Surveillance Detection

Surveillance Detection

• Definition

• General Surveillance Awareness

• Surveillance Detection Routes (SDR)

• Route Analysis

Definition

• Surveillance Detection - The process of determining your surveillance status– Incorporated into your lifestyle and habits– Simple and routine– Nothing that causes a potential surveillance team to question

any action or lack of action – from start to finish

• Counter-Surveillance– The process of using other people to help determine your

surveillance status– Normally relies on Observation Posts (OP)– OPs should be higher than your location– Observers relay a signal of some sort to you

General Surveillance Awareness

• Awareness of Surroundings in Public

– Note who and what is in your area

– Vary your approaches to destinations

– Watch for repeated sightings of people that seem out of place

General Surveillance Awareness

• Note suspicious activities:– Vehicles pass the same area repeatedly or at slower than

a normal rate– Vehicles with multiple passengers– Dirty vehicles with clean license plates (or vice versa) -

indicates a recent change– People lingering in your area or passing by frequently– Look at windows in nearby buildings for anything out of the

ordinary– Look for people or vehicles making evasive movements

General Surveillance Awareness

• Maintain a low profile!

• Beware of complacency!

• Default state - – Conduct all operational activities with the assumption that you are

under hostile surveillance– Abort operational activities if you detect surveillance

Surveillance Detection Routes (SDR)

• Definition– A planned route taken by an operator for the purpose of

detecting surveillance in support of an operational objective. It's designed to be natural and non-alerting.

• AKA “Surveillance Detection Run”

• Objective

• Criteria for an SDR

Objective

• Establish repeated correlation of surveillance team and target activities over “TDD”

– TIME• Has a reasonable amount of time elapsed since the first

sighting?

– DISTANCE• Have you traveled far enough to indicate that a second

sighting is more than a coincidence?

– DIRECTION• Have you made several changes in direction since the

previous sighting?

Objective

• Adopt behaviors that require observable responses from surveillants.

• Rule of thumb - three times = correlation– "Once is happenstance, twice is coincidence, three times

is surveillance.“

• Look for non-changeable features!– Surveillants may use “disguises” to avoid detection.

• Don’t alert surveillants!– Detecting surveillance can be easy, but avoiding alerting

surveillants makes it more challenging.

Criteria for an SDR• Must cover sufficient TDD to “break the box”

• Uses plausible pretexts for any activities designed to detect surveillance status

• Does not include any elements that are unnatural or alerting to surveillants – keep their perception of you neutral

• Uses strategies to force the surveillance team to reveal itself...

– Establish correlation between your actions and those of your surveillance

– Ensure the correlation is not a coincidence using the TDD factors

Abort Routes

• Used to abort an SDR prior to any operational activity

• Legitimizes the route from start to finish

• Not an obvious change or deviation

Anatomy of an SDR

Start Point

Cover Stop

SurveillanceDetection

Point

Cover StopSurveillance

DetectionPoint

SurveillanceDetection

Point

Cover Stop

OperationalActivity

ObservationPost

ObservationPost

Abort Route

End PointEnd Point

Strategies to force the surveillance team to reveal itself...

• Surveillance Detection Points (SDP) • Choke Points • Cover Stop • Channel • Multiple Turns• Natural Reverses • Stair-Stepping • Varied Traffic Density • Changing Modes of Transportation• "Sifting"

Surveillance Detection Points (SDP)

• "Intrusion Points" - locations where surveillance is expected to intrude

• Example– Entering a building with multiple exits – the team will

probably decide to follow you if they don’t have enough people to cover all exits

Choke Points

• Locations on a route that can't be avoided due to environmental factors

• Examples– Entrance to a building or compound

– Revolving doors leading into office buildings or shopping centers

Cover Stop

• Location that provides a logical reason for the route and aids in timing

• Example– Stopping at a specialty store to make a

purchase or inquire about an item

Channel

• Linear area where surveillance must travel in order to follow a target

• Example– Crossing a bridge

Multiple Turns

• Several logical changes in direction of travel

• Example– Turning left at an

intersection and then merging onto a highway

Natural Reverses• LOGICAL changes to

travel in the opposite direction

• An unnatural reverse is a very alerting behavior

• Examples– Driving to a parking lot in a

major city and then backtracking on foot to reach a logical destination.

– A rotary or highway on-ramp/exit ramp that gives you a view in the opposite direction

CLEAR VIEW OF SURVEILLANTS

Stair-Stepping• Movement to intended

destination in a series of "dog-legs" (linear movement to various intrusion points or cover stops)

• Example– Zigzag travel to multiple intrusion

points and cover stops to "run errands" en route to a final destination

Varied Traffic Density• Repeated movement into and out of areas

with many or few people (or vehicles)

• Example– Entering and exiting a large crowd to purchase a

ticket to a public event

I NEED A LOGICAL REASON TO BE IN THIS DESERT.

I NEED A LOGICAL REASON TO BE IN THIS

CROWD.

Changing Modes of Transportation

• LOGICAL switching between travel on foot, public transportation, and use of a vehicle

• Example– Walking to a cab stand and then

taking a cab to the nearest subway station

EVERYTHING YOU DO DURING AN SDR MUST APPEAR TO HAVE A LOGICAL

REASON.

REMEMBER THAT YOUR SURVEILLANTS MIGHT NOT BE TOO BRIGHT

OR CREATIVE.

THE REASON SHOULD BE PRETTY OBVIOUS!

"Sifting"

• Eliminates irrelevant suspicions through the application of TDD factors until you achieve certainty

• Example– Continue an SDR to include at

least three significantly different locations at three significantly different points in time

3

Route Analysis

• Areas of Predictable Travel (APT)

– An area on a route that a target must travel through in order to reach a known destination.

– This is the most likely location for a physical attack against the target.

TWO OPERATORS ENTER AN APT

TWO PURPLE HEARTS (POSTHUMOUSLY AWARDED)

GRENADE!!

"Hollywood Tradecraft"• Driving backwards

• Getting on and then quickly getting off of a subway train

• Driving down dead-end streets

• Illogical U-Turns

• Entering a crowded movie theater and then immediately walking out the exit

Surveillant: Why is he

driving on a golf course?

Surveillant: Why is he making a U-turn?

Answer: because he’s an idiot.

Remember

• The surveillance team’s perception is their reality and they will react accordingly.

• Your reality isn’t relevant – they only know what they perceive based on your actions

On the other hand, Hollywood Tradecraft makes sense when

your objective is survival!

Losing Surveillance• With the preceding warnings about Hollywood Tradecraft in mind,

how could you lose surveillance in the unlikely event that you need to do so?

– Jump into a taxi when no other cabs are immediately available.– Take a bus just before it leaves a stop.– Enter a subway station at a time when a large crowd will be exiting,

cross through the crowd, and then quickly leave from the other side of the station.

– Pass through a revolving door that will slow pursuit and then immediately duck out of sight.

– Etc.

• Remember that these and other similar actions will serve as red flags to surveillants. They only make sense when immediate survival or another unusual circumstance outweighs consideration of long term operational viability.

About Mobile Phones• Mobile phones can act as carriers for any radiated signal

– This means your mobile phone conversations can be intercepted by mistake

• Mobile phones can also serve as beacons that allow surveillants (physical/technical) to track you

• Turn off your mobile phone AND disconnect the battery to mitigate this risk

ACTIVITY

• Design and conduct an SDR

Start Point

Cover Stop

SurveillanceDetection

Point

Cover Stop

SurveillanceDetection

Point

SurveillanceDetection

Point

Cover Stop

OperationalActivity

ObservationPost

ObservationPost

Abort Route

End PointEnd Point

Questions?