Basic Surveillance and Surveillance

Detection – March, 2009

 INTRODUCTION

• All hostile acts begin with hostile surveillance or

investigation.
• Intelligence officers must accept that they will be
targeted for hostile surveillance.
• In foreign environments, they must learn to live
and operate comfortably within this framework.
• To operate comfortably and effectively in hostile
environments requires knowledge, skill and above
all, self-discipline.
• Consequences of failure in hostile environment
entail risk to:
– Critical national security information
– The lives of informants
– In some cases, the life of the intelligence officer
himself
 Goals of this Course
• Knowledge
– Know and recognize the common
modes of surveillance employed
around the world
– Understand the strengths and
weaknesses of the modes and types of
surveillance
• Skills
– Learn specific techniques to detect and
deter hostile surveillance
– Practice and perfect the techniques in
a non-hostile environment
 Modes of Surveillance

• Covert surveillance
• Overt surveillance
• Mixed surveillance operations
 Covert Surveillance

• Intended strictly to develop

information without affecting
the target’s behavior
 Overt Surveillance

“…We are watching

you”
• Primary goal is to affect the
target’s behavior
• May be used purely as
harassment
 Mixed Covert/Overt Operations
• Primary goal is deception
• Manipulates target’s behavior
• Creates false assumptions
– Target believes he sees the
hostile operation
– Target assumes he is in the clear
when the overt portion is
removed
– Play’s on target’s psychology
• Sense of relief
• Arrogance
 Types of Surveillance

• Fixed surveillance
• Solo mobile surveillance
• Multiple mobile surveillance
• Mixed operations
• Technical surveillance
 Fixed Surveillance

• Does not move or visibly react

to target’s actions
• Strengths:
– Difficult to detect
• Weaknesses:
– Requires large amounts of
resources against moving targets
– If covert, requires elaborate
cover
 Solo mobile surveillance

• A single mobile operator

following a target
• Typical of unsophisticated
police/private investigators
• Strengths:
– Small investment in resources
• Weaknesses:
– Very vulnerable to detection
– Must mirror target’s movements
Segmented Solo Mobile Surveillance:
A sub-set

• Follows target in segments over

extended time period
• May involve multiple operators,
working as individuals
• Strengths:
– Far less vulnerable to detection
– Small investment in resources
• Weaknesses
– Requires that target operate
predictably
– Takes a long time to work (weeks at
minimum)
 Multiple Mobile Surveillance
• Multiple operators working against a
moving target
• Typical of more sophisticated government
operations (police, clandestine services)
• Strengths:
– Difficult to detect
– Avoids showing target the same operators
twice
• Weaknesses:
– Requires extensive training, practice and
superior area knowledge
– Requires skilled coordination/direction
– Large investment in resources
 Examples of Multiple Mobile
Surveillance
• ABC: The “street dance”
• Paralleling
• Envelopment: The “bubble”
 Mixed Surveillance Operations

• Two kinds:
– Mixed covert/overt
– Mixed mobile/fixed
 Mixed Surveillance Operations:
Covert/Overt
• Target is deliberately shown
overt operation
• Overt is operation surrounded
by covert operation (perhaps
in a bubble configuration)
• At a pre-planned point, target
is allowed to “escape” the
overt operation
• Covert operation remains in
place
 Mixed Surveillance Operations:
Fixed/Mobile
• Target is “called out” from
point of origin by fixed
operator, who does not visibly
react to his departure.
• Mobile operators “pick up” the
target farther along his route
 WARNING
• We have separated the various
modes and types of surveillance as
an aid to learning and
communication. These distinctions
are artificial.
• In reality, Intelligence Officers
should understand that they may
encounter any and all of the above
modes and types, in all possible
combinations, during their careers.
 War Stories!
• Assassination Attempt: AP Chief Minister Chandra Babu Naidu
October 2003
• Chief Minister of the Indian State of Andra Pradesh
narrowly escaped a series of roadside bombs while
traveling in his motorcade.
• The bombs (4-5 in all) had been set in an embankment
at a choke point several days prior, indicating
compromise of Naidu’s route.
• The bombs were command-detonated, indicating the
use of spotters (surveillance) at the point of departure
and along the route.
• Naidu’s motorcade consisted of 10 vehicles. Along the
route, he switched vehicles in order to have a private
conversation with a subordinate.
• The vehicle Naidu should have been in was selectively
destroyed, with loss of life.
• Indian security spokesman announced with some
satisfaction that they had “foiled” an assassination
attempt against the Minister.
• The facts of the case strongly indicate hostile
surveillance at the point of origin, along the route, and
at the attack site.
 Situational Awareness

• Situational Awareness
– What is it?
– Why is it necessary?
– How to practice a sustainable,
relaxed level of awareness
 Situational Awareness

• Situational Awareness
– What is it?
• Definition
– Mindset or attitude not just an action
– What it is NOT
 Situational Awareness

• Situational Awareness
– Why is it necessary?
 Situational Awareness

• Situational Awareness
– Levels of Awareness
• Tuned-out
• Relaxed
• Focused
• High Alert
• Comatose
 Situational Awareness

• Situational Awareness
– Levels of Awareness
• What is the proper level of awareness?
• Shifting levels
 Special Skills:
Surveillance Detection
for Meeting Security
 Awareness Practice

• Train your mind to remember,

and effectively communicate,
detailed descriptive
information.
• Pick a person on the street.
Look at him briefly, and
describe him to yourself.
• Wait an hour or two, then
write down the description.
 Effective Descriptions

• Policeman’s description:
– Caucasian male
– 60 years old
– 1.8 meters tall
– 100 kilos
– Short gray hair, brown eyes,
mustache
• OK for police work
 Effective Descriptions
• Counter-surveillance operator’s
description:
– Police description, plus:
– Brown boots (Footwear seldom
changes)
– Walks like a farmer (Body language)
– Smokes Marlboro cigarettes (Bright
package, very visible)
– Also smokes a pipe (Unusual,
distinctive personal habit)
– Sean Connery (Who does he
resemble?)
 Superior Area Knowledge
• Officers must have intimate
knowledge of the cities in which
they work.
• Newly assigned officers should be
allowed ample time and resources
to study their areas of operation
(AORs) before being given
operational assignments
– Map study
– On-ground familiarization
– SDR design and practice
Surveillance Detection Routes (SDRs)
• Intelligence professionals use
surveillance detection routes every
time they must take a discreet
meeting with a source or handler.
• They learn and use a variety of
routes and meeting sites and times,
choosing them at random. This
works to defeat fixed surveillance.
• A well-designed and executed SDR
gets you to your meeting on time –
unaccompanied – and without
alerting potential watchers.
 Design and Practice
• The only way to run a perfect SDR is
to design it ahead of time - and
practice it.
• It must give you multiple
opportunities to see potential
watchers.
• It should include a number of moves
that allow you to look back – all of
which must be smooth and appear
natural to observers.
• In order to appear natural, there
must be an apparent reason, i.e.,
“cover” for each of your moves.
• Let’s look at some of the moves:
 Parallel Movement
• Using a map, plot the most direct
and logical route from your starting
point to the meeting site.
• Your SDR should parallel, cross and
envelope this direct route, always
tending toward the meeting site.
• Remember, your goal is to get to the
meeting unaccompanied, but without
alerting potential watchers.
 Turns
• Turns at natural corners give you a
chance to look back and see who is
behind you.
• More importantly, a turn forces
followers to react to your movement.
• If you make a turn, there must
eventually be a logical reason for it:
A stop at a bank or store, for
example.
 Stairstepping
• Stairstepping is a more sophisticated
(and provocative) version of the
simple turn.
• It means making a series of left and
right turns, usually chosen in a grid
pattern of streets.
• As a rule of thumb, you can assume
that anyone who is still behind you
after 3 or 4 turns in a stairstep
pattern is following you.
• Because it is provocative, a stairstep
pattern MUST be followed
immediately by a logical stop. Which
brings us to:
 Stops
• Stopping on an SDR is a powerful
detection tool if used correctly.
• Choose a store or other business
with a glass front that will allow you
to see what happens outside. Gas
stations are also good.
• Make it natural: Buy gas, buy a
newspaper, get coffee. As you enter,
remember who stops with you, who
enters shortly after you stop, or who
slows down and looks as they pass
your stop.
 Channeling
• A channel is a section of your route
chosen to force surveillance to follow
directly behind you, giving you a
powerful detection opportunity.
• If you are the target of a multiple
team, an effective channel will force
all or most of the team to get behind
you in a line. This is called a wagon
train.
• Examples of effective channels are
long bridges, well-lit tunnels, and
sections of highway without exits or
overpasses.
 Reversals
• A reversal is basically a U-turn that allows
you to look back naturally, and that forces
surveillance to react to or mirror your
movement.
• Reversals are highly provocative and, again,
must be followed by a stop that explains the
reversal.
• An example of a good reversal is to choose a
stop (store or gas station) on the opposite
side of a divided street. Go past the stop to
the next crossover, make the U-turn, do the
stop, then make another crossover to get
back onto your route.
• This whole operation (actually a double
reversal) will force surveillance to either
stop on the original route, replace a follower
with another, or mirror your movements.
 Dry Cleaning
• On foot, enter a crowded building with
multiple exits. Large department stores and
shopping malls are good.
• Surveillance will be forced to enter with you,
since they can’t know what exit you will use.
• Use stops, reversals and stairstepping
inside, to detect surveillance that may have
followed you in.
• Leave by a different exit.
• Obviously, don’t try this if you are driving
unless you are able to leave your car where
it is and proceed: Surveillance will simply
set up on your car and wait until you come
back to it.
 Breakout
• There is only one SDR technique
that works to detect a well-
operated hostile “bubble”:
– You must move, swiftly and decisively,
at 90 degrees to your general direction
of travel, for at least 4 blocks, and
immediately resume travel along the
original direction.
– This “breaks” through the bubble and
forces it to re-deploy around you.
– It is a provocative move, and must
include a cover stop fairly soon after
resuming directional travel.
 While Driving
• Principles are the same as for
pedestrian operations
• Remember your car may be
more easily identified than you
are number plates, cannot
change color/model)
• Practice memorizing license
plates, including in mirrors
• At night, memorize head light
patterns
 What Are You Looking For?
• It’s deceptively simple: You are
looking for the same cars or
people over time and distance.
• The logical question is always:
Why am I seeing this car or
person again, across town and
after doing my SDR, when I
saw him an hour ago in a
different place and
environment?
• If there is no innocuous and
logical answer to that question,
you are under surveillance.
 ANOMALIES
• What does hostile surveillance look like?
• It tries to look like nothing at all. However,
hostile surveillance operators make
mistakes. When they do, the skilled
protective surveillance team will detect
them:
• Multiple sightings over time and distance
• People who don’t “fit in” to the environment
(dress, nationality)
• Demeanor: Furtive behavior
• Photography and optics
• Note taking
• Poor cover
• Coordinated behavior and other links
• Use of OPs and other suspicious positioning
What is the typical hostile surveillance
type?
• There is no typical type.
• Hostile services recruit
operators of both sexes, all
ages.
• If you look only for military
-age men, you may miss very
effective hostile operators!
 Timing Stops and Final Moves
• Your SDR has taken you across town
to the vicinity of the meeting site.
• You have not detected surveillance
and believe you are “clean”.
• If you have planned and practiced,
there should be a few spare minutes
before the agreed meeting time.
• You should go PAST the meeting site
to a “timing stop” that gives you a
natural reason to wait, plus a final
opportunity to look for surveillance.
Have coffee, watch your back, and at
the appointed time, go direct to your
SAFE meeting.
 Demeanor
• Remember, the goal is to detect
surveillance without alerting it that
you are operational.
• Suspicious or “lurking” behavior is
easy to spot. Act natural and relax.
• When communicating by cell phone,
don’t try to hide it. Everyone uses
cell phones and surveillance has no
way of knowing who you are talking
to (with one exception that we will
address in the next slide).
• Don’t try to hide your face. If you
have surveillance, they already know
what you look like.
 Cover
• Officers must be provided, and must
“live” credible cover “legends”
throughout the period of their
assignments.
• Their actions must be consistent with
their legends at all times – including
when they are non-operational (i.e., “off
duty”).
• Officers should role-play, with partners,
being challenged and interrogated to
insure smooth maintenance of their
cover, both for status and action.
 Disguises
• Intention is not to conceal identity
• Intention is to confuse and
obfuscate communication of
identifying information
• Light disguises best: Hats, clothing
changes
• Things that don’t change as easily:
– Body language
– Habits (smoking)
– Shoes
 Trade Craft: Communications
• The safest way to communicate clandestine
information is verbally, in face-to-face,
unobserved meetings. This is the purpose of the
SDR.
• If the passing of recorded information is
necessary in a meeting, the safest way to do this
is in the most innocuous and natural way
possible.
• “Spy-like” techniques are usually unnecessarily
risky and provocative, if observed. “Dead drops”
and their like are especially risky, both to people
and to information.
• When absolutely necessary, physically small
storage media such as computer thumb drives
can be transferred using well-practiced “brush
passes”.
Training and discipline of informants

• “Informants must be taught,

and must always use, the
same level of security
awareness and surveillance
detection techniques as their
handlers!
 Aborting the Meeting
• There are few circumstances under which
should you attend a clandestine meeting if
you believe you are being followed
(emergencies are an exception).
• Have a pre-arranged cell phone abort signal.
A simple phone call in which your number
appears on your handler’s screen is
sufficient.
• In case both you and your source are being
watched by surveillants in communication
with one another, this is one phone call that
should be made clandestinely. Have the
number pre-dialed and press the call button
without raising the phone above your waist.
• When aborting a meeting, go to the nearest
logical stop, stay there long enough for
cover purposes, and then vacate the area.
 Intuition
• “Surveillance Paranoia” is commonly felt,
especially when you’re first starting out.
• HOWEVER: It is also true that the “feeling”
we sometimes get of being followed is
absolutely accurate; the information is still
in our subconscious.
• You should not ignore these intuitions. Use
your SDR techniques to verify or negate
them.
• In extreme cases, deploy a defensive
counter-surveillance operation.
• Finally, try to see things through the eyes of
potential hostile surveillance: In their place,
what would I be doing?
 Surveillance Diagnostics
• To determine whether an officer or
facility is under programmatic
hostile surveillance
– Embassy
– Safe house
• Should be conducted by a specially
trained team.
• Team should be brought in from
OUTSIDE
• Where possible, the team should be
composed of indigenous assets
Diagnostics: Defensive Operations

– Used to verify, to a high degree of

accuracy, whether a friendly target is
under hostile surveillance
– Should be deployed whenever hostile
surveillance is suspected
– In extreme hostile environments,
should be deployed routinely at
random intervals
– Should not utilize operational routes or
meeting places.
 Mobile Protective Bubble
• Target utilizes a pre-assigned route or
routes, beginning at a logical point of
origin (usually, the embassy)
• The friendly team forms a protective
“bubble” around target as he moves
• Hostiles operating against the target will
show themselves inside the “bubble, if
operated correctly.
• The friendly team is on the outside,
looking in.
• The operation should be continued
through multiple runs to increase the
degree of accuracy.
• This technique is also useful in discreetly
protecting a VIP.
 “Hot and Cold” Manipulation
• Forces hostile surveillance to show itself at the time
and place of the friendly team’s choosing.
• Target follows a pre-assigned series of routes over a
number of days (7-10).
• The point of origin (point A) is “heated up” using
aggressive, overt surveillance. This forces hostiles
away from the point of origin.
• The routes are designed to appear random to outside
observers.
• All of the routes, however, pass through the same two
points, one at 1/3 (point B) and one at 2/3 (point C).
• The friendly team posts fixed covert surveillance at
points B and C.
• Any person or vehicle moving behind the target at both
points B and C during the same “run” is likely to be
hostile.
• Any person or vehicle moving behind the target at B
and C on successive runs is highly likely to be hostile.
• The operation should continue for at least 7 – 10 runs.
 CONTACT
STRATEGIC FORECASTING,
INC.
700 Lavaca Street
Suite 900
Austin, Texas 78701
512.744.4300
• Scott Stewart - stewart@stratfor.com
• Mike Parks - longbow99@earthlink.net

www.stratfor.com