Messing With Their Heads: Manipulating and Detecting Hostile Surveillance

One of the fundamentals of TorchStone’s approach to understanding and countering criminal behavior is that attacks “don’t just happen.”

Crimes of all types are the result of processes and behaviors that can be understood and detected.

One of these key bellwether behaviors is pre-operational surveillance.

Almost every criminal act, from a purse-snatching to a terrorist bombing, involves some degree of pre-operational surveillance.

A pickpocket may only conduct a few minutes or even seconds of surveillance, while a kidnapper planning the abduction of a high-value target may conduct weeks of surveillance, but the point remains that pre-attack surveillance is conducted in both attacks.

I’ve written previously about how people can detect hostile surveillance directed against them.

I’d like to take one step deeper and discuss ways individuals and security teams can manipulate those conducting surveillance, thereby forcing them to show their hand.

Keep a Look-Out

While almost all hostile actors conduct surveillance, the good news is that most of them are very bad at it.

They possess very poor surveillance skills, and they tend to “lurk” with no apparent reason to be where they are and doing what they are doing.

They also tend to exhibit poor demeanor and generally stick out from the people around them by behaving in unnatural ways.

Mistakes made by untrained people conducting surveillance can be quite easy to catch—as long as there is someone looking for those mistakes.

Problem is—often, no one is looking.

This allows hostile actors who are bumbling operatives practicing poor tradecraft to get away with conducting surveillance on a target.

Drawing out Surveillants

But in addition to just watching for surveillance, there are also actions that individuals and security teams can take to place additional pressure on those conducting surveillance.

Professional intelligence officers carefully fashion lengthy and sophisticated surveillance detection routes that help them determine if they are being followed by a highly trained surveillance team from a hostile security service.

Detecting surveillance from that type of opponent can be very difficult.

It is necessary because it can literally mean life or death to the sources being met by the intelligence officer and can also result in the intelligence officer being kicked out of the country where he or she is operating.

Fortunately, most of us will not be surveilled by that type of highly sophisticated surveillance team.

This means that we don’t need to conduct a four- or five-hour surveillance detection route before attending a meeting.

However, some of the principles employed in surveillance detection routes can help identify criminal surveillance.

Kinesis

A primary tool you can use to help identify hostile surveillance is to move.

It is far more difficult to surveil a moving target than it is a static one, and the opportunity to make mistakes is multiplied while the target is in motion.

This difficulty is increased when those conducting surveillance are untrained and if they are working in a very small group, or even worse, alone.

Conducting solo surveillance against a mobile target is the most difficult type of surveillance there is—especially if the target is practicing good situational awareness.

TEDD: to ascertain if you observe the same person or people over Time, in different Environments, over Distance, while watching for Demeanor mistakes.

As a person moves over time, through different environments, and across distance, it affords them the opportunity to watch for the elements of TEDD.

This works whether the person is on foot or in a vehicle.

(Out)maneuver

Additional tools can make movement even more effective in helping determine if someone is being followed.

Channels, or narrow places with restricted access, force someone who wants to surveil a target to follow them in.

It is often possible to spot surveillance by paying attention to the people (or cars) who enter the channel after the target does and then looking to see if the same person or vehicle follows the target out of the channel.

Common channels include bridges, tunnels, subway stations, and even limited access highways.

Turns, especially a series of turns, and other changes of direction, including U-turns, can also place a good deal of pressure on anyone conducting surveillance.

An innocent pedestrian or car may follow a target as they move through one turn, but after three turns, anyone still following the target should be viewed with suspicion.

Stops along the route of movement provide an opportunity to see if anyone also stops moving when the target does and then starts moving again when the target resumes moving.

A stop inside a location with a glass front like a coffee shop can often provide a good place from which to observe the people outside on the street to see if there are demeanor hits like lurking.

Important Caveat

Do not attempt to use these methods if you are being surveilled by a government security service.

They are surveillance professionals and will quickly recognize these tactics for what they are.

If they see you using them, they may suspect you are an intelligence officer conducting a surveillance detection route.

This will likely result in you being targeted for far more intensive attention.

It is not wise to play games with the local security service.

When intelligence officers use these tools against a security service, they have to be very patient and subtle.

If they detect surveillance, they need to remain calm and do their best to appear to behave normally as if they had not spotted the surveillance.

However, those employing these tools against criminals or militants can be much more abrupt and overt in their actions.

For example, they can square a block rather than space their turns out.

If hostile surveillance is detected, they can also be more open in seeking to move to a safe location and alerting the proper authorities to their situation.

In a Team Setting

Security teams can also use these same tools.

One way to use them is to work these elements into movements intentionally with the principal.

If that is not possible, paying particular attention to the behavior of people as the motorcade progresses through channels, turns, and stops on their regular motorcade routes can also be effective.

Even relatively simple things such as having residential or office security personnel watch the reaction of people outside the facility to the principal’s departure can also assist.

Single Focus

Of course, the best tool to determine whether a person or facility is under surveillance is the use of a dedicated surveillance detection team.

The surveillance team is created specifically to watch for watchers.

This team can use mobile assets, fixed assets, or a combination of both.

Team members identify places—“perches” in surveillance jargon—that an operative would need to occupy in order to surveil a potential target, such as the entrance to a residence or office building.

The surveillance detection team will then watch those perches for signs of hostile surveillance.

Surveillance detection teams can also manipulate surveillance by “heating up” particular perches with CCTV coverage, static guards, or roving patrols.

This forces any potential hostile surveillance operatives away from those areas and toward perches that are outwardly more relaxed but are really traps where the surveillance detection team can focus its efforts.

Press the Advantage

Surveillance detection teams also can use overt assets, such as uniformed police or guards, to stop, question, and identify any suspicious person they observe.

This can be a particularly effective tactic, as it places the surveillant on notice that they have been spotted, and this will hopefully cause them to conclude that the facility or principal they are attempting to surveil is too hard of a target.

Even if the security forces who question the subject never realize the person was actually conducting surveillance, such an encounter normally will lead the surveillant to assume that he (or she) has been identified—“burned”—and that the people who stopped him knew exactly what he was doing.

Also, by denying surveillants perches that are close to the target’s point of origin or destination (home or work, for example), security teams can effectively push hostile surveillance farther and farther away.

Distance tends to inject ambiguity into the situation and complicates the hostile information-collection effort.

For instance, if surveillants do not know what car the target drives, they can easily obtain that information by sitting outside of the person’s home and watching what comes out of the garage or driveway.

By contrast, surveillants forced to use a perch a mile down the road might have dozens of cars to choose from.

Cross Reference

Databasing is an important tool to assist in detecting surveillance.

The observations of suspicious individuals or vehicles made by security team members, along with the input from cameras and license plate reader cameras, can help greatly in connecting the dots.

A database can help the team determine whether it has encountered the same person or vehicle repeatedly on different shifts or at different sites.

This analytical component of the surveillance detection team is essential to the success of the team’s efforts, especially when there are multiple shifts working the operation and multiple sites are being covered.

People also have perishable memories, and databasing ensures that critical information is retained and readily retrievable.

People seeking to conduct surveillance face a host of constraints, and these tools can be used to take advantage of those constraints to help identify individuals as they conduct surveillance and prevent them from progressing further along their attack cycle.

This article was originally written and published by Scott Stewart, Vice President of Intelligence at Torchstone Global and Protective Intelligence Honors Pioneer on August 12, 2022.