Basic Surveillance and Surveillance Detection – March, 2009

• All hostile acts begin with hostile surveillance or investigation.

• Intelligence officers must accept that they will be targeted for hostile surveillance.

• In foreign environments, they must learn to live and operate comfortably within this framework.

• To operate comfortably and effectively in hostile environments requires knowledge, skill and above all, self-discipline.

• Consequences of failure in hostile environment entail risk to:– Critical national security information– The lives of informants– In some cases, the life of the intelligence officer

himself

INTRODUCTIONINTRODUCTION

Goals of this CourseGoals of this Course

• Knowledge– Know and recognize the common

modes of surveillance employed around the world

– Understand the strengths and weaknesses of the modes and types of surveillance

• Skills– Learn specific techniques to detect

and deter hostile surveillance– Practice and perfect the techniques in

a non-hostile environment

Modes of SurveillanceModes of Surveillance

• Covert surveillance• Overt surveillance• Mixed surveillance operations

Covert Surveillance Covert Surveillance

• Intended strictly to develop information without affecting the target’s behavior

Overt Surveillance Overt Surveillance

“…We are watching you”

• Primary goal is to affect the target’s behavior

• May be used purely as harassment

Mixed Covert/Overt OperationsMixed Covert/Overt Operations

• Primary goal is deception• Manipulates target’s behavior• Creates false assumptions

– Target believes he sees the hostile operation

– Target assumes he is in the clear when the overt portion is removed

– Play’s on target’s psychology• Sense of relief• Arrogance

Types of SurveillanceTypes of Surveillance

• Fixed surveillance• Solo mobile surveillance• Multiple mobile surveillance• Mixed operations• Technical surveillance

Fixed SurveillanceFixed Surveillance

• Does not move or visibly react to target’s actions

• Strengths:– Difficult to detect

• Weaknesses:– Requires large amounts of

resources against moving targets– If covert, requires elaborate

cover

Solo mobile surveillanceSolo mobile surveillance

• A single mobile operator following a target

• Typical of unsophisticated police/private investigators

• Strengths:– Small investment in resources

• Weaknesses:– Very vulnerable to detection– Must mirror target’s movements

Segmented Solo Mobile Surveillance: Segmented Solo Mobile Surveillance: A sub-setA sub-set

• Follows target in segments over extended time period

• May involve multiple operators, working as individuals

• Strengths:– Far less vulnerable to detection– Small investment in resources

• Weaknesses– Requires that target operate

predictably– Takes a long time to work (weeks at

minimum)

Multiple Mobile Surveillance Multiple Mobile Surveillance

• Multiple operators working against a moving target

• Typical of more sophisticated government operations (police, clandestine services)

• Strengths:– Difficult to detect– Avoids showing target the same operators

twice

• Weaknesses:– Requires extensive training, practice and

superior area knowledge– Requires skilled coordination/direction– Large investment in resources

Examples of Multiple Mobile Examples of Multiple Mobile SurveillanceSurveillance

• ABC: The “street dance”• Paralleling • Envelopment: The “bubble”

Mixed Surveillance OperationsMixed Surveillance Operations

• Two kinds:– Mixed covert/overt– Mixed mobile/fixed

Mixed Surveillance Operations:Mixed Surveillance Operations:Covert/OvertCovert/Overt

• Target is deliberately shown overt operation

• Overt is operation surrounded by covert operation (perhaps in a bubble configuration)

• At a pre-planned point, target is allowed to “escape” the overt operation

• Covert operation remains in place

Mixed Surveillance Operations:Mixed Surveillance Operations:Fixed/MobileFixed/Mobile

• Target is “called out” from point of origin by fixed operator, who does not visibly react to his departure.

• Mobile operators “pick up” the target farther along his route

WARNINGWARNING

• We have separated the various modes and types of surveillance as an aid to learning and communication. These distinctions are artificial.

• In reality, Intelligence Officers should understand that they may encounter any and all of the above modes and types, in all possible combinations, during their careers.

War Stories!War Stories!

• Assassination Attempt: AP Chief Minister Chandra Babu Naidu October 2003

• Chief Minister of the Indian State of Andra Pradesh narrowly escaped a series of roadside bombs while traveling in his motorcade.

• The bombs (4-5 in all) had been set in an embankment at a choke point several days prior, indicating compromise of Naidu’s route.

• The bombs were command-detonated, indicating the use of spotters (surveillance) at the point of departure and along the route.

• Naidu’s motorcade consisted of 10 vehicles. Along the route, he switched vehicles in order to have a private conversation with a subordinate.

• The vehicle Naidu should have been in was selectively destroyed, with loss of life.

• Indian security spokesman announced with some satisfaction that they had “foiled” an assassination attempt against the Minister.

• The facts of the case strongly indicate hostile surveillance at the point of origin, along the route, and at the attack site.

Situational AwarenessSituational Awareness

• Situational Awareness – What is it?– Why is it necessary?– How to practice a sustainable,

relaxed level of awareness

Situational AwarenessSituational Awareness

• Situational Awareness – What is it?

• Definition– Mindset or attitude not just an action– What it is NOT

Situational AwarenessSituational Awareness

• Situational Awareness – Why is it necessary?

Situational AwarenessSituational Awareness

• Situational Awareness – Levels of Awareness

• Tuned-out• Relaxed• Focused• High Alert• Comatose

Situational AwarenessSituational Awareness

• Situational Awareness – Levels of Awareness

• What is the proper level of awareness?• Shifting levels

Special Skills:Special Skills: Surveillance Detection Surveillance Detection

for Meeting Security for Meeting Security

Awareness Practice Awareness Practice

• Train your mind to remember, and effectively communicate, detailed descriptive information.

• Pick a person on the street. Look at him briefly, and describe him to yourself.

• Wait an hour or two, then write down the description.

Effective DescriptionsEffective Descriptions

• Policeman’s description:– Caucasian male– 60 years old– 1.8 meters tall– 100 kilos– Short gray hair, brown eyes,

mustache

• OK for police work

Effective DescriptionsEffective Descriptions

• Counter-surveillance operator’s description:– Police description, plus:– Brown boots (Footwear seldom

changes) – Walks like a farmer (Body language)– Smokes Marlboro cigarettes (Bright

package, very visible)– Also smokes a pipe (Unusual,

distinctive personal habit)– Sean Connery (Who does he

resemble?)

Superior Area Knowledge Superior Area Knowledge

• Officers must have intimate knowledge of the cities in which they work.

• Newly assigned officers should be allowed ample time and resources to study their areas of operation (AORs) before being given operational assignments– Map study– On-ground familiarization– SDR design and practice

Surveillance Detection Routes (SDRs)Surveillance Detection Routes (SDRs)

• Intelligence professionals use surveillance detection routes every time they must take a discreet meeting with a source or handler.

• They learn and use a variety of routes and meeting sites and times, choosing them at random. This works to defeat fixed surveillance.

• A well-designed and executed SDR gets you to your meeting on time – unaccompanied – and without alerting potential watchers.

Design and PracticeDesign and Practice

• The only way to run a perfect SDR is to design it ahead of time - and practice it.

• It must give you multiple opportunities to see potential watchers.

• It should include a number of moves that allow you to look back – all of which must be smooth and appear natural to observers.

• In order to appear natural, there must be an apparent reason, i.e., “cover” for each of your moves.

• Let’s look at some of the moves:

Parallel MovementParallel Movement

• Using a map, plot the most direct and logical route from your starting point to the meeting site.

• Your SDR should parallel, cross and envelope this direct route, always tending toward the meeting site.

• Remember, your goal is to get to the meeting unaccompanied, but without alerting potential watchers.

TurnsTurns

• Turns at natural corners give you a chance to look back and see who is behind you.

• More importantly, a turn forces followers to react to your movement.

• If you make a turn, there must eventually be a logical reason for it: A stop at a bank or store, for example.

StairsteppingStairstepping

• Stairstepping is a more sophisticated (and provocative) version of the simple turn.

• It means making a series of left and right turns, usually chosen in a grid pattern of streets.

• As a rule of thumb, you can assume that anyone who is still behind you after 3 or 4 turns in a stairstep pattern is following you.

• Because it is provocative, a stairstep pattern MUST be followed immediately by a logical stop. Which brings us to:

StopsStops

• Stopping on an SDR is a powerful detection tool if used correctly.

• Choose a store or other business with a glass front that will allow you to see what happens outside. Gas stations are also good.

• Make it natural: Buy gas, buy a newspaper, get coffee. As you enter, remember who stops with you, who enters shortly after you stop, or who slows down and looks as they pass your stop.

ChannelingChanneling

• A channel is a section of your route chosen to force surveillance to follow directly behind you, giving you a powerful detection opportunity.

• If you are the target of a multiple team, an effective channel will force all or most of the team to get behind you in a line. This is called a wagon train.

• Examples of effective channels are long bridges, well-lit tunnels, and sections of highway without exits or overpasses.

ReversalsReversals

• A reversal is basically a U-turn that allows you to look back naturally, and that forces surveillance to react to or mirror your movement.

• Reversals are highly provocative and, again, must be followed by a stop that explains the reversal.

• An example of a good reversal is to choose a stop (store or gas station) on the opposite side of a divided street. Go past the stop to the next crossover, make the U-turn, do the stop, then make another crossover to get back onto your route.

• This whole operation (actually a double reversal) will force surveillance to either stop on the original route, replace a follower with another, or mirror your movements.

Dry CleaningDry Cleaning

• On foot, enter a crowded building with multiple exits. Large department stores and shopping malls are good.

• Surveillance will be forced to enter with you, since they can’t know what exit you will use.

• Use stops, reversals and stairstepping inside, to detect surveillance that may have followed you in.

• Leave by a different exit.• Obviously, don’t try this if you are driving

unless you are able to leave your car where it is and proceed: Surveillance will simply set up on your car and wait until you come back to it.

BreakoutBreakout

• There is only one SDR technique that works to detect a well-operated hostile “bubble”:– You must move, swiftly and decisively,

at 90 degrees to your general direction of travel, for at least 4 blocks, and immediately resume travel along the original direction.

– This “breaks” through the bubble and forces it to re-deploy around you.

– It is a provocative move, and must include a cover stop fairly soon after resuming directional travel.

While DrivingWhile Driving

• Principles are the same as for pedestrian operations

• Remember your car may be more easily identified than you are number plates, cannot change color/model)

• Practice memorizing license plates, including in mirrors

• At night, memorize head light patterns

What Are You Looking For?What Are You Looking For?

• It’s deceptively simple: You are looking for the same cars or people over time and distance.

• The logical question is always: Why am I seeing this car or person again, across town and after doing my SDR, when I saw him an hour ago in a different place and environment?

• If there is no innocuous and logical answer to that question, you are under surveillance.

ANOMALIESANOMALIES

• What does hostile surveillance look like?• It tries to look like nothing at all. However,

hostile surveillance operators make mistakes. When they do, the skilled protective surveillance team will detect them:

• Multiple sightings over time and distance• People who don’t “fit in” to the

environment (dress, nationality)• Demeanor: Furtive behavior• Photography and optics• Note taking • Poor cover• Coordinated behavior and other links• Use of OPs and other suspicious positioning

What is the typical hostile surveillance What is the typical hostile surveillance type?type?

• There is no typical type.• Hostile services recruit

operators of both sexes, all ages.

• If you look only for military -age men, you may miss very effective hostile operators!

Timing Stops and Final MovesTiming Stops and Final Moves

• Your SDR has taken you across town to the vicinity of the meeting site.

• You have not detected surveillance and believe you are “clean”.

• If you have planned and practiced, there should be a few spare minutes before the agreed meeting time.

• You should go PAST the meeting site to a “timing stop” that gives you a natural reason to wait, plus a final opportunity to look for surveillance. Have coffee, watch your back, and at the appointed time, go direct to your SAFE meeting.

DemeanorDemeanor

• Remember, the goal is to detect surveillance without alerting it that you are operational.

• Suspicious or “lurking” behavior is easy to spot. Act natural and relax.

• When communicating by cell phone, don’t try to hide it. Everyone uses cell phones and surveillance has no way of knowing who you are talking to (with one exception that we will address in the next slide).

• Don’t try to hide your face. If you have surveillance, they already know what you look like.

CoverCover

• Officers must be provided, and must “live” credible cover “legends” throughout the period of their assignments.

• Their actions must be consistent with their legends at all times – including when they are non-operational (i.e., “off duty”).

• Officers should role-play, with partners, being challenged and interrogated to insure smooth maintenance of their cover, both for status and action.

DisguisesDisguises

• Intention is not to conceal identity• Intention is to confuse and

obfuscate communication of identifying information

• Light disguises best: Hats, clothing changes

• Things that don’t change as easily:– Body language– Habits (smoking)– Shoes

Trade Craft: CommunicationsTrade Craft: Communications

• The safest way to communicate clandestine information is verbally, in face-to-face, unobserved meetings. This is the purpose of the SDR.

• If the passing of recorded information is necessary in a meeting, the safest way to do this is in the most innocuous and natural way possible.

• “Spy-like” techniques are usually unnecessarily risky and provocative, if observed. “Dead drops” and their like are especially risky, both to people and to information.

• When absolutely necessary, physically small storage media such as computer thumb drives can be transferred using well-practiced “brush passes”.

Training and discipline of informantsTraining and discipline of informants

• “Informants must be taught, and must always use, the same level of security awareness and surveillance detection techniques as their handlers!

Aborting the MeetingAborting the Meeting

• There are few circumstances under which should you attend a clandestine meeting if you believe you are being followed (emergencies are an exception).

• Have a pre-arranged cell phone abort signal. A simple phone call in which your number appears on your handler’s screen is sufficient.

• In case both you and your source are being watched by surveillants in communication with one another, this is one phone call that should be made clandestinely. Have the number pre-dialed and press the call button without raising the phone above your waist.

• When aborting a meeting, go to the nearest logical stop, stay there long enough for cover purposes, and then vacate the area.

IntuitionIntuition

• “Surveillance Paranoia” is commonly felt, especially when you’re first starting out.

• HOWEVER: It is also true that the “feeling” we sometimes get of being followed is absolutely accurate; the information is still in our subconscious.

• You should not ignore these intuitions. Use your SDR techniques to verify or negate them.

• In extreme cases, deploy a defensive counter-surveillance operation.

• Finally, try to see things through the eyes of potential hostile surveillance: In their place, what would I be doing?

Surveillance DiagnosticsSurveillance Diagnostics

• To determine whether an officer or facility is under programmatic hostile surveillance– Embassy– Safe house

• Should be conducted by a specially trained team.

• Team should be brought in from OUTSIDE

• Where possible, the team should be composed of indigenous assets

Diagnostics: Defensive OperationsDiagnostics: Defensive Operations

– Used to verify, to a high degree of accuracy, whether a friendly target is under hostile surveillance

– Should be deployed whenever hostile surveillance is suspected

– In extreme hostile environments, should be deployed routinely at random intervals

– Should not utilize operational routes or meeting places.

Mobile Protective BubbleMobile Protective Bubble

• Target utilizes a pre-assigned route or routes, beginning at a logical point of origin (usually, the embassy)

• The friendly team forms a protective “bubble” around target as he moves

• Hostiles operating against the target will show themselves inside the “bubble, if operated correctly.

• The friendly team is on the outside, looking in.

• The operation should be continued through multiple runs to increase the degree of accuracy.

• This technique is also useful in discreetly protecting a VIP.

““Hot and Cold” ManipulationHot and Cold” Manipulation

• Forces hostile surveillance to show itself at the time and place of the friendly team’s choosing.

• Target follows a pre-assigned series of routes over a number of days (7-10).

• The point of origin (point A) is “heated up” using aggressive, overt surveillance. This forces hostiles away from the point of origin.

• The routes are designed to appear random to outside observers.

• All of the routes, however, pass through the same two points, one at 1/3 (point B) and one at 2/3 (point C).

• The friendly team posts fixed covert surveillance at points B and C.

• Any person or vehicle moving behind the target at both points B and C during the same “run” is likely to be hostile.

• Any person or vehicle moving behind the target at B and C on successive runs is highly likely to be hostile.

• The operation should continue for at least 7 – 10 runs.

CONTACTCONTACT

STRATEGIC FORECASTING, INC.

700 Lavaca StreetSuite 900

Austin, Texas 78701512.744.4300

• Scott Stewart - stewart@stratfor.com• Mike Parks - longbow99@earthlink.net

www.stratfor.com