Surveillance Detection Fundamentals

Section 1 — Why Surveillance Precedes Attack

Almost every targeted attack — robbery, kidnapping, assassination, facility breach — is preceded by a reconnaissance phase. The attacker needs to know when the target is most vulnerable, what security measures are in place and where the gaps are, the target's routine and predictable behaviour patterns, and entry, exit, and escape routes.

This reconnaissance takes time. And time means exposure. The surveillance detection mission is to identify that exposure — to see the attacker watching before the attack begins.

Section 2 — Surveillance Methods

Static surveillance: a person or vehicle positioned in a fixed location, observing the target over time. Most common indicator — a vehicle with occupants that remains stationary for more than 45–60 minutes near a target location.

Mobile foot surveillance: an individual following on foot, often using cover of normal pedestrian behaviour (shopping, phone use, stopping at stalls).

Mobile vehicle surveillance: a vehicle following a target vehicle, using traffic to maintain cover. May use multiple vehicles in a relay to reduce detection.

Technical surveillance: cameras, listening devices, or tracking devices placed in or near the target. Less common in the Liberian threat environment but increasing.

Social engineering: gaining information through conversations with staff, domestic workers, or the target themselves, without the target knowing.

Section 3 — Surveillance Indicators

Surveillance is rarely obvious. The trained observer looks for indicators — behaviours and patterns that suggest someone is collecting information rather than pursuing legitimate activity: unusual attention to the target location or person (lingering, photographing, note-taking); the same person or vehicle seen near the target in multiple locations or on multiple occasions; behaviour inconsistent with the cover story (a "customer" who never buys anything); communication at key moments — a person who makes a call as the principal exits the building; vehicles with occupants that park but never enter a nearby business; persons who appear to be watching exits and entrances rather than using them.

Section 4 — The Surveillance Detection Team Role

The surveillance detection (SD) team operates separately from the CP team. Their job is to observe the observers — to identify anyone showing surveillance behaviour — while remaining undetected themselves.

SD operators must be trained in covert observation techniques, familiar with the pattern of life in the operating area (so deviations are visible), disciplined in communication (they report; they do not intervene), and capable of accurate, detailed written reporting of every contact.