EMERGENCY CARD THREE — COMPROMISED CHANNEL

    EMERGENCY CARD: COMPROMISED CHANNEL 
    CARD NUMBER: EC-03 
    LAST REVIEWED: October 2025

TRIGGER

    Evidence the primary channel is compromised — unknown device joins, authentication failure anomalies, or a probe that contains information only shared in the channel.

EXECUTION STEPS

    Stop all operational traffic on the channel immediately. The session goes dead, not the team.

    Continue only with innocuous chatter for 24 hours. Abrupt abandonment signals awareness.
    Watchdog contacts each member individually through the pre-arranged offline check method to confirm compromise scope — who knew what, and when.
    Rotate to the fallback channel. Fresh keys, fresh credentials, none reused from the primary.

    Assume everything said on the compromised channel is known to the adversary. Run the leak review — what did we say there, and what damage does it do now that it is exposed.
    Debrief within 24 hours on the fallback channel (name & Method). Root cause, then rotate any credentials that crossed the compromised space.

THE STING RULE

    A compromised channel is also an asset. Everything the adversary believes they captured may already be fog. Whether it was seeded as fog or retrofitted, the Watchdog decides during the debrief — and then you weaponize the adversary's certainty about information you controlled.