One of the most underestimated skills of an executive protection agent is counter-surveillance tactics. This specific topic is either being touched on for a brief time during EP courses or not covered at all. Within the functions of protective operations, counter surveillance plays a pivotal role in mitigating risks and ensuring the effectiveness of protection strategies.
When most people think about bodyguards, they think about the people who are around a celebrity or an important public figure. They do not know that executive protection is more than just protective agents surrounding a VIP. It involves a comprehensive approach to security, involving thorough planning, risk and threat assessments, intelligence gathering, comprehensive advance work, and strategic responses. While visible security measures (such as bodyguards) are important, the covert and preemptive aspects are equally critical to a successful protection operation. Counter-surveillance is the art and science of identifying and countering threats before they manifest, making it an indispensable tool in the executive protection toolbox. It is such an important area that it needs to be properly studied.
Why are specific people at risk for surveillance? The objective of surveillance is to monitor, record, and analyze the movements and activities of individuals or groups to gather information. Criminals use surveillance to discover what your weaknesses are to do you harm (especially terrorist organizations), and paparazzi use it to find your patterns so they can predict your next move and where to find you next. Some other reasons individuals or entities may be surveilled is to gather business intelligence or other personal motives such as private investigations, often relating to legal matters or personal disputes. An all-new group of people who use surveillance against their victims are sex predators and stalkers. The intention of these individuals is obviously for kidnapping, trafficking, and harm to their victims.
Understandably, there are many risks associated with being followed or monitored, such as:
Compromised Personal Safety: Surveillance can be a precursor to more direct threats such as physical attacks, kidnapping, or ambushes.
Privacy Invasion: Persistent surveillance can lead to significant invasions of privacy, affecting the mental well-being and sense of security of the clients and their family members.
Information Leakage: Surveillance can result in sensitive or confidential information being intercepted, posing risks to both personal and corporate security.
Behavioral Alteration: Knowing one is being watched can lead to altered behavior, which can impact client’s performance and decision-making.
What is Counter-Surveillance? Counter-surveillance is the proactive practice of monitoring and countering potential threats, hostile surveillance, or intelligence gathering activities aimed at the protected individual or group. It involves the use of advanced techniques, technology, and trained personnel to detect, deter, and neutralize potential threats while avoiding confrontation.
And it can be crucial for the following reasons:
Early Threat Detection: One of the primary advantages of counter-surveillance is the ability to detect threats in their early stages. Hostile individuals or groups often conduct surveillance to gather information, assess vulnerabilities, and plan attacks. In his book “I was Born on November 17”, Dimitris Koufontinas, one of the most notorious domestic terrorists in Greece and the leader of the infamous November 17 terrorist organization, (responsible for the assassination of CIA Chief of Station Richard Welch and 4 other Americans as well as the killing of at least 19 other individuals), explained in detail the tactics of how the terrorist organization would conduct surveillance on their targets. A very educational read for those interested in learning from the adversary. In such events, effective counter surveillance can intercept early surveillance attempts by raising awareness and allowing security teams to intervene before a threat materializes.
Reducing Vulnerabilities: Counter-surveillance helps protect individuals by identifying weaknesses in their security protocols. By pinpointing potential vulnerabilities or patterns that could be exploited by malicious actors, protective measures can be adjusted or strengthened to minimize risk. Weaknesses can be found in the biggest and most sophisticated protective operation, no one is immune.
Preventing Ambushes or Attacks: Surveillance is often a precursor to ambushes or attacks. Counter-surveillance can identify suspicious individuals or activities that may indicate imminent danger, allowing security teams to take proactive measures to prevent an attack.
Enhanced Situational Awareness: Counter-surveillance teams provide real-time intelligence, which enhances the situational awareness of executive protection personnel. This enables them to make informed decisions, adjust routes, and respond effectively to changing circumstances.
Protecting Privacy: Counter-surveillance also plays a role in protecting the privacy of high-profile individuals. By identifying and deterring paparazzi or overzealous fans, it allows clients to maintain a degree of personal space and control over their lives. In one of our previous podcasts with a retired famous paparazzi, he admitted that he knew where to find celebrities because they had a routine life and used the same restaurants or bars over and over again.
Things to consider during counter-surveillance operations. A good counter-surveillance agent is the one who understands the tactics of surveillance practices. As we mentioned earlier, surveillance and counter-surveillance are a very specialized area within protective operations and one needs to dedicate a good amount of specialized training to it. Something to consider for those EP agents who want to learn more.
Before diving into counter-surveillance, it's essential to grasp the concept of surveillance itself. Learn from your adversary. In order to be able to counter an act, you must know how to perform the act. Previously, we explained who may be conducting surveillance on you or your client and why. Below, we will analyze the methods of surveillance, the various methods used, different forms a surveillance can take, and commonly used techniques. If you know how your adversary operates, you will be more skilled in anticipating their moves, identifying surveillance and mitigate risks.
Methods of Surveillance: Surveillance methods vary greatly depending on the objectives and the technology available. Common methods include:
Physical Surveillance: Involves the physical observation of a person or place. It can be either stationary (watching from a fixed position) or mobile (following the target).
Technical Surveillance: Utilizes electronic devices like cameras, microphones, GPS trackers, and wiretapping equipment to monitor and record activities.
Cyber Surveillance: Involves monitoring online activities, including email communications, social media interactions, and browsing history.
Aerial Surveillance: Uses drones or other aircraft to observe from above.
Agent-Based Surveillance: Involves human intelligence where individuals gather information through personal interaction or infiltration into a group.
Tools Used in Surveillance: Surveillance tools range from simple binoculars to sophisticated electronic equipment:
Optical Surveillance Tools: Binoculars, telescopes, and cameras.
Audio Surveillance Tools: Listening devices, voice recorders, and wiretaps.
Electronic Surveillance Tools: GPS trackers, motion sensors, and digital monitoring software.
Data Surveillance Tools: Software for monitoring internet activity, including email interception and network monitoring.
Forms Surveillance Can Take: Surveillance can take several forms, including:
Covert Surveillance: Conducted without knowledge of the subject.
Overt Surveillance: Visible and obvious monitoring, often used as a deterrent.
Personal Surveillance: Focused on individuals or small groups.
Mass Surveillance: Broad monitoring, often of large populations or areas.
Common Techniques Used in Surveillance: Surveillance techniques will depend on the purpose and context.
Tail Surveillance or “Tailing”: Following a subject discreetly.
Stationary Surveillance: Observing from a fixed point.
Electronic Eavesdropping: Listening in on conversations or communications.
Cyber Monitoring: Tracking online activities and digital footprints.
Pattern Analysis: Studying routines and behaviors for anomalies.
Counter-surveillance 101
Counter-surveillance tactics are critical for executive protection teams to ensure the safety and security of high-profile individuals. These tactics help identify and mitigate potential threats and hostile surveillance. One of the most important aspects of counter-surveillance is being able to identify suspicious people/behaviors. For this, we will use the U.S. government acronym TEDD which illustrates the principles one can use to identify surveillance. TEDD stands for Time – Environment – Distance - Demeanor. In other words, if a person sees someone repeatedly over a particular timeframe, in different environments and/or at distances not proximal to each other, or one who displays a poor demeanor, then it can be assumed he or she is under surveillance.
When an individual becomes the specific target of a planned attack, they may find themselves subjected to various elements of surveillance, including time, environment, and distance (TEDD). However, if the focus of the threat is directed towards a location, such as a subway or a government facility where the individual works, the primary element to be aware of is demeanor. Demeanor, in this context, refers to a person's behavior that appears unusual or unnatural, or his presence is unjustified. This behavior can range from overtly suspicious actions, such as loitering without a clear purpose or reason for being in a particular place, to more subtle signs that are almost undetectable to an observer. Sometimes, it's a gut feeling or a sense that something isn't right, rather than something visibly obvious.
Signs of poor demeanor may include:
Mirroring: Acting in sync with the target's movements, indicating a potential attempt to monitor or follow them.
Communication: Making efforts to communicate or coordinate with others when the target moves, possibly signaling collaboration within a surveillance team.
Avoiding Eye Contact: Refraining from making eye contact with the target, potentially to avoid drawing attention or revealing intent.
Unnatural Behavior: Signs of emotional stress, such as nervousness, excessive enthusiasm, or noticeable sweating.
Abrupt Movements: Making sudden turns, stops, or changes in direction that seem out of place or unnatural.
Extended Presence: A person who remains in a specific area for an unusually long period without an apparent reason.
Unjustified Contact: Repeated or unplanned interactions with a specific person without a clear explanation.
Unjustified Presence: A person whose presence in a particular location or at a specific time is not easily justified or explained.
Pattern Repetition: Multiple individuals displaying similar behaviors or signs.
Standing Out: Someone who noticeably differs from the surrounding crowd in some way.
Intuition: Trusting your instincts when you get a bad feeling or sense that something is amiss.
Observing Hands: Pay attention to whether individuals are holding anything that could be used as a weapon or a tool for kidnapping.
Covert Communication: Monitoring for signs of communication, such as texting, hand signals, nods, repeated eye contact, or any unusual interactions when you move.
In the context of terrorism, displaying poor demeanor can also involve:
Inappropriate Attire: Wearing clothing that is unsuitable for the weather, like donning heavy coats in the summertime, or exhibiting unusual bulges or wires under clothing that might suggest concealed weapons or devices.
Physical Discomfort: Showing signs of nervousness, such as excessive sweating, mumbling, or fidgeting.
Avoiding Security: Deliberately attempting to evade security personnel or behaving in a manner that raises suspicions when encountering security measures.
Unusual Baggage: A person carrying bags, suitcases, or luggage that appears out of place or disproportionate to the situation.
In addition, according to some reports, suicide bombers often exhibit an intense stare as they approach the final stages of their mission. They seem to have tunnel vision, being able to focus only on their intended purpose or target. They may also be under the influence of drugs.
We have to highlight that poor demeanor encompasses a wide range of behaviors and signs, from the overtly conspicuous to the subtly unusual. Being vigilant and aware of these indicators can help individuals recognize potential threats and take appropriate actions to ensure their safety in various situations, especially in environments where security risks are a concern.
Recognizing signs of being followed is critical for executive protection teams. One should be on the lookout for:
Repetition in Appearances: Notice repeated appearances of the same vehicle or person(s) in different locations or over time.
Unusual Patterns: Highlighting patterns such as a person on foot or in a vehicle making the same turns, stopping when you stop, or lingering in the same areas.
-Using your peripheral vision, mirrors, and other reflective surfaces (like shop windows or parked cars) for better observation.
-Enter buildings or make sudden, unexpected turns to test if a follower is maintaining their pursuit.
-While driving, change speeds, make sudden, unexpected turns to test if a follower is maintaining their pursuit. Make a stop at a safe location to observe if any vehicle stops nearby or behaves suspiciously. When you can, perform a legal and safe U-turn to see if the following vehicle replicates the maneuver. Drive a route in reverse or returning to a previous location to check for surveillance.
Counter-surveillance tactics for executive protection teams:
Behavior Analysis: EP team members have to learn how to observe the behavior of people in the vicinity of the protected individual. Look for signs of unusual or suspicious conduct, such as individuals who appear to be loitering, repeatedly changing their positions, taking a keen interest in the protected person, or other signs we mentioned earlier.
Varying Routes and Schedules: In our world, we say routine can be as deadly as a bullet, and there is a truth to it. EP teams must avoid predictable patterns by varying the routes and schedules of the protected individual. This makes it more challenging for potential threats to plan and execute an attack. And an additional challenge is that many clients become quite used to their patterns and it takes patience and understanding to slowly convince them that the day-to-day changes in routes or patterns are a good thing and not a bother or a hinderance.
Discreet and Safe Communication: It is disappointing to say that we have many examples of EP agents who do not practice secure and discreet communication methods, adding more risks to their client’s safety. Always maintain OPSEC, use secure communication apps (Sorry, but WhatsApp is NOT one of them) and be careful what you post on social media.
Counter-Observation: The majority of EP operations are done by small teams. Not all clients or teams have those extra bodies to deploy for their own counter-surveillance team. That is why it is important for the team members to be extra vigilant and keep an eye on individuals who may be surveilling the protected individual.
Technical Surveillance Detection: Use specialized equipment to detect electronic surveillance devices, such as hidden cameras, bugs, or GPS trackers. In addition, educate yourself and seek extra training in how to sweep vehicles, accommodations, and meeting locations for listening devices or threats.
Situational Awareness: Promote constant situational awareness among team members. Encourage them to be vigilant and observant of their surroundings, including people, vehicles, and anomalies.
Route Reconnaissance: Conduct advance reconnaissance of routes and locations where the protected individual will visit. Identify potential chokepoints, escape routes, and secure areas.
Spotting Surveillance Teams: Train team members to recognize signs of hostile surveillance teams. Look for vehicles or individuals that appear out of place, conduct frequent U-turns, or employ evasive driving tactics.
Emergency Response Protocols: Develop and rehearse with your team emergency response protocols to address situations where hostile surveillance is identified. These protocols should include contacting law enforcement, documentation, team briefings and taking appropriate actions to ensure the principal's safety.
Counter-Intelligence Measures: Be aware of potential leaks of sensitive information within the team, household personnel, or from external sources. Implement counter-intelligence measures to protect operational details.
Adaptive Tactics: Be always flexible and adapt tactics based on the specific circumstances and threat environment. Threats may change, so the counter-surveillance approach should evolve accordingly.
Do not forget the Human Element!
The human element is irreplaceable in counter-surveillance operations. Skilled and trained personnel with a deep understanding of human behavior and surveillance techniques are the linchpin of a successful counter-surveillance program. Their ability to blend in, remain discreet, and adapt to evolving threats is invaluable. Nothing can replace real time on the ground intelligence.
For executive protection teams, counter-surveillance is not really an option, it is an important component for protecting high-profile individuals, security team members and mitigating potential risks. By providing early threat detection, reducing vulnerabilities, preventing ambushes, enhancing situational awareness, and protecting privacy, counter-surveillance serves as a vital pillar of executive protection operations.