How NAVADMIN 26170 Pits OPSEC Against FOIA and Privacy Law

The legal oddity in NAVADMIN 26170/26 is not that the Navy has an operational-security reason to reduce the online exposure of commanders. It is that the categories reportedly removed from public websites—names, ranks, official photographs, assignments, and biographical details—sit close to the center of what Defense Department-facing public-access guidance describes as releasable without a service member’s written authorization. That does not make the directive unlawful. It does make the legal issue unusually clean.

Navy Times reported that the Navy instructed commands to remove portraits and biographies from websites, quoting the NAVADMIN’s concern that adversaries can collect personal and professional information from publicly available sources and aggregate it for targeting or intelligence purposes.[1] Military OneSource, in guidance dated April 2026, separately explains that information including name, rank, photograph, duty assignments, awards, military education, and duty status may be released without written authorization under the Privacy Act and FOIA framework.[2]

Those two propositions can both be true. A record may be legally releasable and still be a poor candidate for routine publication on a public-facing command webpage. But once an agency moves information from “published as a matter of course” to “available only if you can persuade us through a request process,” FOIA lawyers start looking for the seam.

The Directive Looks Strongest As OPSEC, Not Privacy

The Navy’s best opening argument is operational security. GAO’s October 2025 report, GAO-26-107492, gives real institutional weight to the concern that adversaries can exploit publicly available online data, including social media and other open-source information, through aggregation.[3] In that light, a commander biography is not merely a ceremonial page. It can be one verified node in a larger profile: face, current command, career path, operational specialty, geography, awards, family cues if present elsewhere, and professional network.

That is the part of the controversy that should not be brushed aside. A photograph that is harmless in a printed change-of-command program can behave differently once it becomes machine-readable, searchable, and durable. Assignment history that once required effort to compile can be connected with procurement records, conference appearances, social media posts, command announcements, and public schedules. The legal question is not whether that risk exists. The question is what OPSEC authority can do to public access once the records are also subject to FOIA and the Privacy Act.

Task & Purpose reported that the removal affects biographies for Navy personnel at the rank of vice admiral and below, while most senior Navy leaders’ biographies remained publicly available.[4] That distinction matters less as a public-relations point than as an access point: the Navy appears to be drawing a line between personnel whose individual exposure should be reduced and the most senior officials whose public role still justifies routine identification.

The Privacy Act Does Not Require Routine Publication

The Privacy Act is often misread in this setting. It restricts agency disclosure of records about individuals maintained in systems of records, subject to statutory exceptions. It does not say that every category eligible for release must remain online forever. The important word in the Military OneSource guidance is not “must.” It is “may.” The listed information may be released without written authorization; that is permission, not an affirmative publication command.[2]

That distinction protects the Navy from the easiest version of the legal attack. A plaintiff would have trouble arguing that removal is unlawful merely because the same information could be released without consent. Agencies make publication judgments all the time: some records are posted proactively, some are available in reading rooms, some are produced only in response to requests, and some are withheld in whole or in part. The Privacy Act tells the agency when disclosure is forbidden or permitted. It does not, by itself, settle whether the Navy has to keep commander pages live.

Still, the Privacy Act guidance makes the removal legally interesting. The Navy is not pulling down Social Security numbers, home addresses, medical history, or family-member contact information. It is reportedly pulling down the very public-professional identifiers that military public-affairs offices have long used to tell the public who holds command authority. When those identifiers move from routine posting to request-only access, the statutory work shifts from the Privacy Act to FOIA.

FOIA Is Where The Test Case Lives

FOIA does not generally require agencies to maintain every useful webpage. It gives any person a right to request agency records, requires disclosure unless an exemption applies, and gives courts a familiar way to review improper withholding. That is why the removal itself is not the end of the analysis. A journalist, researcher, contractor, watchdog group, or counsel doing due diligence can still ask the Navy for the biographies, official photographs, assignment histories, or underlying records.

At that point, the Navy would have to do more than point to a vanished webpage. It would need to process the request, identify responsive records, and justify any withholding under FOIA. The most natural exemption for ordinary commander biographies is Exemption 6, which protects personnel, medical, and similar files when disclosure would constitute a clearly unwarranted invasion of personal privacy. Exemption 1 could matter if particular responsive material is properly classified, but the publicly reported categories—name, rank, official photograph, duty assignment, education, awards—do not become classified simply because they are useful to an adversary.

Exemption 6 is a balancing test. The agency identifies the privacy interest; the requester identifies the public interest in disclosure; the court asks whether the invasion of privacy is clearly unwarranted. For a junior sailor’s private contact information, the answer may be easy. For a commanding officer’s official biography, it is not. Command authority is public authority. The public interest is not celebrity curiosity; it is knowing who exercises government power, what experience they bring to it, and how the institution presents their qualifications.

The Navy’s OPSEC rationale would not disappear inside Exemption 6. It could strengthen the privacy-side showing by explaining why aggregated public-professional information now creates a concrete risk to personnel. GAO’s adversary-aggregation warning helps the Navy avoid sounding as if it merely prefers obscurity.[3] But the harder move is translating that operational risk into the particular privacy interest protected by Exemption 6, then outweighing the public interest in identifying officers who command public forces.

Removal Is Not The Same As Withholding, Until A Request Forces The Question

The most vulnerable legal point is not the Navy’s authority to clean up its websites. It is what happens after a requester asks for the same information that the Navy chose to stop publishing. FOIA litigation requires an agency record, a proper request, and an alleged improper withholding. If no one has submitted a request for the removed biographies or source records, the legal dispute remains prospective.

As of July 19, 2026, no reported FOIA challenge to NAVADMIN 26170/26 appears to have been filed on the available record. That matters. It keeps the analysis in the realm of litigation risk, not adjudicated illegality. It also means the exact NAVADMIN text should be treated carefully: the publicly available analysis depends on press quotations and descriptions, because the directive itself has not been directly reviewed here.

A requester would likely try to avoid making the case about website design. The stronger request would ask for discrete records: the biographies removed from specified command pages, official portraits of named commanders, assignment histories maintained by the Navy, or records identifying current commanding officers for named units. That framing forces the agency to say whether the records exist, whether they are being withheld, and which exemption applies.

The Navy, in turn, would likely argue that proactive removal is not itself a FOIA withholding. FOIA is a request-and-response statute. Agencies can decide not to publish many records that they might later release. If the Navy processes a request and releases responsive records with redactions, a court may never need to decide whether the original takedown had independent legal significance.

The harder case is a categorical denial. If the Navy refuses to release commander biographies or official portraits solely because aggregated public access creates OPSEC risk, a requester can argue that the agency is trying to convert a publication policy into a withholding rule. That is where the previously public nature of the records becomes useful evidence, even if it is not dispositive. Prior publication does not waive every exemption in every circumstance, but it makes the agency explain what changed: the record, the risk environment, the personnel affected, or the legal theory.

Why The Removed Categories Matter

The Navy’s legal exposure is sharper because the removed material is official rather than intimate. A name and rank identify a public officer. A command assignment tells the public who is responsible for a public function. A biography is often the agency’s own representation of competence and authority. Awards and military education can be decorative, but they can also explain why an officer was selected for a role or how an institution values certain experience.

That does not eliminate the individual risk. It does change the FOIA balance. Exemption 6 privacy interests are real, but courts have historically been more receptive when the information reveals little about government operations and much about private life. Commander biographies reveal both individual information and institutional information. They are about a person, but they are also about the chain of command.

The Navy can answer that the aggregation risk is precisely what makes old categories newly sensitive. A single command page may not expose much. A scraped archive across commands, years, photographs, and assignments may expose patterns that no public-affairs officer intended to publish as a dataset. That argument is serious. It also needs a record if it becomes a FOIA defense: declarations, examples at an appropriate level of detail, and a connection between the requested fields and the asserted harm.

The War Horse Analogy Helps, But Only So Far

The closest litigation route is not a constitutional challenge to the NAVADMIN. It is a FOIA case brought after a denied or heavily redacted request. The War Horse’s litigation against the Marine Corps over access to Marine Corps records is useful for that reason: it shows how a press or transparency plaintiff can turn a military-records access dispute into a justiciable withholding claim rather than a generalized complaint about secrecy.

But the analogy should not be overworked. The War Horse case involved different records and a different service branch. A Marine Corps dispute over medical or personnel records does not decide whether Navy commander biographies, official portraits, or assignment histories must be released. It does, however, point to the likely architecture of a challenge: identify the requester’s use, request specific records, exhaust the administrative process, and contest the claimed exemption in district court.

Standing should not be the hardest part of that case if the plaintiff is a FOIA requester. FOIA standing usually follows from the denial of requested records. The difficult questions would be exemption fit, segregability, prior public availability, and whether the Navy can justify a categorical approach rather than making record-by-record or field-by-field judgments.

What Counsel And Requesters Should Watch

For FOIA officers, the cleanest internal practice is to keep the regimes separate. OPSEC may justify removing routine web publication. The Privacy Act may allow release of certain official information without written authorization. FOIA still requires a request-specific response and an exemption-specific explanation. Blending those into a single “privacy and security” rationale will be tempting and weak.

For requesters, the most useful early requests will be narrow. Ask for the biography or official portrait of a named commander, the removed webpage content for a specified command, or the records identifying who held command during a defined period. A broad request for every removed Navy biography will invite delay, processing disputes, and a litigation record about burden rather than access.

For defense-industry counsel and researchers, the practical effect may arrive before the legal one. Commander biographies have been used to understand reporting chains, program exposure, past assignments, and potential conflicts. If the Navy continues to release the same information through FOIA, the change is a timing and friction problem. If it begins withholding the records categorically, it becomes a precedent problem.

This is also where prior coverage should be kept in its lane. The earlier Navy Photo Removal Controversy Raises Transparency Law Questions addressed the news and Federal Records Act angle. The harder question now is not whether the removed pages were records. It is whether the Navy can use OPSEC to end routine publication while still satisfying FOIA when someone asks for the same material.

The Bounded Legal Judgment

NAVADMIN 26170/26 is not obviously illegal on the available public record. The Navy has a credible OPSEC rationale, reinforced by government concern over adversary aggregation of open-source data. The Privacy Act does not require routine publication merely because certain official information may be released without consent. FOIA does not freeze an agency website in place.

But the directive creates a clean FOIA test case because the removed category is not marginal. Names, ranks, photographs, assignments, and official biographies have historically served public accountability as well as public affairs. If the Navy releases them upon request, the controversy remains mostly about friction and policy. If it withholds them, it will have to ask a court to accept that an OPSEC-driven aggregation theory can outweigh the public interest in knowing who commands.

References

1. Navy instructs commands to remove portraits, biographies from websites, Navy Times, July 17, 2026
2. Service Member Privacy Versus Public Access to Information, Military OneSource, April 2026
3. GAO-26-107492, U.S. Government Accountability Office, October 2025
4. Navy removes commander bios, Task & Purpose, July 17, 2026