Technical Surveillance Countermeasures (TSCM)

A modern surveillance concern is rarely limited to a traditional listening device in a room. Tracking and monitoring can involve concealed audio or video equipment, location trackers, compromised phones, cloud accounts, connected vehicle or vessel systems and other technical routes. A proportionate TSCM response therefore starts with the threat, the environment and the evidence already available.

Homes and offices

Residential and commercial premises may present concerns around concealed microphones or cameras, altered or substituted equipment, wireless transmissions, local networks and connected devices. A technical review should consider the physical environment and its normal electronic baseline rather than rely on a single consumer detector.

Cars and other vehicles

Vehicle-related surveillance can involve stand-alone location trackers, Bluetooth tracking devices, connected-car accounts or misuse of legitimate telematics. The relevant enquiry may therefore include both the vehicle itself and the digital services associated with it.

Pleasure craft and yachts

Pleasure craft combine features of a vehicle, a residence and a connected technical environment. Cabins, onboard power, Wi-Fi, cellular or satellite connectivity, navigation electronics and remotely accessible systems can all affect the scope of a technical-security review. Publicly visible vessel information should also be distinguished from genuinely covert tracking.

Phones, tablets and other devices

A physical sweep cannot resolve every surveillance concern. A compromised device, malicious application, shared cloud credential, location-sharing setting or unauthorised account session may expose location, communications, microphone or camera access without any separate object being present.

What a proportionate TSCM review can consider

• Threat-led scoping: what information appears to be leaking, over what period, and who had legitimate access.
• Physical integrity and indications of alteration, substitution or unexplained equipment.
• Relevant anomalies in the radio-frequency, electromagnetic, acoustic or network environment.
• Unwanted-tracker alerts and location-sharing or telematics exposure.
• Device, account and application indicators where digital compromise is a credible alternative explanation.
• Preservation of alerts, identifiers, photographs and other evidence before potentially destructive changes are made.
• Escalation to specialist technical examination, digital forensics, legal advisers or law enforcement where appropriate.

When this scenario may arise

Typical triggers include repeated unexplained knowledge of private conversations or movements, unwanted-tracker notifications, suspected information leakage during a dispute or transaction, unexplained changes to devices or premises, concerns following unauthorised access, or a credible personal-safety or harassment issue.

A sweep is not a guarantee

No single examination can prove that surveillance has never occurred. Some devices store data rather than transmit it, some systems transmit intermittently, and software or account compromise may leave no physical item to find. Reporting should therefore distinguish positive findings, anomalies, unresolved questions and the limits of the examination.

Read our technical briefing on modern tracking, eavesdropping and TSCM.