Military reference books and manuals (2009-2023, Volume 6)

TB 380-41

CHAPTER 5

SAFEGUARDING COMSEC MATERIAL

information for other than official purposes. Any

5.1 GENERAL.

requests for public or nonofficial display or

publication of COMSEC information, including

(U) This chapter provides minimum standards

Freedom of Information Act (FOIA) Requests,

for the protection and physical control of

will be referred to HQDA (DAMI-CD).

COMSEC material. To effectively safeguard

and establish security for COMSEC material, it

5.2.3

(U) FOR OFFICIAL USE ONLY (FOUO)

is vital that each COMSEC Custodian and

Application. The protective marking FOUO will

assigned alternate custodian becomes familiar

be applied to unclassified COMSEC information

with and thoroughly understands the

when the originator determines that it should not

procedures, responsibilities and communications

be publicly released. The marking will be based

channels presented in this chapter.

on the FOIA policies contained in IAW AR

25-55. As a minimum, the FOUO marking

should be applied to the following types of

5.2 CLASSIFICATION

information, if unclassified:

GUIDELINES FOR COMSEC

(U) Lists of COMSEC short/long titles.

INFORMATION.

(U) Narrative information on

(U) The following guidelines provide limited

characteristics of COMSEC equipment.

instructions on classifying COMSEC information.

Additional guidance on classifying information

(U) Indications of new COMSEC

pertaining to COMSEC equipment is contained

developments.

in AR 380-40.

(U) COMSEC planning, programming,

5.2.1

(U) Foreign Release. COMSEC

and budgeting information.

information in any form is not releasable to

foreign nationals unless specifically authorized.

(U) Specifications and purchase

Requests for release will be forwarded to HQDA

descriptions pertaining to COMSEC equipment or

DCS, G-2 (ATTN: DAMI-CD) per AR 380-40.

the support of unique COMSEC requirements.

5.2.2

(U) Handling and Release of

(U) Operating instructions, maintenance

Unclassified COMSEC Information. As a

manuals, and publications related to auxiliary

general rule, all unclassified COMSEC

equipment developed exclusively for use with

information is intended FOR OFFICIAL USE ONLY

COMSEC equipment.

and should be withheld from public disclosure

based on exemptions authorized under the

(U) COMSEC material reports (SF 153).

Freedom of Information Act (FOIA). The open

or public display of U.S. Government or foreign

(U) Official photographs or line drawings

COMSEC material and information at

of classified COMSEC equipment.

commercial or other public meetings, open

houses, or for other nonofficial purposes is

(U) Information of substance that relates

forbidden unless specifically authorized by other

to the application of cryptographic transmission

HQDA Directives (see DA Pamphlet 25-380-2

or emission security measures to COMSEC

for CCI). This prohibition includes discussion,

information.

publication, or presentation of COMSEC

5-1

FOR OFFICIAL USE ONLY

TB 380-41

5.2.4

(U) Compilations. Compilation of

(U) All physical key marked “CRYPTO”

unclassified COMSEC information may warrant

must be produced by the NSA and obtained

classification (see AR 380-40, Appendix B).

through COMSEC logistics channels.

5.2.5

(U) Use of Caveat "CRYPTO." The

(U) The marking “CRYPTO” imposes no

caveat "CRYPTO" is always capitalized and is

additional investigative or access requirements

defined as "The marking or designator

on U.S. personnel. A security clearance is not

identifying all COMSEC key used to protect or

required for access to key marked “CRYPTO” if

authenticate telecommunications carrying

it does not bear a classification marking.

classified national security information and

sensitive, unclassified Government or

(U) Unclassified key marked “CRYPTO”

Government-derived information, the loss of

will be stored in the most secure manner

which could adversely affect national security

available to the user. As a minimum, it will be

interests." The purpose of this marking is to

stored in a manner that is sufficient to preclude

identify only that key which must be handled and

any reasonable chance of theft or access by

controlled under the special access, storage,

unauthorized persons. It should be double-

distribution, accounting, and destruction

wrapped for shipment. It should be transmitted

requirement of the CMCS as set forth in this TB.

via the same means as classified key or, as a

The following apply:

minimum, via U.S. Registered Mail. Upon

receipt, packages should be examined and

(U) Key will be marked “CRYPTO” when

processed from a physical security standpoint in

its purpose is to authenticate a communication

the same manner as classified key.

or provide protection against Signals Intelligence

(SIGINT) exploitation and the communication

5.2.6

(U) Marking of COMSEC Equipment.

will be passed by radio, microwave, cable (other

COMSEC equipment and components in the

than a protected distribution system), or other

U.S. inventory will carry markings as follows:

potentially exploitable means. Key, which does

not meet these criteria, will not be marked

(U) COMSEC Equipment and

“CRYPTO.”

Assemblies. All COMSEC equipment and

assemblies (including telecommunications

(U) Most hard copy key produced by the

equipment with integral cryptography) will be

NSA will be marked “CRYPTO.” The principal

marked with a short title, the term

exceptions will be key intended for

"GOVERNMENT PROPERTY," and the

demonstration purposes, sample key for use in

accounting number (serial number).

or outside the classroom, and maintenance key

used exclusively for bench testing purposes. All

(U) Element Boards. Printed circuit

other classes of key are intended to protect or

element boards used in COMSEC equipment or

authenticate and will be marked “CRYPTO.”

performing COMSEC functions in other

equipment will be marked with a short title and

(U) The marking “CRYPTO” may be

accounting number (serial number).

used on both classified and unclassified key

(hard copy or software); it will not be used on

(U) Other Items. Those separate items,

equipment, manuals or other COMSEC material.

which perform a COMSEC function as

All AKMS-generated electronic key will be

determined by the NSA, will be marked with a

understood to carry the “CRYPTO” designation

short title.

and be protected accordingly.

(U) Equipment and Assembly Short

(U) Key used to protect classified

Titles. With regard to the short titles mentioned

communications will be marked with the

in the preceding paragraphs:

appropriate classification. Key used to protect

unclassified national security-related

(1)

(U) Radio sets and other

telecommunications will not be classified unless

communications equipment with an

the format or composition of the key is, in itself,

integral COMSEC capability may, with

classified.

the approval of the NSA, be

nomenclatured in the Joint Electronic

5-2

FOR OFFICIAL USE ONLY

TB 380-41

Type Designation System (JETDS),

information must be protected to prevent hostile

MIL-STD -196D.

activities from building a database to exploit our

systems, equipment, and material. Unless a

(2)

(U) Short titles for COMSEC items will

particular item of COMSEC information will

be assigned by the NSA.

become declassified at a particular time or

following a specified event, the item

(U) Classified Items. In addition, those

classification will be derived from the source

items determined as classified by the NSA will

document and the information shall be marked

bear an appropriate classification marking.

IAW DoD 5200.1-PH:

COMSEC equipment with hardwired operational

keying variables installed will be marked

Derived From:

"CRYPTO."

Declassify On:

Date of Source:

(U) Unclassified items designated

CCI. Unclassified CCI items will contain a CCI

(U) In those instances where documents are

label (see paragraph 5.2.7).

prepared from multiple sources, the

declassification date or event that provides the

(U) Previous Markings. Equipment

longest period of classification shall be used and

marked under previous guidance need not be

entered in the “Declassify On” statement.

re-marked except as directed by the NSA.

5.3 PHYSICAL SECURITY

5.2.7

(U) Controlled Cryptographic Items

(CCI).

MEASURES.

(U) CCI equipment is unclassified

(U) COMSEC material plays a vital role

controlled end items or assemblies that perform

in the protection of national security

a critical COMSEC or COMSEC ancillary

communications. This chapter describes

function. Although CCI equipment is

minimum physical security measures designed

unclassified, it requires access controls and

to safeguard the integrity of COMSEC material

physical protection against actions that could

and the facilities in which COMSEC material is

affect its continued integrity. Physical protection

operated or stored. Access is defined as the

controls applied to CCI are detailed in DA PAM

capability and opportunity to obtain knowledge

25-380-2.

of or to alter information on material.

(U) The marking "CONTROLLED

(U) The broad dispersal of COMSEC

CRYPTOGRAPHIC ITEM" or "CCI" will be used

material and its positioning in a large variety of

to identify those items of COMSEC hardware

environments have created the need for

and microcircuits to the end item and assembly

increased emphasis on physical security

level when they are designated Controlled

procedures. Individual commanders are

Cryptographic Items by the NSA.

responsible for ensuring that access to classified

COMSEC material within their commands or

(U) As a minimum, un-keyed CCI will be

organizations is properly controlled and that the

safeguarded as sensitive, valuable property. No

material is stored, accounted for, transmitted,

security clearance is required for access to un-

and destroyed IAW AR 380-40 and this TB.

keyed CCI, but access will be limited per DA

Pam 25-380-2 on a need-to-know basis.

(U) The procedures for safeguarding

Sensitive Item management and controls, as

COMSEC Material and facilities are designed to

prescribed in AR 710-2, will be applied to CCI.

ensure the integrity of COMSEC material

against the following threats:

5.2.8

(U) COMSEC Classification Guidance.

(U) See AR 380-40.

(1)

(U) Loss, theft, sabotage, unauthorized

access to, or observation of COMSEC

5.2.9

(U) Classification Duration.

material.

Cryptographic systems protect the most highly

classified communications of the U.S.

(2)

(U) Tampering with, or TEMPEST

Government and its allies. COMSEC

exploitation of, COMSEC material.

5-3

FOR OFFICIAL USE ONLY

TB 380-41

(3)

(U) Clandestine exploitation of sensitive

(U) Visitors’ Register. DA Form 1999-E,

communications within a secure

Restricted Area Visitor Register, will be used to

telecommunications facility.

record the arrival and departure of any person

not on the access roster. The commander may

(U) Users should also refer to local

waive this requirement when the COMSEC

operating instructions for security procedures

Facility is merely a classified container (e.g.,

pertaining to specific systems, and to AR 380-40

Mosler safe) within a common use office area. It

for policy related to the security of COMSEC

is also at the discretion of the commander

material. Security procedures for CCI are

whether or not a visitor is/is not required to fill in

contained in DA Pam 25-380-2.

the SSN block of the DA Form 1999-E. The SSN,

which is sensitive in nature and should not be

openly displayed for public view, is already listed

5.4 ACCESS TO AND

on the security clearance information form

provided to the security manager of the

IDENTIFICATION OF A

restricted area prior to the visit.

(See Appendix

COMSEC FACILITY.

D for reproducible forms.)

(U) Privacy Act Statement. Within

(U) A COMSEC Facility is defined as a secure

space, area, room, structure or series of

COMSEC Facilities that the commander has

structures approved by a competent authority for

determined the SSN will be used (i.e., an

the primary purpose of generating, operating,

individual entering both his/her SSN and

storing, repairing or training personnel in the use

signature on the DA Form 1999-E), the following

Privacy Act Statement, which appears at the

or maintenance of classified COMSEC material.

bottom of DA Form 1999-E, must be conspicuous

In those instances when, due to operational

necessity, a larger facility is not required, a

to the signer’s view:

“Authority: 10 USC

COMSEC Facility may consist of nothing more

3012/EO. The SSN is used only for

than a GSA-approved security container or

identification. Access to this COMSEC Facility

multiple containers in a common administrative

may be denied without SSN.”

office area: provided adequate safeguards are

(U) Equipment Screening. Except for

present to inhibit unsupervised access by

unauthorized individuals.

closed crypto-equipment, all classified COMSEC

material will be screened from view by visitors.

(U) Access. Access to COMSEC

Facilities may be granted by the commander (or

(U) Visitor Surveillance. All visitors will

be kept under constant surveillance and will not

his/her designated representative) to personnel

be permitted access to classified COMSEC

whose duties require such access (need-to-

know). These personnel must possess security

information.

clearances equal to the classification level of the

COMSEC material (as well as the national

(U) Maintenance Personnel Access.

security information) to which they will have

Maintenance personnel will only be allowed

access to classified COMSEC equipment and

access. Commanders are authorized to employ

information for which they have appropriate

local systems (e.g., clearance status rosters) for

verifying individual clearances. Access is

clearance. If maintenance personnel do not

defined as the capability and opportunity to

have the appropriate clearance, they MUST be

obtain knowledge of or to alter information or

kept under constant surveillance to prevent their

material.

unauthorized access to classified equipment.

(U) Identification of Facility.

(U) Visitors. Persons whose duties do

not require access, or those who are not

properly cleared, will be permitted entry only

(1) (U) In accordance with AR 190-13,

upon approval from the commander or his/her

Chapter 6, COMSEC Facilities SHALL

designated representative.

be designated by the Installation/Activity

Commander (or civilian equivalent), in

writing, as a RESTRICTED AREA. A

prominent sign placed conspicuously

(bilingual where appropriate), and the

5-4

FOR OFFICIAL USE ONLY

TB 380-41

Warning Notice contained in paragraph

guidance see your Certified TEMPEST

6-4, AR 190-11 will be posted to identify

Technical Authority (CTTA).

the restricted area. No other phrase will

be used. Commanders outside the U.S.,

5.5.2

(U) Secure Room Operations. When

its possessions, and its territories will

fixed plant COMSEC Facilities employ several

establish such restricted areas for

types of COMSEC equipment and handle a

COMSEC Facilities consistent with local

large volume of classified traffic, the facility will

security conditions, risk assessments,

be located in a SECURE ROOM or

and Host-Country Agreements, as

CONTROLLED AREA as specified in the

applicable.

following paragraphs:

(U) General Office Use. When the

(2) (U) When conditions warrant, the

COMSEC Facility area is also used for general

designation of a COMSEC Facility as a

office purposes, it is the responsibility of the

Restricted Area may be waived, at the

commander to enforce compliance with access

commander's discretion. For example,

requirements as described in AR 380-40. CCI

when a COMSEC Facility is merely a

equipment keyed with unclassified “CRYPTO”

safe or series of classified containers

key used for passing Sensitive But Unclassified

within a common use office area or

(SBU) information will be provided double barrier

building, the designation of that limited

protection.

space occupied by the classified

container(s) as a "Restricted Area" may

(U) Secure Storage Area. If a

not be appropriate.

COMSEC Facility is used for secure storage of

classified material, facility construction

(3) (U) To enhance security, the physical

standards apply as directed by AR 380-40.

location of a COMSEC Facility will not

be advertised or made conspicuous by

5.5.3

(U) General Area Operations.

the posting of external signs, except as

noted above for the placement of a

(U) When fixed COMSEC Facilities do not have

"Restricted Area" sign. However, within

the requirements for a signal center, they may

a secure or restricted area that is not

be located in a controlled, general area.

accessible to the general public, there

are no restrictions as to the placement of

5.5.4

(U) Devices (other than COMSEC

"internal signs" giving directions to a

Equipment) Used Within a COMSEC Facility.

COMSEC Facility or identifying a room

Communication devices, such as telephones,

or office as the COMSEC Facility for the

interoffice communication systems and other

benefit of customers and other official

transmitting devices, must meet the provisions

visitors to the COMSEC Facility.

of AR 381-14 (C) when installed in an

operational COMSEC Facility. This restriction

5.5 PROTECTION OF FIXED

does not apply to a COMSEC Facility used

solely for storage of COMSEC information. For

COMSEC FACILITIES.

all other items, see AR 380-40.

5.5.5

(U) Electronic Access Control

(U) Fixed COMSEC Facilities are vulnerable to

Devices. Electronic access control devices

both overt and covert security violations.

(e.g., cipher locks, keyless push buttons) do not

Standards for securing and protecting fixed

afford the required protection against

COMSEC Facilities are presented in this

unauthorized admittance and, therefore, will not

paragraph and are the minimum-security

be substituted for the required built-in, three-

measures that must be employed.

position combination lock.

5.5.1

(U) Installation of On-Line Crypto-

(U) Electronic access control devices

Equipment. To prevent foreign intelligence

will be properly installed to prevent tampering.

exploration of compromising emanations, the

Electronic access control devices using electro-

installation of on-line crypto-equipment and

mechanical locks may be used in addition to the

supporting communications equipment in

built-in, three-position combination lock. In this

COMSEC Facilities will be directed by

case, the electronic access control devices will

NSTISSAM TEMPEST/2-95. For additional

5-5

FOR OFFICIAL USE ONLY

TB 380-41

be used only for the admittance of known

Security Check IS required unless an Intrusion

authorized personnel into occupied or otherwise

Detection System is operating.

guarded COMSEC Facility areas.

(U) 24-Hour Operations. In a

(U) Operation of electronic access

COMSEC Facility that operates continuously

control devices will meet the following criteria:

(24-hours -a-day), an area check will be

completed at the end of each shift and the SF

(U) The code sequence will be screened

702 properly annotated IAW AR 380-5.

or masked to prevent unauthorized viewing

during door-opening procedures.

5.6.2

(U) Area Security.

(U) Non-continuous Operations.

(U) A positive means will be provided to

COMSEC Facilities, which do not operate

ensure identification of all persons prior to their

continuously, require a security check be made

admittance.

at the end of each workday to establish that the

facility is secure and that all classified COMSEC

(U) Authorized personnel will change

information is properly stored and safeguarded.

code combinations annually, upon duty

termination of any individual who knows or has

(U) Area Checklist. Area checklist

access to the code combination, and at any time

forms will be designed and produced by the

the code becomes compromised. An SF 700

local commander (an SF 701 may be used).

will be used to record combination change

The area checklist will provide for and require

information and will be posted to the inside of

the signature or initial of the individual

the door.

performing the check. The area checklist will

verify that:

(U) Push buttons will be kept dust free to

prevent reconstruction of the code.

(1)

(U) Security containers are locked and

double-checked.

5.6 SECURITY CHECKS.

(2)

(U) Classified trash is properly stored.

(U) Security checks will be made by COMSEC

Facility personnel or by other specifically

(3)

(U) Windows are locked.

designated personnel.

(4)

(U) Alarms are activated and working

5.6.1

(U) Types of Security Checks.

properly.

(U) End of Workday Security Check.

(5)

(U) Other security measures are in

As directed by AR 380-5, at the end of each

effect IAW local SOP.

workday, Security Container Check Sheet (SF

702) will be used to verify that each security

container, cabinet, secure room, or vault

5.7 PROTECTION OF

containing classified material is secure. When

MOBILE AND

another individual is not present to check the

locks for security, the person who locked the

TRANSPORTABLE COMSEC

container, cabinet, room or vault must also

perform the second security check and complete

FACILITIES.

the "checked by" section of the SF 702. Such

checks must be performed as a separately

(U) The requirements for safeguarding mobile or

distinct action after the locking process to satisfy

fixed COMSEC Facilities are basically the same.

the requirements of AR 380-5.

Mobile facilities require that security measures

be adapted to the particular environment of the

(U) Non-Workday Security Check.

operation. Un-keyed COMSEC equipment,

Non-workday Security Checks are not required

which is installed in ground/air/water vehicles,

unless the facility is opened during weekends,

should not be removed for storage provided they

holidays, or after hours. If the facility is a TS

are protected to a degree which, in the judgment

facility located in OCONUS, a non-workday

of the commander or responsible authority, is

5-6

FOR OFFICIAL USE ONLY

TB 380-41

sufficient to preclude any reasonable chance of

(U) Determination of Access.

theft, sabotage, tampering or access by

unauthorized persons.

(1)

(U) The commander will determine

whether guard personnel (including

5.7.1

(U) Protection. During CRYPTO-

foreign nationals) guarding flight lines,

operations, guards will protect all transportable

aircraft, motor pools, or vehicles are

and mobile COMSEC Facilities. Operating

providing area control or will also have

personnel satisfy the requirement for guards

access to the COMSEC equipment

when the facility layout and operator duties

installed therein. Foreign nationals will

make it feasible for operators to provide

not have unescorted access to

adequate control.

COMSEC equipment. If, in the

judgment of the commander, supporting

5.7.2

(U) Minimum Mobile COMSEC Facility

supplementary measures (e.g., locked

Protection. As a minimum, protection for

aircraft and vehicles, fences) provide

mobile COMSEC Facilities will be provided by

adequate protection to prevent any

one of the following methods:

reasonable possibility of access to the

COMSEC equipment by the guards, the

(U) Full-Time Guards. Full-time guards

guards will be considered to be

will be stationed within sight of the COMSEC

providing AREA CONTROL.

Facility if there is no supplemental protection, or

if there is a possibility of unauthorized removal

(2)

(U) Guards who are not given access to

of the vehicle.

COMSEC material, and who are used to

supplement existing physical security

(U) Patrol or Guard Post. A patrol or a

measures, need not meet access

guard post may be used providing it is

requirements. If a facility is located in

supplemented by an alarm system having a

U.S. or Allied territory, a roving guard

response time of five minutes or less. This

who makes rounds at least every four

security system must be implemented so that

hours is sufficient as long as the

there is no possibility of unauthorized removal of

COMSEC material is appropriately

the vehicle.

secured. In Allied countries, guards

employed by the host country may be

(U) Guards Stationed at Entrances to

used for area control.

a Fenced Area. Guards can be stationed at all

entrances to a fenced, restricted area (such as a

(3)

(U) If a facility is located in non-U.S.,

protected, fenced motor pool). In this case,

non-Allied territory, U.S. guards must be

access must be restricted to properly cleared

used and they must be situated at all

and authorized individuals.

times in the immediate area of the

facility, preferably within the facility.

5.8 USE OF GUARDS.

(U) The Use of Un-cleared Guards.

Normally, properly cleared guards will be used

(U) Clearance Requirements. Guards

to secure a COMSEC Facility. However, the

who have ACCESS to classified COMSEC

clearance of guards protecting closed vehicles

material must be properly cleared to the highest

or shelters, which serve as COMSEC Facilities,

level of material held. ACCESS is defined as

may be waived provided:

the capability and opportunity to obtain

knowledge of or to alter information or material.

(1)

(U) The COMSEC Facility enclosure is

Guards with area control duties only (e.g., motor

constructed to positively prevent

pools, buildings) need not be cleared when they

undetected access.

are used to support other security measures and

will not normally have access to classified

(2)

(U) The main entrance to the COMSEC

information.

Facility is secured by a Group 1R

combination-locking device. When this

is not possible, the main entrance will be

secured with an approved high security

padlock.

5-7

FOR OFFICIAL USE ONLY

TB 380-41

(3)

(U) The facility entrance is constructed

force must be adequate and able to respond to

or arranged to prevent viewing of

an alarm within 15 minutes to minimize the

COMSEC material when the door is

possibility of enemy capture or temporary

open.

occupation of the site. The commander

responsible for operation of the unattended site

(4)

(U) All entrances other than the main

will need to arrange for an immediate guard

entrance to the COMSEC Facility are

force to respond in emergencies, and the

bolted with panic hardware (emergency

appointment of an AR 15-6 board (when

mechanisms that open only from the

appropriate) who is responsible for investigating

inside).

incidents involving threats to the COMSEC

equipment on the site. Commanders must

(5)

(U) Door hinges are installed in a

comply with the requirements of AR 380-5, AR

manner to positively prevent unhinging

190-16, DA Pamphlet 25-380-2, and paragraph

of the door from the outside.

5.10 of this TB.

(6)

(U) All windows within the facility are

(U) Unattended Cryptonets.

barred and securely fastened from the

Cryptonets whose key is held in COMSEC

inside. Windows will also be screened

equipment located at unattended sites will be

to prevent unauthorized viewing from

kept as small as possible. Unique key will be

the outside.

used on each link terminated at an unattended

site.

5.9 EMPLOYMENT OF

(U) Unattended Key Storage. Key

other than that electronically or physically held in

COMSEC EQUIPMENT AT

the COMSEC equipment will not be stored at

UNATTENDED SITES.

an unattended site.

(U) Special situations may require that certain

(U) Site Inspections. Unattended sites

will be periodically inspected at random intervals

COMSEC equipment be located at unattended

(as determined by the commander) to verify that

sites. This practice may be authorized, but will

be subject to the following safeguards:

no one has tampered with the COMSEC

equipment. Site inspections will be performed at

(U) Unattended COMSEC Equipment

a minimum of once a month.

Storage. As a general rule, uninstalled,

classified COMSEC equipment and COMSEC

5.10 STORAGE OF COMSEC

maintenance manuals are not authorized to be

stored at unattended sites. However, when

MATERIAL.

mission priorities dictate, one on-line spare may

be installed at the commander’s discretion to

(U) Storage means the use of security

provide redundancy for operational circuits,

containers, vaults, alarms, guards, and so forth,

provided special security measures as

to protect COMSEC material or information

prescribed in paragraph 5.10.3c are employed.

when it is not under the direct and continuous

In addition, COMSEC equipment loaded with

control of properly cleared and authorized

classified key must be secured in an GSA-

personnel. In contrast, when classified

approved security container or equipped with

COMSEC material is in use by, in the physical

locking bars secured by an approved, high

possession of, or continuously attended by

security, combination padlock (NSN 5340-00-

properly cleared personnel, its protection is

285-6523) meeting Federal Specification FF-C-

presumed. For guidance on PCM, refer to

110. CCI equipment keyed with unclassified

CJCSI 3260.01.

“CRYPTO” key used for passing SBU

information will be provided double barrier

5.10.1

(U) Storage of Classified “CRYPTO"

protection.

Key. Classified key marked “CRYPTO” will be

stored by one of the following methods in

(U) U.S. Unattended Site. Adequate

accordance with its classification:

U.S. or Allied military forces must be located in

the vicinity of any unattended site. This reaction

5-8

FOR OFFICIAL USE ONLY

TB 380-41

(U) TOP SECRET. TOP SECRET key

manner that will provide security against the

will be stored in a dual safe (safe stored inside a

possibility of theft or access by unauthorized

safe) with each compartment having a different,

persons.

approved, combination lock IAW AR 380-40; or

a GSA-approved safe with an electro-

5.10.3 Storage Restrictions.

mechanical, dual digit (two combination) lock

(U) Mobile Storage. In mobile or

meeting Federal Specification FF-CC-2740

transportable facilities wherein normal storage

(X07/X08). Two SF 700s, prepared and stored

means are not practical, only limited amounts of

separately, are needed to record the two

essential keying material may be stored. The

combinations required for a TS storage

following procedures apply:

container to ensure TPI for TS material is

established and maintained. See AR 380-40,

(1)

(U) The applicable requirements of

paragraph 2-18d for further information.

paragraph 5.7apply.

(1)

(U) Store in any GSA-approved safe-

(2)

(U) Security containers must be

type container that has not been altered

securely affixed to the facility.

through unauthorized modification.

(3)

(U) COMSEC holdings will be limited to

(2)

(U) Store in a vault constructed as

those that are operationally essential to

directed in AR 380-40.

perform the mission. No more than a

single edition of keying material will be

(3)

(U) Alarmed Area. The TS storage area

held.

will be securely constructed and have

substantial barriers to prevent

(4)

(U) Unattended facilities, which contain

unauthorized or forced entry. Barriers

keying material or keyed COMSEC

will be constructed so that forced entry

equipment, will be guarded by

will leave evidence of such entry and

appropriately cleared U.S. personnel.

trigger an alarm or alert a guard.

Commanders will comply with the

contents of AR 190-16 and paragraph

(U) SECRET.

5.9 of this TB.

(1)

(U) Store SECRET key by any one of

(U) Storage Containers.

the methods designated for TOP

SECRET key.

(1)

(U) Older Security Containers. Security

containers that were previously

(2)

(U) Store in a GSA-approved storage

approved, but do not meet current

container, which has a built-in, three-

standards, may continue to be used

position, dial-type combination lock.

(with written CSLA approval) until

approved containers can be obtained

(U) CONFIDENTIAL.

through normal supply channels.

(1)

(U) Store CONFIDENTIAL key by any of

(2)

(U) Repair of Damaged Security

the methods designated for TOP

Containers. In the event of restoration

SECRET or SECRET key identified in

or repair, the security integrity of

the preceding paragraphs.

containers must be restored IAW the

standards specified in AR 380-5.

(2)

(U) Store in a steel file cabinet. The file

Containers that have been repaired or

cabinet will have a built-in, changeable,

restored to meet original security

three-position combination lock.

specifications may be used to secure

5.10.2

(U) Storage of Unclassified "CRYPTO"

classified COMSEC information (except

Key. Unclassified CRYPTO key will be stored

for TOP SECRET COMSEC keying

using the same methods used for classified key,

material and information).

if practical, or in the most secure method

available to the user. As a minimum,

(3)

(U) Non-approved Containers. Non-

unclassified CRYPTO key will be stored in a

approved security containers will be

5-9

FOR OFFICIAL USE ONLY

TB 380-41

protected by continuous guard or by an

potential to criminal and subversive

alarm system. When using an alarm

elements. However, under emergency

system, frequent irregular security

or tactical contingency conditions, when

checks will be made of the area.

other secure storage facilities are not

reasonably available, commanders may

(U) Supplementary Control Methods.

authorize short-term storage (not to

During storage, vaults, alarmed areas and

exceed 30 days) of CCI in a

security containers that contain classified

consolidated secure storage facility.

CRYPTO key must not be accessible to

Long term storage of CCI under these

unauthorized personnel.

conditions must be supported by a

formal risk assessment per AR 190-51,

(1)

(U) To prevent accessibility,

and the authorization provided, in

supplementary control methods will be

writing, to the Accountable Officer by a

used. For ex ample:

commander of grade 05 or above in the

chain-of-command. See DA PAM 25-

Locked rooms.

380-2 for further information on storage

Locked and guarded buildings.

of CCI.

Alarms.

(3)

(U) CCI, common fill devices and

(2)

(U) For each security situation,

uninstalled COMSEC equipment will not

commanders must determine what

be stored keyed except when

supplementary controls are necessary

specifically authorized in the system

to prevent unauthorized access to the

operating instructions or by other

storage device. Normally, guards or

competent authority.

security forces used under these

conditions need not be cleared. Refer

(U) Operational Configurations.

to paragraph 5.8.a for further

information.

(1)

(U) When un-keyed classified COMSEC

equipment is installed in an operational

5.10.4

(U) Storage of COMSEC Equipment

configuration in a ship, aircraft, vehicle,

and Components.

building, etc., it may be left unattended

provided it is otherwise protected to a

(U) Non-Operational Configurations.

degree which, in the judgment of the

When classified COMSEC equipment or

commander, is sufficient to prevent the

components are not installed in an operational

likelihood of theft, sabotage, tampering

configuration, such items will be stored in the

or access by unauthorized persons.

same manner prescribed for material of the

Installed COMSEC equipment will not

same classification as directed by AR 380-40.

be removed from vehicles for the sole

purpose of providing security storage.

(1)

(U) Unclassified equipment and

Frequent removal of COMSEC

components other than CCI will be

equipment and subsequent reinstallation

stored by a suitable method which will

can cause equipment failure and

prevent any reasonable possibility of

downgrade operational readiness.

theft, sabotage, tampering, or access by

When the installed COMSEC equipment

unauthorized persons.

is keyed, provisions of AR 380-40 and

AR 380-5 apply.

(2)

(U) CCI (keyed or un-keyed) shall not be

stored in vaults, security containers, or

(2)

(U) Normally, the same protection

arms storage facilities containing items

provided for vehicles, or high value and

of monetary value (e.g., cash, jewelry,

government property, is adequate for

precious metals, etc), weapons,

the protection of un-keyed unclassified

ammunition, or other sensitive items.

COMSEC equipment installed in

Commanders must recognize that each

vehicles and facilities. The responsible

additional item of value stored in a

commander will consider the sensitivity,

single security storage facility increases

value of the equipment, and other

the risk of loss by intensifying the target

factors (such as environment) when

5-10

FOR OFFICIAL USE ONLY

TB 380-41

determining acceptable security

inside clear dimensions are H 48 1/2" x

requirements and methods for

W 19 1/4" x D 31 5/8".

protecting un-keyed, unclassified

COMSEC equipment.

(2)

(U) Mosler Model 30-39 Special Class 5

Single Door Security Cabinet. This

(3)

(U) A tactical vehicle parked in a public

cabinet is designed for closed-door

location is not adequately protected

operation. It contains fans and secured

unless physically attended or under the

vents. Holes for power conduit

visual control of a responsible person.

mounting are not provided. The user

Such basic protection measures are

may select the conduit mounting

even more essential when a vehicle is

location (top, back, or side) and have

equipped with a radio and COMSEC

mounting holes predrilled at the factory

equipment is installed in the vehicle. In

or may drill the holes after receiving the

addition to the protection provided to

cabinet. The inside clear dimensions

COMSEC equipment when un-keyed,

are H 25 3/4" x W 19 1/8 x D 34".

enhanced protection must be provided

to keyed equipment to prevent its

(3)

(U) Mosler Model 30-31 Special Class 5

unauthorized use or the unauthorized

Single Door Security Cabinet. This

extraction of its key.

cabinet is designed for closed-door

operation. It contains fans and secured

(U) Special Cabinets for COMSEC

vents. Holes for power conduit

Equipment. The NSA has approved the use of

mounting are not provided. The user

special cabinets for COMSEC equipment in

may select the conduit mounting

operational configurations. These cabinets do

location (top, back, or side) and have

not have NSNs and are not manufactured under

mounting holes predrilled at the factory

a GSA contract. They are available from their

or may drill the holes after receiving the

sole source manufacturer, the Mosler Safe

cabinet. The inside clear dimensions

Company. No other vendor has offered similar

are H 25 3/4" x W 19 1/8" x D 25".

special-purpose crypto-equipment safes for

government procurement. Because of limited

(U) Security for Other COMSEC

projected use, these security cabinets will not be

Material. The following COMSEC Material will

submitted to GSA for certification. Since these

be safeguarded IAW AR 380-5:

cabinets deviate from federal specifications, they

do not bear the GSA label. As a result, the

(1)

(U) General COMSEC instruction

containers are not authorized for storage of

documents (KAG).

superseded or future key. However, these

cabinets may be used to store equipment

(2)

(U) COMSEC equipment operating

containing the current key. Direct all orders and

instructions (KAO).

inquiries to:

(3)

(U) COMSEC equipment maintenance

Mosler, Government Sales

manuals (KAM) other than cryptographic

8509 Berk Blvd.

media.

Hamilton, OH 45015-2213

(Telephone 1-800-568-7233)

(4)

(U) Crypto-ancillary material (including

hardware or software).

(U) Approved Modified Special

Cabinets. The following modified security

(5)

(U) Other types of COMSEC material

cabinets are approved for closed-door operation

not specifically covered in this chapter.

and storage of COMSEC equipment.

(U) Secured Storage Areas. Each

(1)

(U) Mosler Model 54-40 Special Class 5

secure area or container used for the storage of

Double Door Security Cabinet. This

classified COMSEC information will be kept

cabinet is designed for closed-door

locked when not under the direct supervision of

operation. It contains fans and secured

authorized personnel.

vents and is provided with three holes in

the top for power conduit mounting. The

5-11

FOR OFFICIAL USE ONLY

TB 380-41

(U) Restrictions on the Use of

(U) The following are the preferred

Storage Containers. There are many items

methods of transporting key and other classified

that are the primary targets of thieves (e.g.,

COMSEC material:

money, precious metals, jewelry, weapons,

narcotics, night vision devices). These items will

(U) Defense Courier Service (DCS) (use

not be stored in vaults, security containers,

DCS Form 1).

secure areas, or other areas used for the

(U) State Department Diplomatic

storage of classified COMSEC material. In an

Courier Service.

emergency, when adequate storage facilities are

(U) Officially designated couriers.

not available, the commander may authorize an

exception to this restriction. This exception will

(U) Authorized means of transportation

be on a temporary basis only (see paragraph

will ensure proper handling, equipment integrity

5.10.4a.).

during shipment, minimum stopovers and

delays, on-time arrival, and reduced possibility

(U) Lock Combinations.

of compromise.

(1)

(U) The combinations of locks used to

(U) Instructions for marking and

secure classified COMSEC information

shipment of CCI material are contained in DA

in storage areas or containers will be

PAM 25-380-2.

safeguarded, changed, and recorded

IAW AR 380-5.

5.12 KEYING MATERIAL

(2)

(U) A Standard Form (SF 700) “Security

MARKED “CRYPTO.”

Container Information” will be

maintained for each vault, secure room,

container or drawer having a separate

(U) The control procedures specified in the

combination.

following paragraph apply to all key marked

“CRYPTO,” whether classified or unclassified.

(3)

(U) Lock combinations will be controlled

5.12.1

(U) Preparation for Shipment.

and provided to a minimum number of

authorized personnel.

(U) Each COMSEC Custodian is

responsible for:

(U) Material Used to Process

Classified COMSEC Information. Typing

(1)

(U) Making sure key is properly

ribbons, diskettes, and disks, which have been

prepared for shipment.

used to process classified COMSEC

information, will be safeguarded as directed by

(2)

(U) Making sure only authorized

AR 380-5.

shipping methods are used.

5.11 TRANSPORTATION OF

(3)

(U) The accuracy and timeliness of all

accounting and Transfer Reports.

COMSEC MATERIAL.

(U) Wrapping. Prior to shipment, key

(U) The possibility of compromise is

will be double-wrapped and securely sealed

increased during shipment. It is imperative that

using gummed paper-reinforced tape (NSN

persons handling COMSEC material in

8135-00-598-6097). Scotch or masking tape will

COMSEC logistics (CMCS) channels and DoD

not be used. Key will be packaged separately

standard logistics channels are carefully

from its associated COMSEC equipment unless

instructed in proper handling procedures,

the application or design of the equipment is

including emergency destruction procedures.

such that the key cannot be physically

Transportation in this context does not include

separated.

moving a cryptosystem between operational

sites by authorized movers.

(U) Marking Packages. All packages

will be clearly and adequately marked as

follows:

5-12

FOR OFFICIAL USE ONLY

TB 380-41

(1)

(U) Inner Wrappings. Conspicuously

5.12.2

(U) Methods of Shipment.

mark inner wrappings as follows:

(U) Preferred methods for shipping key

(a) (U) Classification (if any).

is in the custody of formally authorized couriers

identified in paragraph 5.11.b.

(b) (U) The marking “CRYPTO.”

(U) Key classified SECRET will not be

sent through the U.S. postal channels without

handling instructions, and notations

prior approval from HQDA (DCS G-2). The use

such as: THIS PACKAGE

of commercial carriers to transport keying

CONTAINS ACCOUNTABLE

material is specifically prohibited.

COMSEC MATERIAL - TO BE

OPENED ONLY BY THE COMSEC

(U) U.S. Registered Mail may be used to

CUSTODIAN.

ship unclassified and individual editions of

CONFIDENTIAL key (or extracts) to users in the

(d) (U) TO and FROM address

U.S. and to activities served by U.S. postal

information: using geographic

facilities (to include APO/FPO facilities). Under

locations, not post office boxes.

no circumstances will the shipment pass through

a foreign postal system or any foreign

(e) (U) COMSEC Account Numbers.

inspection.

(f)

(U) The instruction, ATTN:

(U) Transportation of key via U.S.

COMSEC Custodian, or equivalent.

Flag aircraft within CONUS is authorized;

however, outside of CONUS it is strongly

(g) (U) The transfer documentation for

discouraged due to the risk of terrorists and

the keying material shipment will be

lack of U.S. control

(see AR 380-40,

placed in a separate envelope. The

paragraph 2-17a).

envelope will be attached to the inner

wrapper of the number one package

5.13 COMSEC EQUIPMENT

of the shipment.

AND COMPONENTS.

(2)

(U) Outer Wrapper. The outer wrapper

will contain only those markings

(U) The following methods will be used for the

necessary to facilitate delivery.

shipment of classified COMSEC equipment and

components. Other methods of transportation

(a) (U) TO and FROM addresses: using

will not be used without prior approval from

geographic locations, not post office

HQDA, (DAMI-CD).

boxes. If package is being delivered

via DCS, the outer wrapper will

(U) Defense Courier Service (DCS).

contain the two-line DCS address,

COMSEC account number, ATTN:

(U) U.S. Diplomatic Courier Service.

COMSEC Custodian, etc.

(U) Officially designated and cleared

(b) (U) The outer wrapper will not display

courier.

any markings that reveal package

contents or that the package

(U) Cleared commercial carrier, which

contents are classified.

provides Protective Security Service (PSS).

5.13.1

(U) Use of U.S. Commercial

shipped by courier, will be marked

Passenger Airlines. Scheduled U.S.

VIA COURIER or with other

commercial passenger airlines may be used by

markings, as may apply. Material

cleared and designated U.S. military personnel

transmitted by State Department

and government civilian employees to transport

Diplomatic Pouch will indicate that

classified COMSEC equipment and components

COURIER ACCOMPANIMENT IS

at the discretion of the local commander,

REQUIRED.

5-13

FOR OFFICIAL USE ONLY

TB 380-41

provided the provisions of AR 380-5 are

empty container on the rail car to

followed.

preclude leaving a full container

vulnerable. If, at any time, the security

(U) The use of foreign carriers must be

risk increases, use of supplemental

approved by HQDA (DAMI-CD).

security measures, such as unit guards,

is encouraged.

(U) COMSEC equipment will not be

shipped keyed unless its physical configuration/

(4)

(U) Inventorying. Units must initiate

engineering design makes it impossible to

inventories of equipment prior to

separate the key from the equipment. See

shipment, which includes, as a

paragraph 5.13.2 for exceptions.

minimum, serial numbers,

nomenclature, and quantity. A copy of

(U) Items marked “CONTROLLED

the inventory should be maintained in

CRYPTOGRAPHIC ITEMS” (CCI), which are

unit files and a copy placed in the

un-keyed, will be shipped IAW DA Pam 25-380-

vehicle or shipping container.

2. The following are basic principles that

commanders must focus on when deploying in

5.13.2

(U) Protecting Classified COMSEC

support of contingency operations and routine

Equipment While in Transportation

shipments to minimize the opportunity for

Channels.

loss/theft of CCI:

(U) The preferred method of protecting

(1)

(U) Planning for unit shipments during

classified COMSEC equipment while in

contingency operations. Commanders

transportation channels is by one of the methods

should have a detailed plan available

in subparagraphs 2-17b(1) and (2) of AR 380-

that includes security during pre-

40. In the interest of minimizing risk,

deployment, deployment, employment,

commanders are directed to make every effort to

sustainment, and redeployment.

satisfy their operational needs using the modes

of transportation authorized, and through the

(2)

(U) Security of equipment in vehicles.

use of couriers or escorts to protect sensitive

CCI should not be left unsecured in

COMSEC equipment. When such methods are

vehicles. These items should be

not feasible, a request for waiver from HQDA

secured in a rack, the vehicle locked in

(DCS G-2) is required.

a motor pool or secured in locked unit

containers with equipment of

(U) EXCEPTION: Within CONUS only,

comparable value and sensitivi ty, and

when operational necessity or contingency

accounted for in accordance with

circumstances dictate, SECRET and

established supply procedures.

CONFIDENTIAL classified COMSEC equipment

installed in an enclosed vehicle or equipment

(3)

(U) Rail shipments. Units should

shelter (e.g., MSE/ SINCGARS) may be

coordinate with security and

transported via un-cleared commercial carriers,

transportation personnel to determine

provided ALL of the following stipulations are

the transportation security requirements

strictly adhered to:

for the type of equipment being shipped.

CCI shipped via rail flatcar will be placed

(1)

(U) The determination of necessity to

in locked MILVANs or CONEX

deviate from preferred transportation

containers and locked with high-security

modes must be based on the

locking devices (see paragraph 5.9a).

commander's own risk assessment and

The door of the container must be

his/her personal acceptance of that risk.

inaccessible to preclude entry. To

(2)

(U) The classified COMSEC equipment

accomplish this, the container should be

and all systems within the vehicle or

positioned on the flat car so the door is

shelter must be completely zeroized and

flush against an immovable object and

purged of all cryptographic key, crypto-

door-to-door if more than one container

ignition keys, etc., except as provided

is utilized. If needed, negotiate with the

for in subparagraph 2-17b of AR 380-40.

carrier through the military traffic

management command to place an

5-14

FOR OFFICIAL USE ONLY

TB 380-41

(3)

(U) The classified COMSEC equipment

5.13.3

(U) Packaging. COMSEC equipment

must be protected by tamper-

and components will be packaged and shipped

detection/tamper-proof labels installed

as directed by AR 380-5: with the exception that

per instructions contained in National

COMSEC equipment packaged as follows are

Security Agency (NSA)-published

considered to be adequately packaged.

Protective Technology Implementation

Procedures, applicable to the COMSEC

(U) Specially constructed fiberboard

equipment and/or specific type of

cases.

tamper-proof label being utilized.

(U) Metal cases.

(4)

(U) The classified COMSEC equipment

must be secured in its shelter mounting

(U) Wooden boxes crisscrossed with

by a steel locking bar that is locked in

metal (or equivalent banding strength) bands.

place with combination padlocks

When packaged in this manner, the inner

meeting Federal Specification FF-P-110,

opaque wrapper as called for by AR 380-5 may

Sergeant & Greenleaf Model 8077A

be omitted.

(NSN 5340-00-285-6523).

5.13.4

(U) Contents Identification. The

contents of COMSEC equipment and

(5)

(U) The vehicle or shelter containing the

component containers will be identified IAW

classified COMSEC equipment must be

MIL-STD 129D. CCI is marked IAW DA PAM

completely enclosed, and all openings

25-380-2.

covered from both the inside and

outside to shield the interior from view.

(U) Outer Wrapper. The outer wrapper

The entrance or door shall be secured

will not display any markings that reveal

with a high-security combination padlock

package contents or that the package contents

as specified in the preceding

are classified. The outer wrapper will contain

paragraphs.

only those markings necessary to facilitate

delivery: TO and FROM addresses using

(6)

(U) The vehicle or shelter should be

geographic locations, not zip codes. If a

banded across all openings with steel

package is being delivered via DCS, the outer

strapping, 1-1/4" wide, 0.035" wide,

wrapper will contain the two-line DCS address

0.035" thick (NSN 8135-00-283-0671) to

and COMSEC account number, ATTN:

further deter theft or attempted forced

COMSEC Custodian. The outer wrapper may

entry.

also be marked to indicate the number of

packages in the shipment (e.g., 1 of 5, 2 of 5).

(U) The selected commercial carriers

must certify that they utilize a system that

(U) Inner Wrapper. The inner wrapper

accurately reflects a continuous chain of

will contain information identifying the contents.

accountability for the material while it is in-

Transfer documentation for the equipment

transit, and:

shipment will be placed in a separate envelope.

The envelope will be attached to the inner

(1)

(U) Is a firm incorporated in the U.S.

wrapper of the number one package of the

shipment.

(2)

(U) Guarantee delivery within a

reasonable number of days, based on

(U) All COMSEC accounts, including

the distance to be traveled.

Tobyhanna Army Depot (TYAD), will ship

unclassified COMSEC material, EXCEPT key

(3)

(U) Have a means of tracking the

and CCI material, via First Class Mail. Other

shipment in-transit and be able to

shipping methods, such as Registered Mail, may

pinpoint the location of the shipment

be used when dictated by transportation

upon request of the government

regulations, shipment size, cost or value or

representative.

operational necessity. For CCI refer to DA

Pamphlet 25-380-2.

(4)

(U) Guarantee that the shipment will be

afforded a reasonable degree of

protection from theft or vandalism.

5-15

FOR OFFICIAL USE ONLY

TB 380-41

authorized individuals appointed on courier

5.14 CRYPTOLOGIC MEDIA.

orders. AR 380-40 and AR 380-5 refer to the

use of a Courier Authorization Card (DD Form

(U) Cryptologic media is any media

2501). This card serves only as a means to

which embodies, describes, or implements a

identify the individual as an authorized

classified cryptologic. Cryptologic media will not

Government Courier. AR 380-40 also refers

be sent through any mail system. Cryptologic

readers to AR 380-5, Chapter 8, for additional

examples include:

guidance, which states that a courier must be

provided a written statement in addition to the

(1) (U) Full maintenance manual (KAM).

DD Form 2501. This official document (Courier

Orders) identifies the individual as a courier; the

(2) (U) Cryptologic descriptions.

material the courier is authorized to hand carry;

briefing instructions regarding who is to receive

(3) (U) Drawings of Cryptographic logic.

the material and how the material is to be

transported, handled, and controlled; how the

(4) (U) Specifications describing a

material is to be stored in transit (overnight

cryptographic logic.

stopovers, etc.); and, what to do in case of

emergency, loss, or compromise of material.

(5) (U) Cryptographic computer software.

The following requirements apply to all couriers:

(U) Cryptologic media will be

transported by a properly cleared:

(U) Security Clearance. Couriers will

be properly cleared for the level of classified

(1) (U) Department courier.

material they are transporting.

(2) (U) Service courier.

(U) Safeguarding the Material. The

designating authority will make sure couriers are

(3) (U) Agency or contractor courier.

briefed on how to safeguard material that is in

transit. Safeguarding the material is particularly

(4) (U) DCS courier.

important during delays and stopovers.

(5) (U) U.S. Diplomatic Courier Service.

(U) Weapons Requirement. The

commander will determine the need for carrying

weapons. Couriers will not normally be armed;

5.15 SHIPMENT OF

however, if the tactical or environmental

conditions warrant the use of weapons, they will

CLASSIFIED WITH

be issued and couriers will be briefed on their

UNCLASSIFIED COMSEC

use, as appropriate.

MATERIAL.

5.16.2

(U) Courier Responsibilities.

(U) Unclassified and classified COMSEC

(U) Material Safeguarding. Couriers

material may be shipped together only when

are responsible for ensuring the integrity of the

there is an urgent operational need to provide

COMSEC material in their custody at all times.

both types of material simultaneously.

(U) Transporting into Foreign

Countries. See paragraph 5.12.2d for

5.16 COURIERS.

transportation requirements.

5.16.1

(U) Courier Requirements. Official

(U) Last-On-First-Off Procedure.

couriers of classified COMSEC material will be

When the physical bulk or configuration of the

so designated, in writing, by the commander or

material being transported will not permit the

his/her authorized representative. COMSEC

courier to keep the material on his/her person or

material being hand carried from one

in view at all times, prior arrangements will be

geographical point to another (e.g., between

made with the carrier to effect a “last-on-first-off”

installations/government facilities) including

procedure (courier will ensure the material is the

keyed or un-keyed CCI, must be couriered by an

5-16

FOR OFFICIAL USE ONLY

TB 380-41

last item loaded and the first item unloaded).

(U) Planning for Hostile or

This procedure ensures the material will not be

Emergency Actions. This planning must

moved without the courier being present.

concentrate on actions to safely evacuate or

securely destroy COMSEC material. Plans must

(U) CRYPTO Key Escort. The courier

be realistic, simple and workable. As the

will escort CRYPTO key at all times. Should the

following reflects, CONUS and OCONUS

material be placed in a locked compartment

requirements differ:

during shipment, the courier will check the

locked area as frequently as possible.

(1) CONUS: Emergency plans for

CONUS are strongly recommended, but not

5.16.3

(U) Airdrop of COMSEC Material.

required. However, for COMSEC accounts

COMSEC material may be air-transported and

that are deployable, the custodian must

airdropped to its destination when necessary

ensure that an emergency plan is developed

due to tactical operating conditions. Air

once the account is deployed OCONUS.

transportation and airdrop of certain COMSEC

See AR 380-40, Chapter 3.

material may be prohibited by specific

cryptosystem regulations or handling

(2) OCONUS: All Army activities

instructions. Units must check appropriate

outside the U.S., its territories, and its

regulations and instructions prior to shipment by

possessions (to include Alaska, Hawaii,

these methods. The following criteria will be

Puerto Rico, Guam and the Virgin Islands),

observed:

which hold COMSEC material, must

maintain a current, written emergency plan

(U) Security Control. Airdropped

for the protection of such material during

COMSEC material will be under the control of a

emergencies.

properly cleared individual prior to and during

flight, and until such time the material leaves the

(U) Training Exercises. Exercises to

aircraft.

train personnel in the execution of Emergency

Plans will be conducted as prescribed in

(U) Material Recovery. Authorized

Chapter 3, AR 380-40. They should simulate

personnel will not airdrop COMSEC material

the real situation, include as many concerned

unless there is a high probability of immediate

personnel as possible, and stop just short of

recovery.

actual emergency execution. The following

training information will be recorded as a

(U) Sling-Loaded COMSEC

Memorandum For Record (MFR) and filed with

Equipment. When required in support of

the emergency plan:

forward tactical operations, vehicles or shelters,

which contain un-keyed COMSEC equipment,

(1)

(U) The latest date of training.

may be transported using sling-loading methods.

Sling-loaded COMSEC equipment will not be

(2)

(U) Types of plans tested.

keyed unless the equipment is required for

immediate operation upon landing. COMSEC

(3)

(U) Training results.

key will not be sling-loaded but may be

transported inside the helicopter.

(4)

(U) Names of participating personnel.

(U) Precautionary Destruction and

5.17 EMERGENCY PLANS

Evacuation. During actual emergency

AND PROCEDURES.

conditions, precautionary destruction or

evacuation of COMSEC material should not be

(U) This paragraph contains procedures for

delayed because of uncertainty as to threat/risk

conditions, or for monetary considerations.

preparing, practicing, and executing emergency

plans as directed by AR 380-40. The

Destruction priorities are specified in paragraph

commander will make sure the following items

5.20.4. COMSEC material replacement after a

crisis is significantly less costly than a damage

are considered when preparing and executing

assessment to national security after a

emergency plans.

compromise.

5-17

FOR OFFICIAL USE ONLY

TB 380-41

(U) Location of destruction implements.

5.18 PREPARATION OF

EMERGENCY PLANS.

m. (U) Provisions for precautionary

disposal action.

5.18.1

(U) Provisions. The following

(U) Annual review of the plan and

provisions, as appropriate, may be incorporated

assigned duties by all personnel.

into emergency plans.

(U) Authorization for the senior member

(U) Procedures for unannounced,

present to implement the plan.

simulated, emergency training exercises.

(U) Assignment of specific

(U) Reporting instructions before, during

responsibilities by duty position, rather than by

and after execution of emergency plans, during

name, with designated alternates.

training or actual emergencies. Include “lessons

learned” in after-action reports.

(U) Location of combinations to

(U) Emergency plans, which contain

containers of COMSEC material.

classified information, must be securely stored

(U) Location of COMSEC material by

as specified in AR 380-5.

storage container.

5.18.2

(U) Coordination. Emergency plans

involving COMSEC material will be coordinated

(U) Removal of accounting records

with or incorporated into higher command

(e.g., IR Cards, automation back-up disk, and

emergency plans. This will ensure that

H/R files) to facilitate the post emergency

evacuation, storage, and/or destruction will be

inventory.

effectively and securely performed as part of the

overall command OPLAN in the event of an

(U) Designation of the evacuation site or

actual emergency.

alternate site. Include the routes and alternate

routes of travel.

5.19 RECOMMENDED

(U) Procedures for removal or

destruction of hard drives, other AKMS

EMERGENCY TASK CARDS.

automation components, and software

containing key management and other classified

(U) Task cards are used for preparing

or sensitive data base information.

emergency plans. Within certain COMSEC

Facilities, task cards may not be appropriate or

(U) Location of fire-fighting equipment.

feasible. In this case, the decision to use task

cards rests with the commander.

(U) Instructions for admitting firemen

and other un-cleared emergency personnel to

(U) In case of an emergency, the senior

the COMSEC Facility, and provisions for

person present must implement the emergency

safeguarding the COMSEC material during such

plan.

access.

5.19.1

(U) Task Cards.

(U) Provisions for packing, loading, and

transporting COMSEC material and for its

(U) First, identify each specific task and

safeguard during transit. In addition,

assign a priority for accomplishment. Then,

consideration should be given to the evacuation

record the task and the approximate time for

of emergency destruction material that will be

completion (write clearly and concisely) on its

used during transit or at a later date.

own 5x8 card.

(U) Provisions for the removal of key, if

(U) In an emergency, personnel will

applicable, from equipment, and the storage

report to a pre-designated location. The person

thereof when emergency storage is to be

in charge or another designated individual will

implemented.

issue the task cards to individuals one at a time,

based on priority. Each individual will then carry

5-18

FOR OFFICIAL USE ONLY

TB 380-41

out the designated task as written on the card

5.20 EMERGENCY

and return to the person in charge to report that

the task has been completed. This individual

MEASURES.

will then be given another task to be completed.

This procedure will continue until all tasks have

(U) Measures, which can be taken in the event

been completed. Under this system, many tasks

of an emergency, include EVACUATION,

are being completed at the same time,

SECURE STORAGE, and DESTRUCTION.

maximum personnel usage is employed, and the

The commander will decide which of these

progress of emergency actions are known at all

measures will be taken and will indicate in the

times.

plan those measures not considered feasible.

Evacuation and/or secure storage will be

5.19.2

(U) Sample Task Cards. The sample

considered before destruction. However,

task cards addressed in the following

simultaneous implementation of any two or all

paragraphs do not necessarily include all actions

three measures may be necessary.

required at a facility. Additions, changes and

modifications to the instructions on these sample

5.20.1

(U) Emergency Evacuation.

cards will be necessary to accommodate the

specific conditions and circumstances at a

(U) Evacuation is defined as the

particular facility. For example: It may not be

removal of COMSEC material to a SAFE,

practical to put the safe combinations (which

alternate location. The removal of COMSEC

must be stored securely) on task cards and at

equipment must be performed in a systematic

the same time conveniently store the cards to

manner and under the direction of a responsible

permit easy access. Sample task card

individual.

instructions are as follows:

(U) When evacuating COMSEC

(U) TASK CARD 1.

material, every effort will be made to prevent

loss or unauthorized access; special care must

(1)

(U) Go to room XX and remove the IR

be exercised during the period from the

Card file from the storage cabinet just

evacuation to the subsequent return of the

inside the door. Take the file to room

material to its original location or the relocation

XX. Go to the incinerator in room XX.

to a new secure area.

Get it fired up.

(U) There are several factors that

(2)

(U) Place the material received into the

influence the decision to evacuate COMSEC

incinerator in the order in which it was

material:

received. Using the IR Card file, check

off the items as they are destroyed.

(1)

(U) Time available.

Tend the incinerator until all material

has been burned. Report back to the

(2)

(U) Future requirements for the

person in charge.

COMSEC material.

(U) TASK CARD 2. Two individuals will

(3)

(U) Degree of hazard involved in the

go to the storage cabinet just inside the door to

removal.

room XX. With the key attached to this card,

unlock the cabinet, remove the three M-3

(4)

(U) Safety of the new location.

Sodium Nitrate Destruction Kits. Load them on

the dolly located next to the cabinet, and roll

(5)

(U) Means of transportation available.

them down the corridor and out the exit. Set up

the kits in the courtyard as you have been

(6)

(U) Transportation routes available.

instructed. As soon as the kits are set up and

ready to accept material, one of you report back

5.20.2

(U) Secure Storage During an

here to me. The other one remain with the kits

Emergency.

and load material into the kits; wait for further

instructions from the person in charge or

(U) Secure storage in an area at risk is

someone acting on his/her behalf.

not an effective emergency measure while under

the threat of enemy attack.

5-19

FOR OFFICIAL USE ONLY

TB 380-41

(U) Secure storage during other types of

(U) Priority 3. Superseded tactical

emergencies can be achieved by using

operational codes.

authorized vaults, safes, or a secure room. If a

secure room is used, all classified boards must

(U) Priority 4. SECRET and

be removed from non-secured COMSEC

CONFIDENTIAL multi-holder key, which is to

equipment and stored along with classified

become effective within the next 30 days.

components and other classified COMSEC

material in approved security containers.

(U) Priority 5. Sensitive pages of crypto-

equipment maintenance manuals (or the

(U) If possible, a guard should remain in

complete manual).

or near the storage area. The placement of

guards in the area as a secondary barrier is

(U) Priority 6. Classified components or

desirable. However, a guard does not satisfy

sub-assemblies of COMSEC equipment (printed

basic emergency storage requirements.

circuit boards and module boards) in the order

listed in the appropriate maintenance manuals.

(U) Various factors, which would

influence the decision to secure COMSEC

(U) Priority 7. The balance of the COMSEC

material in place, are as follows:

equipment maintenance manuals and classified

operating instructions.

(1)

(U) Time available.

(U) Priority 8. All remaining classified

(2)

(U) Nature of the emergency (whether

COMSEC material and unclassified key marked

by human or natural causes).

“CRYPTO.” Superseded authenticators and

unused two-copy key will be destroyed, if time

(3)

(U) Seriousness of the emergency.

permits.

(4)

(U) Possibility of returning to the site.

5.21 EMERGENCY

(5)

(U) Bulk and weight of the material (in

DESTRUCTION METHODS

deciding whether to store or evacuate).

AND MATERIALS.

5.20.3

(U) Emergency Destruction.

Destruction of key includes zeroizing COMSEC

(U) Destruction Methods and Materials. It is

equipment and removing and destroying the

the responsibility of the commander to select

current key card or key list extract. Plans for

appropriate emergency destruction measures for

COMSEC Facilities holding classified

a COMSEC Facility. This selection should be

operational key will include provisions for the

based on a comprehensive risk assessment and

emergency destruction of such key.

threat evaluation, conditions at each facility and

the available destruction alternatives.

5.20.4

(U) Priorities. USED, SUPERSEDED,

Destruction procedures and methods are as

classified key marked “CRYPTO” is the MOST

follows:

SENSITIVE of all COMSEC material. It must be

given the HIGHEST DESTRUCTION PRIORITY

5.21.1

(U) Key and COMSEC Documents.

to prevent its compromise. The general priority

When there is an emergency situation, key and

for emergency destruction of COMSEC material

other classified COMSEC publications will be

is as follows:

destroyed based on priority, as specified by the

commander in the Emergency Plan. If this is not

(U) Priority 1. All superseded and current

possible, any method may be used which, in the

classified key marked “CRYPTO” in that order

judgment of the senior person present, will result

except authenticators, CONFIDENTIAL tactical

in the least likelihood of unauthorized access or

operations codes, unused OTP and OTT, and

recovery. Any devices or method approved for

unused point-to-point (two copy) key.

routine destruction is acceptable.

(U) Priority 2. TOP SECRET multi-holder

5.21.2

(U) Shredders. Any type of shredder

key that is to become effective within the next 30

may be used when other methods of destruction

days.

are not available and the key is mixed with an

5-20

FOR OFFICIAL USE ONLY

TB 380-41

equal amount of other material of similar

(f)

(U) Other items, including screen

composition. Shredders may also be used as a

cover, outer drum cover, inner drum

supplementary method to speed destruction,

cover, lever lock ring, gasket, plastic

when necessary. Shredded key, when sized

foam spacers, and miscellaneous

larger than 1.2 mm (0.05 inches) in width and 13

packing material.

mm (0.5 inches) in length, or as an alternative,

0.73 mm (0.03 inches) in width and 22.2 mm

(2)

(U) This device is capable of destroying

(0.87 inches) in length, will be scattered or

a maximum of 12 pounds of paper or

dispersed over a wide area.

mixture of paper, plastics, film, magnetic

tape on nonmetallic reels, and printed

circuit boards. The composition of items

WARNING

to be destroyed should be within the

following limits:

(a) (U) Cellulose paper (documents) 70-

100 percent.

(b) (U) Plastics (printed circuit boards),

SODIUM NITRATE

20 percent maximum.

5.21.3

(U) Sodium Nitrate Destructors.

Magnetic tape on aluminum reels or metal

metallic reels, three percent

components of COMSEC equipment (especially

maximum.

aluminum or magnesium) will never be placed in

Sodium Nitrate Destructors since a severe

(d) (U) Paper must be intermixed with

explosion hazard exists. Also, intense heat and

plastics, film and tapes to effect

a column of flames as high as 20 feet are

complete destruction.

generated whenever the M3 or M4 Document

Destroyer is used. Personnel will remain at a

(U) Document Destroyer, Emergency,

safe distance for 20 minutes after ignition. The

Incendiary, M3 (NSN 1375-00-529-8004-

M3 and M4 will only be used out-of-doors in an

M605).

area free from overhead obstructions or other

objects that may catch fire. The molten slag

(1)

(U) The M3 kit consists of:

reacts violently when coming into contact with

cold or wet surfaces.

(a) (U) 5 each 19 lb packages of sodium

nitrate.

(U) Document Destroyer Kit M4 (NSN

1375-00-078-0450-M 814). Document destroyer

(b) (U) Igniter charge.

kit M4, or other prepared kits, may be used for

document destruction (refer to TB-CML-110).

(1)

(U) The M4 device consists of:

(d) (U) Retaining ring assembly.

(a) (U) A 55-gallon metal outer drum.

(e) (U) Two igniters.

(b) (U) A fiberboard inner drum.

(f)

(U) Box of safety matches.

(2)

(U) The device is capable of destroying

nitrate loaded in the space between

a maximum of 100 pounds of paper or

the outer and inner drums.

mixture of materials of the same

composition and ratios as stated in the

(d) (U) 3 tubular bags of ignite mix.

preceding paragraph for the M4

Document Destroyer. To use the M3 kit

(e) (U) 2 each M-72 railroad fuses.

you must obtain a clean 55-gallon drum,

open at one end. A metal cover with a

6-inch-to-8-inch diameter hole must be

5-21

FOR OFFICIAL USE ONLY

TB 380-41

provided for the 55-gallon drum in order

to maintain sufficient pressure inside the

(i)

(U) An additional igniter and box of

drum to ensure complete combustion.

matches are provided should the first

The M3 is employed as follows:

attempt fail.

(a) (U) Open the kit. Remove one

WARNING

package of sodium nitrate and

spread its contents over the bottom

of the drum: breaking up any lumps.

(b) (U) Scatter about one fourth of the

material to be burned over this layer

of sodium nitrate and follow with

SODIUM NITRATE

another layer of sodium nitrate.

Paper and books need not be torn

up. Printed circuit boards to be

Magnetic tape on aluminum reels or

destroyed must be mixed with paper;

equipment components made of larger

otherwise, destruction will not be

amounts

metal

(especially

accomplished.

aluminum or magnesium)

must never

destroyed

the

container

utilizing the ABC-M4 since a severe

sodium nitrate and paper: spreading

explosion hazard exists.

Use of

and breaking the lumps in each

the ABC-M4 generates intense heat

package of sodium nitrate until the

and large amounts of flame and

last fourth of material to be burned

toxic smoke.

Areas in which the

has been added.

ABC-M4

activated

will

IMMEDIATELY EVACUATED.

(d) (U) Add the last package of sodium

nitrate and the ignition charge. Mix

this layer with paper. Do not scatter

(U) File Destroyer, Incendiary, ABC-

the ignition charge.

M4 (NSN 1375-00-219-8564-M610).

(e) (U) Place the metal band around the

(1)

(U) Installation of the ABC-M4 in a filing

drum directly below the top-rolling

cabinet or security container takes up

hoop. Fasten the band by passing

approximately 60 percent of the usable

the end through the ring on the other

drawer space. For this reason, planning

end and bending it back.

must take into account the destruction of

any classified material that must be

(f)

(U) Cover the drum with the metal

removed from the file drawers (refer to

screen and attach the wires on each

TB-CML-110). The ABC-M4 consists of:

corner of the screen to the

corresponding "D" rings on the metal

(a) (U) A wooden crate containing 44

band. Do not punch holes in the

oxidizer panels filled with sodium

drum.

nitrate.

(g) (U) Remove the tape holding the

(b) (U) 4 igniter panels with wiring

lever to the body of the igniter. Hold

harnesses.

the lever tightly to the body of the

igniter and remove the safety pin.

(h) (U) Insert the fuse end to the igniter

(2)

(U) Two ABC-M4 kits are required to

through the hole in the metal screen

destroy the contents of a standard 4-

and drop the igniter into the

drawer security container. The oxidizer

incinerator drum. The igniter has a

panels are interlaced at 1 or 2-inch

1.2 to 2 second delay before ignition

intervals through the file drawers with 1

(see TM 43-0001-38, page 6-8).

or 2 igniter panels placed in each

5-22

FOR OFFICIAL USE ONLY

TB 380-41

drawer. The chain-link mats are placed

until the entire contents of the drawer

on top of the paper in each drawer to

are burning. The weight of the rack

keep it compressed during destruction.

keeps the contents of the file

Destruction is accomplished with

compressed, thereby providing

drawers in the closed position.

maximum contact between the paper

Activation is normally accomplished

and the sodium nitrate and maximum

electrically by attaching the igniter panel

effectiveness of the incendiary. A file

wiring harnesses to a truck battery or

destroyed by an ABC-M4 incendiary

other voltage source. Each igniter box

emits large volumes of acrid black

contains two squibs connected in

smoke while burning; therefore, the

parallel to a pair or igniter wires that are

area should be evacuated until

used to connect the squibs to a power

burning is complete and the area is

source.

ventilated.

(a) (U) One oxidizer panel is installed in

(h) (U) If possible, following an active

the front of each file drawer and one

burn period (approximately 20

behind each 1/2-inch thickness of

minutes) and a sufficient cool-down

paper in the drawer until all papers in

time, containers in which ABC-M4's

the drawer are sandwiched between

have been activated will be re-

oxidizer boxes.

opened and the contents inspected.

These devices, especially older

(b) (U) An igniter panel is placed ahead

ones, are not completely reliable and

of the first oxidizer box in each file

some unburned or partially burned

drawer.

material may still remain.

(3)

(U) Fuels, kerosene, gasoline, and

drawer must be extended out of the

sodium nitrate may be used to expedite

drawers with care in a manner to

burning. Extreme care must be used for

prevent them from being cut or

personal safety.

broken when the drawers are closed.

The wires are brought together so

they may be easily connected to the

WARNING

firing line.

(d) (U) A chain-link mat is placed on top

of the papers and panels in each

drawer so that it will remain in

contact with the contents of the file

SODIUM NITRATE

as burning progresses.

(e) (U) The drawers are closed.

(U) Magnetic tape on aluminum reels or metal

components of COMSEC equipment (especially

(f)

(U) The squib wires are connected in

aluminum or magnesium) will never be placed in

parallel to a firing lead.

Sodium Nitrate Destructors since a severe

explosion hazard exists. Also, intense heat and

(g) (U) A blasting machine or other

a column of flames as high as 20 feet are

source of electricity is used to fire the

generated whenever the drum is used.

squibs, which sets fire to the wood-

Personnel will remain at a safe distance for 20

flour-and sodium nitrate mixture.

minutes after ignition. The drum will be used

The sodium nitrate furnishes oxygen

only out-of-doors in an area free from overhead

to support combustion in the closed

obstruction or other objects, which may catch

file. Papers adjacent to the igniter

fire. The drum must not be tipped over while

panel ignite and the sodium nitrate in

contents are still actively burning. The molten

the next oxidizer panel furnishes the

slag reacts violently when coming into contact

necessary oxygen for combustion.

with cold or wet surfaces.

Combustion progresses in this way

5-23

FOR OFFICIAL USE ONLY

TB 380-41

(U) Sodium Nitrate Destructor Drums.

(U) Destruction will be accomplished to a degree

If prepared kits are not available, 120 pounds of

that reconstruction of the cryptographic logic is

sodium nitrate (spray-coated and pelletized, if

not possible. Removing and destroying the

available), two or three pounds of sugar, and a

classified assemblies and CCI components

55-gallon steel drum (20 gauge or heavier) can

within the equipment, including classified printed

be used to destroy approximately 100 pounds of

circuit boards and multi-layer boards can do this.

paper and from 15 to 20 printed circuit boards at

If the classified assemblies and CCI are

the same time. The following directions apply:

destroyed, it is not necessary to totally destroy

the remainder of the equipment. The following

(1)

(U) Dump about 20 pounds of sodium

are approved and effective methods for the

nitrate into the bottom of the drum

emergency destruction of crypto-equipment.

followed by 6 to 10 inches of paper and

one printed circuit board. The paper

should be flat.

WARNING

(2)

(U) Repeat with about 2 inches of

sodium nitrate, 2 or 3 inches of paper

and one printed circuit board until the

drum is full, ending with a layer of

sodium nitrate on top.

SODIUM NITRATE

(3)

(U) Make a starter charge by thoroughly

mixing 2 or 3 pounds of sugar with an

(U) Do not stare directly at the fireball caused by

equal amount of sodium nitrate. Spread

the ignition of the M1A2 or similar device: The

the mixture over the top layer.

intense light can cause eye damage. Extreme

heat, intense flames and toxic smoke are

(4)

(U) Cover the drum. At lower altitudes,

caused by the ignition of these incendiaries.

a 24-inch square of 5/8-inch wire mesh

Personnel should remain at a safe distance for

screen, weighted or wired to the drum,

15 to 20 minutes after ignition.

makes an adequate cover. At 3,000

feet or more above sea level, a lid with

(U) Thermite Incendiaries. Thermite

less ventilation than the screen must be

incendiaries will provide effective and total

devised. Such a lid may be improvised

destruction (not authorized for use in the U.S.

by cutting one or more holes in a regular

except for training purposes). Ensure you

steel drum lid. Hold the lid on with a

have read the instructions to determine what is a

wired-down screen mesh cover.

safe distance away from the explosion.

(5)

(U) A combustible mixture such as

(1)

(U) Cryptographic Equipment

rubbing alcohol can be sprinkled on the

Destroyer, Incendiary, M1A2-TH4

starter charge. Normally, this is not

(NSN 1375-00-834-8884-M598). The

required as the fire can be started by

M1A2 is a thermite incendiary

means of a torch or burning paper

measuring 10-1/2" x 15" x 1-1/2" and

applied to the starter charge. After the

weighing 35 pounds. This device may

fire is started, the operator should

be placed on the equipment exterior or

retreat 50 feet or more. It may take up

on components, which have been

to 5 minutes for the fire to reach its full

removed (refer to TB -CML-110). The

intensity.

M1A1-TH1 and M2A1 are obsolete

devices similar to the M1A2 and may

5.21.4

(U) Destruction of COMSEC

still be found at some sites. The M1A1

Equipment. COMSEC equipment will only be

is the same size and weight as the

destroyed as a last resort to prevent it from

M1A2 although it is slightly less powerful

falling into unauthorized hands. Destruction

and is charged with thermite rather than

may be by any method that will render the

TH4 thermite. The M2A1 is a half-sized

equipment unusable and irreparable.

(16" x 8-1/2" x 1", 12 pounds) version of

the M1A1. The number of M1A2

devices required for destruction varies

5-24

FOR OFFICIAL USE ONLY

TB 380-41

with the size and density of the target.

(2)

(U) Remove and discard

The degree of destruction may be

UNCLASSIFIED printed circuit boards.

enhanced by placing target equipment

or material in a close fitting pit in the

(3)

(U) Evenly relocate classified boards, if

ground or in a wooden or double-lined

necessary.

steel box. This prevents the molten

slag, which accomplishes the actual

(4)

(U) Fill equipment chassis with loose,

destruction, from running off. The

prilled sodium nitrate.

M1A2s should be placed one on top of

the other and banded or taped to the

(5)

(U) Place the M1A2 panel on top of

equipment or material to be destroyed.

equipment or drawer and ignite

Ignition of the M1A2 may be

normally.

accomplished as follows:

(U) Grenade, Hand Incendiary, AN-

(a)

(U) Manually. Remove the tape

M14 (NSN 1330-00-219-8557-G900). Due to its

holding the safety pin in place and

small size and limited duration of burn, the AN-

remove the safety pin. There are

M14 grenade is only of marginal value in an

three seconds before detonation.

emergency destruction. It may be used to ignite

other devices such as the M4 or M3 drums or

(b)

(U) Electrically. Make two leads by

the M1A2 panel. The M14 may also be used, as

twisting together all wires of the

a last resort, to destroy beyond reuse a small

same color and touching them to a

piece of equipment, single drawers of large rack-

voltage source. There are three

mounted equipment, or several stacked reels of

seconds before detonation.

magnetic tape.

(c)

(U) With the AN-M14 incendiary

(U) Emergency Destruction Cable.

grenade. Pull the safety pin and

The following is a suggested procedure for

place the grenade quickly on the top

simultaneously igniting several incendiaries by

incendiary towards the front and

means of an "emergency destruction cable."

between the detonators.

The procedure is appropriate in overseas

communications/signal centers where

emergency plans call for the in-place destruction

WARNING

of several pieces of installed equipment. To

prevent accidental ignition, one person will be

designated to HOLD the AC plug until ignition is

desired. The procedure is as follows:

WARNING

SODIUM NITRATE

(U) In no case will the plug be connected to a

(U) This technique generates an intensely

power source that would place the incendiaries

violent reaction with intense heat and light and

between the individual and the exit.

large amounts of flame and toxic smoke.

Personnel should remain at a safe distance for

(1)

(U) Fabricate a cable long enough to

15-20 minutes following ignition.

reach from a power source outside or

near the door of the facility to each

(U) Field Expedient Equipment

equipment position.

Destruction. The following technique has been

developed to totally destroy COMSEC

(2)

(U) At the point where the cable passes

equipment, after it has been zeroized, by using

each position, a pair of six-foot leadoff

a combination of one M1A2 panel and 30-35

wires should be installed on the cable.

pounds of loose, prilled sodium nitrate.

(1)

(U) Remove and discard equipment top,

(3)

(U) Install a male AC plug at the end of

or open the drawer on rack-mounted

the main cable. In an emergency, the

equipment.

cable should be laid on the floor

5-25

FOR OFFICIAL USE ONLY

TB 380-41

throughout the facility so that it is within

5.21.5

(U) Destruction in Aircraft.

one foot from the base of each

equipment position.

(U) Evacuation Over Water. If an

aircraft is operating over water and its capture or

(4)

(U) Place incendiaries on equipment

other emergency appears imminent, zeroize the

and attach the incendiary leadoff wires

COMSEC equipment and destroy key and

to the six-foot pairs of the leadoff wires

associated material as completely as possible if

coming from the cable.

time permits.

(5)

(U) Double-check all connections and

(U) Evacuation Over Land. If the

EVACUATE the facility.

aircraft is in danger of going down over land in a

friendly zone, COMSEC equipment will be

(6)

(U) Apply the AC male plug to a power

zeroized and all classified COMSEC material will

source.

be allowed to remain in the aircraft. However, if

the aircraft is being forced down over a hostile

(7)

(U) The existing emergency power light

area, first zeroize the COMSEC equipment.

fixtures required in communications/

Every effort should be made to totally smash

signal centers may be modified and

classified and CCI components beyond reuse.

used as an electrical source point to

Shred or rip paper material to pieces and then

simultaneously ignite all incendiaries by

jettison the residue and smashed components

throwing a single switch. A primary

over the widest possible area.

ignition voltage of 110/220 VAC, or a

secondary ignition voltage of 6/12 VDC,

5.22 DESTRUCTION OF

would be applied to the cable via a

common terminal point. The use of a

COMSEC MAINTENANCE

switch to select the desired voltage

would eliminate the necessity of

MANUALS.

physically changing wire connections or

searching for an alternate battery source

(U) Sensitive Pages. Destruction

should the local power fail prior to

procedures will be as directed in paragraph

ignition. The switch is wired in such a

5.18.5a and shall apply to all organizations

way that in one position the terminals

operating outside the U.S., its territories, and its

are directly in parallel to the source

possessions, with the exception of CLSFs

voltage of 110/220 VAC and, in the

holding KAMs for storage only. Each KAM

other position, the voltage selected is in

contains, at the rear of the textual portions,

the battery voltage of 6/12 VDC should

either a list of sensitive pages or a statement

the power be off. In the center or "off"

that there are no sensitive pages in the KAM. In

position, the terminals would be "open"

addition, some KAMs further identify their

or have no voltage applied at all. When

sensitive pages by means of gray or black

the switch is off, the emergency

diagonal or rectangular markings at the upper

destruction cable can safely be

portion of the binding edge. During an

connected without fear of premature

emergency, there may be insufficient time to

ignition of the incendiaries. The device

completely destroy the KAMs. Information

also provides emergency lighting to

contained in certain KAMs may consist largely of

facilitate the connection of the

unclassified information with only a few

emergency cable if normal lighting is

extremely sensitive pages. The sensitive pages

lost. The materials required (local

will be destroyed first, before the remainder of

purchase) are two binding post

the KAM.

terminals and one toggle switch. The

switch must be a three-position, DPDT,

single-hold mounting which opens both

sides of the circuit.

(U) Fire Axes. Printed circuit boards

may be destroyed by hacking with an ax and

scattering the pieces.

5-26

FOR OFFICIAL USE ONLY

TB 380-41

(U) Preparing Sensitive Pages for

(U) Test Exercise. A text exercise

Emergency Destruction.

should be conducted on each KAM to ensure

that all sensitive pages will be removed by the

(1)

(U) Apply distinctive markings (e.g., red

procedure described in the preceding

stripes) to the binder edge and covers of

paragraph. After conducting such a test, care

all KAMs containing identified sensitive

must be taken to ensure each page is correctly

pages.

inserted into the manual. A page check should

then be performed. Refer to paragraph 5.19 for

(2)

(U) Remove each sensitive page from

emergency task cards.

the KAM.

5.23 ACTIONS AFTER AN

(3)

(U) Cut off the upper left -hand corner of

each sensitive page such that the

EMERGENCY.

uppermost binder hole is removed.

Either of the cutting methods indicated

(U) Report Requirements. Whenever

is satisfactory.

emergency plans are executed, message

reports will be sent to CSLA with an information

copy to the CONAUTH. In addition, an

information copy will be sent to the CLSF, which

provides COMSEC support, and to the unit's

next higher headquarters. If the emergency

action involves a COMSEC Incident, reports will

be submitted as directed in Chapter 7 of this TB.

Reports of emergencies are exempt from reports

control under the provisions of AR 335-15.

(4)

(U) When cutting off the page corner,

(U) Report Contents. When reporting

use extreme care not to remove any text

emergency conditions that do not result in a

or diagrams from the page.

COMSEC Incident, as a minimum, units will

perform the following:

(5)

(U) Reinsert all pages in their proper

order and replace the screw posts,

(1)

(U) List the material destroyed or

binder rings or multi-ring binder.

relocated.

(6)

(U) Conduct a page check.

(2)

(U) Indicate the method and degree of

destruction.

(U) Removing Sensitive Pages in an

Emergency.

(3)

(U) Indicate the circumstances that

caused the emergency plans to be

(1)

(U) Remove the screw post or binder

executed.

rings, or open the multi-ring binder, and

remove all pages from the KAM.

(4)

(U) Summarize resupply actions initiated

or planned, if applicable.

(2)

(U) Insert a thin metal rod (wire,

screwdriver, etc.) through the top hole of

(U) Recovery of COMSEC Material.

the KAM so that it extends completely

When the execution of emergency plans results

through the manual.

in the abandonment of classified COMSEC

material, every reasonable effort will be made to

(3)

(U) Holding both ends of the rod, shake

recover the material at the earliest possible

the entire manual vigorously. The

moment. Recovered classified COMSEC

sensitive pages should fall freely to the

material or residue thereof, will be collected and

floor.

placed under the control of appropriately cleared

individuals until disposition instructions are

received.

5-27

FOR OFFICIAL USE ONLY

TB 380-41

necessity, current key must be retained in order

5.24 PRECAUTIONARY

to maintain secure communications.

ACTIONS.

(U) Future and contingency key and

backup cryptosystems should be removed or

(U) When a situation develops that

stored, and all superseded material destroyed.

indicates an emergency plan may have to be

At the first hint of an emergency, superseded

executed, as a precaution, commanders must

key will be destroyed. Removal or storage of

be prepared to immediately reduce COMSEC

future key should be considered in preference to

material holdings to the minimum necessary for

destruction. The commander, with advice from

continued operation. This precautionary action,

the COMSEC Custodian, will determine what

prior to an actual emergency, will remove

material will be retained to continue secure

nonessential material from danger and simplify

communications and when to store, remove, or

evacuation or destruction should they become

destroy material not required.

necessary.

(U) When material is destroyed as a

(U) The same priority listed in paragraph

precautionary measure, the appropriate

5.20.3 for emergency destruction will apply for

issuing activity will be notified for the

precautionary destruction except that, of

purpose of accounting and post emergency

resupply.

5-28

FOR OFFICIAL USE ONLY

TB 380-41

CHAPTER 6

ARMY KEY MANAGEMENT SYSTEM (AKMS)

key generator and other classified components

6.1 GENERAL.

of the workstation must be secured in a GSA-

approved security container.

(U) The AKMS provides local real-time

electronic key generation, distribution, and

6.2.2

(U) LCMS Workstation. The term

management in support of C4I at all levels. It

“LCMS Workstation” specifically applies to the

provides accountability and management of

Local Management Device and Key Processor

existing COMSEC material now being

(LMD/KP). At a future date, the AKMS will

maintained by Army COMSEC accounts

include another component called the

worldwide. The AKMS ensures compatibility

Automated Communications Engineering

and interoperability between all services within

Software (ACES) workstation that can provide

DoD and replaces the current Army automated

Signal Operation Instructions (SOI) and net

COMSEC software (ACCLAIMS), as well as the

planning information. This future capability will

majority of manual COMSEC accounts. AKMS

not be further addressed in this TB. The Army’s

also provides for electronic distribution of

distribution plan for LCMS Workstations placed

Modern key, such as that key used for keying

a workstation in all existing Army COMSEC

STU-III, Secure Telephone Equipment (STE),

accounts, except for a few small Army COMSEC

Secure Data Network System (SDNS), and

Accounts.

other FIREFLY-based COMSEC encryption

equipment.

6.2.3

(U) LCMS Functional Elements.

When the two functional elements of the LCMS

6.1.1

(U) Primary Tier 1 Sites (PT1S). For

Workstation are operating in tandem and

the purpose of this TB, all references to COR

interconnected, they are referred to as the

pertain to the Primary Tier 1 Sites (PT1S) to

LMD/KP. The LCMS Workstation consists of

which the AKMS COMSEC accounts are

two functional elements.

serviced (i.e. Lackland AFB, Texas or Fort

Huachuca, Arizona). A Service Authority has

(U) First Functional Element. The first

been assigned for each service. Only those

functional element (LMD) is a commercial

actions that are specific to an AKMS COMSEC

Pentium, (Y2K compliant) Personal Computer

account will be addressed in this chapter. All

(PC), with a hard drive loaded with SCO UNIX

other actions required for the maintenance and

and Local COMSEC Management Software

accountability of Army COMSEC accounts are

(LCMS). Depending on the mission, units have

addressed elsewhere in this TB.

been issued either a “ruggedized” laptop PC or a

desktop model. When the PC is loaded with all

the required software, it is referred to as a Local

6.2 LOCAL COMSEC

Management Device (LMD). If open classified

storage of the LCMS Workstation is not

MANAGEMENT SOFTWARE

possible, the LMD hard drive must be stored in a

(LCMS) WORKSTATION.

GSA-approved security container as specified in

AR 380-5. The desktop model LMD’s

6.2.1

(U) Purpose. The purpose of LCMS is

removable hard drive must be stored as

to reduce the operational and security human

SECRET collateral material. The laptop model’s

intelligence threat vulnerabilities by automated

hard drive is not removable, which requires the

key management using electronically generated

secure storage of the computer itself, when

and distributed COMSEC key material. It is

required. The laptop LMD will also be stored as

recommended that the LCMS Workstation be

SECRET collateral material.

stored in an operational configuration where it

does not have to be dismantled at the end of

each workday. When this is not possible, the

6-1

FOR OFFICIAL USE ONLY

TB 380-41

(U) Second Functional Element. The

second functional area of the system is the Key

(U) Incoming/Outgoing Transfer

Processor (KP). The KP must be stored in an

Reports.

approved COMSEC Facility except for those

workstations that are deployed in a tactical

(U) Reportable Destructions

environment for a period not to exceed 90 days.

(U) Local Destructions

6.2.4

(U) LCMS Power Requirements. The

facility or work area housing the LCMS

(U) Active Hand Receipts

Workstation must have a continuous source of

stable power. The use of a surge protector is

(U) Generation Reports

recommended. An Uninterruptible Power

Supply (UPS) is included with each initial fielding

(U) Possession Reports

of the desktop LCMS Workstation to allow for an

orderly and safe shutdown of the LCMS

(U) Relief from Accountability Reports

Workstation in the event of an unscheduled

power loss. Due to the Laptop LMD’s internal

(U) ALC 4/7 Inventory Reports (included

computer battery, an UPS is not provided for the

in full local inventory). These reports are

Laptop configuration of the LCMS Workstation.

required so the auditors can verify that local

It is recommended that the unit locally obtain an

inventories of ALC 4/7 material are being

UPS for the protection and orderly shut down of

conducted. ALC 4/7 material, listed on a Relief

the KP when in a laptop configuration.

from Accountability Report SF-153 is exempt

from this requirement.

6.3 ACCOUNTABILITY OF

6.4.1

(U) COMSEC Account Semiannual

Inventory Report (SAIR). For AKMS accounts,

THE LCMS WORKSTATION.

the COR electronically initiates a request for an

SAIR to the LCMS Workstation. The COMSEC

(U) The LMD is an unclassified PC and must be

Custodian generates and forwards this inventory

accounted for on the unit property book and

back to the COR within the required 30 days (45

controlled by the Property Book Officer (PBO),

days for National Guard and Army Reserve

IAW AR 710-2. The LCMS is classified

accounts only). Any AKMS-required

SECRET (non-COMSEC accountable) and,

modifications to the COMSEC Account

when loaded onto the LMD, causes the hard

Registration Packet (CARP) must also be

drive of the LMD to be classified SECRET (not

forwarded to the Army service authority

CMCS accountable). The removable hard

representative (CSLA). After the Central Office

drives and laptop LMDs with internal hard drives

of Record (COR) reconciles the SAIR, a

are to be controlled as SECRET collateral

Certificate of Verification will be provided to the

material as specified in AR 380-5. The KP is a

COMSEC Custodian via a Tier 1 free-form text

SECRET COMSEC device and is centrally

message advising the commander that the

accountable in the CMCS as ALC-1 (Serial

assets charged to their COMSEC account have

Number accountable to the COR). The KP is

been satisfactorily accounted for.

not, repeat, not, a Controlled Cryptographic

Item (CCI).

6.4.2

(U) COMSEC Account Change of

Custodian Inventory Report (CCIR). The

6.4 INVENTORY

CCIR for AKMS accounts will be created and

sent by the custodian to the COR for

REQUIREMENTS.

reconciliation. The Service Authority must

receive the CARP within 14 days after the CCIR

(U) Upon initial start up of an LCMS

has been sent. A new hard copy CARP, with an

Workstation, COMSEC Custodians will print SF

original wet signature, will be provided to the

153 hard copies of the following transactions as

Service Authority for update of the database. A

they occur. These documents will be retained

copy of the inventory with an original signature

as required by AR 380-40, Appendix C.

will also be maintained by the account. After the

COR reconciles the CCIR, a verification that the

(U) Receipts for COMSEC Transactions.

account has been cleared will be provided to the

6-2

FOR OFFICIAL USE ONLY

TB 380-41

custodian via a free-form text message. The

(U) If a COMSEC account is relocated

outgoing custodian will not be released from or

to an area where an existing account does not

depart the organization until this verification

exist, the following actions must be adhered to

message is received. The account will print a

prior to movement of the AKMS account.

copy of the message and file it with the original,

signed inventory. The new custodian will not be

(1)

(U) A new CFAR and CARP must be

capable of logging onto the LCMS Workstation

submitted to the COR. The COMSEC

and signing for any COMSEC material received

account number or EKMS ID will remain

by the account prior to his or her official

unchanged. Failure to obtain a new

appointment and issuance of the registration

CFA prior to relocation will result in a

certification specified in the new CARP. After

reportable incident for all COMSEC

the appointment date and signature of the CCIR

material charged to the account.

Certification & Correction (C&C) page, the new

custodian will assume responsibility for all

(2)

(U) Upon approval of the CFA, all

material and account records in their existing

COMSEC accountable material must be

condition. If the commander allows the

shipped via DCS or a properly cleared

COMSEC Custodian to depart the unit prior

courier to the new, approved COMSEC

to clearance from COR, the commander

Facility.

assumes personal responsibility for the

COMSEC account and any accounting

(3)

(U) The CIK associated with the key

irregularities that may exist. A CCIR also

processor must be transported in

serves as an SAIR. The next SAIR will be

separate containers from the KP when

scheduled six (6) months from the CCIR

being transported via DCS or via

signature dat e.

courier.

6.4.3

(U) Special Inventory Report (SIR).

(4)

(U) The LMD removable hard drive must

There are no Special Inventory Reports (SIRs)

be handled as SECRET collateral. All

generated by the LCMS. Under circumstances

non-CMCS accountable material

other than a routine CCIR or SAIR, the need

associated with the LMD must be

may arise for a custodian to perform an SIR. An

shipped to the new location IAW AR

example of an SIR would be an unexplained

380-5.

temporary absence or permanent and

unauthorized absence of a COMSEC Custodian

6.4.5

(U) AKMS Daily and Shift Change

(see Table 6-2 for deletion of a user account

Inventory Requirements. All Army COMSEC

from the LCMS). When an SIR becomes

Accounts will conduct daily or shift change

necessary, custodians will generate a CCIR,

inventories as specified in paragraph 4.12, sub-

annotate that this is an SIR in the comment

paragraphs c and d. The LCMS does not

section (see paragraph 2.8, paragraph C, sub-

provide a daily/shift change inventory sheet.

paragraph 1), print the SF 153, pen and ink

Custodians will use a DA Form 2653-E or develop

change the type of inventory from CCIR to SIR,

their own by use of word processor or

and provide this report to the servicing COR.

spreadsheet.

6.4.4

(U) Change of Account Location

6.4.6

(U) ALC 4 Inventory Requirements.

Inventory Report. When an LCMS Workstation

AKMS cannot produce or print an inventory

is to be physically relocated to another location,

report for ALC 4 materiel only, as required in

the custodian will perform the following:

paragraph 4.13.5. To ensure that ALC 4 annual

inventories are conducted and reported,

(U) Generate a Change Account

custodians will print a copy of the Semiannual

Location Inventory in the LCMS.

Inventory Report (SAIR) (created for the Local

Account—not for the COR). The custodian will

(U) Perform a 100% physical inventory

then inventory the ALC 4 material to ensure that

of the COMSEC material being accounted for on

all items are on-hand, line through the

the LCMS Workstation and any physical material

semiannual report, and make a pen and ink

on-hand prior to the movement, and verify this

change stating “Annual ALC 4 Inventory.”

inventory upon arrival at the new location.

6-3

FOR OFFICIAL USE ONLY

TB 380-41

Table 6 -1. Inventory Reports (AKMS Accounts)

SITUATION

TIME OF SUBMISSION

COPIES

DISTRIBUTION

REMARKS

Semiannual

(1) The COR will initiate the

1 COR

Monitored response by the

Inventory (SAIR).

inventory request.

1 File

COR until receipt of the

(2) The account will conduct

inventory.

an inventory of reportable

assets and return the C&C

page within 30 days,

electronically.

Change of

(1) Generated by COMSEC

1 COR

Tier 2 forwards the signed

Custodian

Account. Sent to the COR

1 File

copy of the C&C page to

Inventory Report

for reconciliation.

the COR and retains one

(CCIR).

(2) The account will conduct

copy for file.

an inventory and return the

C&C page electronically and

by hard copy immediately

after the inventory, but NTE

45 days.

Special Inventory

Immediately after inventory.

1 COR

Upon sudden and

- Manual

1 File

unexplained departure of

Change of

custodian.

Custodian

Tier 2 holds original

Report.

signature copy.

Change Account

Immediately prior to

Notify COR of deployment

Location

departure and after arrival at

Inventory-

destination.

Movement or

Deployment of a

unit to another

geographic area.

Conversion

Immediately after

1 COR

Used to report change of

Report

adjustment.

1 File

short title or serial number

of material or equipment/

component conversion

from one configuration to

another and ALC changes.

Special

Immediately after recovery.

1 COR

Indicate circumstances

Possession

1 File

involved. An example

Report -

would be inadvertent

COMSEC

destruction of material.

material

recovered that

had previously

been deleted

from

accountability.

Special

Immediately after discovery.

1 COR

Indicate circumstances

Possession

1 File

involved. An example

Report -

would be equipment found

COMSEC

on-station. Depending on

material found

the circumstances, this

which is not on

may require a COMSEC

accounting

Incident Investigation and

records

Report.

(SF 153).

6-4

FOR OFFICIAL USE ONLY

TB 380-41

name and then process a local CCIR. The

6.5 LOCAL ACCOUNTING

COMSEC Custodian will include comments

FOR COMSEC MATERIAL.

explaining that this is a change of HRH, the date

the joint inventory was completed, and any

additional information deemed necessary. The

(U) This paragraph identifies unique COMSEC

COMSEC Custodian will print this inventory and

accounting procedures that must be

perform a pen and ink change to the inventory

implemented to ensure that AKMS COMSEC

type (i.e., Change of Custodian to Change of

accounts adhere to COMSEC accounting policy

Hand Receipt Holder). The new HRH will

outlined in AR 380-40 and Army COMSEC

compare the inventory report to the accountable

procedures outlined throughout this TB.

items summary that was used to inventory: if

there are no discrepancies, the new HRH will

6.5.1

(U) Hand Receipts (HR). When it is

sign this Change of HRH Inventory. The

required to provide COMSEC material for a

Change of HRH Inventory will not be provided to

specific or indefinite period of time, the material

the COR.

will normally be hand-receipted using an SF 153

generated by the LMD/KP. The material will

(U) HRH Discrepancies. If there are

only be hand-receipted to an individual. Within

discrepancies, the new HRH will annotate them

the AKMS, a Hand Receipt Holder (HRH) is

on the Change of HRH Inventory. It will be the

registered as a Local Element. The HRH that

outgoing HRH’s responsibility to resolve all

takes possession of the material assumes direct

annotated discrepancies prior to departure from

responsibility for safeguarding this material.

the unit and before changing the Local Element

registration.

(U) Manual HRs. Under unusual

conditions (e.g., conditions that may delay a

6.5.2

(U) Inventory Maintenance. An

tactical mission), hand receipts may be prepared

alternate HRH must also sign the Change of

manually. See paragraph 4.11.3 for instructions

HRH Inventory if TOP SECRET material is

on the preparation of a manual hand receipt.

currently on hand receipt or when such material

is received. The issuing COMSEC Custodian

(U) HR Briefs. The COMSEC

will keep the original signed copy of the Change

Custodian will ensure all HRHs are properly

of HRH Inventory. A copy will be maintained by

briefed on the safeguarding, destruction,

the current HRH. A hand receipt file will be

inventory and operating instructions for

maintained by both the issuing COMSEC

COMSEC material that will be in their

account and the HRH. These hand receipt files

possession. HRHs will sign a briefing statement

serve as the record of accountability and

prepared by the custodian attesting that they

responsibility for all material issued on hand

have been properly briefed on the

receipt. Upon return of the material to the

responsibilities of an HRH. If material is to be

AKMS COMSEC account, the original copy of

sub-hand-receipted, the custodian must provide

the hand receipt will be removed from the file by

written approval to the sub-HRH.

the custodian and returned to the HRH.

Identification and disposition of hand receipt files

(U) HR Accountable Summaries.

will be IAW AR 380-40, Appendix C.

Prior to taking possession of any COMSEC

material, the COMSEC Custodian will process,

6.5.3

(U) Accounting for Superseded Key.

print and distribute a Local Element accountable

The servicing COR for Tier 1 will automatically

item summary that identifies all assets that will

delete all regularly superseded key from the

be signed for by the HRH. If there is an existing

account assets on the supersession date

Local Element (an HRH account) the incoming

assigned to this material. The material will

HRH and outgoing HRH will perform a joint

continue to be reflected on the COMSEC

inventory to ensure all material identified in the

account (Tier 2) local assets. When regularly

accountable inventory is on hand.

superseded key reaches its supersession date,

the COMSEC Custodian will perform a local

(U) HRH Material Transfer. When the

destruction of the material. This will not be

COMSEC Custodian has been notified that the

reported to the COR. LCMS does not allow for

hand receipt is ready for transfer, he or she will

the custodian to destroy "electronic" key if the

modify the current HRH (Local Element)

database reflects that a copy of that key is still

registration data to reflect the incoming HRH’s

6-5

FOR OFFICIAL USE ONLY

TB 380-41

on hand receipt to a user. The COMSEC

6.5.5

(U) Clearing Typographical Errors

Custodian must ensure that users provide timely

When Entering a Physical Receipt into

destruction reports.

LCMS. The following procedures must be

followed to correct a transaction when a

6.5.4

(U) Issue of ALC 4 Material Within

typographical error has been entered into

AKMS. In AKMS, issuing ALC 4 Material is not

LCMS:

a valid transaction; however, the COMSEC

Custodian performing the following two

Select accounting > possession > set material to

transactions can accommodate it:

pending investigation > select the short title to

be corrected by highlighting it > right click, hold,

(U) A hand receipt to the Local Element

and drag down to “material to be marked” box >

for the ALC 4 material will be performed

release the right click and the material should

between the custodian and the HRH. The SF

automatically show up > select "edit quantities"

153 hand receipt block will be marked through

> the next screen appears, highlight the short

and the “other” block will be annotated manually

title and in the "qty to mark" box, type in the

to reflect an “issue.” The custodian will insert

number of items to mark (usually 1, unless you

the following statement in the comment section

entered a quantity of more than one when you

of the hand receipt or on another sheet of paper

entered the short title) > select "update" and

that will be attached to this SF 153: “THE

select "mark items" > select exit on the "set

MATERIAL LISTED ABOVE HAS BEEN

material to pending investigation" screen >

DROPPED FROM CMCS ACCOUNTABILITY

select accounting > relief from accountability

AND HAS BEEN ISSUED TO YOU AS THE

report > originate relief from accountability

HRH. YOU ARE RESPONSIBLE FOR THE

report, on the "quantity selection screen" in the

PROPER STORAGE, HANDLING,

top box "reference for reporting relief from

INVENTORY, AND DESTRUCTION OF THIS

accountability," enter the reason for requesting

CLASSIFIED MATERIAL IAW 380-40.” Local

relief from accountability (i.e., "MATERIAL

destruction records are required for all ALC 4

INCORRECTLY ENTERED INTO LCMS

material marked “CRYPTO” regardless of the

DATABASE”) > click on the short title in the

classification. These destruction records will be

window > click on the "qty to relieve" and enter

maintained for a period of 90 days. After the

the number to relieve and click "update" > select

HRH has signed for this material, the custodian

"prepare report": if remarks are desired, enter

is no longer responsible. The HRH will sign the

them and any comments > select "record

SF 153 and provide the original copy to the

annotations” wrap and send the report to the

issuing COMSEC Custodian.

servicing COR.

(U) Once the issue of ALC 4 material

6.5.6

(U) Recording STU-III Key

has been completed, the ALC 4 material needs

Conversions in AKMS. When converting STU-

to be removed from the LCMS database. The

III in AKMS, the key must be issued to a HRH.

custodian will utilize “Destruction of Local

As explained earlier in this document, an HRH

Material” in LCMS to accomplish this.

(Local Element) must be an individual. The

Custodians will annotate the SF 153 with the

HRH may be either an appointed subordinate if

following statement either electronically or on a

the account is responsible for keying the STU -III,

separate sheet of paper that will be affixed to the

or an HRH from another section within the

original destruction report: “THIS IS NOT A

unit/command. Once the key has been loaded

DESTRUCTION REPORT. THIS IS A RECORD

into the STU -III, the Crypto Ignition Key (CIK)

OF THE ISSUANCE OF ALC 4 COMSEC

log must be completed and returned to the

MATERIAL TO AN AUTHORIZED USER. BY

issuing custodian. The custodian will enter the

SIGNING THIS REPORT YOU ARE

transaction as “filled-in end equipment” in

ASSUMING FULL RESPONSIBILITY FOR THE

LCMS. Upon receipt of the conversion notice

PROTECTION, DISTRIBUTION AND

from the Central Facility, file the conversion

DESTRUCTION OF THIS MATERIAL.” The

notice in the COMSEC accounting files. Re-key

custodian will print and retain a copy of this

is not entered into the LCMS Workstation.

destruction report. To complete this transaction

in the LCMS database, you must “confirm

destruction of local material.”

6-6

FOR OFFICIAL USE ONLY

TB 380-41

6.5.7

(U) Five Digit Outgoing Voucher

what transpired, enter the item, and then click

Number. When physical material is received by

“add.” Prepare the report and record

an AKMS COMSEC account and the “reconcile

annotations. These steps will cause a

physical material hardcopy” report is created,

“Possession Report” to be generated. The

LCMS can only accept a maximum of five (5)

custodian must wrap and send the transaction to

digits as input for the incoming voucher number.

the COR. A copy of the Possession Report will

In cases where the voucher number is longer

be printed, attached to the copy of the reportable

than 5 digits, custodians should enter the last

destruction report and the MFR, and retained on

five digits of the voucher number as the

file. When the item is later destroyed, normal

incoming number.

destruction procedures will be followed.

6.5.8

(U) Destruction “Certification

6.5.10 (U) Account Transactions to COR.

Statements” IAW TB 380-41, paragraph

When requested, the custodian will retransmit

4.19.5b, the “I certify” statement must be

transactions to the COR. In the event that the

inserted on all consolidated destruction reports.

COMSEC account transactions have been

In LCMS, it will not be required to insert the “I

archived, the COR will be provided a hard copy

certify” statement. All reportable destruction

of the transaction and will be notified that

reports generated by LCMS are “consolidated”

requested soft copy of these transactions have

destructions. Custodians will retain the local

been archived.

vouchers with wet signatures and post with their

reportable destruction report.

6.6 GENERAL

6.5.9

(U) Inadvertent Destruction of

INFORMATION ON AKMS

COMSEC Material. Due to the strict security

procedures enforced within the LCMS

ELECTRONIC KEY

Workstation, when destruction of material is

erroneously entered into AKMS, LCMS cannot

DISTRIBUTION AND

“reverse” this action. Should this situation occur,

DESTRUCTION.

the custodian must perform the following steps

immediately:

(U) The following paragraph provides some

(U) Contact the COR account manager

general guidance/information on AKMS

via e-mail, message, or fax with an explanation

electronic key distribution and destruction.

of the error (include the short title, edition,

6.6.1

(U) Electronic Key Distribution.

quantity, and serial number). Prepare a

Memorandum For Record (MFR) explaining the

(U) AKMS COMSEC accounts will issue

circumstances of the error.

electronic keying material to Hand Receipt

Holders (HRHs) via a Data Transfer Device

(U) Within LCMS, the custodian will

(DTD) or to a Common Fill Device (CFD). The

generate a “reportable destruction report,”

COMSEC Custodian will retain a signed copy of

annotate what transpired in the comment

the issuing SF 153 until a destruction certificate

section, print and retain the document as an

is received from the user or until unused

accountable record, and send the destruction

portions of the electronic key is returned from

report via the message server to the COR.

the HRH. An automated audit trail exists when

material is distributed to a DTD. The HRH can

(U) Contact the EKMS Help Desk,

verify if key was received by viewing the key

explain the situation, and ask to be walked

storage register in the DTD. The COMSEC

through Inventory Reconciliation Status

Custodian will attach a descriptive ID to all

Transaction (IRST) or inventory cycle

electronic keying material being distributed to

procedures.

the DTD. This ID will provide a quick, verifiable

means to identify the material.

(U) The custodian will then be required

to add those items back into the LCMS

database. The custodian should click on

accounting > possession > originate possession

report. In the “reason for possession” box, enter

6-7

FOR OFFICIAL USE ONLY

TB 380-41

(U) It may become necessary to

and Personal Identification Number (PIN) for the

distribute the electronic keying material below

LCMS Workstation may be stored together

the hand receipt level, or sub-hand receipt. This

unless the account is a TOP SECRET (TS)

will be accomplished by issuing the key from

account. If the account is a TS account, follow

DTD to DTD, DTD to CFD, or CFD to CFD.

the procedures set forth in AR 380-5, chapters 6

HRHs will prepare a local Electronic Key

& 7.

Management (EKM) worksheet to record or

control distribution (custodians may create their

6.7.2

(U) LMD/KP “Disaster Recovery Kit.”

own EKM worksheets as long as the required

The following is a list of critical materials (as a

fields are inserted): see Appendix D for a

minimum) that must be maintained by each

sample (reproducible) worksheet. The HRH will

COMSEC account in case the LMD/KP has

retain the local record until destruction and/or

failed and must be reinitialized. The following

turn-in has been completed and the COMSEC

listing is referred to as a "Disaster Recovery Kit."

Custodian closes out the hand receipt.

(U) KP REINIT CIK #1 (2 each), KP

6.6.2

(U) Electronic Key Destruction. To

REINIT CIK #2 (2 each). One set of the KP

ensure 100% accountability and control of

REINIT CIKs should be hand-receipted to the

electronic keying material from its generation

unit security office. The other set will remain

until destruction, COMSEC Custodians and

with the Disaster Recovery Kit.

users must document a positive and

uninterrupted audit trail. The HRH and a

(U) Backup KP User CIKs, one each for

witness shall verify the destruction by signing

the primary and alternate custodian, will be

and returning a Local Destruction Report to the

created and maintained in the Disaster

issuing COMSEC Custodian. Signed Local

Recovery Kit.

Destruction Reports will be retained by the

custodian as supporting documentation for the

(U) A minimum of two EKMS ID STU -III

consolidated (reportable) destruction report IAW

keys must be retained on hand.

TB 380-41, and filed IAW AR 380-40, Appendix

C. When HRHs distribute electronic key below

(U) The u/ Filesystem Backup Tape (as

the hand receipt level, they must ensure this

a minimum, the current day or a tape for the

material is destroyed upon supersession and

previous day).

that a valid, written audit trail of the destruction

is completed and retained on-site. A locally

(U) LMD User’s Floppy Disk (1 each,

developed EKM worksheet will be used to track

created and updated by custodian).

this destruction. The HRH will retain a copy of

the Sub-Hand Receipt Holder’s EKM worksheet

(U) SCO UNIX Emergency Floppy Disk -

for 60 days after the key is destroyed or turned

boot (1 each)

in to the custodian.

(U) SCO UNIX Emergency Floppy Disk -

root (1 each)

6.7 ACCESSIBILITY TO

(U) SCO UNIX OPENSERVER 5.0.5

THE LMD/KP.

Desktop Installation Software CD (1 each).

(U) All personnel having read/write access to the

(U) SCO UNIX OPENSERVER 5

LMD/KP will be registered as a User. The

Supplement CD (1 each).

Systems Administrator (SA) for the LCMS

Workstation will assign appropriate privileges for

(U) Floppy disk, SCO OPENSERVER 5

each individual. When there is a permanent,

OSS497B or OSS497C Patch (1 each).

unauthorized absence of a COMSEC Custodian

or alternate having access to the LMD/KP, or if

(U) KP MPUP Field Download 0403.

an individual is no longer authorized access, the

individual will immediately be deleted from the

(U) Master Copy of Utility Floppy Disk

LCMS Workstation (see Table 6-2).

(UFD) (1 each).

6.7.1

(U) CIK and PIN Number Storage.

m. (U) LCMS 4.03 Installation CD (1 each).

The operator Cryptographic Ignition Key (CIK)

6-8

FOR OFFICIAL USE ONLY

TB 380-41

(U) (Laptop ONLY): LynnSoft PC Card

(U) Once the /u filesystem back up has

Software, lsio4ports, Part # LSPC5D, Version

been completed, archiving of the LCMS

2.0 Release 1.6 (1 each).

database will be performed. Archiving will

remove all completed transactions that have

(U) Floppy Disk (Laptop only): LynnSoft

occurred on the system to date. It is

PC Card Software, LSIO4PORTS, part #

recommended that archiving be performed on a

LSPC5D, Version 2.0, Release 1.6 (1 each).

floppy disk due to the smaller size of the disk

and the cost effectiveness; however, any

(U) LCMS Workstation System Backup

removable storage device may be used. Each

and Restore Procedures for Phase 4 (1 each)

time the system is archived, a different diskette/

(available in the SA Manual).

storage device must be used. This will prevent

the information from being overwritten and lost.

(U) (Desktop ONLY): Key to the

mounting lock on the removable hard drive

(U) Next, the custodian will perform the

chassis (1 each).

KP changeover. The KP changeover involves

decrypting and re-encrypting all key and voucher

(U (Desktop ONLY): Key to the rear

data in the LCMS database. Archiving must be

CPU cabinet lock (1 each).

performed prior to KP changeovers. This

procedure will minimize the amount of time

(U) SCO OPENSERVER 5 Certificate of

required to decrypt and re-encrypt data stored in

License and Authenticity (COLA) should be

the LCMS database. A new set of REINIT #2

maintained by the COMSEC account. If the

keys will be created at the end of this process;

Information Assurance Security Officer (IASO)

therefore, there must be 2 blank KSD-64s on

requires that the original COLA be stored in the

hand for this purpose. DO NOT ZEROIZE THE

IASO office, arrangements to obtain this COLA

OLD REINIT KEY! The two most current sets of

within 24 hours must be made with the IASO.

REINIT keys must be kept on hand. Any

REINIT keys older than the two most current

(U) The LCMS Workstation Disaster

sets can be zeroized.

Recovery Kit is mission essential and must be

maintained as a complete unit to ensure

(U) Once it is determined that the KP

immediate recovery of the system. It cannot be

changeover has been effectively accomplished,

emphasized enough that material comprising the

a /u filesystem backup must be performed again

Disaster Recovery Kit must be maintained.

at this point. This will complete the functions

Failure to maintain the complete recovery kit

that are required to ensure that the post-KP

will be considered a COMSEC Incident and

changeover LCMS database is successfully

will be reported to the Army COMSEC

backed up. This /u filesystem backup may be

Incident monitoring activity.

done on the same tape as the first one

mentioned in subparagraph a. All backup and

6.7.3

(U) Archiving and Key Processor (KP)

archiving media must be marked SECRET and

Changeover. Archiving and KP changeovers of

safeguarded according to AR 380-5. For

the LCMS Workstation must be performed

additional backup requirements, refer to NAG-

quarterly. More frequent archiving is acceptable

71. Explanations of archiving and changeover

and encouraged for accounts that process

are contained in the EKMS 704 series user’s

numerous transactions. To ensure that

manual. COMSEC Custodians may also refer to

information does not become lost and the LCMS

guidance received from CSLA, such as the

system does not become overloaded with

Utility Floppy Disk, and specific Army Backup

information, a database backup of the system

and Restore Procedures documentation

must be performed. The custodian must

contained in the Army Phase 4 LCMS

perform the changeover in the following order:

Workstation System Administration Manual (TB

11-7010-348-10-1).

(U) A backup of the /u filesystem must

be performed using the UFD Backup and

6.7.4

(U) Accountability for KSD-64 Transit

Restore menu option #2.

CIKS. Transit CIKs that are fielded with a new

depot-initialized KP are ALC- 4 and will be

accounted for in the CMCS until the KP is

initialized within LCMS. This transit CIK then

6-9

FOR OFFICIAL USE ONLY

TB 380-41

becomes the user’s CIK and will be handled as

the local account registration must remain “on”

SECRET “collateral” material. The CIK will no

at all times. De-selecting the KP option in an

longer be accountable in the CMCS. Whenever

attempt to increase the processing times of the

a newly initialized KP is provided to an account,

LCMS is a reportable COMSEC Incident.

it is the responsibility of the account to provide

blank KSDs.

6.7.6

(U) AKMS User Deletion. See Table

6.2.

6.7.5

(U) AKMS KP Settings. When an

account is fielded via an LCMS Workstation, the

KP settings are established. The KP selection in

Table 6 -2. Deletion of an AKMS User Account from an LCMS Workstation

This procedure was developed using an LCMS Workstation running SCO OpenServer 5.0.5 Desktop

and LCMS 2.0.2.2.

Step

Action

You must be logged into LCMS as a user ID-privileged as an LMD Administrator. If the

account ID you are about to delete has been tagged as a KP operator or KP administrator, you

will need to be logged onto the KP before you can delete the user ID from LCMS.

From the LCMS Desktop Menu Bar, click on Registration. In the Operator Tool window

that opens, click on Operator Tool.

In the Operator Tool window, click on the line containing the user ID that is to be deleted.

This will highlight the line in reverse video. Then, click on the Delete button. In the Operator

Delete Confirmation window that opens, click on the Continue button.

If the user ID being deleted is associated with the KP, you will need to respond to several

prompts on the KP display. Answer the KP questions by pressing the appropriate button on

the KP.

After a few seconds, confirm that the user ID no longer displays in the Operator Tool

window. In the same window, click on the Exit button.

Simultaneously depress the keys <Ctrl><Alt><F1> to switch to screen 1, the Console

screen.

Use the UFD Utility Menu option #2 to remove the user ID from UNIX and to remove that

user’s home directory from the system. Proper procedure requires that the System

Administrator review the content of the user’s home directory before deleting its content.

If the person using the now deleted user ID had knowledge of the root’s password, the

password for root must be changed. To change the root’s password, use the following

command and answer its prompts in accordance with current security guidelines:

passwd <Enter>

6-10

FOR OFFICIAL USE ONLY

TB 380-41

6.9.1

(U) STU-III Connectivity. The AKMS

6.8 STORAGE OF LCMS

requires STU-III connectivity to a message server.

AKMS message servers are located at the

WORKSTATION.

Primary Tier 1 Sites (PT1S) (i.e., the CORs

located at Ft Huachuca, AZ; San Antonio, TX; and

(U) Any space housing the LCMS Workstation

the Extension Tier 1 site located in Mannheim,

must be an approved COMSEC Facility, except

Germany). The location of the message servers

for a workstation deployed in a temporary

supporting Army COMSEC accounts will vary.

environment for a period not to exceed 90 days.

Commanders should consider upgrading existing

It is recommended, that the LCMS Workstation be

telephone lines supporting Army COMSEC

stored at all times in its operational configuration,

accounts based on this requirement. The use of

in a secure area approved by the command’s

operator-assisted calls is not conducive to

cognizant security authority for the open storage

efficient automated operations and may

of SECRET material. If open storage in an

jeopardize the successful completion of AKMS

approved COMSEC Facility is not possible, the

transactions between the LCMS Workstation and

LMD hard drive and key processor associated

the PT1S message servers during critical periods

with the desktop, and the complete laptop LMD

of operation.

must be stored in a GSA-approved security

container when unattended, as specified in AR

6.9.2

(U) Laser Printers. All accounts

380-40. Frequent disassembly and removal of

receiving LCMS Workstations will be fielded with

this sensitive equipment for storage, and

dedicated laser printers. If, for some reason, this

subsequent reinstallation, can be expected to

printer becomes defective and it is necessary to

significantly reduce its serviceable life

use a replacement laser printer, it must be the HP

expectancy. Extreme care must always be

LaserJet III or equivalent. If the account uses a

exercised when handling the equipment and

dot matrix printer, it must be the Epson LQ-570 or

when connecting/disconnecting the LMD/KP to

compatible. There are some restrictions with

prevent damage to external connectors. Open

respect to using a dot matrix printer.

storage requirements for SECRET material are

outlined in AR 380-5.

(U) Screen dumps will not print.

(U) Most of the activity reports will print

6.9 ASSOCIATED

out but the printout may not contain all the

EQUIPMENT AND

information because of the paper width.

REQUIREMENTS.

(U) Activity reports will be printed only in

landscape mode.

(U) All COMSEC accounts receiving the LCMS

Workstation must, repeat, must have a

(U) All other printouts should work well,

dedicated STU -III. The STU -III will be used for

including the COMSEC Material Report (SF 153)

connection into the AKMS, and will require the

and printable icon reports.

use of a special COMSEC key, which is provided

by CSLA during AKMS fielding. The STU-III

6.9.3

(U) DTD. A Data Transfer Device (DTD)

associated with AKMS can be used to make other

must be on hand at each AKMS account.

secure calls, but it must be available to the AKMS

terminal at all times in order to provide continuous

6.9.4

(U) Data Cartridge. An HP T-20 Data

Cartridge (nomenclature HP C 4435”X”) is

key management and distribution functions, as

well as connection into the AKMS architecture, as

required for the LCMS to perform back-up

needed.

operations. It is available in single pack (HP C

4435A), double pack (HP C 4435B), or five-pack

(HP C 4435D). If there is any difficulty with the

procurement of this item, see Appendix F of this

TB for points of contact, or request assistance

from the AKMS Help Desk.

6-11

FOR OFFICIAL USE ONLY

TB 380-41

6.11.3

(U) Replacement KP. Due to security

6.10 TRAINING.

considerations and because of anticipated battery

failure within the KP, it is essential that, when

(U) Both the custodian and an alternate from each

CSLA notifies the account to evacuate the KP for

COMSEC account must be trained on the

scheduled maintenance, this action be taken in a

operations of the LCMS Workstation (see

timely manner. Replacement KP devices will be

paragraph 2.7.1[c]). There must be a minimum of

located at pre-positioned sites. When an account

one System Administrator (SA) at each camp,

receives notification to return a KP to Lackland

post, and station that the commander will make

AFB, TX, for maintenance, a replacement KP will

available to perform SA duties with reference to

be automatically transferred to the account from

the AKMS.

the geographical area servicing the account.

Once the new KP is received and key data

6.10.1

(U) LCMS Operator Training Criteria.

transferred, the old KP must be zeroized. The

Personnel selected for LCMS operator training

custodian will then make arrangements to ship it

must be appointed COMSEC Custodians and

via DCS in its specialized shipping container to

alternates. Custodians must have previously

the COMSEC Account at Lackland AFB, TX.

attended the Standardized COMSEC Custodian

Course (SCCC). Personnel attending LCMS

6.12 ADDITIONAL ARMY

training must be computer literate and preferably

have some knowledge of the UNIX operating

PUBLICATIONS.

system. It is imperative that trained individuals

return to their units and provide training to the

(U) LCMS Workstations are fielded with the

COMSEC account clerks and clerical personnel

following reference publications:

on the operations of the LCMS. Commanders

must carefully consider local personnel transfers,

separations and retirements to ensure that there

*EKMS 704C Volume 1 (LMD/KP Operator’s

are sufficient LCMS-trained personnel to occupy

Manual).

these critical positions.

*EKMS 704C Volume 2 (LMD/KP Quick Steps

and Troubleshooting Guide).

6.11 LCMS MAINTENANCE.

· TB 11-7010-348-10-1 (Technical Bulletin

6.11.1

(U) LMD Accountability. The LMD is

System Administration Manual for Army

accounted for on the unit property book. It will be

Phase 4 Local COMSEC Management

maintained according to existing installation

System [LCMS] Workstation).

support procedures for the repair and service of

classified automation systems.

· TB 11-7010-293-15-1 (Warranty Program for

Army Key Management System [AKMS]

6.11.2

(U) Depot Level Repair. The Key

AN/GYK-49[V]1&2).

Processor (KP) is a SECRET, COMSEC device.

Maintenance or repair of the KP below depot-level

· TM 11-7010-293-12 (Technical Manual

is not authorized. When failures of the KP occur,

Operator’s and Unit Maintenance Manual,

it must be evacuated through COMSEC account

Computer Set, General).

channels to Lackland AFB in San Antonio, TX, via

Defense Courier Service (DCS). Every three (3)

* Indicates documentation provided in both hard

years the KP must be returned to San Antonio for

copy and HTML format.

scheduled maintenance. CSLA will monitor the

distribution of the KP within the Army and alert

6.12.1

(U) LMD Software Upgrade. (U) As the

COMSEC accounts when the KP must be

LCMS Workstations are upgraded with new

returned for maintenance and re-certification.

versions/phases of LCMS, the appropriate

Commanders at all levels must stress proper care

documentation in the preceding paragraph will

and handling of the KP. Misuse or damage of the

also be updated. If the need exists to validate the

KP, other than fair wear and tear, may result in a

current editions of AKMS manuals, users should

report of cursory investigational and substantial

contact the Army EKMS Help Desk.

financial liabilities to the user.

6-12

FOR OFFICIAL USE ONLY

TB 380-41

6.12.2

(U) Doctrine. COMSEC accounts should

connectivity will be secured by either STU-III or

have the following Army-adopted NSA doctrine

STE secure voice and data telephone

and policy guides on hand:

equipments. This configuration also allows for the

distribution of electronic COMSEC keying

· NAG 47 (Operational Security Doctrine for

between COMSEC user accounts (Tier 2 - Tier

The AN/CYZ-10/10A Data Transfer Device

2). The STU -III or STE interconnected to a DTD

[DTD]).

and interfaced through the PTSN provides the

COMSEC account with the capability to provide

· NAG 71 (Operational Security Doctrine for

electronic key material via direct communications

The Local Management Device/Key

from Tier 2 to Tier 3.

Processor [LMD/KP]).

6-14 AKMS ACCOUNT

6-13 COMMUNICATIONS.

INVENTORIES.

(U) The Public Telephone System Network

(U) ALC 7 material is locally generated electronic

(PTSN) dial-up system will provide

key. A printout of the ALC 7 material is required

communications between the LCMS Workstations

annually for the custodian’s review. The

and the EKMS message servers located at the

custodian must ensure all superseded ALC 7 key

Primary Tier 1 Sites. Army COMSEC accounts

material is destroyed upon supersession.

within the European Theater will have connectivity

to the European Extension Tier 1 (ET1) site. This

6-13

FOR OFFICIAL USE ONLY

TB 380-41

CHAPTER 7

COMSEC COMPROMISES AND INCIDENTS

destruction reports (including back-up

7.1 COMPROMISES AND

documentation for consolidated destruction

reports) for COMSEC material; and the

INCIDENTS.

capture, recovery by salvage, tampering, or

unauthorized viewing, access or

(U) It is important that all personnel who possess,

photography of classified COMSEC material

handle, operate, maintain, or repair COMSEC

or unclassified key marked “CRYPTO.” The

material be totally familiar with physical and

loss, theft, capture, recovery by salvage, or

cryptographic security policies and procedures.

tampering with a Controlled Cryptographic

Personnel will report all security violations to the

Item (CCI), keyed or un-keyed, is also

COMSEC Facility supervisor, the COMSEC

considered a Physical COMSEC Incident

Custodian, and the local commander. An

and will be reported accordingly.

undetected or unreported incident is the most

damaging security violation of all because the

(2)

(U) Personnel Incidents. Any attempted

potential damage to national security cannot be

recruitment, known or suspected contact by

neutralized.

a foreign intelligence entity, capture by the

enemy, or unauthorized absence or

(U) Any individual who knowingly conceals,

defection of an individual having knowledge

obstructs, fraudulently alters records, or

of and access to COMSEC information or

otherwise attempts to cover-up the existence of

material are considered Personnel Incidents.

a COMSEC Incident, and any individual who

The unauthorized disclosure of COMSEC

becomes aware that a COMSEC Incident has

information, or attempts by unauthorized

occurred and fails to report such an incident, are

persons to affect such disclosure, also fall

both guilty of a criminal offense punishable

into this category.

under federal statute and the UCMJ, as

applicable.

(3)

(U) Cryptographic Incidents. Any

equipment malfunction, human error by an

(U) Compromises. A compromise results

operator or COMSEC Custodian that

from any event or action where COMSEC material is

adversely affects the cryptosecurity of a

irretrievably lost or available information clearly

machine, auto-manual, or manual

proves that unauthorized persons have gained

cryptosystem is a Cryptographic Incident.

access to classified COMSEC information or

Unique incidents, which pertain to specific

unclassified key marked “CRYPTO.”

cryptosystems, are contained in technical

cryptographic operational operating manuals

(U) COMSEC Incident. A COMSEC

(TM/KAO), maintenance manuals (KAM),

Incident is an occurrence that potentially jeopardizes

limited maintenance manuals (LMM),

the security of COMSEC material or the secure

technical bulletins (TB), or in specific DA

electrical transmission of national security

pamphlets.

information (see Table 7-1). AR 381-12 requires the

local U.S. Army counterintelligence support unit be

(4) Administrative Incidents. Any action that

notified of all reportable COMSEC Incidents.

jeopardizes the integrity of COMSEC

material is considered an Administrative

(U) There are four types of COMSEC

Incident. These incidents include insecure

Incidents that must be reported (reference Table 7-1

practices that are dangerous to COMSEC

for a specified listing of each type of incident):

security as well as violations of COMSEC

procedures that require corrective action to

(1)

(U) Physical Incidents. These include the

ensure the violations do not recur.

loss, theft, loss of control, improper

preparation of, or lack of preparation of,

FOR OFFICIAL USE ONLY

7-1

TB 380-41

Table 7 -1. Reportable COMSEC Incidents

TYPE OF INCIDENT

CIRCUMSTANCES (See AR 380-40 for additional information)

1. Physical

Loss due to:

Incidents

1. Technical Surveillance.

(Reportable to the

2. Combat.

NSA and COR)

3. Capture.

4. Theft.

5. Other

Physical security violations:

1. Tampering.

2. Unauthorized viewing.

3. Recovery by salvage.

4. Photography of classified material or unclassified key marked

“CRYPTO.”

5. Material found that was previously reported lost.

6. COMSEC material left unsecured or unattended where

unauthorized persons had access.

7. Transportation/shipment via unauthorized means.

8. Improper destruction.

9. Unauthorized maintenance or modification.

10. Deliberate falsification of COMSEC records or reports.

11. Unexplained removal of keying material from its protective

packaging.

12. COMSEC material not accounted for on accounting records or

COMSEC material on hand previously reported as destroyed.

13. Loss of TPI or No-Lone Zone for Top Secret (TS) material.

14. Any loss of control over a keyed common fill device.

15. Discovery of COMSEC material not completely destroyed and

left unattended.

16. Discovery of a clandestine electronic surveillance or recording

device in or near a COMSEC Facility.

17. Unexplained zeroization of COMSEC equipment when there are

indications of unauthorized access or penetration.

18. Unauthorized copying or reproduction of COMSEC material.

Any other occurrence jeopardizing the physical security of

COMSEC material or information.

Loss, theft, capture, recovery by salvage, or tampering with

keyed or un-keyed CCI equipment.

7-2

FOR OFFICIAL USE ONLY

TB 380-41

Table 7 -1. Reportable COMSEC Incidents (Continued)

TYPE OF INCIDENT

CIRCUMSTANCES

2. Cryptographic

a. Use of key material which has been:

Incidents

1. Compromised

(Reportable to the

2. Superseded

NSA and COR)

3. Defective

4. Previously used (not authorized for re-use)

b. Incorrect application of key material:

1. Use of key produced without authorization of the NSA

(homemade maintenance, homemade codes, etc.).

2. Without authorization of the NSA for other than the intended

purpose (test key for operational use; key used on more than

one type of equipment). Does not include use of operational key

for training when authorized by the CONAUTH.

3. Unauthorized extension of a cryptoperiod.

c. Any equipment malfunction, operator or management error that

adversely affects the operational security of a cryptosystem.

d. Use of COMSEC equipment with defective cryptologic circuitry

or use of unapproved operating procedures.

e. Plain text transmission resulting from COMSEC equipment

failure/malfunction.

1. Transmission during a failure.

2. Transmission after an uncorrected failure that may cause

improper operation of COMSEC equipment.

3. Operational use of COMSEC equipment without completion of

alarm-check test or after failure of the required alarm-check.

4. Discussion via non-secure communications of the details of a

COMSEC equipment failure or malfunction.

Any other occurrence that may jeopardize the cryptosecurity of

a COMSEC system.

3. Personnel

a. COMSEC personnel who are known or suspected of:

Incidents

1. Absence without leave.

(Reportable to the

2. Defection.

NSA and COR)

3. Espionage.

4. Treason.

5. Attempted recruitment.

6. Control by a hostile intelligence entity.

7. Capture by the enemy during hostilities.

8. Sabotage by a person having detailed knowledge of COMSEC

information.

b. Any other occurrence that may jeopardize the security of

COMSEC material or the material it protects.

7-3

FOR OFFICIAL USE ONLY

TB 380-41

Table 7 -1. Reportable COMSEC Incidents (Continued)

TYPE OF INCIDENT

CIRCUMSTANCES

4. Administrative

a. Actions which jeopardize the integrity of COMSEC material:

Incidents

1. Premature or out -of-sequence keying.

(Reportable only

2. Inadvertent destruction of key material.

within the Army

3. Destruction without authorization of CONAUTH.

chain-of-command

4. Receipt of a package containing COMSEC material with a

as directed by the

damaged outer wrapper, but the inner wrapper is intact.

MACOM. At a

5. Failure to zeroize a common fill device or failure to destroy

minimum, the

COMSEC material within required time limits.

(IAW AR 380-40

incident must be

paragraph 7-3d[4], late destruction over 30 days is a Physical

reported to the

COMSEC Incident.)

CONAUTH.)

6. Removal of key material from protective packing prior to issue or

(For KOV-14 User

removal of protective packaging without authorization.

Cards, see

7. Failure of a user to properly safeguard or secure unclassified

paragraph 7.9 of

Cryptographic Ignition Keys (CIK), PCMCIA Cards, PKI Devices,

this TB)

Common Access Cards, etc.

See DA Pamphlet 25-380-2 for reporting CCI Administrative

Incidents.

CAUTION: Comply with the following security tips:

(U) Restrict knowledge of information concerning tampering with COMSEC equipment,

penetration of protective technologies, information related to system vulnerabilities, or

discovery of clandestine devices on a strict need-to-know basis.

(U) Immediately and simultaneously report to the NSA, the local counter-intelligence field

office, and the controlling authority when tampering is known or suspected. Wrap and seal

the material along with all protective technologies and store it in the most secure limited-

access area available. Take no action until instructions are received from the NSA.

(U) Where a clandestine surveillance or listening device is suspected, do not discuss it in the

area of the device or anywhere else a device may similarly have been installed. Take no action

that might alert the clandestine activity, except on instructions from the applicable counter-

intelligence field office or the NSA.

(U) The U.S. Army CECOM

7.2 REPORTING COMSEC

Communications Security Logistics Activity

(USACSLA) is designated by HQDA as the

INCIDENTS.

Army COMSEC Incident Monitoring Activity

(CIMA) and the Adjudication Authority for all

(U) In accordance with AR 381-12, the

reportable COMSEC Incidents. CSLA will be an

local U.S. Army Counterintelligence Support Unit

addressee on all incident reports. For

will be notified of all reportable COMSEC

assistance and guidance in the preparation and

Incidents immediately (the same day) upon

submission of incident reports, contact the

discovery. Formal written reports, as directed in

COMSEC Incidents Program Manager at

this TB, are required within 24 to 72 hours

Commercial (520) 538-6008/ DSN 879-6008 or

depending on the type of incident (see

via e-mail at: incidentdesk@csla.army.mil or

paragraph 7.3 below).

incidentdesk@huachuca-emh99.army.smil.mil.

7-4

FOR OFFICIAL USE ONLY

TB 380-41

7.2.1 Responsibilities.

(2) (U) Immediately report the following

types of COMSEC Incidents to HQDA,

(U) The NSA will perform the following

G-2, ATTN: DAMI-CDS.

functions:

(a) (U) Loss or theft of Mission/Inter-

(1)

(U) Evaluate all Cryptographic and

theater COMSEC Package (ICP)

Personnel COMSEC Incident Reports.

key.

(2)

(U) Evaluate all Physical COMSEC

(b) (U) Falsification of records that result

Incident Reports involving keying

in a compromise of COMSEC

material when the responsible

material.

Controlling Authority cannot be

identified.

of the Controlling Authority and/or

(3)

(U) Evaluate all Physical COMSEC

CIMA Program Manager, may

Incidents involving multiple

adversely impact mission critical

Controlling Authorities of different

command, control, and

departments or agencies.

communications (C3), sensitive

intelligence activities, or ongoing

(4)

(U) Evaluate all COMSEC Incidents

contingency operations.

involving the Secure Data Network

System (SDNS) and STU -III Key.

(3) (U) Evaluate Physical COMSEC

Incidents involving multiple Army

(5)

(U) Evaluate all reportable COMSEC

Controlling Authorities.

Incidents related to:

(4) (U) Evaluate Physical COMSEC

(a) (U) Tampering, sabotage, or

Incidents involving a single Army

evidence of covert penetration of

Controlling Authority when that

packaging.

Controlling Authority caused the

incident.

(b) (U) Unauthorized modification of

COMSEC equipment, security

(5) (U) Direct additional investigation and

containers, or vaults where

reporting, as warranted.

COMSEC material is stored.

(6) (U) Administer final adjudication to

determine when a reported COMSEC

COMSEC technical material

Incident has resulted in a COMSEC

promulgated by the NSA (e.g.,

Insecurity.

algorithms, logic, KAMs, technical

engineering documents).

(7) (U) Provide statistical data and a

narrative assessment on the number

(U) The Army CIMA will perform the

and type of reportable COMSEC

following measures:

Incidents for inclusion in the CSLA

Annual COMSEC Assessment Report to

(1)

(U) Establish a formal register to assign

HQDA per AR 380-40, paragraph 6-4.

case numbers and a records jacket for

all reportable COMSEC Incidents. All

(U) Controlling Authorities will be

records and supporting documents will

responsible for the following:

be retained on file for not more than six

(6) years or until no longer needed

(1) (U) Evaluate Physical COMSEC

following the completion and closure of

Incidents involving keying material they

the case file (reference AR 380-40 for

control, except as noted in

additional information).

subparagraph b above.

7-5

FOR OFFICIAL USE ONLY

TB 380-41

(2) (U) Notify the Army CIMA and the NSA

precedence and the allowed preparation time for

regarding the results of all completed

an incident report. There are four types of

evaluations.

reports:

(3) (U) Initiate recovery actions when it is

(U) Initial Report. This report is

believed that material has been

required for each detected COMSEC Incident.

compromised. See AR 380-40,

The unit that detected the incident will submit

paragraph 7-10.

initial reports. The unit that detected the incident

might not be the unit that caused the incident.

(4) (U) Evaluate and report incidents

The unit that caused the incident will direct

involving Signal Operating Instruction

additional reporting as warranted/required.

(SOI) as classified information under the

provisions of AR 380-5.

(U) Amplifying Report. This report will

be submitted when there is new information

7.2.2 Controlling Authority Limitations.

regarding an incident for which an initial report

has been submitted, or every 30 days until a

(U) Controlling Authority responsibilities are

final report is submitted. It may also serve as a

limited to initiating precautionary supersession

final report.

and recovery actions, as warranted, and

rendering an evaluation as part of the

(U) Final Report.

administrative processing and closure of the

Incident. Recommendations related to

(1)

(U) The final report will include a

procedural changes or disciplinary measures

summary of the results of all inquiries

are outside the scope of this responsibility.

and investigations, and it must identify

corrective measures taken or planned to

minimize the possibility of recurrence.

7.3 COMSEC INCIDENT

(2)

(U) The final report may be incorporated

REPORTS.

with the initial report in those instances

where all information concerning an

7.3.1

(U) Report Contents.

(See following

incident has been obtained and there is

sub-paragraphs 7.5, 7.6, and 7.7 for detailed

no follow on information.

(See Figure 7-

instructions.)

2.)

(U) In order to conduct a proper

(U) Abbreviated Report. This report

evaluation, it is vital that all immediately

may be submitted during ground combat

available and essential information be included

operations to report incidents involving

in Initial Reports concerning reportable

the physical security of key. The report

COMSEC Incidents. Incident reports must NOT

shall provide sufficient details to enable

be delayed in order to obtain additional

the CONAUTH to determine whether a

information. For example, a missing current key

compromise has, in fact, occurred.

list will be reported immediately after a

Therefore, the report must answer, at a

reasonable search.

minimum, the questions: who, what,

when, where, and how. If the

(U) Incident reports will be classified

CONAUTH orders an unscheduled

according to content and must be transmitted by

supersession of key as a result of the

appropriate electrical means. Memorandum

incident, a subsequent complete report

reports may be used only when electrical means

must be submitted as soon as possible.

are not available. COMSEC Incident Reports do

not require the assignment of a Reports Control

7.3.3

(U) Report Precedence.

Symbol (RCS).

(U) Initial and amplifying record reports

7.3.2

(U) Reporting Incidents. Reports are

of the following incidents will be assigned

normally filed in sequence, each subsequent

IMMEDIATE precedence; reports must be

report relaying additional information, as the

submitted as soon as possible, but no later than

incident investigation proceeds. The particular

nature of each incident will determine the

7-6

FOR OFFICIAL USE ONLY

TB 380-41

24 hours after discovery of the incident or

(U) Other Reportable COMSEC

receipt of amplifying information.

Incidents. Initial and amplifying reports of any

COMSEC Incident not covered in the preceding

(1)

(U) Incidents involving currently effective

paragraphs, normally will be assigned ROUTINE

keying material or keying material

precedence and must be submitted as soon as

scheduled to become effective within 15

possible, but no later than 72 hours after

days.

discovery of the incident or upon receipt of

amplifying information. However, originators

(2)

(U) Incidents involving defection,

should assign higher precedence to a report that

espionage, hostile cognizant agent

has potential for significant impact.

activity, clandestine exploitation, enemy

capture, tampering, penetration,

7.4 ROUTING OF INCIDENT

sabotage, unauthorized copying,

reproduction or photography.

REPORTS.

(3)

(U) When known compromise of

(U) Incident reports are OFFICIAL

RECENTLY (within 30 days)

command correspondence and will ALWAYS be

superseded key is detected, the incident

submitted by or for the commander. All reports

will be reported immediately to all

will be classified depending on their content;

ACTION addressees and will be

however, all Personnel Incident Reports will

assigned IMMEDIATE precedence.

be classified CONFIDENTIAL. As a minimum,

all other incident reports will be marked “FOR

(U) Initial reports of the following

OFFICIAL USE ONLY” or classified, as appropriate.

incidents will be assigned PRIORITY

Reports will be addressed as shown in Table 7-

precedence; the reports must be submitted as

soon as possible, but not later than 48 hours

after discovery of the incident and upon receipt

(U) In accordance with AR 380-40,

of amplifying information.

paragraph 7-9c. (2)(d), COMSEC Incidents

involving loss or theft of mission/Inter-theater

(1)

(U) Incidents involving future keying

COMSEC Package (ICP) key; falsification of

material scheduled to become effective

records that result in a compromise of key; or

in more than 15 days.

any incident that may impact mission-critical

Command, Control, and Communications (C3)

(2)

(U) Incidents involving superseded,

operations will immediately be reported to

reserve or contingency keying material.

HQDA, DCS, G-2 DAMI-CD by the Army CIMA.

(3)

(U) Cryptographic incidents. Reports

7.4.1

(U) Incident reports that involve Joint-

will be issued within 72 hours from the

Staff Position Control Material (Two-Person

time the incident was discovered.

Control) and devices must be addressed IAW

Joint Publication 1-04.

(U) When preparing reports of

Personnel Incidents and Physical Incidents

7.4.2

(U) Satellites and Space Vehicles.

involving COMSEC equipment (including that

When preparing reports pertaining to classified

lost in satellites and space vehicles) and

COMSEC equipment lost aboard satellites or

supporting documentation, assign a ROUTINE

other space vehicles that fail to reach or

precedence to all addressees. Submit these

maintain orbit, the COMSEC material may be

reports as soon as possible, but no later than 72

presumed destroyed upon reentry into the

hours after discovery and upon receipt of

Earth's atmosphere. These losses will be

additional information. You may assign higher

reported as prescribed in Table 7-1 and

precedence to reports that have potentially

paragraph 7.6.11.

significant impact to national security.

7-7

FOR OFFICIAL USE ONLY

TB 380-41

Table 7-2. Incident Reporting Addressees

TYPE OF

ACTION ADDRESSEE

INFO ADDRESSEE

INCIDENT

Physical

1. CONAUTH

1. DIRNSA FT GEORGE G MEADE MD //I413//

2. DIRUSACCSLA, FT

(See Note below.)

HUACHUCA AZ //SELCL-SAS-

2. DIRUSACCSLA, FT HUACHUCA AZ //SELCL-

IN//

ID-KEY//

DMS Address: /C=US/O=U.S.

DMS Address: /C=US/O=U.S. Government/

Government/OU=DoD/OU=

OU=DoD/OU=ARMY/OU=Organizations/

ARMY/OU=Organizations/L=

L=CONUS/L=FORT HUACHUCA AZ/

CONUS/L=FORT HUACHUCA

OU= CSLA/OU=CSLA ID Key

AZ/OU= CSLA/OU=CSLA

Incidentdesk 1(uc)

3. Local US Army Counterintelligence Support

Unit

4. Appropriate Command Channels

5. Appropriate MACOM ISSPM

6. CSLA CIR if OCONUS

Key in

1. DIRNSA FT GEORGE G

1. CONAUTH

distribution

MEADE MD //I413//

2. DIRUSACCSLA, FT HUACHUCA AZ //

channels

2. DIRUSACCSLA, FT

SELCL-ID-KEY//

HUACHUCA AZ //SELCL-SAS-

IN//

DMS Address: /C=US/O=U.S. Government/

(See DMS address above.)

OU=DoD/OU=ARMY/OU=Organizations/

L=CONUS/L=FORT HUACHUCA AZ/

OU= CSLA/OU=CSLA ID Key

3. Local US Army Counterintelligence Support Unit

4. Appropriate Command Channels

5. Appropriate MACOM ISSPM

Key incident

DIRUSACCSLA, FT

1. DIRNSA FT GEORGE G MEADE MD //I413//

at CONAUTH

HUACHUCA AZ //SELCL-SAS-

2. Local US Army Counterintelligence Support Unit

level

IN//

3. Appropriate Command Channels

(See DMS address above.)

4. Appropriate MACOM ISSPM

Equipment

1. DIRNSA FT GEORGE G

1. DIRUSACCSLA, FT HUACHUCA AZ //

and

MEADE MD //I413// (See Note

SELCL-ID-KEY//

Document

below.)

2. DIRUSACCSLA, FT

DMS Address: /C=US/O=U.S. Government/

HUACHUCA AZ //SELCL-SAS-

OU=DoD/OU=ARMY/OU=Organizations/

IN//

L=CONUS/L=FORT HUACHUCA AZ/

(See DMS address above.)

OU= CSLA/OU=CSLA ID Key

2. Local US Army Counterintelligence Support Unit

3. Appropriate Command Channels

4. Appropriate MACOM ISSPM

Cryptographic

1. DIRNSA FT GEORGE G

1. Local US Army Counterintelligence Support Unit

MEADE MD //I413// (See Note

2. Appropriate Command Channels

below.)

3. Appropriate MACOM ISSPM

2. DIRUSACCSLA, FT

4. CSLA CIR if OCONUS

HUACHUCA AZ //SELCL-SAS-

IN//

(See DMS address above.)

7-8

FOR OFFICIAL USE ONLY

TB 380-41

Table 7-2. Incident Reporting Addressees (Continued)

Personnel

1. DIRNSA FT GEORGE G

1. Local US Army Counterintelligence Support Unit

MEADE MD //I413// (See Note

2. Appropriate Command Channels

below.)

3. Appropriate MACOM ISSPM

2. DIRUSACCSLA, FT

4. CSLA CIR if OCONUS

HUACHUCA AZ //SELCL-SAS-

5. CONAUTH (When Keying material is suspected

IN//

to be involved.)

(See DMS address above.)

Administrative

Determined by the MACOM

CONAUTH

Incident reports pertaining to STU-III will also be addressed to the NSA, ATTN: Y18

7.4.3

(U) Discovery of Listening Devices.

electrical transmission, Initial and

Reporting instructions for the discovery of

Amplifying Reports of COMSEC physical

technical intercept devices (i.e., wiretaps or

and personnel incidents may be

"BUGS") are covered in AR 381-14(S).

transmitted in-the-clear, provided the

Classification will be SECRET, as a minimum.

commander has determined that

immediate transmission is essential.

Final Reports SHALL NOT be

7.4.4

(U) Compromising Emanations. Loss

transmitted in the clear.

of COMSEC information through compromising

emanations will be reported to the Army Certified

TEMPEST Technical Authority (CTTA).

7.6 PHYSICAL INCIDENTS.

Telephone: Commercial (301) 677-4440.

(U) The information contained in the following

paragraphs is considered essential and must be

7.5 TRANSMISSION

included in incident reports.

DURING MINIMIZE AND

7.6.1

(U) Physical Incident Reports.

“IN-THE-CLEAR.”

Include the following information in all Physical

Incident Reports:

(U) Transmission During MINIMIZE.

Initial and Amplifying COMSEC Incident Reports

(U) Account Identification. COMSEC

are authorized for electrical transmission during

account number(s) and the unit(s) involved.

periods of MINIMIZE, in accordance with AR

25-10. Final Reports; however, will NOT be

(U) Material Identification. Complete

electrically transmitted during MINIMIZE.

identification of the material involved in the

incident, including:

(U) Transmission "In-the-Clear."

(1)

(U) Short Title (including edition

(1)

(U) Cryptographic Incidents. Reports

designator).

of cryptographic incidents WILL NOT be

transmitted in the clear.

(2)

(U) Accounting/Serial Number(s) of ALC

1 and 6 (report other material by

(2)

(U) Physical and Personnel Incidents.

quantity).

During tactical operations when the

reporting command or activity may not

(3)

(U) Specific segments, tables, days, or

have immediate access to secure

pages involved (if not the complete

document).

7-9

FOR OFFICIAL USE ONLY

TB 380-41

(U) Keyed or Un-keyed. If equipment or

(U) Surreptitious Access. Indicate the

components were involved, indicate whether they

possibility of surreptitious access by

were keyed or un-keyed.

unauthorized persons.

(U) Incident Description. Provide a

7.6.4

(U) Damaged Package. If a package is

description of the incident, including the date and

damaged or shows evidence of possible

time of discovery, and answers to the questions:

tampering, also include the following:

Who? What? When? Where? Why? How?

(U) Damage Description. Provide a

description of the damage and the extent to

(U) Compromise. Estimate the

which the material could have been viewed.

probability of compromise (e.g., compromise is

Take photographs from various angles and retain

CERTAIN, PROBABLE, IMPROBABLE,

on file in case further investigation is required.

POSSIBLE, or IMPOSSIBLE).

(U) Transportation Method Used.

(U) Key. If key is involved, identify the

Indicate the method of transportation used (DCS,

CONAUTH(s).

official courier, registered mail, etc.).

7.6.2

(U) Missing Material. If the material

involved is missing, also include the following:

(U) Circumstances. Describe the

circumstances that may have caused the

(U) Time and Place. Report the date,

damage or permitted possible unauthorized

location and circumstance of the last known

access to classified COMSEC material. If the

sighting.

information cannot be determined by local inquiry

or investigation, the ACTION addressee will take

(U) Cause of Loss. Provide all available

action to have the shipment traced and all

information pertaining to the cause of loss.

necessary information obtained. Once the

information is available, another report will be

(U) Actions Taken. Describe all actions

submitted to supplement the Initial Report.

being taken to locate the material.

(U) Unauthorized Viewing Contents. If

(U) Unauthorized Access. Indicate the

there was a possibility that unauthorized persons

possibility of access by unauthorized persons.

viewed the classified contents of a damaged

package, report the Security Clearance status

(U) Disposal Method Used. Explain the

and nationality of each of those persons

disposal method used for classified and

unclassified waste.

(U) Counterintelligence. Indicate the

identity of the counterintelligence (CI) unit that

7.6.3

(U) Temporary Loss. If the material is

provided assistance during the investigation, if

temporarily lost or otherwise out of proper

applicable.

channels, also include the following:

7.6.5

(U) Unauthorized Access

(U) Time and Circumstances. Indicate

the exact period of time and under what

(U) If it is known that unauthorized persons had

circumstances the material was discovered to be

access to classified COMSEC material or

out of proper channels.

information (for even a very short time), your

report will include the following:

(U) Action. Indicate the action that

caused the material to be returned to proper

(U) Indicate the identity of each person

channels.

and their clearance status.

(U) Clearance Status. Indicate the

(U) Indicate the length of time the

clearance status of persons having unauthorized

person(s) had access.

access.

(U) Any COMSEC material to which the

person had access.

7-10

FOR OFFICIAL USE ONLY

TB 380-41

7.6.6

(U) Material Left Unprotected.

(1)

(U) Location of the crash. Give

geographical coordinates, if available, or

(U) Unprotected material includes safes,

if close to shore, give approximate

containers, rooms or vaults that had been left

distances.

open or unlocked or were discovered to have

malfunctioning locking devices.

(2)

(U) Approximate depth of water.

(U) In cases where the classified

(3)

(U) Whether or not material was in

COMSEC material was left UNATTENDED or

weighted containers.

was not securely stored, the report will include

the following:

(4)

(U) Whether or not aircraft sank

immediately.

(1)

(U) Indicate the date and time period that

the material was left unsecured.

(5)

(U) Whether or not foreign vessels were

in the immediate area.

(2)

(U) Indicate the date and time the

incident was discovered.

7.6.8

(U) Combat Conditions. Under combat

conditions, no further reports resulting from

(3)

(U) Explain when, by whom, and what

situations described in 7.6.7 and 7.6.8 are

actions were taken to secure the

required unless recovery or salvage efforts are

container or area.

made, in which case the results of that effort

should be reported. In addition, Final Reports

(4)

(U) Describe what security measures

are not required for material possibly

were in effect at the time the incident was

compromised under ground combat conditions.

discovered (i.e., guards, building kept

Actions taken to recover COMSEC equipment

locked, restricted area).

missing due to actual combat operations should

be comparable to actions taken to recover any

(5)

(U) Undetected Entry. Indicate the

other equipment assigned to the unit involved.

possibility of an undetected entry into the

7.6.9

(U) Unauthorized Photography.

area by unauthorized persons.

Photographing CLASSIFIED COMSEC material

7.6.7

(U) Aircraft Crashes. Aircraft crashes

is prohibited. This does not apply to its

will be reported as follows:

photocopy reproduction or microfilming for the

purpose of producing an OFFICIAL record under

(U) Crashed on Land. If an aircraft

proper controls and accountability, or to the

should crash on land under combat, or non-

photographing of an external view of a CCI

combat conditions the report will include:

equipment. Photographing CLASSIFIED

COMSEC equipment requires specific written

(1)

(U) Location of crash (specify if in

authorization from HQDA (DAMI-CD). (See AR

enemy-controlled territory).

380-40.)

(2)

(U) Whether the crash area was secured,

7.6.10

(U) Satellites. When classified

when, and by whom.

COMSEC material is lost aboard a satellite or

other space vehicle, report the equipment by

(3)

(U) Whether the aircraft was completely

short title and accounting number and give the

destroyed by impact or explosion.

launch time and the probable impact point on the

earth's surface.

(4)

(U) Whether or not the aircraft burned.

7.6.11

(U) Controlled Cryptographic Items

(CCI).

(5)

(U) Whether or not the crash area was

searched.

(U) CCI are unclassified controlled end

items or assemblies that perform a critical

(U) Crashed at Sea. If the aircraft

COMSEC or COMSEC ancillary function;

crashed at sea, the report will include:

however, when CCI contains key, it will be

protected in a manner consistent with the

classification of the information it processes.

7-11

FOR OFFICIAL USE ONLY

TB 380-41

Incident reports will be prepared accordingly. A

(4)

(U) Results of inventories and preliminary

security clearance is not required for access to

local investigations.

CCI, but access shall be restricted to U.S.

citizens whose duties require such access.

(5)

(U) Results of CI interviews,

Access may also be granted to permanently

interrogations and investigations.

admitted, resident aliens who are U.S.

Government civilian employees, active duty, or

(6)

(U) List of missing COMSEC material or

reserve members of the U.S. Armed Forces and

lists of all classified COMSEC material to

whose duties require access.

which the person had access at the time

of the incident. When the amount of

(U) COMSEC Incidents involving un-

material makes a message listing

keyed CCI (i.e., physical loss of CCI, tampering,

impractical, the list may be forwarded

theft) will be reported IAW DA PAM 25-380-2 and

separately by the fastest available

paragraph 7-2 of this TB.

method.

(7)

(U) A general statement of the

7.7 PERSONNEL INCIDENTS.

individual's backg2round in COMSEC and

the extent of his/her knowledge of crypto-

7.7.1

(U) Definitions. The definition of a

principles.

reportable personnel incident is as follows:

(U) When a person having access to

(U) Final Reports. Final Reports are

classified COMSEC information is suspected of

required for Personnel Incidents. However, initial

or subsequent reports may serve as the Final

ESPIONAGE, DEFECTION, SUBVERSION,

SABOTAGE, etc. (refer to Table 7-1).

Report by adding a statement as follows: "The

inquiry/interview/interrogation showed no

Or,

evidence of possible compromise of classified

COMSEC information. This is a Final Report."

(U) When a person who has been

(U) Appropriate Action. Appropriate

designated by the commander as having detailed

action on individual incidents will be taken as

knowledge of COMSEC equipment or manual

specified in the following paragraphs.

cryptosystems is declared AWOL, is captured or

presumed captured by enemy forces, becomes

7.7.3

(U) Captured or Presumed Captured

deceased under suspicious circumstances, or

Personnel. Within five days from the date the

has had his or her security clearance revoked.

individual is returned to U.S. control or is

declared dead, the commander will notify the

(U) DETAILED KNOWLEDGE is defined

NSA, Counterintelligence (CI) and CSLA.

as an understanding of the crypto-principles of

classified COMSEC equipment and CCI. This

7.7.4

(U) Personnel Absence. A report to the

implies knowledge and understanding beyond

NSA is required if the commander makes a

that which even an efficient operator would

determination that an individual is absent or

require or possess.

deceased under the criteria of paragraph 7.7.1.

7.7.2

(U) Personnel Incident Reports.

(U) Inventory of Classified COMSEC

Material. When any individual is declared

(U) As a minimum, all Personnel Incident

absent per paragraph 7.7.1, an inventory of all

Reports will be classified CONFIDENTIAL and

classified COMSEC material to which the person

contain the following information:

had access will be made immediately. Also, a

preliminary check will be made to determine the

(1)

(U) COMSEC Account Number.

possibility of defection, subversion, or other

crime.

(2)

(U) The individual's full name, rank or

grade, and SSN.

(U) CI Interview. When an AWOL,

DEFECTOR, or SUBVERSIVE is returned to

(3)

(U) Date and circumstances of the

U.S. control, CI personnel will interview the

incident.

individual.

7-12

FOR OFFICIAL USE ONLY

TB 380-41

7.7.5

(U) Revocation or Suspension of

(U) Provide a detailed description of the

Clearance for Cause.

associated communications activity (i.e.,

on-line/off-line, simplex/half duplex, transmit

(U) Inventory of Classified COMSEC

only/receive only, point-to-point/netted

Material. With the revocation or suspension of

operation).

clearance for cause (e.g., serious violation of law

or regulations which justifies revocation), an

(U) Report the number of messages sent

inventory of all classified COMSEC material to

or received, and the general type of traffic

which the individual had access will be

involved.

conducted immediately.

7.9 ADMINISTRATIVE

(U) Defection or Subversive Intent. A

INCIDENTS.

preliminary local check will be made to determine

if there is any evidence to indicate the possibility

of DEFECTION or SUBVERSIVE intent.

(U) COMSEC Administrative Incidents

are both administrative and COMSEC in nature

(U) Compromise . The individual will be

in that they are insecure practices dangerous to

interviewed and, if necessary, further inquiry

security and they jeopardize the integrity of

made to determine if there has been any

COMSEC material. Because of this danger, it is

compromise of classified COMSEC information.

essential that positive action be taken by

commanders to prevent their recurrence. These

incidents, however, will be reported only within

7.8 CRYPTOGRAPHIC

the Army chain-of-command as directed by the

INCIDENTS.

MACOM (at a minimum, the incident must be

reported to the CONAUTH). Such reports will be

(U) Cryptographic incidents associated with each

retained on file for two years for review by

cryptosystem are identified in the operating

Command Inspectors and Auditors.

(KAO) and maintenance (KAM) instructions. The

following guide will be used in reporting

(U) The loss of a KOV-14 “User” Card

Cryptographic Incidents:

is an Administrative Incident. User cards are

those KOV-14 cryptographic cards already

7.8.1

(U) Equipment Malfunctions.

assigned to a user and associated with a

particular Secure Terminal Equipment (STE).

(U) Identify the equipment or

When a user card is lost, users must promptly

components involved.

inform the COMSEC Custodian who will advise

the chain-of-command of the loss, as well as

(U) Describe how, and under what

report the incident to the COR and ask for Relief

conditions, the equipment was being used at the

from Accountability because the KOV-14 Card is

time of the incident.

tracked in the CMCS. The COR will then remove

the item from the account’s assets and notify the

(U) Identify the symptoms of the

NSA.

malfunction. Indicate, if applicable, the possibility

that the malfunction was deliberately caused.

(U//FOUO) EXCEPTIONS: The following

incidents involving the KOV-14 Card must be

(U) If the equipment was used to send

reported within 24-hours of discovery as

operational traffic, identify the TRAFFIC and the

COMSEC Incidents IAW paragraph 7.3 of this

SHORT TITLE of any key involved.

TB. Refer to NSTISSI 3030 for further

information.

7.8.2

(U) Unauthorized Cryptoperiod

Extension. Should the incident involve an

(1)

(U) The loss of the user card occurs with

unauthorized EXTENSION of a prescribed

its associated carry card.

cryptoperiod:

(2)

(U) The loss of a user card occurs with

its associated STE.

7-13

FOR OFFICIAL USE ONLY

TB 380-41

(3)

(U//FOUO) The lost card was not a user

(U) When evaluation of the incident

card, but a fill card.

indicates that supersession of any item is

necessary, the CONAUTH must immediately

(4)

(U//FOUO) There is known or suspected

notify all holders of that item.

tampering of the KOV-14 card.

(U) When a cryptosystem has been

(5)

(U) There is a mismatch of keying

declared compromised, it will NOT be used for

material on the card and key tag (keying

further encryption unless it is operationally

information can be verified after STE

essential that encrypted messages are sent

association).

before the supersession date and an alternate

system is not available. See also AR 380-40,

(U) Reports of defective keying material

paragraphs 7-9 and 7-10.

and production errors are not considered

reportable COMSEC Administrative Incidents.

7.12 INCIDENT CASE FILES.

Such deficiencies are routine in nature and are

reported directly to the NSA for resolution as an

(U) Each COMSEC account must maintain case

administrative matter.

files for Reportable COMSEC Incidents. As a

minimum, every case file will include:

7.10 INVESTIGATIONS.

a. The Initial/Final Report(s) as well as any

(U) Normally, informal inquiries about

Amplifying Reports, as needed. The Initial

reportable COMSEC Incidents will uncover

Report, or an Amplifying Report, could serve as

sufficient information to determine whether or not

the Final Report (see report descriptions in

a COMPROMISE has occurred and the

paragraph 7.1 of this TB).

measures recommended for preventing

recurrence.

b. The CIMA Case Assignment Message.

If this message is not received within 30 days,

(U) Formal investigations may be

the custodian must follow-up with the CIMA to

required to determine certain violations of law or

ensure the incident report(s) were received and

regulations. Such investigations will be

to ask for the status of the case.

conducted either at the discretion of the

commander, as directed by cognizant authority,

c. The COMSEC Incident Evaluation

or as mandated by regulation. If there is an

issued by the appropriate agency (e.g., CIMA,

investigation, it will be conducted IAW AR 15-6.

NSA, CONAUTH).

Investigating personnel will be properly cleared.

d. The Case Closure Message issued by

CIMA.

7.11 EVALUATIONS.

(U) CCIRs will not be cleared if the account has

(U) The evaluation of information

pending incidents against it.

contained in an incident report is based not only

on the information, but also on the security

characteristics of the cryptosystem. Evaluations

7.13 REVIEWING AND MARKING

of incident reports must determine possible

COMPROMISED MESSAGES.

effects of the incident occurrence. The

evaluation will routinely consist of CIMA

7.13.1

(U) Reviewing Messages. When

personnel contacting the involved parties to

classified operational key is considered

determine if there were factors that led to

compromised by the CONAUTH, the information

compromise or loss of control of the material in

encrypted with that key is also considered

question. As the responsible activity, CIMA

compromised. In this case, immediate action will

(and/or the NSA) may direct further investigation

be taken to review the national security

or reporting in order ensure that a proper

information that has been compromised. The

evaluation can be performed.

CONAUTH will also evaluate the resultant impact

of such compromise on past, current and future

operations. In some cases, corrective action can

be taken to reduce or counteract the damage

7-14

FOR OFFICIAL USE ONLY

TB 380-41

caused by the compromise. Traffic reviews, that

7.14.2

(U) Relief from Property

is, reviewing the record copy of messages

Accountability.

encrypted in a compromised system, will be

directed by the CONAUTH.

(U) Relief from CMCS accountability will

not be construed as relief from property

7.13.2

(U) Marking Messages. Messages

accountability. In all cases of relief from CMCS

involved in a compromise will not be

COMSEC accountability, the following statement

automatically downgraded or declassified as a

will be prepared, signed by the commander, and

result of the compromise. Instead, the classified

filed in the custodian's records: "The

information contained in the message will be

circumstances surrounding the loss of (identify

reevaluated, with downgrading or declassification

material) have been considered and a

being considered as directed by AR 380-5.

determination has been made that a request for

relief from property accountability (is/is not)

required."

7.14 RELIEF FROM

ACCOUNTABILITY.

(U) It should be noted that relief from

COMSEC accountability does not mean relief

7.14.1

(U) Relief from CMCS Accountability.

from responsibility for the loss, damage, or

Relief from CMCS accountability is granted by

destruction of government property (see

the Army COMSEC Incident Monitoring Activity

paragraph 2.9d of this TB).

(CIMA). The CIMA will provide a closure

message to the COMSEC account and to the

COR. The COR will, in turn, remove the material

in question from the Army assets.

7-15

FOR OFFICIAL USE ONLY

TB 380-41

***CONFIDENTIAL***

01 02

201438Z MAR 03 RR RR CCCC

AA ZYUW TCC-1

REPORTING ORGANIZATION

SEE TABLE 7-1

INFO: SEE TABLE 7-1

C O N F I D E N T I A L

(CLASSIFICATION IS BASED UPON CONTENT)

SUBJECT: INITIAL/FINAL COMSEC INCIDENT REPORT (U)

A. (U) AR 380-40, CHAPTER 7, DTD XXXX

B. (U) TB 380-41, CHAPTER 7, DTD XXXX

1. (U) COMSEC ACCOUNT OF THE UNIT INVOLVED.

2. (C) MATERIAL IDENTIFICATION, COMPLETE ID OF THE MATERIAL, INCLUDING:

A. SHORT TITLE (INCLUDE EDITION DESIGNATOR)

B. ACCOUNTING/SERIAL NUMBER(S) OF ALC 1, 3, 6 AND 7 MATERIAL (OTHER MATERIAL

BY QUANTITY).

C. SPECIFIC SEGMENTS, TABLES, DAYS, OR PAGES INVOLVED (IF NOT THE COMPLETE

DOCUMENT).

3. (U) KEYED OR UN-KEYED. ONLY IF EQUIPMENT OR COMPONENTS WERE INVOLVED.

4. (C) INCIDENT DESCRIPTION, PROVIDE A DESCRIPTION OF THE INCIDENT, INCLUDE THE DATE

AND TIME OF DISCOVERY, AND ANSWERS TO THE QUESTIONS WHO, WHAT, WHEN, WHERE, WHY AND

HOW?

5. (C) COMPROMISE. ESTIMATE THE PROBABILITY OF COMPROMISE (E.G., COMPROMISE,

NO COMPROMISE, OR COMPROMISE CANNOT BE RULED OUT).

6. (U) KEY. IF KEY IS INVOLVED, IDENTIFY THE CONAUTH(S).

7. (C) MISSING MATERIAL. IF THE MATERIAL INVOLVED IS MISSING, ALSO INCLUDE

THE FOLLOWING:

A. DATE, LOCATION, ETC. LIST THE DATE, LOCATION AND CIRCUMSTANCE OF THE LAST

KNOWN SIGHTING.

B. CAUSE OF LOSS. LIST ALL AVAILABLE INFORMATION PERTAINING TO THE CAUSE OF LOSS.

C. ACTIONS TAKEN. LIST ALL ACTIONS BEING TAKEN TO LOCATE THE MATERIAL.

D. UNAUTHORIZED ACCESS. INDICATE THE POSSIBILITY OF ACCESS BY UNAUTHORIZED PERSONS.

E. DISPOSAL METHOD USED. INDICATE THE DISPOSAL METHOD USED FOR CLASSIFIED AND

UNCLASSIFIED WASTE.

8. (U) TEMPORARY LOSS. IF THE MATERIAL IS TEMPORARILY LOST OR OTHERWISE OUT OF PROPER

CHANNELS, ALSO INCLUDE THE FOLLOWING:

A. TIME AND CIRCUMSTANCES. INDICATE THE EXACT PERIOD OF TIME AND UNDER WHAT

CIRCUMSTANCES THE MATERIAL WAS DISCOVERED OUT OF PROPER CHANNELS.

B. ACTION. INDICATE THE ACTION THAT CAUSED THE MATERIAL TO BE RETURNED TO PROPER

CHANNELS.

C. CLEARANCE STATUS. INDICATE THE CLEARANCE STATUS OF PERSONS HAVING UNAUTHORIZED

ACCESS.

D. SURREPTITIOUS ACCESS. INDICATE THE POSSIBILITY OF SURREPTITIOUS ACCESS BY

UNAUTHORIZED PERSONS.

9. (U) FOR ALL FINAL COMSEC INCIDENT REPORTS, INCLUDE CORRECTIVE ACTIONS IMPLEMENTED

TO PREVENT A RECURRANCE OF THIS INCIDENT.

10. (U) POC. GIVE NAME, DSN, COMPLETE COMMERCIAL TELEPHONE NUMBER, FAX NUMBER, AND

E-MAIL ADDRESS.

G. HENDERSON

DERIVED FROM: TB 380-41

124 INF DIV, 5932

DECLASSIFY ON: SOURCE MARKED OADR

DATE OF SOURCE: xxxx

DON OWEN, MAJ, CDR

***CONFIDENTIAL*** 201438ZMAR03

Figure 7-1. Unclassified Example - Physical COMSEC Incident Report

7-16

FOR OFFICIAL USE ONLY

Military reference books and manuals (2009-2023, Volume 6) - page 37