Detecting Hostile Surveillance
By TorchStone VP, Scott Stewart
I spend a lot of time speaking and writing about things like situational awareness and OODA and have recently published pieces on these topics. They emphasize the importance of people observing what is happening in the environment around them.
One obvious question that arises from such discussions is: “What am I supposed to be looking for?” As such, it seems only proper to write something to help answer this critical question.
What Does Surveillance Look Like?
The first thing to remember is that attacks and other crimes don’t just appear out of a vacuum. They are the result of the attack cycle and the pathway to violence, and those planning crimes are vulnerable to detection as they progress through these processes.
The activity that most exposes hostile actors to detection is surveillance, and every criminal act involves some degree of surveillance. Obviously, the amount of surveillance needed for a simple purse snatching is much less than that required for a complex kidnapping, but both nevertheless require surveillance.
Most criminals have poor surveillance tradecraft. Yet, the reason they are able to succeed in their crimes despite their ineptitude at this critical skill is that the majority of people simply aren’t looking for surveillance and therefore miss even awkward surveillance efforts.
Tradecraft is an espionage term that refers to operational techniques used in the field. The term implies that tradecraft is as much an art as a skill and that they require a degree of finesse to conduct them properly.
In many ways, tradecraft skills are like learning a musical instrument. One can listen to music, read books on music theory, and take lessons, but becoming a skilled musician requires a great deal of time and practice.
The same is true for the art of surveillance, as it takes time and practice on the street for one to become a skilled surveillance operative.
While there are some terrorist operatives and high-end criminals who have mastered the surveillance art, most hostile actors simply do not devote the time necessary to become adept. They display terrible technique, use sloppy procedures, and lack finesse during their surveillance. This makes them easy to pick out—but only if someone is looking for them.
TEDD
When training intelligence officers to spot hostile surveillance, the U.S. government uses the acronym “TEDD” to illustrate the principles that can be used to identify surveillance. TEDD stands for Time, Environment, Distance and Demeanor, and is also applicable to ordinary citizens trying to identify hostile criminal or terrorist surveillance.
If a person sees someone repeatedly over time—in different environments and at a distance from where they last saw them—or if they notice someone who displays poor surveillance demeanor, then that person can assume he or she is under surveillance.
For example, if you see someone on your morning commute to work, and then see the same person while shopping that evening at the mall in a different part of town, there is a good chance that person is following you.
For an individual, however, TEDD is only relevant in cases where you are being specifically being stalked or targeted for a complex attack such as a kidnapping or being stalked. In such cases, the individual will have the elements of time, environment, and distance to see the hostile actor planning a crime.
However, in mass casualty incidents such as a terrorist or workplace violence attack, it is often the location that is being targeted rather than a specific individual. An individual who just happens to be at the attack site will not have the ability to make time, environment, or distance correlations.
In such cases, a victim will only have a demeanor to key on. It is often a demeanor mistake that allows one to initially notice a person and then key in on them over the other TEDD factors of time, environment, and distance.
Changing Appearance
Skilled hostile actors conducting surveillance over an extended period may cloak their actions by changing their clothing, wearing wigs, or other light disguises. They may also use different vehicles or license plates, and thus watching for mistakes in demeanor is critical for detecting hostile surveillance.
It is thus important to focus on the things that cannot be changed as easily as clothing or hair, such as a person’s facial features, build, mannerisms and gait. Additionally, while someone can change the license plate on a car, it is not as easy to alter other aspects of the vehicle such as scratches and dents in the body.
Critical Places
One technique that can be helpful in detecting hostile surveillance is to identify critical places that provide optimal visibility of a critical place someone doing surveillance would want to watch.
Such a critical place would include the front door of the surveillance target’s residence or office, or a choke point on a route frequently used by the target, and the places that provide an optimal view of them are referred to as perches in surveillance jargon.
Once identified, perches can then be monitored for telltale signs of hostile surveillance such as people who do not belong, people who are unnaturally lurking, or people making more subtle demeanor mistakes.
Keying in on Demeanor
Demeanor is the outward behavior a person displays to those watching him or her. The key to good surveillance tradecraft is mastering the ability to display appropriate demeanor for the environment one is in.
Practicing good demeanor is not intuitive. In fact, I believe many of the things one must do to maintain good demeanor while conducting surveillance are counter to human nature.
At its heart, surveillance is watching someone while attempting not to be caught doing so. As such, it is an unnatural activity, and a person doing it must deal with strong feelings of self-consciousness and of being out of place.
Burn Syndrome
People conducting surveillance frequently suffer from what is called “burn syndrome,” the belief that the people they are watching have spotted them. Feeling “burned” will cause untrained surveillance operatives to do unnatural things, such as hiding their faces or suddenly ducking into a doorway or turning around abruptly when they unexpectedly come face to face with the target.
People inexperienced in the art of surveillance find it difficult to control this natural reaction.
Because of this, intelligence, law enforcement, and security professionals receive extensive surveillance training that includes many hours of heavily critiqued practical exercises, often followed by field training with a team of experienced surveillance professionals.
This training emphasizes and reinforces maintaining proper demeanor. Even experienced surveillance operatives must deal with the feeling of being burned.
The difference is that since they have received extensive professional training, they are better able to control their reaction and behave normally. They possess the ability to maintain a demeanor that appears normal even though their insides are screaming that the person they are watching has seen them.
Proper Cover
In addition to doing something unnatural or stupid when feeling burned, another common mistake made by amateurs when conducting surveillance is the failure to use proper cover for action and cover for status.
Cover for status is a person’s purported identity—his costume. A person can pretend to be a student, a businessman, a repairman, etc. Cover for action explains why the person is doing what he or she is doing—i.e., sitting on that bench waiting for a bus.
Proper cover for status and cover for action makes the presence of the person conducting the surveillance look routine and normal in that specific environment at that particular time. When done right, the surveillance operative fits in with the mental snapshot subconsciously taken by the target as the target goes about his or her business.
An example of a bad cover for status would be someone dressed as a “businessman” walking in the woods or at the beach. An example of a bad cover for action is someone pretending to be sitting at a bus stop who remains at that bus stop even after several buses have passed.
For the most part, however, inexperienced operatives conducting surveillance practice little or no cover for status and cover for action. They just lurk and look totally out of place. There is no apparent reason for them to be where they are or doing what they are doing.
In addition to plain old lurking, other demeanor giveaways include a person moving when the target moves, communicating when the target moves, making sudden turns or stops, or even using hand signals to communicate with other members of a surveillance team or criminal gang.
Surveillants also can tip off the person they are watching by entering or leaving a building immediately after the person they are watching does so, or simply by running in street clothes.
Just Doesn’t Look Right
Sometimes, people who are experiencing the burn syndrome exhibit almost imperceptible behaviors that the target can sense more than observe. It may not be something that can be articulated, but the target just has a gut reaction gets the gut feeling that there is something wrong or creepy about the way a certain person is behaving.
The term we use for that gut feeling is “JDLR” or Just Doesn’t Look Right. Innocent bystanders do not exhibit behavior that triggers such feelings. I encourage people to trust their gut when they encounter such a situation.
There is often little to lose by doing so, other than perhaps a little time and effort, and avoiding a potential problem is always the right thing to do.
Another important demeanor indicator is a person’s eyes. How a person looks at you—or doesn’t—can provide a good indicator of their intent.
Are they looking at you with a hostile, drop-dead look? Do they have a thousand-yard stare? Are they avoiding your gaze? It has been said that the eyes are the window to the soul, and I have found this to very often be true.
It takes intelligence officers months or years of training and practice to become highly proficient at detecting surveillance conducted by professional surveillance operatives, and there are many tricks of the trade.
However, almost anyone can learn to spot surveillance by poorly trained criminals or terrorists—it is not rocket science.
The keys to doing so are to first understand a bit about surveillance and demeanor as we have done in this article; and secondly, to make the effort to practice situational awareness to look for surveillance when appropriate.