Surveillance

Detection
 Surveillance Detection

• Definition

• General Surveillance Awareness

• Surveillance Detection Routes (SDR)

• Route Analysis
 Definition
• Surveillance Detection - The process of determining your
surveillance status
– Incorporated into your lifestyle and habits
– Simple and routine
– Nothing that causes a potential surveillance team to question
any action or lack of action – from start to finish

• Counter-Surveillance
– The process of using other people to help determine your
surveillance status
– Normally relies on Observation Posts (OP)
– OPs should be higher than your location
– Observers relay a signal of some sort to you
 General Surveillance
Awareness
• Awareness of Surroundings in Public

– Note who and what is in your area

– Vary your approaches to destinations

– Watch for repeated sightings of people that seem

out of place
 General Surveillance
Awareness
• Note suspicious activities:
– Vehicles pass the same area repeatedly or at slower than
a normal rate
– Vehicles with multiple passengers
– Dirty vehicles with clean license plates (or vice versa) -
indicates a recent change
– People lingering in your area or passing by frequently
– Look at windows in nearby buildings for anything out of the
ordinary
– Look for people or vehicles making evasive movements
 General Surveillance
Awareness
• Maintain a low profile!

• Beware of complacency!

• Default state -
– Conduct all operational activities with the assumption that you are
under hostile surveillance
– Abort operational activities if you detect surveillance
 Surveillance Detection Routes
(SDR)
• Definition
– A planned route taken by an operator for the purpose of
detecting surveillance in support of an operational objective. It's
designed to be natural and non-alerting.

• AKA “Surveillance Detection Run”

• Objective

• Criteria for an SDR

 Objective
• Establish repeated correlation of surveillance
team and target activities over “TDD”

– TIME
• Has a reasonable amount of time elapsed since the
first sighting?
– DISTANCE
• Have you traveled far enough to indicate that a second
sighting is more than a coincidence?
– DIRECTION
• Have you made several changes in direction since the
previous sighting?
 Objective
• Adopt behaviors that require observable responses
from surveillants.

• Rule of thumb - three times = correlation

– "Once is happenstance, twice is coincidence, three times
is surveillance.“

• Look for non-changeable features!

– Surveillants may use “disguises” to avoid detection.

• Don’t alert surveillants!

– Detecting surveillance can be easy, but avoiding alerting
surveillants makes it more challenging.
 Criteria for an SDR
• Must cover sufficient TDD to “break the box”

• Uses plausible pretexts for any activities designed to detect

surveillance status

• Does not include any elements that are unnatural or alerting

to surveillants – keep their perception of you neutral

• Uses strategies to force the surveillance team to reveal itself...

– Establish correlation between your actions and those of
your surveillance
– Ensure the correlation is not a coincidence using the TDD
factors
 Abort Routes
• Used to abort an SDR prior to any
operational activity

• Legitimizes the route from start to finish

• Not an obvious change or deviation

 Anatomy of an SDR
Surveillance Cover Stop
Detection Surveillance
Cover Stop Point Detection
Point
Start Point
Observation
Post Cover Stop

Surveillance
Detection Abort Route
Observation Point
Post

Operational
Activity End Point
End Point
 Strategies to force the surveillance
team to reveal itself...
• Surveillance Detection Points (SDP)
• Choke Points
• Cover Stop
• Channel
• Multiple Turns
• Natural Reverses
• Stair-Stepping
• Varied Traffic Density
• Changing Modes of Transportation
• "Sifting"
 Surveillance Detection Points
(SDP)
• "Intrusion Points" - locations where
surveillance is expected to intrude

• Example
– Entering a building with multiple exits – the team will
probably decide to follow you if they don’t have
enough people to cover all exits
 Choke Points
• Locations on a route that can't be
avoided due to environmental factors

• Examples
– Entrance to a building or compound
– Revolving doors leading into office
buildings or shopping centers
 Cover Stop

• Location that provides a logical

reason for the route and aids in timing

• Example
– Stopping at a specialty store to make a
purchase or inquire about an item
 Channel

• Linear area where surveillance must

travel in order to follow a target

• Example
– Crossing a bridge
 Multiple Turns
• Several logical
changes in
direction of travel

• Example
– Turning left at an
intersection and then
merging onto a highway
 Natural Reverses
• LOGICAL changes to
travel in the opposite
direction
• An unnatural reverse is
a very alerting
behavior

• Examples
– Driving to a parking lot in a
major city and then
backtracking on foot to reach
a logical destination.
– A rotary or highway on- CLEAR VIEW OF
ramp/exit ramp that gives SURVEILLANTS
you a view in the opposite
direction
 Stair-Stepping
• Movement to intended
destination in a series of "dog-
legs" (linear movement to
various intrusion points or
cover stops)

• Example
– Zigzag travel to multiple intrusion
points and cover stops to "run
errands" en route to a final
destination
 Varied Traffic Density
• Repeated movement into and out of areas
with many or few people (or vehicles)
I NEED A LOGICAL REASON
TO BE IN THIS DESERT.
• Example
– Entering and exiting a large crowd to purchase a
ticket to a public event
I NEED A LOGICAL
REASON TO BE IN THIS
CROWD.
 Changing Modes of
Transportation
• LOGICAL switching EVERYTHING YOU DO
DURING AN SDR
between travel on foot, MUST APPEAR TO
HAVE A LOGICAL
public transportation, REASON.
and use of a vehicle REMEMBER THAT YOUR
SURVEILLANTS MIGHT
NOT BE TOO BRIGHT
OR CREATIVE.
• Example
– Walking to a cab stand and then THE REASON SHOULD
BE PRETTY OBVIOUS!
taking a cab to the nearest
subway station
 "Sifting"
• Eliminates irrelevant
suspicions through the
application of TDD factors
until you achieve certainty

• Example
– Continue an SDR to include at
least three significantly different
locations at three significantly
different points in time
 Route Analysis GRENADE!!

• Areas of Predictable
Travel (APT)

– An area on a route that TWO OPERATORS ENTER AN APT

a target must travel

through in order to
reach a known
destination.
– This is the most likely
location for a physical
attack against the
TWO PURPLE HEARTS
target. (POSTHUMOUSLY AWARDED)
 "Hollywood Tradecraft"
• Driving backwards Surveillant:
Why is he
driving on a
• Getting on and then quickly golf course?
getting off of a subway train

• Driving down dead-end

streets

• Illogical U-Turns
Surveillant:
Why is he
• Entering a crowded movie making a
theater and then U-turn?
immediately walking out the
exit
Answer: because he’s an idiot.
 Remember
• The surveillance
team’s perception is
their reality and they
will react accordingly.

• Your reality isn’t On the other hand,

relevant – they only Hollywood Tradecraft
makes sense when
know what they your objective is
survival!
perceive based on
your actions
 Losing Surveillance
• With the preceding warnings about Hollywood Tradecraft in mind,
how could you lose surveillance in the unlikely event that you need
to do so?

– Jump into a taxi when no other cabs are immediately available.

– Take a bus just before it leaves a stop.
– Enter a subway station at a time when a large crowd will be exiting,
cross through the crowd, and then quickly leave from the other side of
the station.
– Pass through a revolving door that will slow pursuit and then
immediately duck out of sight.
– Etc.

• Remember that these and other similar actions will serve as red
flags to surveillants. They only make sense when immediate
survival or another unusual circumstance outweighs consideration of
long term operational viability.
 About Mobile Phones
• Mobile phones can act as carriers for any radiated signal
– This means your mobile phone conversations can be intercepted by
mistake

• Mobile phones can also serve as beacons that allow surveillants

(physical/technical) to track you

• Turn off your mobile phone AND disconnect the battery to

mitigate this risk
 ACTIVITY
• Design and conduct an SDR
Surveillance Cover Stop
Detection
Cover Stop Surveillance
Point
Detection
Point

Start Point
Observation
Post Cover Stop

Surveillance
Detection Abort Route
Observation Point
Post

Operational
Activity End Point
End Point
Questions?