The helicopter on the roof in Saigon was not a surprise. It was the last frame of a sequence that had been running in public for months.
Flights out of Tan Son Nhut were booked solid at prices nobody was hiding. Refugee columns were on the wire services. Embassy dependents had been leaving for weeks. Any competent analyst with a newspaper and a sense of arithmetic could have produced the timeline - and several did, and it changed nothing, because the institutions receiving the assessment had already decided what they believed.
That gap, between what was collectable and what was believed, is the subject of this book.
Trail Watchers and Web Crawlers takes thirty-one events from the Vietnam War and uses each to teach a discipline of open-source intelligence: producing reliable conclusions from information anybody could have obtained. It is the majority of what an adversary already knows about your organization, and almost none of it required breaking in.
Vietnam is the largest natural experiment we have in what happens when an open society fights a closed one. One side published nearly everything - casualty figures, unit rotations, budget lines, daily briefings, testimony under oath. The other published almost nothing and read everything.
Inside:
- Dien Bien Phu - the most dangerous thing you publish is not your capability. It is your model of the adversary's.
- The Gulf of Tonkin - how a hedged assessment becomes an unfalsifiable fact in seventy-two hours, and why your attribution claims do the same thing.
- Igloo White - a billion dollars a year of sensors on the Ho Chi Minh Trail, defeated by tape recordings and cattle. Every SOC is somewhere in this chapter.
- Sam Adams - when the collection is sound, the analysis is right, and the customer cannot afford the answer.
- Pham Xuan An - the finest analyst of the war worked from open sources, in public, for the other side, for twenty years.
- Son Tay - a flawless raid on an empty camp, and why every finding needs an expiry date written on it.
- Bucha - the forensic method that took months at Hue in 1968, executed in three days, because the imagery arrived with a timestamp.
A closing section carries every lesson into the conflict Ukraine, where commercial satellites, a citizen sensor network, soldiers with phones, and machine analysis have compounded each Vietnam-era failure and added a new one on top.
For security leaders, threat intelligence analysts, penetration testers, incident responders, investigators, journalists, risk professionals and for readers of military history who want to know why it still matters.
There are no tool names in it, no search syntax, no checklists. The tooling becomes obsolete and was never the hard part. The hard part is what you believe about what you have found, which is a human problem and therefore an old one.
From the author of Stone Walls and Firewalls: Cybersecurity Lessons from the American Civil War. Alper Basaran has spent twenty years as a penetration tester and incident responder across industrial control systems, financial institutions and critical national infrastructure.
