What gave it away?

from here and here

I suppose you don't necessarily have to be a master of operational security to be a flight attendant, but if you're going to call in a bomb threat on the plane your ex-boyfriend is on then a bit of opsec would probably help.

Your tradecraft is trash if you do

from here and here (image source)

I'm not saying don't use any garbage can for your dead drops, only that you shouldn't use one that is so literally under surveillance. Practice some situational awareness and recognize those cameras are a threat to the operational security of your clandestine activities.

Might as well be twirling your moustache

from here and here

Sometimes you really have to wonder what's going through malware writers' minds when they leave clues like that in their malware. I'm not saying this is what gave them away, but it certainly didn't do them any favours.

Think Before You Click mug

Product Page

Because sometimes you need a reminder. Especially if you haven't finished the contents of the coffee mug yet.

Loose lips sink tanks?

from here and here

Apparently there are many people who can't keep a secret, even if it's part of their job.

Batman knows how to keep a secret

found on Izismile

I wonder if Robin's opsec is as disciplined as this, or if he's just dying to hear from people so he can show off why he's called The Boy Wonder.

It really was a pipe dream

from here and here

I'm sure it took a lot of time, money, and effort to develop Pipedream, and now it seems it was all for naught because everyone got advanced warning about it.

I suppose my feelings on the matter could best be summed up as:

Watch on YouTube

Someone's getting fired

from here

I know infosec pros tend to preach forgiveness for security fuck-ups by your users, but I don't think the same holds true for nation-state attackers. Someone inside India's Patchwork threat group infecting themselves with a remote access trojan was a pretty serious operational security failure and it's literally their job not to fuck that kind of stuff up.

Loose Tweets Sink Fleets sticker

Product Page

Finally, the old adage about loose lips sinking ships has been updated for the 21st century.

Not exactly covert

from here and here (image source)

Now I'm not spy, but I'm pretty sure that when you're spying you're not supposed to advertise what what you're doing so the whole world can see. 

Or maybe that's exactly what spies should be doing so that they're transparent and we can have an open discussion about what they're doing. But I think it's unlikely that any such operation would survive public scrutiny

I Can Haz OpSec?

found on Daily LOL Pics

This ranks right up there with the malware author whose license plate says "VIRUS" 

Oversharing Private Stuff Everywhere Constantly mug

Product Page

People who get it will get it, and the ones who don't will just think you're using a mug emblazoned with social commentary. 

Who knew you could be identified by your identifying marks?

from here

You'd think a member of the mafia would know enough opsec to keep his tattoos covered when broadcasting his likeness across the globe. I guess not all of them do.

When is a bum rap not a bum rap?

from here

Sometimes I think people would be better off if they left their mobile phones at home. When you're committing a crime seems like one of those times. Barring that, set a passcode on it so that it can't be unlocked with your ass.

Take a bite out of your own crime

from here

Was it some kind of anti-theft sausage? Clearly it had tamper-evident properties.

If only all crooks could give themselves away like that.

When your OpSec is as bad as your legal advice

from here

You'd think that a lawyer would know not to take part in something as obviously illegal as a violent insurrection at the Capitol building. You'd further think that a lawyer would have the good sense not to post evidence of such illegal activity on social media for the world (and your employer) to see. Apparently in at least one case you'd be wrong.

Can't quite put my finger on what went wrong

from here and here (image source one and two)

I considered the possibility that hackers uploading their fingerprints to a crime scene might be a technologically impaired hacker, but honestly I think there must be a fair bit of skill in that. It's just a really dumb thing to do.

The personal touch has personal consequences

from here

The story about the attempted compromise of a Tesla factory is surprising to me because of how much trust the criminals placed in their would-be accomplice. Certainly there are other ways to get this done, even if the old thumb drive in the parking lot trick doesn't work. Allowing himself to be not only seen but to engage on a personal, even friendly basis is what did this crook in. This is why anonymity is so valuable in criminal enterprises.

Fame isn't all it's cracked up to be

found on Izismile

Much like how being a famous smuggler means you're doing something wrong, being a famous spy is equally counter productive because you're not going to be able to go where you want to go or do what you want to do without people noticing.

It turns out there are a wide variety of other scenarios where being famous also works against you. For example, if you're famous for going after bad guys you better believe they're going to go after you too. If you're famous for having a lot of money you'll also be a target, or if you're famous for having access to something valuable, etc.

All in all, if you want to get things done it's generally better to go unnoticed and blend in than it is to stand out and draw attention to yourself by being famous.

Of course this is only true for people. Companies like Facebook and Google are very famous for spying on users and it doesn't seem to matter.

OPSEC - The Most Secure Man in the World

Watch on YouTube

Some of these sound suspiciously like the OpSec version of Chuck Norris Facts, but OpSec itself (like Chuck Norris himself) is real.