The Navy now treats doxing of sailors as collection, not as a privacy complaint

What holds the list together is output. Published personal data tells someone who a service member is and where to find them off base ^[3]. Ground-level surveillance turns that into a confirmed pattern ^[3]. A drone over a pier or a piece of critical infrastructure produces something the open web cannot: current disposition ^[5]. An attempt on an access control point produces a timed measurement of how the guard force reacts ^[4]. Each feeds the next, which is why the Navy's account describes one campaign rather than a run of unrelated incidents ^[1].

The reframing creates an uncomfortable asymmetry in what the service can actually order. Gates can be reinforced, watch postures changed, drone sightings escalated. The remedy offered for the personnel side is that individuals review and privatize their accounts, strip identifying information, and stay alert to phishing and imposter profiles ^[6]. That reaches only the data a member still controls. Nothing in the guidance as reported touches records already sold, scraped or archived, and the exposure that matters for physical targeting is usually the exposure that left the member's hands some years ago.

The reporting instruction is the part with operational teeth. Personnel are told to report being followed or photographed away from the installation, and unusual interest in military movements or base operations ^[7]. That makes the commute and the parking lot part of the sensor coverage, and it routes through three different institutions at once: NCIS, base security, and local police ^[8]. A tail noticed at a grocery store becomes a counterintelligence datum only if whoever takes the call recognizes it as one. Local law enforcement is being asked to be the intake point for a campaign whose pattern is visible only in aggregate somewhere above them.

Six categories of adversary activity are named in the same breath ^[10], and this account of the warning names no state behind any of them, supplies no incident count, and dates nothing ^[11]. It reaches us secondhand, with SC World summarizing DefenseScoop's reporting ^[9]. So the instruction to the force is specific while the threat picture behind it is not auditable from what has been published. Nobody outside the Navy can say how many gate probes sit behind the phrase "coordinated initiatives designed to test security responses" ^[4], or whether drone activity near Navy assets means a handful of sightings or a standing presence ^[3].

That gap matters because the guidance shifts effort onto individuals on the strength of a threat assessment they cannot inspect. Account hygiene is cheap and worth doing regardless. But a warning that treats OSINT exposure as an operational security failure implies that someone is tracking which exposures produced which surveillance, and that feedback loop is where the campaign framing either earns itself or stays a memo. The willingness the Navy describes, moving from threats and harassment online to attempted physical attacks ^[4], is the claim that would justify the whole structure. It is also the claim with the least public evidence attached.