Coming soon, a double phishing attack. For anyone who clicks through, they'll be told its a security check, and then be instructed to click through for a study or something. It will work especially well with uniformed people if you start with enough data, because they can be "ordered" to "participate" in the follow on.
The DOD did everything a phishing campaign does. Why isn't that illegal?