"The best intelligence operation is the one the target never knew happened."
Course Review and Assessment Preparation
Instructor Sele: You now have the full intelligence and surveillance detection toolkit — from the intelligence cycle and OSINT collection to SDRs, counter-surveillance, and the integrated CP-SD model. This final module consolidates your learning and prepares you for the Course 4 assessment.
Section 1 — Core Principles Review
Information is not intelligence — raw observation becomes intelligence only after evaluation and analysis. Grade everything. Act only on graded, verified intelligence.
Surveillance precedes attack — detecting reconnaissance in Phase 2 is the most powerful intervention available. The SD programme exists to see the watcher before the attack is planned.
The 3× Rule is the threshold — one sighting is a note, two is a concern, three in unconnected locations is confirmed surveillance.
CS operators observe and report — they never act. A CS operator who confronts a surveillance subject destroys the intelligence operation. Discipline is the asset.
Digital security is physical security — a compromised phone or a social media post can betray a principal as surely as an unlocked gate.
Section 2 — Key Definitions for the Test
Intelligence — information that has been collected, evaluated, and analysed so it can be acted upon. Intelligence Cycle — Direction → Collection → Analysis → Dissemination. HUMINT — human intelligence from people and informants. OSINT — open-source intelligence from publicly available sources.
3× Rule — same indicator, three or more sightings, in locations that cannot be coincidence. SALUTE — Size, Activity, Location, Unit/Uniform, Time, Equipment. SDR — Surveillance Detection Run: a planned route designed to flush out surveillance. FPO — Fixed Point Observation: a static covert observation position.
Pattern of Life — a systematic record of normal activity that makes deviations visible. Doxxing — public exposure of private personal information to facilitate targeting.
Section 3 — Common Mistakes in Intelligence Operations
Acting on single-source, unverified intelligence without caveating it clearly. Failing to file SALUTE reports within 15 minutes — memory degrades rapidly. CS operators breaking discipline and confronting surveillance subjects. Using personal phones and unencrypted apps for operational communication. Sharing intelligence beyond the need-to-know group.
Section 4 — Career Pathway in Intelligence
Completion of Course 4 qualifies SafeHaven guards for intelligence support roles, including Intelligence Coordinator (site-level), Surveillance Detection Operator, Counter-Surveillance Team Member, and Close Protection Intelligence Support.
Advanced intelligence and SD roles carry higher contract values and represent a specialist career track within SafeHaven distinct from the general guard progression pathway.
- •Five core principles: information ≠ intelligence; surveillance precedes attack; 3× Rule is the threshold; CS only observes and reports; digital security = physical security
- •Know the key definitions — intelligence cycle, HUMINT, OSINT, SDR, FPO, SALUTE, Pattern of Life, Doxxing
- •File SALUTE reports within 15 minutes — always
- •Course 4 is the gateway to specialist intelligence and SD career roles at SafeHaven
- •Intelligence is only valuable if it reaches the right person in time to act on it
"Intelligence work is invisible work. Nobody sees the SDR that found the surveillance. Nobody sees the OSINT report that changed the route. Nobody sees the CS operator who sat in a café for four hours watching a man who turned out to be conducting a reconnaissance for a kidnap. All they see is a principal who arrived safely. That invisibility is the measure of excellence in this discipline. Do your job well enough that no one ever knows how close it was."
A guard at a fixed site observes the same man photographing the building on two consecutive days. Using the 3× rule, is this confirmed surveillance?