procedures contained in this TB apply to both
following:
manual and automated accounts; however,
some of the procedures and instructions
a.
(U) Minimum Safeguards. Defines
contained herein apply exclusively to manual
minimum safeguards and standard criteria and
records, forms, and files. COMSEC Custodians
procedures for protecting COMSEC information.
managing automated accounts will adhere to all
instructions contained in Army Key Management
b.
(U) Special Safeguards. Defines the
System (AKMS) documents. Conflicts between
special safeguards of the Army COMSEC
this TB and the aforementioned stated
Material Control System (CMCS) and the Army
documents, which cannot be reconciled, will be
Key Management System (AKMS). The defined
reported to the U.S. Army Communications
safeguards are achieved by the use of correct
Electronics Command (CECOM),
procedures for the control of access, storage,
Communications Security Logistics Activity
distribution, accounting, and destruction of
(CSLA) IAW the instructions contained in
COMSEC material.
paragraph 1.4.
c.
(U) Accounting Procedures. Defines
accounting procedures for COMSEC material.
1.3 AVAILABILITY OF FORMS.
d.
(U) Maintaining COMSEC material.
(U) The following forms (see Appendix D) are
Defines procedures for requesting, receiving,
authorized for local reproduction:
stocking, and reporting COMSEC key,
publications, and equipment.
a.
(U) Department of Army (DA) Form
1999-E, Restricted Area Visitor Register
e.
(U) Incorporation of National
(Figure D-1). This form is also available at the
INFOSEC Policy. Incorporates the applicable
USAPA website (www.usapa.army.mil).
provisions of the National Security
Telecommunications and Information Systems
b.
(U) DA Form 2011-E, COMSEC Aids
Security Instructions (NSTISSI) promulgated by
Items Register (Figure D-2). This form is also
the National Security Agency (NSA), as
available at the USAPA website
implemented by AR 380-40.
1.1.3
(U) References, Abbreviations and
Terms. See Appendixes.
FOR OFFICIAL USE ONLY
c.
(U) DA Form 2011-1-E, COMSEC
1.5 ARMY COMSEC
Equipment Items Register (Figure D-3). This
WHOLESALE LOGISTICS
form is also available at the USAPA website
MANAGEMENT PROGRAM.
d.
(U) DA Form 2653-E, COMSEC
a.
(U) CSLA is the Army Wholesale
Account - Daily Shift Inventory (Figure D-4).
Logistics Manager for COMSEC equipment and
This form is also available at the USAPA
Keying Materiel. CSLA is part of a subordinate
website (www.usapa.army.mil).
activity of the U.S. Army Communications-
Electronics Command (CECOM; a Major
e.
(U) DA Form 4669-E, COMSEC
Subordinate Command [MSC] of the Army
Material Voucher Control Register (Figure D-5
Materiel Command [AMC]).
Front and Reverse). Side 2 of 3 is to be printed
on the reverse side of 2 of 2. This form is also
b.
(U) CSLA operates a National Inventory
available at the USAPA website
Control Point and National Maintenance Point
(NICP/NMP) for COMSEC centrally accountable
materiel, and one of the Primary TIER 1 sites
f.
(U) DA Form 5251-E, CONAUTH Key
(PT1S) for DoD to administer the Electronic Key
Management Worksheet (Figure D-6). This
Management System (EKMS). In its capacity as
form is also available at the USAPA website
a Tri-Service EKMS Manager, CSLA staffing
includes representatives from the U.S. Navy and
U.S. Air Force.
g.
(U) DA Form 5941-E, COMSEC Material
Disposition Record (Figure D-7). This form is
c.
(U) CSLA maintains a permanent staff
also available at the USAPA website
of CSLA Information Security (INFOSEC)
Representatives (CIRs) in the Continental
United States (CONUS) and outside the
h.
(U) EKMS Worksheet, Local
Continental United States (OCONUS) in Europe
Electronic COMSEC Material Disposition
and Korea. Personnel assigned to these offices
Record (Figure D-8). This is a sample
are available for any COMSEC material or
worksheet; however, custodians may design a
account automation assistance you may need.
worksheet that will better fit their needs as long
See Appendix F for Points of Contact.
as the pertinent information is included (see
Appendix D). Reproduce this form on 8½ x13-
1.6 COMMENTS AND
inch white paper printed head to foot.
RECOMMENDATIONS.
1.4 RESOLUTION OF
(U) Users are invited and encouraged to send
CONFLICTS.
comments and suggested improvements to this
TB in DA Form 2028 format directly to CSLA,
(U) Conflicts, which cannot be reconciled locally,
ATTN SELCL-ID-P3.
and situations not covered by this TB, will be
submitted through command channels for
resolution to: Director, U.S. Army
Communications-Electronics Command,
Communications Security Logistics Activity,
ATTN: SELCL-ID-P3, Fort Huachuca, AZ 85613-
7041. In addition, requests for deviation waivers
from the standard procedures prescribed in this
TB will be prepared IAW AR 25-30 and
submitted through command channels to CSLA.
INDEX-1-2
FOR OFFICIAL USE ONLY
TB 380-41
d.
(U) Electronic Material. Throughout this
1.7 INTRODUCTION OF
TB, references will be made to “Electronic
ELECTRONIC KEY
(COMSEC) Material.” This term is used as a
generic phrase to encompass all locally-, Tier 1-,
MANAGEMENT SYSTEM
or Central Facility-generated keying material;
FIREFLY and modern key; and imported keying
(EKMS).
material.
a.
(U) The NSA developed EKMS for joint-
1.8 SERVICE AUTHORITY.
use and compatibility throughout all Department
of Defense (DoD) services and the Civil
Agencies. EKMS enables COMSEC Custodians
(U) The “Service Authority” is a new term and
to generate electronic key by use of a key
will be used throughout this TB. The Army
processor. This system will drastically reduce
Service Authorities are listed in Appendix F.
the amount of physical key within the CMCS by
The approved definition for a Service Authority is
providing for key generation at the account level
as follows: “The service authority is the
and making COMSEC accounting virtually
command or activity within each military service
transparent to users.
that oversees Communications Security
(COMSEC) operations, policy, procedures and
b.
(U) Army Key Management System
training.” In the Army, the Headquarters,
(AKMS) is the Army’s implementation of the
Department of the Army (HQDA), Deputy Chief
EKMS. AKMS will provide local real-time
of Staff, and G-2 serve in this capacity. Service
electronic key generation, distribution, and
authority responsibilities are those functions that
management in support of Command, Control,
the military services have determined cannot be
Communications, Computers and Intelligence
performed by the Tier 1. Service authority roles
(C4I) at all Army Command levels. AKMS has
include cryptographic hardware management
been incorporated throughout this TB; however,
and distribution control, including Foreign
detailed AKMS information resides in Chapter 6.
Military Sales (FMS); approving account
AKMS will perform the following:
establishments; approving authority for
Certification Approval Authorities (CAAs);
(1)
(U) Provide accountability and
implementing COMSEC Material Control System
management of existing and future
(CMCS)/Key Management Infrastructure (KMI)
COMSEC material.
policy and procedures; direct operational
support; final adjudication authority in
(2)
(U) Ensure compatibility and
determining if reported COMSEC Incidents have
interoperability between Army COMSEC
resulted in COMSEC Insecurities; ensuring
accounts and all other services within
service compliance with COMSEC Access
DoD.
Program requirements; and standing
membership on KMI working groups and the
(3)
(U) Replace the current ACCLAIMS IV
Tier 1 Joint Configuration Control Board (JCCB).
Automation program and most manual
accounts.
c.
(U) Physical Material. Throughout this
TB, reference will be made to “Physical
(COMSEC) Material.” This term is used as a
generic phrase to encompass all “hard copy”
key, software, publications, equipment items and
hardware.
1-3
FOR OFFICIAL USE ONLY
TB 380-41
THIS PAGE HAS BEEN LEFT BLANK INTENTIONALLY
1-4
FOR OFFICIAL USE ONLY
TB 380-41
CHAPTER 2
COMSEC FACILITY, CMCS, ACCOUNTS,
AND CUSTODIAN REQUIREMENTS
COMSEC material. Accountable reporting
2.1 COMSEC MATERIAL
channels for COMSEC material are shown in
Figure 2-1. Local accountability is maintained
CONTROL SYSTEM (CMCS).
for all other CMCS-accountable material.
a.
(U) The CMCS was established to
b.
(U) The following paragraphs describe
provide accountability for all COMSEC material.
the procedural tasks that support the CMCS
CSLA maintains PT1S Fort Huachuca Central
and the Army organizations or activities that
Office of Record (COR) within the architecture of
perform them. As discussed in the following
the EKMS Tier 1 System, which provides a
paragraphs, these CMCS components (Figure
continuous and exact record of centrally
2-2 on following page) form the basis for
accountable (ALC 1, ALC 2, and ALC 6)
providing COMSEC support to the WARFIGHTER
in COMSEC operations.
TIER 0
N S A
Central Facility
TIER
1 SYSTEM
(PT1S)
Tier
1
Extension Tier
1
Tier
1
Ft Huachuca, AZ
Mannheim, GE
Lackland AFB, TX
TIER 2
Traditional COMSEC Account
AKMS COMSEC Account
TIER 3
Hand Receipt
Holders/ Local
Elements
Figure 2-1. EKMS Architecture
2-1
FOR OFFICIAL USE ONLY
TB 380-41
Army COMSEC Central
Office of Record (COR)
TYAD
CLSF-COMSEC
Tobyhanna Army
Logistics Support
Depot
Facility
COMSEC Account
Hand Receipt/
Local Element
Figure 2-2. COMSEC Material Control System (CMCS)
2-2
FOR OFFICIAL USE ONLY
TB 380-41
2.1.1 Army CMCS Structure.
(a)
(U) Maintains records of:
a.
(U) COR (throughout this TB, the
(1)
(U) All services’ COMSEC
COR may be referred to simply as the Tier 1).
accounts by account number.
The Tier 1 is a software application that allows it
to function as the primary element (component)
(2)
(U) Master inventories for all
of the EKMS, which provides critical functions
accountable COMSEC material.
and features at the COMSEC Wholesale
Management level required to manage, protect,
(3)
(U) Correspondence between
distribute, and transfer electronic and hard copy
Tier 1 and COMSEC accounts.
key material for Joint -Service COMSEC
material.
(b)
(U) Directs periodic inventories and
performs verifications of COMSEC
(1)
(U) The Tier 1 is capable of generating
material held by accounts.
and distributing electronic key material
for COMSEC equipment.
(c)
(U) Issues Certifications to
COMSEC accounts for:
(2)
(U) Under this system, the Tier 1
provides the functions required to
(1)
(U) Verification of satisfactorily
maintain the Central Office of Records
conducted and properly reported
(COR) for all services.
inventory.
(3)
(U) The Tier 1 performs the account
(2)
(U) Clearance and relief from
registration, privilege management,
accountability for former COMSEC
ordering, distribution, account, system
Custodian(s).
management, and security
management, as well as directs the
(d)
(U) Removes from CMCS
management and distribution of physical
accounting any COMSEC material
COMSEC material for all services.
that has been lost, stolen, or
destroyed without proper
(4)
(U) The Tier 1 is composed of two major
certification or authorization as
elements and several components that
directed by the Service Authority for
function together to provide a complete
Army Incidents.
and fully operational system for
worldwide support of DoD Military
(e)
(U) Provides central accountability
Services. The two major elements are
for all centrally accountable
the Primary Tier 1 located at Fort
COMSEC material to include
Huachuca, Arizona, and administered by
positive -control material.
CSLA (formerly known as the ACCOR);
and the Primary Tier 1 located at
(f)
(U) Serves as the Registration
Lackland Air Force Base at San Antonio,
Authority for all accounts.
Texas, and administered by the United
States Air Force (USAF). In addition, an
(g)
(U) Executes key ordering/
Extension Tier 1 (ET1) is located at
generation for traditional and
Mannheim, Germany, to provide in-
modern key.
country support to all service elements
in the European Theater of Operations.
(h)
(U) Maintains a current COMSEC
An additional ET1 may be added in the
Account Registration Packet
future to support the Pacific Theater.
(CARP) for each Army account at
Some of the specific functions
its supporting Tier 1 site.
performed by the Primary Tier 1 are as
follows:
(i)
(U) Issues Privilege Certificates to
all Tier 2 users.
2-3
FOR OFFICIAL USE ONLY
TB 380-41
b.
(U) Extension Tier 1 (ET1). An ET1
support for COMSEC equipment in the
serves as a communications connector to the
Army inventory, worldwide. All depot
Tier 1. When directed, or during contingencies,
functions for equipment are performed
an ET1 can function as registration authority and
by TYAD. The U.S. National Distribution
an ordering authority for the COMSEC accounts
Authority (USNDA) administered by the
it supports. ET1 will not function as a COR
National Security Agency (NSA), with its
except when directed in wartime or during other
distribution point located at Hanover,
emergencies. ET1 maintains a defined
MD, exclusively performs wholesale-
distribution formula to support customers: it may
level physical key material storage and
order key material from the TIER 1 or direct
distribution.
appropriate local generation of key material to
satisfy theater requirements. This requires an
(2)
(U) COMSEC Logistics Support Facility
ET1 to maintain the capability for key material
(CLSF). A CLSF is any designated
generation, translation, packaging and
support element in the Army that
distribution. In addition, an ET1 has the
provides retail- or wholesale-level
functional capabilities to maintain local
COMSEC material distribution, supply,
accounting records for COMSEC material (i.e.,
storage or maintenance service to a field
hard copy and electronic key material as well as
Army or equivalent force, Corps, or
centrally accountable COMSEC equipment),
Division.
provide accounting functions, and respond to
queries regarding account management. ET1
(3)
(U) Maintenance Activities. COMSEC
supports the enforcement of ordering,
accounts designated by the Major Army
distribution, generation, and short title
Commands (MACOMs) and approved
assignment privileges at the COMSEC accounts
by HQDA to perform specific COMSEC
within its area of responsibility.
equipment maintenance functions.
c.
(U) COMSEC Accounts (Tier 2).
(4)
(U) Operational Accounts. Active units
COMSEC accounts managing key and other
that are authorized accounts, and who
COMSEC material by use of the AKMS are also
require COMSEC material in the
referred to as Tier 2. All COMSEC accounts will
performance of their missions. These
be considered as either a Local or a Peer
accounts are normally established below
COMSEC Account. A Local COMSEC Account
Division level.
is the COMSEC account that initiates action. A
Peer COMSEC Account is the account that
(5)
(U) RDT&E Accounts. COMSEC
receives the action from the Local COMSEC
accounts designated for Research,
Account. Neither the COR nor the Central
Development, Testing and Evaluation.
Facility (CF) are considered Local or Peer
COMSEC Accounts. Those included in this
d.
(U) COMSEC Hand Receipt Holder
category consist of:
(Tier 3). This COMSEC Hand Receipt Holder
level, also referred to as Tier 3, is the level of
·
(U) Traditional Accounts. COMSEC
COMSEC operations where Hand Receipt
accounts conducting accounting functions
Holders and users of COMSEC equipment and
manually; and,
key receive direct support from the Tier 2
COMSEC Custodian. The COMSEC Custodian
·
(U) AKMS Accounts. COMSEC
should inspect Hand Receipt Holders once a
accounts conducting accounting and key
year. When it is not possible for the custodian to
generation functions using the LCMS
personally inspect each Hand Receipt Holder
Workstation.
due to widespread and distant dispersion, the
custodian will require each Hand Receipt Holder
(1)
(U) COMSEC Wholesale Depot. The
to complete a self-inspection and inventory
COMSEC Directorate at Tobyhanna
prepared by the custodian. The Hand Receipt
Army Depot (TYAD) has been
Holder must certify inventory accuracy of his/her
designated to store and issue all
holdings as well as compliance with all security,
COMSEC material centrally managed as
control and accounting requirements mandated
wholesale stocks by CSLA. It also
by AR 380-40 and this TB. The COMSEC
provides depot-level maintenance
Custodian will maintain, on file, a record of the
2-4
FOR OFFICIAL USE ONLY
TB 380-41
inspection/inventory for review by Command
ATTN: COMSEC Account 5A0299
Inspectors and CSLA Auditors. COMSEC
APO AP 96205-0031
accounts will hand receipt to individuals. Hand
Receipt Holders are required to:
b.
(U) Physical Location. This address is
the physical location of the account. The
(1)
(U) Sign for accountable COMSEC
physical location will consist of Unit designation;
material received.
ATTN: COMSEC Account (number); physical
location (e.g., street address, building number,
(2)
(U) Safeguard COMSEC material in their
Kaserne name, room number); and city, state or
possession and provide secure storage
country. For example:
as prescribed in AR 380-40.
Commander
(3)
(U) Promptly report COMSEC Incidents,
1ST Signal Brigade
as directed.
ATTN: COMSEC Account 5A2099
CLS C-K-Maintenance Division
(4)
(U) Comply with local accounting
Building S-1096, Room 22
procedures for assigned COMSEC
Camp Coiner, Seoul, Korea
material, as directed by the custodian.
c.
(U) Defense Message Service (DMS)
(5)
(U) Conduct daily shift-to-shift
Address. DMS addresses can be found in your
inventories, as specified in paragraph
DMS directory.
4.12.
/C=US/O=U.S. Government/OU=DoD/OU=
e.
(U) EKMS ID. Within the EKMS
ARMY/OU=Organizations/L=CONUS/L=FO
architecture, EKMS ID Numbers are required to
RT HUACHUCA AZ/OU=CSLA/OU=CSLA
identify COMSEC accounts, establish
Incidentdesk 1(uc)
credentials, and execute transactions between
the various elements and activities operating
d. AUTODIN Message Address. This
throughout the system. A separate EKMS ID
addressing system, which is being phased-out in
will be assigned to individuals or activities as
favor of the DMS system, is composed as
follows:
directed in DA Pam 25-100-1.
·
(U) Tier 2 COMSEC Accounts
CDR CLSCKMTDIV1STSIGBDE
·
(U) Central Office of Record
SEOUL KOR //5A0299//
·
(U) Tier 1 Registration Authority
e.
(U) Defense Courier Service (DCS)
·
(U) Controlling Authorities (who do not
Address.
manage an EKMS COMSEC Account)
·
(U) User Representative
(1) (U) This address is used for the delivery
·
(U) Command Authority
of material shipped via DCS. The
address consists of two lines and is
At the Tier 2 level, with the exception of a few
placed on the exterior wrapper of the
existing Army COMSEC accounts, the EKMS ID
package. The first line contains the
will be the established COMSEC Account
COMSEC Account Number, a dash, a
Number.
two-letter Defense Courier Service
Station digraph, and a two-number
2.1.2
(U) CMCS Addresses. The CMCS
routing suffix. The second line contains
uses six different types of addresses:
the unit’s abbreviated title (without
a.
(U) Mailing Address (the physical
designations such as HHC, HQ, etc.).
address for receiving mail). This address will
For example:
include the COMSEC Account Number in the
attention (ATTN) line. For example:
5DR300RA20
918th SIG CO DET A
Commander
HHD 41ST Signal Battalion
Unit 15258
2-5
FOR OFFICIAL USE ONLY
TB 380-41
(2) (U) Deliveries of COMSEC material sent
2.2.2
(U) COMSEC Facility Approvals.
through DCS will be made to the
Each organization or activity that has
COMSEC account DCS station; not the
determined the need for a COMSEC account
COMSEC account physical address. It
requires a COMSEC Facility Approval (CFA)
is the responsibility of the custodian to
from CSLA. Approval will be obtained prior to
pick up, or ensure the pick up by
establishing, performing major alterations that
authorized personnel, the shipment at
affect physical security, relocating, or upgrading
the DCS station or from a DCS courier.
the classification of a COMSEC Facility.
Requests for a CFA will be submitted by the
(3) (U) When establishing a new account or
local commander through normal command
a CHANGE to an account, the custodian
channels to CSLA, based on established Major
must provide the DCS station a copy of
Command (MACOM) or Major Subordinate
the new CARP and 3 copies of DCS
Command (MSC) policies. An updated CFA
Form 10.
need not be routed through your chain of
command unless dictated by local command
(4) (U) DCS addresses will be provided to
policies.
the COMSEC account by the DCS
station after submission of required
a.
(U) Change of Security Level. When a
documentation. Refer to DCS 5200.1-M
traditional account or AKMS account requires
for instructions on filling out the form.
any security level change, a new COMSEC
(This publication is not available through
Facility Approval Request (CFAR) must be
publication channels; it must be obtained
submitted. However, an LCMS account requires
directly from DCS.)
a new COMSEC Account Number, a new KOK-
22A, all new FIREFLY and associated KOK-22A
(5) (U) Notify CSLA upon receipt of the DCS
keys, and the transfer of all materials from the
address. Provide CSLA with the DCS
existing account to the new account.
routing code assigned to the account.
Additionally, when an AKMS account must
change its security classification level, it must
e.
(U) Internet Protocol (IP) Address.
contact the CSLA Help Desk for detailed
This address is for accounts reporting to Tier 1
instructions. See Figure 2-3 for a sample CFAR.
via an LCMS Workstation. The IP Address is
assigned by CSLA and allows access to the Tier
b.
(U) Additional Equipment Received.
1 message servers.
A new/updated CFA is not required when a new
equipment system or new software is brought
2.1.3
(U) COMSEC Directory Service
into an account unless the facility must be
(formerly COMSEC Account Address
upgraded to accommodate the system.
Directory). The Registration Authority at the
COR maintains the COMSEC Directory Service.
c.
(U) COMSEC Facility Approval for
The Directory Service lists all COMSEC
Hand Receipt Holders. The need for a
accounts and contains each account’s mailing,
COMSEC Facility for a Hand Receipt Holder will
message, DCS address and physical location.
be determined by the COMSEC account
AKMS accounts can access this information via
custodian based on unique circumstances or
their LCMS Workstation. Traditional COMSEC
mission requirements, such as large volumes of
accounts must contact the COR for access to
required material. If the COMSEC account
account information.
custodian determines that the Hand Receipt
Holder will be required to have a COMSEC
Facility Approval, the COMSEC account
2.2 COMSEC FACILITY.
custodian will approve the facility by use of a
memorandum, which will include the information
2.2.1
(U) Approving Office for the COMSEC
listed in paragraph 2.2.3. The memorandum will
Facility. Headquarters, Department of the Army
be retained, on file, in the COMSEC account
(HQDA) has delegated COMSEC Facility
files for review by COMSEC Inspectors and
Approval Authority to CSLA. All requests for
Auditors.
COMSEC Facility Approvals must be addressed
to CSLA.
2-6
FOR OFFICIAL USE ONLY
TB 380-41
d.
(U) Duration of COMSEC Facility
(4) (U) RDT&E (Research- Development-
Approval. The CFA is valid as long as the
Testing and Evaluation).
physical protective measures and security
procedures, which were the basis for the
(5) (U) Other (if your account does not fall
approval, remain substantially unchanged.
(See
into one of the previous categories,
AR 380-40 for additional information.)
explain its purpose).
2.2.3
(U) Request for Approval. The
c.
(U) Physical Security. The planned
request memorandum will be prepared using the
physical security measures must be described in
general guidelines contained in the following
detail. Physical security description of the
paragraph. When establishing an account,
facility will indicate overall construction
attach a signed copy of the CARP. A separate
composition, to include walls, ceiling, floors,
request will be submitted for each COMSEC
windows, doors, access control, and other
Facility approval being requested. As a
measures designed to prevent overt or covert
minimum, the memorandum will be marked “FOR
access. If TOP SECRET (TS) material will be
OFFICIAL USE ONLY” (FOUO). The following
stored, include planned provisions to secure TS
information will be provided on each CFAR
material IAW Two Person Integrity (TPI). For
submitted to CSLA (see Figure 2-3).
example, an OCONUS account would include
the use of a Joint-Service Interior Intrusion
a.
(U) General Information.
Detection System (J-SIIDS). Also provide the
General Services Administration (GSA)
(1) (U) Requesting organization’s complete
description of all security containers used within
mailing address.
the facility.
(2) (U) Unit Identification Code (UIC).
d.
(U) Material and Equipment Security.
Describe, in detail, how classified COMSEC
(3) (U) Telephone number (DSN and
material and equipment will be protected during
commercial).
non-working hours, or when not under the direct
and continuous control of properly cleared and
(4) (U) COMSEC account number (if
authorized personnel; that is, stored in approved
assigned; otherwise, leave blank).
containers, vaults, strong rooms, and so forth.
(5) (U) Location of the facility (includes
e.
(U) Standards Statement. Prepare a
building, floor and room numbers).
statement, which certifies that applicable
standards for the operation, storage, and
(6) (U) Point of contact (name and
destruction of COMSEC material can be met.
telephone number).
These standards are as described in Chapters 4
and 5. Organizations, which have standard
(7) (U) Type of request (initial request or
Positive Control Material (PCM) and/or Two
modification).
Person Integrity (TPI) material, will include
ONLY that information which applies to the
(8) (U) Classification information (the
standard material (for PCM refer to CJCSI
highest level/classification of material
3260.01).
that will be used and/or stored)
f.
(U) The CFAR will also contain a
b.
(U) Purpose . Indicate the primary
statement that the commander has evaluated
purpose of the facility:
the risks to the facility and found them
acceptable (AR 380-40, paragraph 4-2b).
(1) (U) Operations (on-line or off-line crypto-
operations using cryptosystems).
2.2.4
(U) Action by Approving Authority.
CSLA will promptly notify the requesting
(2) (U) Distribution (primary mission is
commander when the CFAR is approved. If the
COMSEC logistics support).
CFAR is not approved, CSLA will inform the
commander what action is necessary to obtain
(3) (U) Maintenance.
approval.
2-7
FOR OFFICIAL USE ONLY
TB 380-41
reassigned to another COMSEC account for at
2.3 ESTABLISHING A
least two years.
COMSEC ACCOUNT.
c.
(U) AKMS COMSEC Account
Numbers. The COMSEC Account Registration
a.
(U) Requirement. The decision to
Package (CARP) must be submitted to CSLA.
establish a COMSEC account or other type of
An EKMS ID (Account Number) will be assigned
EKMS ID is a commander’s prerogative based
by the COR.
on operational necessity. Whenever feasible,
COMSEC support should be requested from and
d.
(U) Change of COMSEC Account
provided on a geographical basis using
Number. With the implementation of the Army
COMSEC accounts which are already
Key Management System (AKMS), the only
established.
significant digit in the COMSEC Account
Number will be the first digit, signifying service
b.
(U) Number of Accounts. The number
or agency. Therefore, there will no longer be a
of established COMSEC accounts will be kept to
need to change account numbers.
a minimum consistent with support and security
considerations. Providing local commanders
2.4.1
(U) COMSEC Account Number/EKMS
concur, there is no objection to COMSEC
ID Structure.
accounts crossing command lines. This practice
is encouraged when it results in economy of
a.
(U) First Position. Indicates the
resources. However, the local commanders
service or agency. Examples are as follows:
must consider their respective unit missions and
whether COMSEC accounting support can be
(1) (U) Navy, Marine Corps, Coast Guard,
sustained under all contingencies (e.g.,
Military Sea Lift Command - 0-3
mobilization, deployment, tactical operations).
The commitments of both units should be
(2) (U) DCS - 4
documented in a Memorandum of
Understanding or Agreement (MOU/MOA) or
(3) (U) Army - 5
other formal support agreement.
(4) (U) Air Force - 6
c.
(U) Establishing a COMSEC Facility.
To establish a new COMSEC account, the unit
(5) (U) NSA - 8
must submit a signed COMSEC Account
Registration Packet (CARP) (formerly DA Form
b.
(U) Second - Sixth Position.
2012) and a copy of the COMSEC Facility
Randomly assigned alphanumeric characters.
Approval Request (CFAR) to CSLA. To
establish a Contractor account, the custodian
2.4.2
(U) Hand Receipt Numbers (Local
must also provide a DD Form 254 (Department
Element). AKMS accounts will register their
of Defense Contract Security Classification
Hand Receipt Holders as “Local Elements.”
Specification Form). CSLA will provide the
AKMS accounts will manage all transactions that
CFAR and the CARP to the COR for account
are directed to the Local Element. AKMS
number establishment.
accounts must refer to the Local Management
Device/Key Processor (LMD/KP) Operators
Manual for further information on Local Elements.
2.4 COMSEC ACCOUNT
NUMBERING SYSTEM.
2.5 COMSEC ACCOUNT
a.
(U) COMSEC Account Number. Each
REGISTRATION PACKET
COMSEC account established is assigned a
(CARP).
unique six-position account number by the COR.
b.
(U) Closed COMSEC Account
(U) The CARP is a multi-purpose form: it
Number. COMSEC Account Numbers assigned
serves as Appointment Orders for the COMSEC
to accounts that have closed will not be
Custodian, as a Request for Establishment of a
COMSEC Account, and to report changes. It is
2-8
FOR OFFICIAL USE ONLY
TB 380-41
used to record all necessary data that applies to
CARP may be submitted to CSLA by electronic
a particular account. A copy of the COMSEC
transmission. Following electronic transmission
Facility Approval (CFA) or a completed
of the CARP, a signed copy will be forwarded to
COMSEC Facility Approval Request (CFAR)
CSLA by regular mail or fax.
must be submitted with the CARP when
establishing a new account. The required
2.5.2
(U) Reporting COMSEC Account Data
format for the CARP is shown in Appendix D
Changes. A modified CARP must be submitted
and may be reproduced.
to the COR upon completion of a Change of
Custodian Inventory Report (CCIR) and when
a.
(U) Establishment of a COMSEC
any information on the memorandum changes
Account or EKMS-ID. To request the
except for the number of Hand Receipt Holders.
establishment of a COMSEC account or EKMS
Changes to Hand Receipt Holders will only be
ID, see paragraph 2.3. A copy of the CFAR
reported when a modified CARP is submitted for
must be sent with the CARP when establishing a
another reason. When a modified CARP is
new account.
submitted as a change, all of the paragraphs,
including the paragraphs that have not changed,
b.
(U) Appointment of a New COMSEC
must be completed. The custodian must also
Custodian or Alternate Custodian. Provide
notify the CONAUTH of any unit identification or
information on the COMSEC Custodian and
address changes.
alternate custodian(s) appointed IAW the criteria
2.5.3
(U) Completion of the CARP. The
shown in paragraph 2.3.
CARP will be completed using the sample in
Appendix E of this TB.
c.
(U) Report Changes. Report changes
to any of the information required on the CARP
2.5.4
(U) Fund Code Department of
IAW paragraph 2.5.3, which enables Tier 1 to
Defense Activity Address Code (DODAAC).
ensure the Directory CAAD is maintained with
The Standard Financial System (STANFINS)
current information.
requires a DODAAC to identify the appropriate
Finance and Accounting Office (F&AO) to which
2.5.1
(U) COMSEC Account Registration
billings will be sent. The CARP specifically
Packet (CARP) Distribution.
requires the COMSEC Account DODAAC. This
a.
(U) Distribution. The COMSEC
will be used by CSLA to determine the
Custodian will submit one copy of the CARP to
customer’s servicing F&AO. Therefore, it is
CSLA by mail or fax, and one copy will be
imperative that COMSEC Custodians
retained for the local file.
periodically review the DOD Activity Address
Directory (DODAAD) to verify that assigned
b.
(U) Expedited Establishment or
unit/account DODAACs are valid. If the
Change. When a COMSEC account is
DODAAC recorded on the CARP is incorrect,
established or changed on an expedited basis, a
immediately submit a modified CARP to CSLA.
2-9
FOR OFFICIAL USE ONLY
TB 380-41
SAMPLE OF COMSEC FACILITY APPROVAL REQUEST (CFAR)
DEPARTMENT OF THE ARMY
HEADQUARTERS, YOUR UNIT DESIGNATOR
MAILING ADDRESS
YOUR OFFICE SYMBOL (380-40A)
MEMORANDUM THRU COMMANDER, YOUR HIGHER HEADQUARTERS, MAILING ADDRESS
FOR DIRECTOR, UNITED STATES ARMY COMMUNICATIONS SECURITY LOGISTICS
ACTIVITY, ATTN: SELCL-ID-SAS, FORT HUACHUCA, AZ 85613-7041
SUBJECT: COMSEC Facility Approval Request (CFAR)
1. Reference
a. AR 380-40, Chapter 4
b. TB 380-41, Chapter 2
2. This command has a requirement to establish or update (complete as appropriate) a COMSEC Facility.
a. General Information
(1) Requesting Unit: Unit Designation, Mailing Address
(2) UIC: Wxxxxx
(3) Telephone Numbers: Commercial and DSN (OCONUS: Use Full commercial telephone number to include country
code.)
(4) COMSEC Account Number: 5xxxxx (Leave blank if for establishment of a COMSEC account, the number will be
determined by your TIER 1 Central Office of Record
(5) Facility Location: Actual location, floor, room, building number, to include street. If requesting a security
container as your facility, state: GSA Approved Security Container within room xxx
(6) Point of Contact: Name, e-mail address and complete telephone number if different from above
(7) Type of Request: Initial (establishment), Relocation, Update, etc.
(8) Classification information: Highest classification of material received or held
b. Purpose: Operations, Distribution, Maintenance, RDT&E, Other IAW TB 380-41, Chapter 2. (Indicate your
Primary Purpose!)
c. Physical Security: Provide physical security description of the facility, IAW TB 380-41, Chapter 2 and AR 380-
40. Also, identify any type of Alarm system. If the request is for a TS facility, identify the provisions to store the
material, IAW TPI. If the facility is to be a GSA approved security container, identify SECONDARY BARRIERS;
include ACCESS control when the container is open. (Example: Room ___ is constructed of 8” block on the outside
wall and sheet rock on the inside walls. All walls go from true floor to true ceiling. There is one window in the room on the
outside wall that can be locked from the inside, which has drapes to prevent unauthorized viewing. The only entry into the
room is through a hollow core door, which has inside hinges and is secured with a key lock. There is an air conditioner
protruding through the outside wall. The AC unit cannot be removed from the outside. TS material will be stored in a
GSA approved security container having dual combination locks.)
d. Material and Equipment Security: Describe protection of material during nonworking hours, IAW TB 380-41,
Chapter 2 (Example: All classified COMSEC material will be stored in GSA approved security containers and the door to
the COMSEC Facility will remain locked during non-working hours.
3. Standards Statement: Prepare a statement certifying whether the applicable standards can or cannot be met, IAW
TB 380-41, Chapter 2. (Example: The standards for the operation, storage and destruction of COMSEC materials as set forth
in TB 380-41 can be met).
4. The Commander has evaluated the risks to the facility and found them to be acceptable.
SIGNATURE BLOCK OF COMMANDER
(Signed by the Commander)
CLASSIFICATION AS APPROPRIATE
Figure 2-3 COMSEC Facility Approval Request (CFAR)
2-10
FOR OFFICIAL USE ONLY
TB 380-41
2.6 SUPERVISION OF
2.7 COMSEC CUSTODIAN
COMSEC FACILITIES.
AND ALTERNATE
REQUIREMENTS.
(U) In discharging their responsibilities, each
commander will make sure the following
2.7.1
(U) Custodian and Alternate
requirements are satisfied:
Appointments. Concurrent with the
establishment of a COMSEC account, the
a.
(U) Policy and Procedures.
commander will appoint a COMSEC Custodian
and at least one alternate. For accounts that
(1) (U) All accounts must have a reference
hold Positive Control Material (PCM), a
file containing a copy of AR 380-40, TB
minimum of four alternates is required. For
380-41, AR 710-2, DA PAM 25-380-2,
accounts that hold TOP SECRET material, three
and a copy of the local Emergency
alternates are required. The CARP will be used
Plans (where required).
for the appointment of a COMSEC Custodian
and alternate(s). In the appointment of a
(2) (U) A COMSEC SOP is highly
custodian and alternate(s), the following criteria
recommended; however, AR 380-40
will apply:
does not require it.
a.
(U) Access Requirements. Individuals
b.
(U) Personnel Training. The
appointed as a COMSEC Custodian or alternate
commander must ensure that each individual is
must meet all requirements as directed by AR
fully qualified to perform the appointed duties as
380-40. As a reminder to the commander,
a COMSEC Custodian or alternate.
“The security clearance of the COMSEC
Custodian and alternates must be, as a
(1) (U) Custodians must meet the
minimum, equivalent to the highest classification
requirements of paragraph 2.7.
of material required. IAW AR 380-67, Personnel
Security, an “interim clearance” is authorized for
(2) (U) COMSEC account custodians will
COMSEC Custodians and alternates.
ensure Hand Receipt Holders and users
Personnel in accounts holding NATO material
are properly trained to use, protect, and
may be required to have a “final” security
safeguard COMSEC material.
clearance to perform custodian or alternate
duties.
(3) (U) Certification of maintenance
personnel will be reflected on DD Form
b.
(U) Rank or Grade. The COMSEC
1435 (COMSEC Maintenance Training
Custodian will be a commissioned officer or
and Experience Record) as prescribed
warrant officer, whenever possible. If a
by AR 25-12.
commissioned or warrant officer is not available,
a carefully selected noncommissioned officer or a
c.
(U) Reporting. All reports required in
permanent DA civilian (not a government
this TB must be submitted promptly and
contractor) meeting the following grade, rank, or
accurately.
equivalent pay criteria may be appointed:
d.
(U) Physical Security. Continuous
(1)
(U) The enlisted and civilian minimum
physical security within the COMSEC Facility
grade limitations are Staff Sergeant (pay
must be maintained to preclude access by
grade E6/GS-7) for COMSEC
unauthorized individuals.
Custodians, and a minimum of Sergeant
(pay grade E5/GS-5) for alternates. IAW
e.
(U) Emergency Plans. See Chapter 5,
AR 380-40, the MACOM commander is
paragraph 5.17.
authorized to grant waivers to a
Sergeant (pay grade E5/GS-5) as a
custodian, or Corporal (pay grade
E4/GS-4) as an alternate. A copy of the
waiver will be kept on file with the CARP
in the COMSEC account.
2-11
FOR OFFICIAL USE ONLY
TB 380-41
(2) (U) Wage grade personnel may be
·
(U) Alternate Custodian Training: It is
appointed as custodians provided they
highly recommended that alternate
are of the salary equivalent to those
custodians receive SCCC training. Should
required for GS employees.
an alternate custodian fail the SCCC, they
may still assume responsibilities of an
(3) (U) U.S. commercial contractors should
alternate custodian, but under no
refer to DODD 5220.22-R, DODD
circumstances will be appointed as the
5220.22-M, and DODD 5220.22-S. A
COMSEC Custodian.
contractor will not be appointed as the
custodian of an active Army account.
·
(U) Verification of Training: All
exceptions to training requirements must be
(4) (U) Under extraordinary circumstances,
approved by HQDA, DCS, G-2. In addition,
a commander may appoint U.S. citizen
when a MACOM has approved a custodian
government contractor personnel as
to be appointed who has not successfully
“Alternate” COMSEC Custodians.
completed the SCCC, the approval must be
These individuals must meet all training
provided to CSLA, COR. Without written
and access security requirements
documentation that either HQDA or the
mandated for U.S. Government
accounts MACOM has provided, CSLA will
employees.
not be able to process the assignment of the
custodian or alternate.
(See AR 380-40,
c.
(U) Training. With the implementation
paragraph 2-2.)
of AKMS, there are two different requirements
for training depending on the type of account:
d.
(U) Custodial Obligations. Attention
Commanders: An individual will not be
·
(U) Traditional Accounts: The
appointed custodian if other assigned duties do
appointed COMSEC Custodian must have
not allow sufficient time for conducting their
successfully completed the Standardized
custodial responsibilities. An extensive list of
COMSEC Custodian Course (SCCC).
duties the custodian, alternate, and witness
When a graduate of the SCCC is not
must perform in doing their respective jobs are
available, the commander may temporarily
identified in paragraph 2.7.2. Depending on the
appoint an untrained COMSEC Custodian;
size of the account’s workload, these duties can
however, the COMSEC Custodian must
easily amount to a full time job and must be
successfully complete this course within six
taken into consideration in assigning additional
months after their effective date of
duties for these individuals. Prior to
appointment.
(Any person appointed as a
appointment as custodian, it must be determined
COMSEC Custodian prior to 1 January 1988
that the individual has at least 12 months (9
and who is and has continuously been a
months for short tour locations) of service
COMSEC Custodian shall be considered
retainability prior to Permanent Change of
“grandfathered” and is not required to attend
Station (PCS) or separation. At no time will any
the SCCC. The “grandfathered” COMSEC
individual be appointed as a COMSEC
Custodian will not be cited for a deficiency or
Custodian or Alternate COMSEC Custodian
shortcoming during any audit or inspection
over more than one Army COMSEC account.
for not successfully completing the SCCC.)
2.7.2
(U) Custodian/Alternate and Witness
·
(U) AKMS Accounts: The appointed
Duties.
COMSEC Custodian must have successfully
a.
(U) COMSEC Custodian. The
completed the SCCC, and two individuals
custodian’s duties involve actions pertaining to
from each account (usually the COMSEC
accountable, COMSEC material charged to the
Custodian and one alternate custodian)
account. The custodian must be thoroughly
must complete formal Local COMSEC
familiar with the procedures for handling
Management Software (LCMS) training.
COMSEC material. In larger activities where the
Unlike a traditional account, the COMSEC
size of the COMSEC account prevents the
Custodian and alternate must be trained
custodian from personally performing required
prior to assuming the responsibilities of an
actions and duties, these actions and duties may
AKMS account.
2-12
FOR OFFICIAL USE ONLY
TB 380-41
be performed by other designated and
the material. The custodian will advise
appropriately cleared personnel under the direct
each individual of their responsibilities
supervision of the custodian. Duties of the
for safeguarding material while in their
COMSEC Custodian are as follows:
possession.
(1) (U) Establish and maintain accurate
(10) (U) Report any compromise or
accounting records and files.
COMSEC Incident of COMSEC material,
Instructions for file numbering, retention,
as directed in Chapter 7.
and disposition of COMSEC files can be
found in AR 380-40, Appendix C and in
(11) (U) Maintain stockage levels for
Chapter 4 of this TB.
operational and contingency key, as
shown in Chapter 3.
(2) (U) Keep informed on COMSEC matters
pertaining to the customers serviced by
b.
(U) Alternate COMSEC Custodian.
the COMSEC account (e.g., Hand
Receipt Holders).
(1) (U) The routine duties of the alternate
custodian are determined by the
(3) (U) Receive, store, transfer and maintain
custodian and may include any or all of
accountability for all COMSEC material
the duties prescribed for the custodian.
issued to the COMSEC account.
(2) (U) The Alternate COMSEC Custodian
(4) (U) Maintain records and prepare
shall continue to manage the operation
reports for accountable COMSEC
of the COMSEC account in the absence
material.
of the COMSEC Custodian.
(5) (U) Maintain a current inventory of all
c.
(U) COMSEC Witness. A witness must
COMSEC material and be aware of the
authenticate all Semiannual Inventories and
location of such material and the
destruction of COMSEC material. Any U.S.
purpose for which it is held. A
Government employee (military or civilian)
Semiannual Inventory Report (SAIR) will
selected to witness a physical inventory or
be completed every six months (for
destruction of COMSEC material must have a
AKMS instructions, see paragraph
security clearance equal to or higher than the
6.4.1).
classification of the material being inventoried or
destroyed. It is imperative that the witness:
(6) (U) Conduct, supervise or cause
required inventories to be performed,
(1) (U) Be aware that a witness is equally
including daily or shift-to-shift
responsible for the accuracy of reports,
inventories.
inventories and physical destruction of
the material.
(7) (U) Ensure COMSEC publications are
authorized and current per DA PAM 25-
(2) (U) Be aware that a witness can be held
35, and that all amendments are
accountable under U.S. Civil Codes and
properly and promptly entered.
the Uniform Code of Military Justice for
COMSEC Logistics Support Facilities
improper performance of this official
(CLSF) and Physical Material Handling
duty.
Segments (PMHS) are exempt from
posting amendments for material that is
(3) (U) Be physically present and view the
held in stock for further distribution.
action of the custodian when
inventorying or destroying COMSEC
(8) (U) Destroy COMSEC material as
material.
prescribed or directed.
(4) (U) Sign the report certifying that the
(9) (U) IAW Controlling Authority
COMSEC material listed on the report
(CONAUTH) direction, requisition
has been inventoried or destroyed by the
COMSEC material for issue to properly
COMSEC Custodian, Alternate COMSEC
cleared individuals whose duties require
Custodian, or Hand Receipt Holder.
2-13
FOR OFFICIAL USE ONLY
TB 380-41
b.
(U) Extended Absence (exceeding 60
2.8 COMSEC CUSTODIAN
days). When a COMSEC Custodian is
scheduled to be absent from the account for
ABSENCE.
extended periods, the commander must
consider and evaluate the impact of such an
(U) Under no circumstances will the custodian
absence with regard to mission accomplishment
and alternate custodian be absent at the same
and accountability of COMSEC material. For
time. Where possible, it is highly recommended
absences exceeding 60 consecutive days, the
that commanders appoint two or more alternate
commander will direct the transfer of the account
custodians to prevent concurrent absences.
to the alternate custodian or other individual
meeting the requirements of paragraph 2.7.1.b.
a.
(U) Temporary Absence (not to
This will be accomplished by submitting a
exceed 60 days). For temporary absences not
modified CARP and a Change of Custodian
exceeding 60 consecutive days, the alternate
Inventory Report to the COR.
custodian will assume all responsibilities and
duties of the custodian. IAW AR 380-67,
c.
(U) Sudden Unscheduled Permanent
Personnel Security, a COMSEC Custodian or
Departures or Unauthorized Absences.
alternate who possess an “interim clearance” is
Under emergency conditions, such as the
authorized to perform these duties. Upon return
sudden unscheduled permanent departure,
from any prolonged absence, the custodian will
death, or unauthorized absence of the
perform the following actions:
custodian, the following actions will apply:
(1) (U) Review all changes and transactions
(1) (U) An immediate inventory of all
that took place during the custodian’s
COMSEC material will be initiated within
absence.
24 hours after the unauthorized
absence, death, or sudden permanent
(2) (U) If during the absence of the
departure of the custodian has been
COMSEC Custodian, the alternate
detected. The alternate custodian, or
custodian receipted for accountable
other properly cleared person, and a
COMSEC material, the COMSEC
cleared witness will perform the
Custodian will inventory the received
inventory. This inventory will be
material immediately upon his/her
recorded on an SF 153 (COMSEC
return. The custodian will sign and date
Material Report), or equivalent for AKMS
the COMSEC accounts copy of the
accounts, for all ALC 1, ALC 2 and ALC
Transfer Report. Below the “NOTHING
6 material. ALC 4 and ALC 7 will be
FOLLOWS” entry on the report, the
retained locally.
custodian’s signature shall be
accompanied by the remark “Received
(2) (U) The resulting inventory report will be
from the alternate.” This relieves the
marked “Special Inventory” at the top of
alternate custodian of responsibility for
the SF 153 or AKMS equivalent and will
the received COMSEC material. For
contain the following comments: “This
AKMS accounts, the alternate will print a
inventory is taken due to the sudden
copy of the transaction and provide it to
permanent departure, death, or
the custodian upon his/her return to
unauthorized absence of custodian
ensure that the custodian can identify all
(name/rank). Request (unit) be notified
receipts generated during his/her
ASAP of any discrepancies prior to the
absence.
appointment of a replacement
custodian.” Furthermore, this report will
(3) (U) If a scheduled or special inventory
contain all necessary remarks pertaining
was performed by the alternate during
to discrepancies (if any) and be
the custodian’s absence, the custodian
submitted to the COR for verification.
will verify, sign, and date the file copy of
The COR will verify the information and
the report and enter the remark “Verified
either provide the commander with a
by COMSEC Custodian” below the
listing of all discrepancies or notification
“NOTHING FOLLOWS” entry.
that the inventory matches the COR’s
records.
2-14
FOR OFFICIAL USE ONLY
TB 380-41
(3) (U) Upon receipt of the inventory
material) have been considered and a
verification from the COR, the
determination has been made that a Request for
commander will appoint a new
Relief from Property Accountability (IS, or IS
custodian, who meets the COMSEC
NOT) required.”
Custodian requirements, and submit a
CARP to Tier 1. A second inventory will
d.
(U) Relief from Property
be taken in which the incoming
Accountability. Relief from COMSEC
custodian and a witness will sign. If the
accountability by the COR is not relief from
alternate custodian was the individual
accountability for the loss, damage or
who completed the special inventory,
destruction of Government property, as defined
and is subsequently appointed as
in AR 710-2 and AR 735-5. Reports of Survey,
custodian, an additional inventory report
AR 15-6 Investigations, and other property
is not required. The appointment of any
accountability and responsibility may be required
other individual will require that the
for the physical loss of COMSEC equipment, as
procedures of paragraph 2.7 be
prescribed in AR 735-5. COMSEC Custodians
followed.
should seek advice and recommendations from
Command S-4 staff elements and Property Book
(4) (U) If the account is an AKMS account,
Officers.
access to the system by the departed
COMSEC Custodian must be deleted.
2.10 MOVEMENT OF
See Chapter 6, Table 6-2, for
instructions relating to deleting an
COMSEC ACCOUNTS.
individual from accessing LCMS.
(U) When an organization is moved between
2.9 RELIEF FROM
overseas and CONUS, between overseas
commands, or within CONUS commands, the
ACCOUNTABILITY.
custodian will take the following actions:
a.
(U) Unresolved Discrepancies. The
2.10.1
(U) Traditional Account Custodian
former COMSEC Custodian will not be relieved
Actions.
from accountability for accountable, COMSEC
a.
(U) Notification. Notify the COR,
material, which is involved in any unresolved
supporting CLSF, all key CONAUTHs and the
discrepancy.
Defense Courier Service of the impending
movement.
b.
(U) Departure Prior to Clearance.
When a COMSEC Custodian departs an
b.
(U) Disposition of Equipment.
organization after the CCIR has been submitted,
Determine proper disposition for material held by
but before clearance is granted, the COR will
Hand Receipt Holders.
request that the appropriate MACOM assist in
getting the former custodian to reconcile all
c.
(U) Disposal of Equipment. Properly
outstanding discrepancies. The commander of
dispose of material that will not be required at
the COMSEC account assumes all responsibility
the new location.
of the COMSEC account if the former COMSEC
Custodian is allowed to depart prior to clearance
d.
(U) Disposition of Material. Determine
being granted by the COR.
if any of the COMSEC material will be
transferred to a different account. If so, prepare
c.
(U) Relief from Accountability. The
and submit a Transfer Report (SF153)
COMSEC account custodian will be granted
numbered in the 0001-4999 series. The report
relief from accountability for COMSEC material
will include all accountable ALC 1 and 2 material
by CSLA after satisfactory evaluation of the
being transferred. Submit a copy to the COR.
incident reports, as directed in AR 380-40. In all
cases of relief from SECURITY accountability,
e.
(U) Submit an updated CARP along with
the following statement will be placed on file in
a current CFAR.
the COMSEC account record: “The
circumstances surrounding the loss of (identify
2-15
FOR OFFICIAL USE ONLY
TB 380-41
f.
(U) Prior to Shipment. Conduct a local
from the KP when being transported via
inventory of the COMSEC material which will be
DCS.
transferred to the new location and prepare a
Change of Account Location Report, SF 153
(5) (U) The removable hard drive from the
(see paragraph 6.4.4). Do not send a copy of
LMD (contains the stored electronic key)
this inventory to the COR.
must be handled as SECRET collateral.
All non-COMSEC accountable material
g.
(U) Receipt of Shipped Material.
associated with the workstation must be
When material arrives at the new location,
sent to the new location IAW AR 380-5.
perform a local inventory to verify receipt of all
COMSEC material.
e.
(U) Prior to Shipment. Conduct a local
inventory of the COMSEC material which will be
2.10.2
(U) AKMS Account Custodian
transferred to the new location, and prepare an
Actions.
inventory report (SF 153). Do not send a copy
of this inventory to Tier 1.
a.
(U) Notification. Notify the COR,
supporting CLSF, all key CONAUTHs and the
f.
(U) Receipt of Shipped Material.
Defense Courier Service of the impending
When material arrives at the new location,
movement.
perform a local inventory to verify receipt of all
COMSEC material.
b.
(U) Disposition of Equipment.
Determine proper disposition for material held by
2.10.3
(U) COR Processing Actions. The
Hand Receipt Holders.
COR will perform the following processing
actions:
c.
(U) Disposal of Equipment. Properly
dispose of material that will not be required at
a.
(U) Suspense . Establish a 90-day
the new location.
suspense to allow the transferring organization
to relocate.
d.
(U) Disposition of Material. Determine
if the physical COMSEC material can be
b.
(U) Process Transfer Report. Process
transferred to an existing COMSEC account.
the SF 153 Transfer Report if material is
Depending on this decision, the following actions
transferred to a new or existing account.
will be taken:
c.
(U) Notify the Service Authority.
(1) (U) If the physical material is to be
Provide the modified CARP to the Service
transferred to an existing COMSEC
Authority for processing along with the
account, prepare and submit a Transfer
COMSEC Facility Approval Request (CFAR) to
Report (SF 153). The Transfer Report
establish a new account.
will include all accountable ALC 1, 2,
and 6 material being transferred.
2.11 CLOSING OF COMSEC
Transmit the Transfer Report to the
COR.
ACCOUNTS.
(2) (U) Update the Directory Service of
2.11.1
(U) Commander’s Actions. When an
location change.
account is to be closed, the commander will take
the following actions:
(3) (U) Once the request for a COMSEC
Facility has been approved, all physical
a.
(U) Notification. Notify CSLA by
COMSEC accountable material must be
message or memorandum of the impending
shipped via DCS or a properly cleared
closure. The subject will read: “Request closure
courier to the new approved COMSEC
of COMSEC Account 5DEXXX.” If COMSEC
Facility.
material held by the closing COMSEC account is
to be transferred to a peer COMSEC account,
(4) (U) The Cryptographic Ignition Key (CIK)
then state so and provide the account number.
associated with the Key Processor (KP)
Also, request relief from accountability for the
must be shipped in a separate container
COMSEC Custodian by name, rank, and Social
2-16
FOR OFFICIAL USE ONLY
TB 380-41
Security Number. An information copy will be
e.
(U) Closure and Relief from
forwarded to the CONAUTH, the Defense
Accountability. Forward a message/
Courier Service, and the supporting CLSF.
memorandum stating the account is closed and
relieve the COMSEC Custodian from
b.
(U) Disposition Instructions. Obtain
accountability.
disposition instructions for all COMSEC account
assets from the CONAUTH. Destroy or transfer
2.11.3
(U) Closing of Accounts Due to
material as directed by the CONAUTH and
Inactivity. CSLA monitors the degree of activity
submit appropriate SF 153s (0001- 4999
within all COMSEC accounts. When an account
series), or AKMS equivalent, to the COR.
has shown no activity for 12 months, CSLA will
advise the unit commander, through the
c.
(U) Disposition of Material. Determine
MACOM, that the COMSEC account is subject
proper disposition for material held by Hand
to being closed due to inactivity. The unit
Receipt Holders.
commander will be given 60 days to justify a
continuing requirement for the account. If none
d.
(U) Resolution of Incidents. Resolve
is provided, CSLA will provide disposition
any open COMSEC Incidents.
instructions for the CMCS accountable material
and close the account.
e.
(U) Relief from Accountability. Only
after all COMSEC material is properly disposed
2.12 CONTINGENCY
of and all Reportable COMSEC Incidents are
resolved, will the Service Authority issue a
DEPLOYMENT OF A
closure message/memorandum, granting relief
from accountability to the COMSEC Custodian.
COMSEC ACCOUNT.
Semiannual Inventory Reports (SAIRs) continue
to be required until all assets have been
(U) Neither CSLA nor a deploying unit makes
disposed of properly and the account has
the final decision that the unit shall deploy
reached a “zero balance.”
with or without its COMSEC account.
Rather, this decision is made at the highest
2.11.2
(U) COR Procedures Upon Closure of
levels of the chain-of-command (General
COMSEC Accounts. The COR will initiate the
Officer level) through consultation and
following procedures upon the closure of a
coordination between the overseas Theater
COMSEC account:
Commander and the unit’s MACOM.
However, unless specifically directed
a.
(U) Notify Shippers. Upon receipt of
otherwise by a competent authority, any unit
the request to close an account, notify all
alerted for deployment will deploy with all its
shippers of impending closure and direct that all
MTOE authorized personnel and equipment,
shipments be stopped in order to facilitate
including their COMSEC account.
closure.
(U) During times of national emergency, wartime
b.
(U) Provide Asset Listing. If
buildup, or as directed by a National Command
requested, the COR will provide an asset list to
Authority, mission requirements may require
closing accounts.
COMSEC accounts to be temporarily relocated
to different geographical locations for extended
c.
(U) Open COMSEC Incident Cases.
periods. When faced with these circumstances,
Check account records for any open COMSEC
commanders and COMSEC personnel will refer
Incident cases.
to the following procedures:
d.
(U) Transactions. Process all
2.12.1
(U) Traditional COMSEC Account
transactions as received until account balance is
Contingency Deployment. The custodian will
at zero.
follow paragraph 2.10.1 a-g for traditional (non-
automated) COMSEC accounts, as well as the
additional requirements listed in paragraph
2.12.3 below.
2-17
FOR OFFICIAL USE ONLY
TB 380-41
2.12.2
(U) AKMS COMSEC Account
account in the deployment area prior to
Contingency Deployment. The custodian will
deploying - and in advance of
follow paragraph 2.10.2 a-g for AKMS COMSEC
shipment. The custodian will
accounts, as well as the additional requirements
coordinate with that COMSEC account
listed in paragraph 2.12.3 below.
to receive and secure the incoming DCS
shipment, and hold it, unopened, until
2.12.3
(U) Additional Requirements for
arrival of the deploying unit.
Deploying COMSEC Accounts. Each
deploying unit must prepare a detailed SOP for
(5) (U) When preparing COMSEC material
the deployment and operation of the COMSEC
for shipment, whether by escort or DCS,
account at the deployment site, tailored to its
all material must be packaged properly
own unique situations. All COMSEC accounts,
(double wrapped) and addressed/
whether traditional or automated, will additionally
identified as the property of the owning
perform the following steps when deploying
(shipping) account. This will preclude
under the contingency conditions described in
the shipment from arriving at the distant
paragraph 2.12 above.
“holding account” and being mistakenly
opened.
(1) (U) The unit will submit a new DCS
Form 10 when arriving at the new
(6) (U) If the deployed unit establishes a
location and provide a forwarding DCS
strategic/fixed COMSEC Facility at the
station address to CSLA Key. The
deployment location, a new CFAR is
account will NOT change account
required once the account has arrived at
numbers.
its new location. Under paragraph 2 of
the new CFAR being submitted, the
(2) (U) The custodian must review the
custodian must indicate that the account
account’s key material assets and
has been deployed by providing the
provide CSLA (COR-Key) a listing of the
following information:
short titles the account will be taking,
and a listing of the short titles of material
· Account Number -5XXXXX -
to be transferred or destroyed. The
Deployed
CSLA Key Manager will stop shipment
· Location: (If not classified)
on short titles that will not go forward.
· Type Request: Update - Tactical,
GSA Approved Security
(3) (U) CSLA will re-direct the shipment of
Container/room or vault.
future keying material to the DCS station
closest to the deployment location once
The COR will institute a 90-day
the custodian has provided that location.
suspense allowing for the re-location of
When the deployment location is
the COMSEC account IAW paragraph
unknown before departure, the
2.10.3a.
custodian will notify the Key Manager
after arrival at the new location so that
(7) (U) While in deployment locations
future material can be re-directed to that
wherein circumstances dictate that
location.
combat/combat support units operate
their COMSEC accounts from mobile
(4) (U) For material that will go forward with
facilities under dynamic tactical
the deploying account, the commander
conditions, a CFA is not required. The
must decide the method of
local command security officer will be
transportation (i.e., will the material be
responsible for ensuring adequate
packaged and escorted [courier] at the
security measures are employed to
time of the unit’s deployment by
protect such facilities at the deployment
COMSEC personnel for control
sites, consistent with local contingency
purposes or, will it be shipped separately
conditions. The use of barrier material,
to the new destination via DCS). If the
barbed wire, concertina wire, armed
material is to be sent via separate
guards, etc. is encouraged. Because of
shipment through DCS, the custodian
the fluid situations that come from a
must contact a supporting COMSEC
mobile operational status, it would be
2-18
FOR OFFICIAL USE ONLY
TB 380-41
impossible to predict every scenario.
b.
(U) When the deployment period is
However, the custodian must become
expected to be less than 12 months, the account
familiar with paragraphs 5.7 through
may be placed in a “suspended” status until the
5.10 of this TB so that he/she can assist
unit’s return and reactivation of the account.
the commander in making the best
decisions possible to ensure the
2.13.2
(U) Suspension of a COMSEC
security, custody and accountability,
Account. When a unit is to be deployed without
physical protection, access control,
the COMSEC account, plans and coordination
storage requirements, and surveillance
must be made for disposition of the COMSEC
of the account and the COMSEC
account’s material and LCMS Workstation prior
material.
to the COMSEC Custodian’s departure to the
deployment location. When the commander’s
2.12.4
(U) CSLA Responsibilities to the
decision is to retain the COMSEC account in a
Deployed Account. CSLA will continue to
non-operational suspended status, the custodian
provide support to the deployed COMSEC
will take the following actions:
account. The following are areas CSLA will be
a.
(U) Notification. The COMSEC
responsible for, but not limited to, during the
Custodian must make all required notifications
time an account is deployed:
as soon as possible after receiving knowledge
of impending unit deployment without its
· Process all accounting transactions
COMSEC account.
· Ensure shipment of material
· Provide and reconcile SAIRs/CCIRs
(1) (U) Notify all applicable Controlling
· Monitor transactions of material
Authorities (CONAUTHs), supporting
CLSF, and the COR, in writing via
2.13 UNIT DEPLOYMENT
memorandum, message, e-mail, etc., of
the pending unit deployment and the
WITHOUT A COMSEC
command decision to place the account
in a non-operational suspended status.
ACCOUNT.
The subject will read: “Request for Non-
Operational Suspension of COMSEC
2.13.1 (U) Mission Support. During
Account 5DEXXX.” Provide as much
contingency operations, some Army units are
detail as possible regarding the
deployed for short durations (non-PCS
deployment and circumstances
deployments) with orders not to bring their
pertaining thereto.
organic COMSEC accounts. Under these
circumstances, COMSEC support is provided by
(2) (U) The unit must contact its servicing
established COMSEC support facilities at the
DCS station as soon as possible after
distant location. When a unit is deployed
notification of a deployment without the
without its COMSEC account, and the COMSEC
COMSEC account. DCS requires a
account is left unmanned and inactive for an
“trusted agent,” such as the unit
extended period at its home station, there are
commander or the COR, to officially
two options available to the commander. It is
request suspension of material delivery
strongly recommended that commanders and
to the account. This will prevent
COMSEC account personnel follow these
frustration in having to return physical
guidelines to prevent Reportable COMSEC
material shipments to senders.
Incidents from occurring.
b.
(U) Disposition of COMSEC Material
a.
(U) If the unit is expected to be deployed
and Equipment. All CMCS accountable
in excess of 12 months, or if the commander
material held in the COMSEC account must be
decides for other reasons the account is to be
destroyed or transferred to a Peer COMSEC
permanently closed, account closure procedures
account; leaving the account at a “zero balance”
will be followed IAW with paragraph 2.11.
before the custodian departs the home station.
2-19
FOR OFFICIAL USE ONLY
TB 380-41
(1) (U) Obtain disposition instructions for all
Management Software (LCMS)
COMSEC account assets from the
Workstation components (except KP
CONAUTH(s). Destroy or transfer
and associated keys) are Property Book
material as directed by the CONAUTH
items and may be maintained (stored)
and submit the appropriate LCMS
as classified and high-dollar items by
Workstation electronically generated
rear echelon personnel during the unit’s
reports (or SF-153s 0001- 4999 series
deployment. It is recommended that the
reports for manual COMSEC accounts)
entire LCMS Workstation be stored as a
to the COR.
single AN/GYK-49 system (excluding the
KOK-22A) to avoid loss and to facilitate
(2) (U) The KOK-22A plays an integral part
re-activation of the account upon the
in electronic signatures being applied to
unit’s return to home station.
AKMS transactions sent to the COR.
For this reason, the KOK-22A and
2.13.3 (U) Unit Return to Home Station.
associated keys should be the last items
transferred from an AKMS account
a.
(U) Notification. The COMSEC
before reaching zero balance. Transfer
Custodian must make all required notifications
the KOK-22A and associated keys to
after receiving orders regarding the unit’s
another COMSEC account for holding
impending return to home station. Two (2)
purposes as designated by the
months prior to the deployed unit’s anticipated
cognizant commander in the chain of
return, the COMSEC Custodian, or other
command. The KOK-22A must remain
cognizant COMSEC personnel, will take the
in an operational status to allow its own
following actions:
Transfer Report Initiating (TRI) to be
correctly prepared and sent to the COR.
(1) (U) Contact the CSLA COR and KOK-
DO NOT ZEROIZE THE KOK-22A
22A Item Manager for coordination and
AFTER COMPLETING THE FINAL
procedures required for returning the
TRANSACTION OF TRANSFERRING
COMSEC account to an operational
THE KOK-22A.
status. Through this coordination, the
holding account will be directed by
(3) (U) In those instances when re-
CSLA to transfer the same serial
certification of the KOK-22A will be
numbered KOK-22A and keys back to
required during the period when the unit
the COMSEC account upon the unit’s
is deployed, the CSLA KOK-22A Item
return. In cases where, prior to
Manager will provide special instructions
deployment, the CSLA KOK-22A Item
for returning the KOK-22A to Lackland
Manager directed the KOK-22A be sent
AFB, TX, for re-certification prior to the
to the depot at Lackland, AFB, CSLA
unit’s deployment. The KOK-22A
shall take action to have a re-certified
certification date is determined by
KOK-22A sent to the unit via DCS.
viewing the battery installation date on
the rear side of the KOK-22A. The re-
(2) (U) In addition, the unit will provide
certification date of the KOK-22A is
information to the CSLA COR account
approximately three (3) years from the
manager and CSLA Audit section to
installation date of the battery.
confirm that the location, technical
details, and physical security, as shown
(U) The COMSEC Custodian must
on the CFAR and authorized by the
contact the CSLA KOK-22A Item
CFA, have not changed during the
Manager prior to taking any action to
period of deployment. The COR will
transfer the KOK-22A to a holding
validate the custodian’s and/or alternate
account or to the depot at Lackland,
custodian’s current status. Changes to
AFB.
the CFAR, CFA, or CARP (including
personnel training for SCCC and LCMS)
(4) (U) Ensure the PBO or other responsible
will be reconciled with CSLA prior to the
rear detachment personnel have control
suspended status being lifted. The
of classified LMD components and
CSLA Audit section and COR will assist
ancillary LMD items. Local COMSEC
the unit to ensure that an accurate
2-20
FOR OFFICIAL USE ONLY
TB 380-41
CFAR, CFA, and CARP are in place at
2.13.4 (U) CSLA Responsibilities:
the time of the unit’s return to home
station.
(1) (U) NOTIFY THE NSA TO SUSPEND
SHIPMENTS TO THE ACCOUNT
(3) (U) Prior to the deployed unit’s
UNTIL FURTHER NOTICE.
anticipated return, the COMSEC
Custodian, or other cognizant COMSEC
(2) (U) NOTIFY THE NSA CENTRAL
personnel, will contact all applicable
FACILITY (CF) TO BLOCK OR
CONAUTHs and the servicing DCS
DISABLE THE ACCOUNT’S MAILBOX,
station to initiate steps for returning the
PRECLUDING EKMS TRANSACTIONS
COMSEC account to an operational
FROM SETTING IN THE BOX FOR
status.
EXTENDED PERIODS WHILE THE
UNIT IS DEPLOYED AND THE
b.
(U) Return of COMSEC Account
ACCOUNT IS SUSPENDED.
Material and Equipment.
(3) (U) KEEP THE ACCOUNT OPEN IN
(1) (U) Upon direction from CSLA, the
CSLA RECORDS BUT IN A
COMSEC account holding the
SUSPENDED STATUS UNTIL
accountable COMSEC material and/or
FURTHER NOTICE.
the KOK-22A will transfer the remaining
material, the same serial numbered
(4) (U) ENSURE CSLA AUDIT SECTION IS
KOK-22A, and associated keys back to
AWARE OF THE SITUATION AND OF
the returning COMSEC account.
ANY CHANGES OCCURRING AS THE
MISSION PROGRESSES AND/OR IS
(2) (U) The unit COMSEC Custodian will
COMPLETED.
arrange with the PBO to have the
remaining stored LCMS Workstation
(5) (U) MONITOR AND ASSIST THE UNIT
components hand-receipted to the
UPON RETURN TO ENSURE AN
account in order to re-configure them
ACCURATE CARP IS APPROVED AND
into an operational LCMS Workstation.
ON FILE, AND THAT QUALIFIED
PERSONNEL ARE STILL AVAILABLE
(3) (U) The custodian will notify the COR
AND PREPARED TO MAINTAIN THE
Account Manager when the account has
COMSEC ACCOUNT (INCLUDING
achieved full operational status and is
SCCC AND LCMS TRAINING).
prepared to receive CMCS-accountable
material. The COR will provide this
information to the CSLA Audit Section.
2-21
FOR OFFICIAL USE ONLY
TB 380-41
THIS PAGE HAS BEEN LEFT BLANK INTENTIONALLY
FOR OFFICIAL USE ONLY
TB 380-41
CHAPTER 3
SUPPLY AND CONTROLLING AUTHORITY
PROCEDURES
from the Army COMSEC Commodity Logistics,
3.1 IDENTIFYING COMSEC
Accounting and Information Management
System (ACCLAIMS) to the Commodity
MATERIAL.
Command Standard System (CCSS). This will
affect processing of transactions for secondary
a.
(U) ARKAG 1. COMSEC Material
items and end items, including classified
Management Data. This document listed
equipment and repair parts. Until all procedural
management data for all COMSEC material;
changes have been made to ensure
however, the ARKAG1 has been eliminated with
compatibility between the various systems, the
the implementation of Tier 1. The function of the
following requisition, funding and turn-in
ARKAG1 is now an automated service. Manual
procedures will continue to be valid. CSLA will
accounts or Peer accounts must call the item
notify COMSEC Custodians when revised
manager for any information in question.
procedures become effective. If custodians
encounter any problems, contact CSLA for
b.
(U) The Federal Catalog (FEDLOG).
assistance. The customer service number is 1-
This file lists catalog data for all equipment.
800-662-2123.
c.
(U) Critical Data Elements:
3.2.1
(U) Requisitions. Class VII End Items,
COMSEC Key (except FORTEZZA cards), and
(1) (U) The Accounting Legend Code (ALC)
publications obtained through CMCS channels
identifies how an item must be
are free issue to Army units and do not require
accounted for in the CMCS (reference
funded requisitions. Likewise, returns for similar
paragraph 4.2 of this TB for a listing of
items through the CMCS do not receive
the ALCs).
monetary credit.
(2) (U) Controlled Inventory Item Code
a.
(U) COMSEC secondary hardware items
(CIIC). The CIIC for COMSEC
are no longer free issue. Identification of
equipment is listed in the FEDLOG. A
COMSEC items at unit level, which require
code number of “9” in the FEDLOG CIIC
funding and those that are free issue, can be
column means the equipment is CCI. A
accomplished by review of the Material Category
code of “U” is for unclassified.
Structure Code (MATCAT) on the Army Master
Data File (AMDF) portion of the FEDLOG.
(3) (U) Source of Supply (SOS). SOS is
CSLA-managed items with a Numeric Code of
listed in the FEDLOG.
“2” in the SECOND position of the MATCAT
require funded requisitions.
3.2 REQUISITION
b.
(U) COMSEC Custodians are
FUNDING AND RETURNS.
responsible for ensuring that Operations and
Maintenance (O&M) funds are available to
(U) The current Standard Army Stock Fund
reimburse the supporting wholesale stock fund
System is in the process of being transitioned to
for material prior to requisitioning. Custodians
the Army Working Capital Fund (AWCF). This
who are unfamiliar with local funding/billing
procedures are encouraged to contact their
transition will affect all COMSEC accounts as it
applies to requisitioning, funding and turn-in of
respective budget officers and supporting
COMSEC secondary items, and is being
resource management office.
accomplished incrementally installation by
installation. Concurrently, CSLA is transitioning
3-1
FOR OFFICIAL USE ONLY
TB 380-41
c.
(U) Detailed information on the
a.
(U) Funding/billing data is not required
preparation and coding of requisitions is
on Army SF 153 turn-in documents. CSLA will
contained in AR 710-2 and AR 725-50.
assign fund code “XP” on all turn-ins for
COMSEC accounts, which submit requisitions
classified items received at the COMSEC depot
directly through normal supply channels, are
activity. This applies only to Army COMSEC
responsible for application of correct MILSTRIP
accounts (account numbers beginning with a
funding/billing data.
“5”).
d.
(U) All requisitions received by CSLA for
b.
(U) The standard financial system
secondary items must contain standard
requires billing/credit transactions to be
MILSTRIP funding/billing data as follows:
processed as single-line entries. Therefore, all
customer turn-ins for funded COMSEC material
(1) (U) Fund Code - XP (see AR 725-50).
must be prepared as single-line documents.
This means that only one short title may be listed
(2) (U) Signal Code - (See AR 725-50 for
on the SF 153. In addition, if the items being
the appropriate Signal Codes for
returned are technically/operationally classified
shipping/billing instructions.)
into more than one condition code, a separate
SF 153 must be prepared for each. FOR
e.
(U) The XP fund code will indicate to
EXAMPLE: If a unit is turning in 10 printed
CSLA that fund availability has been verified. It
circuit boards (PCB), Short Title E-ABC, two of
also signifies that billing will be accomplished
which are condition code A (Serviceable), and
manually using Standard Form 1080 billing
the remaining eight are condition code F
procedures instead of the automated inter-fund
(Unserviceable/ Reparable), two separate SF
billing system. The standard financial system
153s are required. This requirement for single-
requires a Department of Defense Activity
line SF 153s does not apply to items for which
Address Code (DODAAC) to identify the
monetary credit is not authorized, such as free
appropriate F&AO to which billings will be sent.
issue items, obsolete items, and uneconomically
The DODAAC in the CA RP, on file in Tier 1, will
reparable items.
be used by USACECOM Finance Office to
determine the customer’s servicing F&AO.
c.
(U) Monetary credit will not be granted
Therefore, it is imperative that COMSEC
for material turned in to Tobyhanna Army Depot
Custodians periodically review the Department
if the wholesale stockage levels are in an excess
of Defense Activity Address Directory
position. Wholesale inventory managers have
(DODAAD) to verify that assigned unit/account
the authority and discretion to deny credit to
DODAACs are valid and have not been changed
customers unless there is a current or projected
or deleted from the DODAAD. If the DODAAC
need for the material returned from field units.
recorded on the CARP is incorrect, immediately
submit a modified CARP to CSLA.
d.
(U) The amount of credit provided will be
based on material condition upon receipt, as
3.2.2
(U) Customer Returns. Turn-in credit
determined by depot technical inspection.
will be given to COMSEC accounts, as explained
Calculation of the appropriate monetary credit
in the following paragraphs, for classified
will be accomplished using standard Army
COMSEC secondary items managed within the
formulas provided by HQDA, within the
CMCS only. Unclassified/CCI COMSEC
serviceability criteria/requirement guideline.
material will be returned by the PBO; other
Computed amounts will then be forwarded to the
supply accounts will be returned through
applicable servicing F&AO for credit to the
standard logistics channels using the material
customer’s account using the same procedures
returns program procedures specified in DA Pam
explained for billing transactions in paragraph
710-2-1.
3.2.1. Credit formulas for unserviceable items
are subject to periodic adjustment based on
actual repair/replacement and labor costs.
3-2
FOR OFFICIAL USE ONLY
TB 380-41
e.
(U) Regardless of other considerations,
d.
(U) National Security Agency (NSA)-
turn-in credit will not be allowed for any
Produced COMSEC Publications (KAMs,
unserviceable returns that do not meet
KAOs, etc.). These publications are
economical repair criteria and maintenance
requisitioned by COMSEC Custodians through
expenditure limitations for COMSEC material.
the CMCS (see subparagraph 3.3.2.a.).
3.2.3
(U) Customer Assistance. Questions
e.
(U) COMSEC Key. COMSEC key is
regarding the contents of this section, and
requested by the CONAUTH. Procedures for
assistance in stock fund matters which cannot
requesting the establishment of a Cryptonet are
be resolved locally, may be addressed by
covered in paragraph 3.6.
contacting CSLA by telephone at Toll Free 1-
800-662-2123, or in writing.
3.3.2
(U) Initial Issue of COMSEC
Publications.
3.3 REQUISITIONING OF
a.
(U) NSA-Controlled COMSEC
Publications. Traditional accounts requisition
COMSEC MATERIAL.
these publications through COMSEC logistics
channels using the appropriate requisition form
3.3.1
(U) General COMSEC Requisition
(DD Form 1348). AKMS accounts will order the
Procedures and Applicable Publications.
publications through their LCMS Workstation
from the supporting CLSF or COR, as
a.
(U) Classified COMSEC Equipment.
applicable. The requestor will receive the basic
COMSEC Custodians will requisition these items
publication plus all printed amendments and
through the CMCS. Requisitioning policy is in
changes with the initial issue. Subsequent
AR 710-2. Requisitioning procedures are in DA
editions, amendments, and changes will be
PAMs 710-2-1 and 710-2-2.
automatically issued to COMSEC accounts,
which are charged with the basic publication
b.
(U) Controlled Cryptographic Items
(and are authorized the level of maintenance
(CCI). CCI will be requisitioned and locally
manual involved). Publications will be issued by
accounted for on property books or stock record
the supporting CLSF for OCONUS or by CSLA
accounts IAW AR 710-2. Management and
for CONUS. The lateral transfer of NSA-
accountability of CCI is a standard logistics
controlled COMSEC publications from one
function under the control of Installation
COMSEC account to another is not authorized
Accountable Officers and unit Property Book
without prior approval of the supporting CLSF or
Officers (PBOs). CCI end item serial numbers
CSLA.
are reported in the Controlled Cryptographic
Item Serialization Program (CCISP) IAW AR
b.
(U) Army COMSEC Publications.
710-3. Selected CCI components require
Army COMSEC Publications are requisitioned
Selected Item Management System-Expanded
through the Standard Army Publications System
(SIMS-X) reporting IAW AR 710-3.
(STARPUBS). Army publications dealing with
COMSEC policy, procedures, equipment
c.
(U) Unclassified COMSEC Equipment.
operation, and maintenance (i.e., Technical
Unclassified COMSEC equipment items which
Manuals [TMs] and Technical Bulletins [TBs])
are NOT designated CCI, such as the NAVSTAR
are automatically issued by updating the DA
Global Positioning System (GPS) and the new
Form 12 Series. This will establish an account
family of Secure Telephone Equipment (STE),
on the initial distribution list for new/revised
will be requisitioned through normal supply
publications that have not already been
channels and will be accounted for and
distributed within the Army. Local publication
controlled as “Sensitive Items,” as prescribed in
channels can obtain existing publications via the
AR 710-2. The loss or theft of unclassified
submission of DA Form 4569.
COMSEC “sensitive items” requires investigation
and reporting per AR 735-5.
3-3
FOR OFFICIAL USE ONLY
TB 380-41
c.
(U) NSA Limited Maintenance
Tobyhanna Army Depot (TYAD) manufactures
Manuals (LMM). LMMs are NSA-produced
ID plates upon request from CSLA. Other labels
maintenance manuals for CCI equipment.
are assigned National Stock Numbers (NSNs)
LMMs are requisitioned through STARPUBS.
and may be requisitioned just like any other
LMMs differ from the NSA KAMs in that they are
expendable supply item. These labels are listed
not controlled within the CMCS and are not
in equipment TMs and are requested on DA
assigned an ALC (see paragraph 3.3.2.b).
Form 2765-1 from local Supply Support Activities
(SSA).
d.
(U) NSA-Published Policy and
Doctrine. The National Security Agency has
c.
(U) Lost, Damaged, Destroyed,
produced several Non-Cryptographic
Mutilated, or Disfigured/Illegible Appliqués.
Operational General Publications (NAG),
Whenever the required “appliqués” (data
National Security Telecommunications and
plates/labels) become lost, damaged, destroyed,
Information Systems Security Instructions
mutilated, or disfigured/illegible, they must be
(NSTISSI), Committee on National Security
immediately replaced. COMSEC Custodians
Systems (CNSS), and Information Assurance
(for classified equipment) and Accountable
Directorates (IAD) policies and doctrine that
Officers (for CCI) are responsible for ensuring
contain operational security doctrine and
that action is taken to maintain the proper
procedures for various COMSEC devices in the
identity of all COMSEC material.
Army inventory. COMSEC accounts are
required to maintain a library of these documents
d.
(U) Replacement Labels/Plates.
applicable to their unit operations, provided they
have been approved by HQDA for Army use.
(1) (U) To obtain replacement identification
These Army-approved documents are not
plates or Printed Circuit Board (PCB) ID
available for distribution through STARPUBS;
labels for COMSEC material, send a
however, they are locally reproducible to satisfy
memorandum or electronic message to
internal distribution requirements. Due to the
the POC listed in Appendix F. Serial
continuing growth in the number of these
number replacement plates or labels for
publications, CSLA will list the applicable
PCBs are replaced only when authorized
documents in their newsletter, The COLT, and
maintenance technicians open
will provide regular updates announcing new
equipment. The replacement of PCB
documents that have been approved by HQDA
plates/labels will be accomplished only
and are available for issue from CSLA.
by the COMSEC maintenance personnel
authorized by the Source, Maintenance,
(U) Army units are prohibited from acquiring or
and Recoverability codes, as shown in
using NSA publications that have not been
the applicable equipment TMs.
approved for Army use by HQDA.
(2) (U) Include the following information in
3.3.3
(U) Identification Plates/Labels.
your correspondence:
a.
(U) COMSEC End Items and Major
(a) (U) Short title/end item nomenclature,
Components. All COMSEC end items and
serial number(s), and COMSEC
major components are identified with
account number/DODAAC.
permanently affixed Identification (ID) plates
containing short titles/nomenclatures, serial
(b) (U) A short justification for the
numbers, and security classification (if
request explaining why the ID
applicable). In addition, some items, as
plates/labels need to be replaced.
prescribed by equipment TMs and NSA
publications, include labels or decals that identify
(c) (U) If the serial number is not known,
items as CCI and/or show which modifications
your request for a new serial number
have been applied to specific items of
should contain the following
equipment.
statement: “A complete audit of
records at this account has been
b.
(U) Serial Numbers. Identification
made and there is no record of the
plates almost always have serial numbers on
original serial number available for
them. Other labels do not reflect serial numbers.
this equipment.”
3-4
FOR OFFICIAL USE ONLY
TB 380-41
(3) (U) When preparing a request for a new
3.4.3
(U) Operations Security (OPSEC).
ID plate/label, the following certification
Properly used cryptosystems and authentication
statement is required:
“I certify that none
systems are necessary to maintain adequate
of the COMSEC items requiring ID
OPSEC within a command.
plates or labels were fabricated, or if any
items were fabricated, it was done with
3.4.4
(U) Approved Systems. The only
prior written approval of CSLA.”
cryptosystems and authentication systems
approved for Army use are those systems as
(4) (U) The Unit Commander must sign the
outlined below:
certification. Upon receiving a request
a.
(U) Produced by the NSA and obtained
for ID plates, CSLA will issue new ID
through the procedures described within this
plates with the original or new serial
chapter.
number permanently inscribed. Upon
request, instructions will also be
b.
(U) Commercial Off-the-Shelf (COTS)
provided on how to requisition
Systems approved by the NSA/DA for local
replacement labels and decals through
purchase under the Commercial COMSEC
the supply system.
Endorsement Program (CCEP). See AR 710-2,
Chapter 1.
(5) (U) Users experiencing difficulty in
obtaining replacement ID plates or labels
c.
(U) Electronic key generated and
should telephone CSLA, 1-800-662-
distributed using NSA-approved key generating
2123.
systems.
3.3.4
(U) Equipment Alteration. See
3.4.5
(U) Selection and Use. For assistance
paragraph 4.18 of this TB.
in the selection and use of manual cryptosystems
and authentication systems, contact CSLA. See
3.4 NEED FOR
Appendix F for POC information.
CRYPTOSYSTEMS AND
(1) (U) Users of each cryptosystem and
authentication system will become
AUTHENTICATION
familiar with the system’s capabilities
SYSTEMS.
and limitations, and have a thorough
knowledge of the appropriate operating
instructions.
3.4.1
(U) Information Security.
(U) Cryptosystems provide security by
(2) (U) Detailed operating instructions
preventing electronically transmitted information
normally accompany each copy of
from falling into the hands of unauthorized
manual systems. The NSA, in the
persons. Machine cryptosystems and certain
cryptosystems Operating Instructions
“one-time” cryptosystems are the most secure
(KAO), Limited Maintenance Manuals
methods of protecting electronically transmitted
(LMM) and Army Operator’s Technical
information. Manual and auto-manual
Manuals I, publishes detailed
cryptosystems are used to protect electronically
instructions for each machine
transmitted information only when machine
cryptosystem. An index of KAOs, LMMs
systems are unavailable.
and Army COMSEC Publications is
listed in DA Pam 25-35.
3.4.2
(U) Authentication Systems.
Authentication systems provide a defense
3.5 CRYPTONETS.
against enemy intrusion into communications
nets. These systems are also used to establish
3.5.1
(U) Cryptonet Elements. Establishing
the authenticity of stations, communicators, or
a cryptonet involves identifying those individuals
communications.
and/or operating elements that must
intercommunicate in a secure mode. In order to
intercommunicate, all cryptonet members must
possess compatible equipment, as well as the
3-5
FOR OFFICIAL USE ONLY
TB 380-41
associated key. Cryptonet planning is
3.5.3
(U) Cryptonet Size. The size of the
conducted in conjunction with communications
cryptonet will be as small as operationally
network planning to ensure compatibility and
feasible for the types of organizations and
interoperability with joint organizations, as well
cryptosystems requiring hard copy key. The
as Army Commands. CONAUTHs will give
CONAUTH will always determine the number of
consideration to the employment of electronic
holders and copy count requirements for key.
key and the implementation of electronic re-key
procedures. When electronically generated key
3.5.4
(U) Cryptonet Expansion. All
is not used, the CONAUTH must send written
cryptonets established will consist of essential
justification to the Service Authority explaining
members only and have a key copy count
why they are requesting hard copy key. This will
sufficient to satisfy the secure communications
limit hard copy key products to the minimum
requirement. Additional copies of key to be used
essential for mission accomplishment.
for possible expansion of Army cryptonets will
not be held by a CLSF unless directed by a
3.5.2
(U) Types of Cryptonets. The
higher headquarters that has received prior
CONAUTH must consider which type of
approval from the CONAUTH and the NSA.
cryptonet (for example, operational or
contingency) will be most economical in terms of
3.6 ESTABLISHMENT OF
production, distribution, storage, and destruction
costs. With the exception of irregularly
CRYPTONETS.
superseded key (such as one-time pads), key for
operational nets is re-supplied as directed by the
a.
(U) Requests for Establishment of
CONAUTH. Irregularly superseded key is
Cryptonets (Physical Key). Requests for
re-supplied upon request of the CONAUTH. Key
establishing machine or auto-manual cryptonets
will be used as follows:
(including requests for approved cryptosystems
and authentication systems) will be submitted via
a.
(U) Operational Key. Operational key
message by the commander of the requesting
will be used for routine day-to-day operations.
activity. These requests, in the form of a
memorandum or message, will be submitted to
b.
(U) Contingency Key. Contingency key
CSLA with the information addressees of the
will be used for operations that occur
NSA, Y132 and the requestor’s next higher
infrequently (exercises less frequent than one
headquarters listed. For KG-84 key, provide this
each month). The use of operational key to
information to the NSA, ATTN: Y271 and Y132.
secure infrequent operations is discouraged,
See Appendix F for POC addresses.
except as explained in the following paragraph,
because it will result in NEEDLESS and
(1) (U) Requests for manual cryptosystems
COSTLY destruction of unused key and it is
will be submitted to the action and
manpower intensive.
information addressees listed in the
preceding paragraph. This includes
c.
(U) Use of Operational Key for
OPCODES, One-Time Pads (OTP),
Contingency Purposes. One or more editions
Authentication Systems, etc.
of operational key may be identified for
training/exercise use by the CONAUTH. The
(2) (U) AKMS accounts will utilize the
CONAUTH may also choose to change the
attributes in the LCMS. Refer to the
status of an operational key to contingency for
LMD/KP Operators Manual.
future use instead of cancellation when a net has
been discontinued. Both of these actions must
b.
(U) Standard Request Form. Requests
be coordinated with CSLA Key Management and
for physical key will contain the following
the NSA. The CONAUTH may change the key
information, as appropriate. Message requests
back to an operational status at a future time, if
for classified key will be classified as
required. The CONAUTH is responsible for
CONFIDENTIAL due to the compilation of
advising all users and CSLA of disposition
information. Request for UNCLASSIFIED key
instructions of unused, cancelled, or superseded
will be marked and handled as FOUO.
key.
(1) (U) Type of Key.
(Refer to figure 3-1):
Electronic keying/re-keying techniques
3-6
FOR OFFICIAL USE ONLY
TB 380-41
will be employed to the maximum extent
(8) (U) Delivery Date. Indicate the Required
feasible.
Delivery Date (RDD). Normal production
lead-time is 120 days from receipt of the
(a) (U) Indicate type of key required
request by the NSA.
(KG-84C, KY-57/58, etc). If the
request is for the Traffic Encryption
(9) (U) Purpose of Operation. Include
Key (TEK) transition training tape,
information (such as exercise name and
provide the number of months the
dates or dates and length of the
tape will be required. The tape
on-the-air test) to assist in identifying
production will be scheduled for the
when the material will be used.
requested period only.
(a) (U) CSLA, the NSA (Y13), and the
(b) (U) If the request is for Key
supporting CLSF (when applicable)
Encryption Key (KEK) tape, specify
will be notified when a newly
the reason for KEK tape instead of
established operational cryptonet
local generation of KEK (e.g., KG-83
(using regularly superseded key) has
is not available for generation of
started operations. This notification
KEKs).
allows the automatic re-supply of key
to begin (see Figure 3-1).
(2) (U) Designated CONAUTH. Include
CONAUTH message address, a point-of-
(b) (U) CSLA and the NSA will also be
contact, e-mail address and telephone
notified each time an edition of any
number.
contingency key is implemented.
Contingency key will only be re-
(3) (U) Nature of Request. Indicate nature
supplied when the CONAUTH
of request (i.e., new equipment or
requests it.
establishment of cryptonet).
(10) (U) Net Structure and Operation.
(4) (U) Key Usage. Indicate key usage:
Indicate net structure and operation, and
National Emergency Operations (NEO),
state if cryptonet is point-to-point or
State Emergency support/Civil Action,
netted.
etc. For machine or auto-manual
cryptosystems, provide a brief statement
(11) (U) Short Title. Indicate the Short Title
describing the scenario under which the
of the key to be replaced, if applicable.
requested key is to be used. For manual
cryptosystems, provide a detailed
(12) (U) Quantity of Crypto-equipment. For
description of the requirement.
machine cryptosystems, indicate the
total quantity of crypto-equipment
(5) (U) Classification. Indicate the
on-hand that will use the key requested.
classification of information to be
encrypted (CONFIDENTIAL, SECRET,
(a) (U) If the crypto-equipment is not
or TOP SECRET).
on-hand, show the equipment
delivery date as established by the
(6) (U) Number of Copies. Indicate the
CSLA. If the delivery date is more
required number of editions and the total
than four months away, the key will
copy count per edition. Also, when
not be requested. Also, if the
requesting establishment of a cryptonet,
communications equipment used in
indicate the canister configurations
support of the crypto-equipment is
requested. See paragraph 4.8.1a and b
not on-hand, and is not due to be
for canister configuration.
delivered within four months, the key
will not be requested.
(7) (U) COMSEC Account Numbers.
Indicate the COMSEC account
(b) (U) For One-Time Tapes/Pads/Disks,
number(s). Also, include the number of
indicate whether the system is a
copies to be shipped to each account.
point-to-point system or a family-type
system (e.g., a 5-way family system
3-7
FOR OFFICIAL USE ONLY
TB 380-41
would consist of five editions, each
edition consisting of one encipher
c.
(U) AKMS Accounts. AKMS accounts
and four decipher pads/tapes/disks).
will send requests using the free form text
Indicate type of circuit (full-duplex,
directly through the message server. Refer to
half-duplex, etc.).
Chapter 6 of this TB for additional key issues
pertaining to AKMS.
(13) (U) Emergency Reaction Force.
Indicate if the unit is part of a Command
Free form text messages will adhere to the
Emergency Reaction Force.
standard English rules of convention (e.g.,
spacing, punctuation, grammar). Failure to
(14) (U) Validation by Higher Headquarters.
construct a legible message may result in the
Include a statement to verify the higher
request being returned to the sender unfulfilled.
headquarters has validated the need for
the cryptonet.
3-8
FOR OFFICIAL USE ONLY
TB 380-41
This is an example of a message request to establish a cryptonet. Content will vary according to
local requirements. Classification is for example purposes only.
***CONFIDENTIAL***
01
02
081241Z
FEB
03
RR
RR
CCCC
AA
ZYUW
TTC-1
NO
FROM
CDR PIRMASENS GE //5A0419//
TO
DIRCSLA FT HUACHUCA AZ//SELCL-ID-KEY//
DIRNSA FT MEADE MD //Y132//
INFO
NCTAMS LANT NORFOLK VA //159039
C O N F I D E N T I A L
SUBJECT: ESTABLISHMENT OF CRYPTONET (U)
A.
(U) TB 380-41 PROCEDURES FOR SAFEGUARDING, ACCOUNTING, AND SUPPLY
CONTROL OF COMSEC MATERIAL
1.
(C) THIS PARAGRAPH IS CONFIDENTIAL DUE TO COMPILATION IAW CHAPTER 3,
REFERENCE A. THIS ACTIVITY HAS A REQUIREMENT TO ESTABLISH A CRYPTONET
USING APPROVED KEY.
A.
(U) TYPE OF KEY: KG-84() OPERATIONAL OTAR KEY KEYTAPE, TENNLEY
(KEY ENCRYPTION KEK WITH WEEKLY OTAR, QUARTERLY CRYPTOPERIOD, ANNUAL
EDITION SUPERSESSION).
B.
(U) CONAUTH: CDR PIRMASENS GE //5A0419//, DSTN/STU-III: XXXXX.
C.
(U) NATURE OF REQUEST: NEW REQUIREMENT.
D.
(U) KEY USAGE: OPERATIONAL.
E.
(U) CLASS: TOP SECRET.
F.
(U) COPY COUNT:
(1) NUMBER OF EDITIONS:
2.
(2) TOTAL COPY COUNT PER EDITION:
2.
(3) CANISTER CONFIGURATION:
16-1-16 (DIGRAPH GF).
G.
(U) SHIP TO: CA 5A0419 1 CY
CA 159039 1 CY.
H.
(U) RDD:
24 APR 00
I.
(U) PURPOSE OF OPERATION: MATERIAL WILL BE USED FOR GENSER
DIRECT AUTODIN FULL TIME CIRCUIT BETWEEN CDR PIRMASENS AND NCTAMS LANT
NORFOLK VA (CCSD 7D35).
J.
(U) NET STRUCTURE/OPERATION: POINT-TO-POINT, FULL-TIME
PIRMASENS CDR TO NORFOLK, VA. ACTIVATION SCHEDULED NLT 01 AUG 2000.
K.
(U) SHORT TITLE REPLACED: NONE.
L.
(U) KG-84() AUTHORIZED: CA 5A0419: AUTH 1 OH: 1,
CA 159039: AUTH: 1 OH: 1
M.
(U) THIS UNIT IS NOT PART OF A COMMAND EMERGENCY REACTION
FORCE.
N.
(C) KEY USAGE: TO BE USED BY ACTIVITIES MENTIONED IN SUBPARA 1
ON ITS DAY-TO-DAY MISSION.
2. ALL ADRS WILL BE NOTIFIED BY THE CONAUTH WHEN CRYPTONET IS
IMPLEMENTED.
3. THIS REQUEST HAS BEEN COORDINATED AND APPROVED BY OUR NEXT HHQ,
5TH SIG CMD, ATTN: ASQK-S.
4.
(U) POC IS MR. DENNIS HILLIARD, CONAUTH.
P. MICHAUD
DERIVED FROM: TB 380-41
CONAUTH, 5932
DECLASSIFY ON SOURCE MARKED OADR
DATE OF SOURCE: JUN 03
DON OWEN, MAJ, CDR
Figure 3-1. Request to Establish a Cryptonet.
3-9
FOR OFFICIAL USE ONLY
TB 380-41
Non-OTAR TEK can have as many
3.6.1
(U) Requests for Key Tapes. Some
copies as the CONAUTH requests.
cryptosystems are capable of local key
generation (i.e., KY-57, KY-58, and KG-83), in
(4) (U) Supersession. At the discretion of
electronic form, for distribution to cryptonet
the CONAUTH, tape TEK may be re-
holders without resorting to hard copy key (see
supplied on a regular or irregular basis.
NAG 16[XXX]). Local generation of electronic
key is the preferred method for operations
(a) (U) Irregular. In most tactical
whether derived from key generation-capable
applications, the consumption rate for
COMSEC equipment, or via the LCMS
tape TEK is not accurately predictable.
Workstation. When field generation of key is not
For example, a commander who has
a viable option, key must be ordered in hard
been designated as a possible NCS
copy form. Ordering key in tape format requires
for a particular start-up KEK may not
the commander and COMSEC personnel to be
serve in that capacity for a long period,
familiar with three different types of key: Traffic
or tape TEK held as back up for a
Encryption Key (TEK), Key Encryption Key
stand-alone (non-TRI-TAC) KG-83
(KEK), and start-up KEK.
may never be used. In applications
like this, CONAUTHs should order
a.
(U) Ordering Tape TEK.
reasonable quantities of tape TEK.
Each edition of this key should be
(1) (U) Uses. For nets/circuits that
superseded irregularly. If follow-on
distribute TEK via Over-the-Air Re-key
editions are needed, allow four months
(OTAR), tape TEK serves two purposes.
for production and delivery. The
At Network Control Stations (NCSs) that
recommended procurement strategy is
derive OTAR TEK from certified KG-
to requisition as many editions of a
83/KGX-93s irregular superseded tape,
single short title of tape TEK as may
TEK serves as emergency back up in
be required for each using NCS or
case of a KG-83/ KGX-93 failure. At
alternate NCS. Where tape TEK is
NCSs that do not use field-generated
held only as back up, the
TEK, tape TEK is required. Tape OTAR
recommended stock level is one
TEK associated with OTAR is not
month’s worth of expected use. That
dedicated to any specific net, circuit, or
period should be long enough to
COMSEC equipment. In that
requisition and obtain a replacement
application, a short title of appropriately
KG-83.
classified key tape can serve as the
source of TEK for any or all nets and
(b) (U) Regular. In applications where its
circuits that are controlled by an NCS.
use rate can be predicted, the number
of 62-segment TEK tape canisters
(2) (U) Format. Tape TEK intended for use
required to meet an NCS’s
on nets/circuits that distribute TEK via
requirement, and the schedule on
OTAR is produced in the “V_” format,
which they are re-supplied, are inter-
indicating that each canister contains 62
related. This requires that the
segments. The second letter of the
CONAUTH adjust the number of short
digraph identifies the cryptoperiod,
titles and their supersession schedules
which may vary with specific
to ensure that the required volume of
applications. See the appropriate KAO
tape TEK is received. For example, if
to determine approved cryptoperiods.
an NCS expects to use 150 segments
of tape TEK per month, the CONAUTH
(3) (U) Copy Count. Only one copy is
should order three monthly-
produced of each edition of tape TEK
superseded short titles.
intended for use on nets/circuits that
distribute TEK via OTAR, since the
using NCS is the only holder. Each
alternate NCS should hold its own short
title(s) of one-copy tape TEK.
3-10
FOR OFFICIAL USE ONLY
TB 380-41
b.
(U) Ordering Tape Start-up KEK.
that exist on a continuing basis and that
distribute TEK via OTAR.
(1) (U) Use. Start-up KEK tape supports
the establishment of temporary tactical
(2) (U) Format. Tape KEK (except that which
nets and circuits secured by KY-57, KY-
is used with KW-46) is produced in the
58, KY-67, KYV-5, KY-99A, KY-100,
“GF” (16 unique segments - three month
KIV-7, or KG-84A/C equipment. Any
cryptoperiod) format. Since only four
commander may order a start-up KEK
segments per edition are used each year,
tape for use by an identified community
the remaining segments are available for
of potential users. Requestors should
cold starts. When a cold start is required,
allow four months for production and
the next segment in the canister will be
distribution.
used. At the end of the quarter, simply
pull the next available segment.
(2) (U) Format. Start-up KEK tape is
produced in the “VA” format (62
(3) (U) Copy Count. In point-to-point
segments - daily cryptoperiod).
applications and nets that use a unique
KEK for each net member (i.e., nets that
(3) (U) Copy Count. The copy count in
OTAR sequentially), the copy count for
which a start-up KEK tape is
each edition of tape KEK is two. In nets
requisitioned should provide for the
that OTAR simultaneously, the copy
expected number of holders and a
count corresponds to the number of net
reasonable number of spare copies to
members. The CONAUTH may order a
accommodate unplanned additions to
few extra copies to accommodate
the cryptonet. The CONAUTH must
possible future cryptonet expansion;
designate where spare copies are to be
however, they must designate where
held.
such extra copies will be held.
(4) (U) Supersession. Each edition of start -
(4) (U) Supersession. Each edition of tape
up KEK tape is regularly superseded at
KEK associated with continuing nets and
two-month intervals.
circuits are superseded annually. Tape
KEK associated with contingency
c.
(U) Ordering Tape KEK. Where
applications may be requisitioned with
physical distribution of keyed fill devices is
irregular supersession, but this places
operationally viable, KEK should be field-
the burden of ensuring continuing
generated. However, since many tactical
resupply on the CONAUTH. In either
environments require use of tape KEK, guidance
case, four months should be allowed for
for ordering tape KEK is as follows.
production and distribution of tape KEK.
(1) (U) Use. Tape KEK, rather than tape
d.
(U) Guidance for Ordering Key Tape.
start-up KEK, should be used on KG-
The following table provides standard
84A/C, KY-57/58/67, and KYV-5/KY-
recommendations given by system type and
99A/KY-100 secured nets and circuits
digraph (for more information on digraph, see
4.8.1a).
3-11
FOR OFFICIAL USE ONLY
TB 380-41
Table 3-1. Digraph for Systems
System
Digraph
Configuration
Cryptoperiod
Fascinator
EB
5-1-5
Weekly (7 days)
GSP (GUV)
TG
12-1-12
Yearly
KG-40
AA
31-1-31
Daily (24 Hours)
KG-45
NC
Varies
Varies
KG-65/75
AB
15-5-75
Weekly (7 days)
KG-66
LH
35-1-35
Varies
KG-81/94/194
VF
62-1-62
Three Months
GC
16-1-16
Monthly
KG-84
AF
31-1-31
Three Months
OTAR KEK
GF
16-1-16
Three Months
VA
62-1-62
Daily (24 hours)
OTAR KEK
VB
62-1-62
Weekly (7 days)
AA
31-1-31
Daily (24 Hours)
Operational TEK
GC
16-1-16
Monthly
VA
62-1-62
Daily (24 hours)
VB
62-1-62
Weekly (7 days)
KG-95
GC
16-1-16
Monthly
KGV-8
GC
16-1-16
Monthly
VA
62-1-62
Daily (24 hours)
KGV-9
NC
Varies
Varies
KGV-10
ZB
15-5-75
Weekly (7 days)
(SINCGARS )
KGV-11/15
NC
Varies
Varies
NE
Varies
Varies
KL-43
AA
31-1-31
Daily (24 hours)
KY-57/58
ZB
15-5-75
Weekly (7 days)
(VINSON)
KY-68
AB
31-1-31
Weekly (7 days)
ZB
15-5-75
Weekly (7 days)
KY-99A/KY-100
ZB
15-5-75
Weekly (7 days)
KYV-2
BB
5-3-15
Weekly (7 days)
3-12
FOR OFFICIAL USE ONLY
TB 380-41
3.6.2
(U) AKMS Accounts. Using the
b.
(U) Assignment of CONAUTH Duties.
attributes of the LCMS and the communications
CONAUTH duties will initially be assigned to the
interfaces provided by the Electronic Key
commander of an organization requesting or
Management System (EKMS), COMSEC
directing the establishment of the cryptonet.
accounts could prepare an electronic key order
Commanders may designate (in writing) a
for the generation and distribution of keying
member of the organization to perform
material from the Primary Tier 1 Facility (COR)
CONAUTH duties on their behalf. For
or the Central Facility (CF), as well as generate
electronically generated key, the organization
key locally. Refer to the LMD/KP operator’s
that directs the key generation performs the
manual for specific procedures.
CONAUTH functions unless those functions are
specifically delegated to another organization in
3.6.3
(U) Requests to Hold Other Services’
writing.
or Agencies’ Cryptonets Key. Commanders
who desire to hold key controlled by another
c.
(U) Transfer of CONAUTH Duties. The
Army Command, service, or agency, will forward
transfer of CONAUTH responsibilities for a
their requests directly to the CONAUTH for
particular cryptonet may become necessary (or
approval. If the CONAUTH is an Army
advantageous) for either administrative or
Commander and the request is approved, the
operational reasons. When a transfer of
CONAUTH will submit the new requirement as
CONAUTH duties occurs, the relinquishing
directed in subparagraph 3.6.1. If the
CONAUTH is responsible for notifying the
CONAUTH is non-Army and the request is
commander, the net members, appropriate key
approved, the CONAUTH will submit the
distribution activities, CSLA, and the NSA via
requirement through proper channels to its
message traffic of the change. The gaining
servicing organization. GPS key does not have
CONAUTH must ensure that sufficient
a CONAUTH; rather, a Validation Authority
operational (and sometimes historical)
approves it. See Appendix B-2, Terms.
information is acquired to ensure continuity of
net operations.
3.6.4
(U) Requests for Foreign Release.
Requests for key that requires release to a
d.
(U) Contingency Operations. During
foreign government will be forwarded to HQDA
the conduct of contingency operations,
as directed in AR 380-40. In addition, a copy of
particularly for nets managed at Echelons Above
the request will be forwarded to CSLA with an
Corps (EAC), it may be desirable for the
information copy to the NSA (Y271).
CONAUTH to temporarily relinquish operational
net control of a particular system to a regional
command or net control center in the forward
3.7 CONTROLLING
contingency area. This temporary delegation or
AUTHORITY.
transfer of operational net control is acceptable;
however, it does not relieve the assigned
(U) The CONAUTH has responsibility for all
CONAUTH from overall supervisory and
communications management functions within a
management responsibility.
command. The CONAUTH is responsible for
3.7.1
(U) Management Responsibilities.
supervising and coordinating the collective
The CONAUTH’s responsibilities and specific
operational and administrative tasks associated
duties are primarily an operational function.
with the management of the cryptonet on behalf
However, they include specific logistics support
of the commander. However, the inherent
actions, surveillance and oversight
command responsibility for communications and
responsibilities that must be performed by the
communications security within an organization
CONAUTH in coordination with the operational
rests with the commander and cannot be
net manager. The commander should formally
delegated to any other individual.
designate responsible personnel to perform each
of these functions.
a.
(U) Authority. The CONAUTH should
be organizationally senior to cryptonet members,
have the staff and expertise to perform essential
management functions, and must have the
authority to ensure instructions are carried out.
3-13
FOR OFFICIAL USE ONLY
TB 380-41
3.7.2
(U) Operational Responsibilities. The
e.
(U) Authorize Key Replacement/
Communications/COMSEC Planning and
Resupply. The CONAUTH will authorize key
Management element—traditionally the Staff
replacement or re-supply in situations where
Signal Officer, Operations Officer, Director of
material cannot be supplied in time to meet
Information Management (DOIM),
operational requirements for machine
Installation/Operations/ Maintenance (IOM)
cryptosystems.
Communications and Electronics (C&E), and the
State Area Command—perform the operational
(1) (U) The CONAUTH must coordinate with
responsibilities for the National Guard Bureau
distribution authorities to ensure timely
(NGB). These responsibilities are as follows:
resupply of keying material.
a.
(U) Plan and Identify Requirements.
(2) (U) When user accounts have only a
Routine changes to cryptomaterial requirements
two-month supply of key remaining, the
should be projected and identified to the
CONAUTH must promptly ascertain the
supporting distribution facility, CSLA, and the
status of follow-on material.
NSA NLT 180 days prior to the operational
requirement to ensure production and
(3) (U) If user accounts cannot be re-
distribution can be accomplished. Emergency
supplied before remaining key is
requirements should be requested by the
expended, the CONAUTH must direct
CONAUTH as soon as they are known.
users to implement the longest
authorized cryptoperiod extension for
b.
(U) Direct Establishment and
each remaining key setting (see
Operation of Cryptonet. The CONAUTH
paragraph 3.7.2g). If the extension is
directs the establishment, operation, and
insufficient, or a resupply date cannot be
management of the material assigned to the
determined, the CONAUTH must report,
cryptonet, as well as designates and maintains a
via message using an IMMEDIATE
record of cryptonet members and the quantity of
precedence, to the NSA (Y13) and CSLA
key each is authorized to hold. The CONAUTH
so that contingency arrangements can
must know the identity of all cryptonet members
be made. The message must include
and the problems users may be experiencing
the short title, the number of net
with the keying material. The CONAUTH must
members, a description of the type of
also know the distribution authorities that support
operations (e.g., full or part time, fixed or
the holders of the material and the most
mobile communications center), and an
expeditious ways of promulgating supersession
explanation for the cryptoperiod
and other emergency information to all holders
extension.
of the keying material.
(4) (U) When time is critical, the CONAUTH
c.
(U) Compromise Control. The
may verbally request emergency
CONAUTH must maintain accurate records on
cryptoperiod extensions from the NSA
pertinent aspects of the cryptonet in sufficient
(Y13) (DSN/STU -III 644-6860 or
detail in order to assess the impact of, and to
Commercial [301] 688-6860). When
recover from, a compromise. The CONAUTH
authorization is given verbally, the
will ensure all net members are aware of
CONAUTH must take immediate action
compromises, and that they are in compliance
and not wait for message
with any recovery actions that have been
documentation. Net members must
deemed necessary as a result of the
abide by all verbal instructions relayed
compromise (e.g., extension of cryptoperiod or
by the CONAUTH.
emergency supersession).
(5) (U) For some cryptosystems, the
d.
(U) Initiate Recovery/Reconstitution.
CONAUTH has the authority to shorten
The CONAUTH will immediately notify all
the cryptoperiod to enhance security if
cryptonet members when a net key is
the cryptonet is unusually large. For
compromised and will determine whether to
example, the cryptoperiod for some
extend the cryptoperiod of the net key or activate
cryptosystems used in cryptonets
a replacement.
3-14
FOR OFFICIAL USE ONLY
TB 380-41
containing 600 or more holders (copies)
prescribed in the keying material. The time
may be reduced to 12 hours instead of
selected for key change must be consistent
the standard 24 hours.
throughout the cryptonet and chosen to have the
least operational impact.
f.
(U) Direct Classification Changes.
The CONAUTH will evaluate and approve
l.
(U) Approve the Issuance of Extracts.
classification changes for all key (see AR 380-
The CONAUTH determines and approves the
40, paragraph 5-6). Before upgrading key to TS,
number of extracts of keying material that may
the CONAUTH must ensure that the material
be issued at the user level, except where
has been previously controlled at the COMSEC
specified otherwise in the operating instructions
account level and has not been issued to a user.
of the material, and provides this information to
For contingency purposes, CSLA must be
each net member.
contacted for a classification change for
resupply.
m. (U) Distribution Directions. The
CONAUTH advises the appropriate key
g.
(U) Approve Cryptoperiod
distribution authorities, CSLA, and the NSA
Extensions. The CONAUTH may authorize
(Y13) of the COMSEC accounts that will be
cryptoperiod extensions up to seven (7) days
issued keying material and the number of copies
unless specific systems doctrine limits the
to be issued. For manual cryptosystems (one-
extension period. CONAUTHs are not required
time pads, operations codes, authentication
to report these extensions; however, they must
systems, etc.), the CONAUTH must first identify
be documented. Additional extension of a
specific operational requirements to the NSA
cryptoperiod must be approved in advance by
(Y271/Y272).
the NSA or reported as a COMSEC Incident.
n.
(U) Cryptonet Evaluation. The
h.
(U) Understand Doctrinal
CONAUTH must continuously monitor the size,
Requirements. The CONAUTH must
operation, and purpose of the cryptonet.
understand all doctrinal and operational
Periodic revalidation that an operational
requirements for missions supported, the proper
requirement exists is mandatory in conjunction
use of key, and be familiar with the capabilities
with the Cryptonet Evaluation Report (CER) (see
of the associated equipment or off-line system.
paragraph 3.7.6). The CONAUTH must notify all
net members, supporting distribution activities,
i.
(U) Specify Implementation and
CSLA, and the NSA (Y13) of any changes in net
Supersession of Key. The CONAUTH must
configuration or keying material status. If
specify the initial cryptonet activation and key
manual cryptosystems are concerned, the
implementation date; designate the contingency
CONAUTH must notify the NSA (Y27).
editions; inform all cryptonet members,
appropriate distribution authorities, and the NSA
o.
(U) Validate Requirements. The
(Y13) when net key is implemented; and inform
CONAUTH contacts cryptonet members, at least
the above of the subsequent supersession rate
annually, to identify the material they control and
thereafter. Only the NSA establishes
to advise each member on how to contact the
supersession rates! Except in emergencies, or
CONAUTH and all other net members under
when key is comprised, the CONAUTH cannot
normal and emergency circumstances. The
change supersession rates.
CONAUTH is authorized to communicate directly
with the cryptonet members.
j.
(U) Determine Unused Key Status.
The CONAUTH determines if unused key can be
3.7.3
(U) Logistics Support. Logistics
placed in contingency status while in secure
support responsibilities are directed by the
storage.
CONAUTH, and it is the COMSEC Custodian
who carries out these responsibilities:
k.
(U) Specify Key Change (HJ) Times
a.
(U) Ensure Key Availability/
When Not Prescribed. The CONAUTH
Sustainment. Ensure all cryptonet members
determines and approves the amount of key held
have sufficient keying material on hand (at least
at the user level and provides this information to
the current edition plus one edition) to sustain
each net member. The CONAUTH will specify
the cryptonet.
HJ time for the cryptonet when the time is not
3-15
FOR OFFICIAL USE ONLY
TB 380-41
b.
(U) Generation and Distribution of
consider the time needed to create or
Electronic Key. Generate, distribute, and
reestablish communications paths before
manage locally generated electronic key.
directing supersession.
Authorize electronic generation, distribution, and
physical transfer of key in a common fill device
(2) (U) Hard copy key: The feasibility of
or Data Transfer Device (DTD).
superseding hard-copy keying material is
contingent on several factors: the number
c.
(U) Control of the Reproduction of
of editions held at the user level; the
NSA-Produced Hard Copy Key. Ensure that
capacity of the NSA to produce the
reproduced NSA key is kept to the minimum
keying material; and the capability to
amount essential, properly classified, controlled,
direct supply replacement. Any decision
and destroyed in the same manner as the
to supersede must take into
original keying material. CONAUTHs, who
consideration the time required to notify
routinely authorize reproduction of the same
all cryptonet members and implement the
material, should increase the copy count of that
new material.
material.
b.
(U) Precautionary Supersession.
d.
(U) Ensure Two-Person Integrity (TPI)
When precautionary supersession is warranted,
for TS. Ensure appropriate two-person integrity
but some net members do not hold or cannot be
procedures are followed for all TS key held until
supplied with replacement key via normal
issued/destroyed.
logistics channels, several options are available
to the CONAUTH. The CONAUTH may (in order
3.7.4
(U) Key Material Compromises.
of preference):
Where substantial evidence exists that
COMSEC keying material (both locally
(1) (U) Electronically generate and distribute
generated and hard copy) has been
replacement key settings or transmit key
compromised, the CONAUTH must take
settings to net members via secure,
immediate action. Ideally, the CONAUTH will
electrical means. Replacement printed
announce precautionary supersession and direct
key settings must be encrypted by
early implementation of uncompromised future
machine on a one-time pad that has not
material. Emergency supersession of hard copy
been compromised and can provide
key must be reported immediately to CSLA and
end-to-end encryption equal to the
the NSA (Y13) so that resupply action may be
classification of the transmitted key.
taken, replacement material may be produced,
and status documents corrected. The
(2) (U) Direct the early implementation of
CONAUTH will direct traffic reviews of any
uncompromised future editions by those
record traffic encrypted using compromised
cryptonet members who hold those
keying material, when warranted.
editions or can be supplied quickly, and
exclude from net operations those
a.
(U) Directed Supersession.
members who do not hold or cannot be
furnished the replacement material.
(1) (U) Electronic Key: Superseding
electronically generated key can present
(3) (U) Physically distribute key to net
a unique problem for tactical users.
members in a common fill device or Data
Some of the communications paths used
Transfer Device (DTD). When keyed,
to deliver the key may no longer exist, as
common fill devices and DTDs must be
some of the relaying units may have
protected at the same level as the key
redeployed and can no longer serve in
contained therein.
that capacity. The CONAUTH must
c.
(U) Options. When supersession is
warranted but not feasible, the following options
are available to the CONAUTH:
3-16
FOR OFFICIAL USE ONLY
TB 380-41
(1) (U) Extend the cryptoperiod of
a.
(U) Annual Reviews. CSLA will provide
uncompromised keying material up to 24
the CER to the CONAUTH annually. The
hours (unless specific cryptosystem
CONAUTH will conduct an annual review of
doctrine prohibits such extensions or
keying material used with machine
authorizes a longer period).
cryptosystems. During the review, the
CONAUTH must comply with the following:
(2) (U) Suspend cryptonet operations until
key can be resupplied.
(1) (U) Justify any continued use of physical
key.
(3) (U) Continue to use the compromised
key. This action would be the LAST
(2) (U) Confirm cryptonet structure,
resort when normal supersession of the
quantities and adequacy of key to meet
compromised material will take place
operational requirements, and a
before emergency supersession can be
continuing requirement for the key. The
accomplished, when keying material
cryptonet must be deactivated if no
changes have a serious detrimental
longer needed.
effect on operations, or when no
replacement material is available. The
(3) (U) Identify large cryptosystems of low
CONAUTH must alert net members by
peacetime use that are candidates for
other secure means, if available, that a
placement into contingency status.
possible compromise has taken place
and direct that users minimize
b.
(U) Review of Manual Cryptosystems.
transmissions using the compromised
The CONAUTH will review all manual
key. Use this option only when
cryptosystems annually to:
continued cryptonet operation is
ABSOLUTELY ESSENTIAL to the
(1) (U) Validate a continuing requirement for
mission.
the cryptosystem.
3.7.5
(U) Defective Keying Material. The
(2) (U) Affirm that the system design and
CONAUTH must report the discovery of
content are adequate and that the status
defective keying material under their control.
of the material is satisfactory (e.g.,
The CONAUTH shall direct the retention of the
operational, contingency, and reserve).
defective material and all associated packaging
material pending the receipt of disposition
(3) (U) Verify that the present holders of the
instructions. Reports should be addressed to
cryptosystem have a continuing need for
the NSA (Y13 and Y265), with information
the system.
provided to CSLA. The NSA (Y13) will provide
disposition instructions for defective key and
(4) (U) Ensure that no machine or auto-
packaging materials by message and, if the
manual system exists which will negate
material is to be recalled, will provide specific
the requirement for the manual system.
instructions for its return. Recalled keying
material must be returned via the Defense
c.
(U) Recommendation for Change.
Courier Service (DCS); Department of State
The CONAUTH will recommend changes in
Courier System; or cleared department, agency,
keying material content, format, or classification
or contractor courier. Transfer reports should
to the NSA (Y13 for machine systems; Y27 for
state the reason for return, refer to the recall
manual systems).
message, and include any other remarks
requested in the recall message.
d.
(U) Suspension of Key Material.
CONAUTH response to the annual CER is
3.7.6
(U) Key Material Reviews. AR 380-40
mandatory. Failure to respond will be reported
requires all CONAUTHs to review and validate
to the CONAUTHs next higher headquarters
their requirements for the cryptosystems and
and/or MACOM. Continued FAILURE to
authentication systems under their control
respond to the CER may cause SUSPENSION
(Cryptosystems Evaluation Report [CER], RCS
in the distribution of future key material.
CSGID-131) per the following criteria:
3-17
FOR OFFICIAL USE ONLY
TB 380-41
3.7.7
(U) Designating Contingency Keying
notified when a newly established current-
Material. When large quantities of
operational cryptonet (using regularly
cryptomaterials provided for regular consumption
superseded key) has started operations. This
are destroyed unused, the CONAUTH should
notification allows the automatic resupply of key
consider placing the material into contingency
to begin. CSLA and the NSA will also be notified
status. Contingency keying material is
each time an edition of any contingency key is
cryptomaterial held for future, irregularly
implemented. This notification ensures the
occurring requirements in excess of routine
timely resupply of future key.
operational requirements. The material is not
activated until needed for the specific
3.8.3
(U) Shipment of Physical COMSEC
requirement and is not destroyed until after use.
Key. Initial shipments of physical COMSEC key
Substantial savings in production, distribution,
will originate from the USNDA Central Facility or,
accounting, and destruction are realized when
in some instances, TYAD (Physical Material
contingency materials are used in place of
Handling System). CSLA will monitor these
regularly superseded effective key. Any action
shipments to ensure the shipments are made on
to establish a contingency cryptonet must be
a timely basis.
coordinated with CSLA and the NSA (Y13).
3.8.4
(U) Transfer Reports for COMSEC
3.7.8
(U) Disposition Instructions for
Key. The Transfer Report (SF 153), which
Keying Material. The CONAUTH is
accompanies a key shipment from USNDA, will
responsible for issuing disposition instructions to
contain the requisition number for each line item
all of their key holders regardless if the
of COMSEC key shipped.
instructions were received from CSLA Key
3.8.5
(U) Excess and Unserviceable
Management or were originated by the
COMSEC Key. Excess and unserviceable
CONAUTH.
COMSEC key will be reported by memorandum
or electronic message to CSLA. Reported
3.8 COMSEC KEY.
excess and unserviceable COMSEC key will
include short title, edition, and quantity of
3.8.1
(U) Authorization to Receive COMSEC
excess.
Key. Authorization to receive COMSEC key or
publications is based on the operational and
3.8.6
(U) Resupply Procedures for
support requirements of each requesting unit or
COMSEC Key.
activity. The CONAUTH is the approving
authority for establishing the cryptonet and for
a.
(U) Regularly Superseded Key.
requisitioning physical key to support the
Regularly superseded key is automatically
cryptonet when electronic key is not feasible.
resupplied based on the supersession rate and
distribution schedule established by the
With the implementation of AKMS/EKMS,
electronically generated keying material (ALC-7)
CONAUTH. Regularly superseded stock will be
will, for the most part, replace physical key.
shipped to the CLSF from production on a
Controlling authorities will delegate key
regular basis.
generation to its servicing AKMS COMSEC
accounts. CSLA coordinates requests for key,
b.
(U) Irregularly Superseded Key.
Irregularly superseded key is resupplied at the
as necessary, to validate the COMSEC account
data and production requirements.
request of the CONAUTH.
3.8.2
(U) Establishing Cryptonets and
c.
(U) Resupply of Key. Requests for
Initial Issue of COMSEC Key Material.
resupply of key may be via electronic message
Procedures used by units and activities (other
or memorandum form, depending on the time
than CLSF) for the establishment of cryptonets
element involved. Submit requisitions, as
and the initial issue of COMSEC keying material
appropriate, to CSLA with an information copy to
are presented in paragraph 3.6. The CLSF is
the NSA, ATTN: COMSEC Account 880099.
also responsible for direct initial issue of material
See Appendix F for POCs and the complete
for cryptonets that are totally within the Army and
mailing address.
wholly within the CLSF area of responsibility.
CSLA, the NSA, and the supporting CLSF will be
3-18
FOR OFFICIAL USE ONLY
TB 380-41
d.
(U) Requisitions for Training and Test
b.
(U) Standard Resupply and
Material. Requisitions for training and test
Redistribution Request Format. For standard
material will be submitted to CSLA by
formats refer to figures 3-2, 3-3, and 3-4.
memorandum or message.
c.
(U) Availability. Requests should be
3.8.7
(U) Processing Requests. When
sent at the earliest possible date to ensure that
available, initial editions will be issued from
follow-on editions are available when needed.
general-purpose reserve stocks in the CLSF.
CSLA will initiate action to fill all other requests.
3.8.8
(U) Classification. All correspondence
pertaining to specific command requirements for
a.
(U) Routine Resupply and
classified operational key will be classified, as a
Redistribution of Keying Material. All
minimum, CONFIDENTIAL.
requests for resupply or redistribution of keying
material will be submitted by the CONAUTH.
3-19
FOR OFFICIAL USE ONLY
TB 380-41
***CONFIDENTIAL***
01
01
081241Z FEB
03 RR RR CCCC
AA ZYUW
TTC-1
NO
CDR102NDMIBN FT RILEY KS //5C5598//
DIRCSLA FT HUACHUCA AZ//SELCL-ID-KEY//
INFO DIRNSA FT MEADE MD //Y13//
SUPPORTING CLSF
C O N F I D E N T I A L
SUBJECT: USKAK 2121 (U)
A.
(U) TB 380-41 PROCEDURES FOR SAFEGUARDING, ACCOUNTING, AND SUPPLY
CONTROL OF COMSEC MATERIAL.
1.
(C) EDITION ALFA OF USKAK 2121 WILL BE IMPLEMENTED ON 1 JUL 03, WITH
NORMAL SUPERSESSION THEREAFTER. REQUEST RESUPPLY IAW ESTABLISHED
SUPERSESSION RATE.
2.
(U) POC 2LT HEWITT, CONAUTH, DSN 237-1918
DECLAS OADR
P. MICHAUD
DERIVED FROM: TB 380-41
COMSEC CUSTODIAN, 5932
DECLASSIFY ON: SOURCE MARKED OADR
DATE OF SOURCE: JUN 03
DON OWEN, MAJ, CDR
***CONFIDENTIAL***
081241ZFEB03
This is an example of a message request for resupply of key. Contents will vary according to local
requirements. The supporting CLSF will also be an INFO ADDRESSEE.
Classified for example purposes only.
Figure 3-2. Request for Resupply of Key
3-20
FOR OFFICIAL USE ONLY
TB 380-41
***CONFIDENTIAL***
01
01
081241Z APR
03 RR RR CCCC
AA ZYUW
TTC-1
NO
CDR102NDMIBN FT RILEY KS //5C5598//
DIRCSLA FT HUACHUCA AZ//SELCL-ID-KEY//
INFO DIRNSA FT MEADE MD //Y13//
SUPPORTING CLSF
C O N F I D E N T I A L
SUBJECT: USKAK 1813 (U)
A.
(U) TB 380-41 PROCEDURES FOR SAFEGUARDING, ACCOUNTING, AND SUPPLY
CONTROL OF COMSEC MATERIAL.
1.
(C) DUE TO IMPLEMENTATION OF EDITION XRAY OF USKAK 1813 ON 1 FEB 94
REQUEST RESUPPLY OF ONE EDITION. USKAK 1813, EDITIONS YANKEE AND ZULU
REMAIN IN CONTINGENCY STATUS.
2.
(U) POC 2LT HEWITT, CONAUTH, DSN 237-1918
DECLAS OADR
P. MICHAUD
DERIVED FROM: TB 380-41
COMSEC CUSTODIAN, 5932
DECLASSIFY ON: SOURCE MARKED OADR
DATE OF SOURCE: JUN 03
DON OWEN, MAJ, CDR
***CONFIDENTIAL***
081241ZAPR03
This is an example of a message request for resupply of key when key usage changes. Contents will
vary according to local requirements. The supporting CLSF will also be an INFO ADDRESSEE.
Classi fied for example purposes only.
Figure 3-3. Request for Resupply of Key when Key Usage Changes
3-21
FOR OFFICIAL USE ONLY