"The best intelligence operation is the one the target never knew happened."
The 3× Rule and Surveillance Detection Runs
Instructor Sele: One sighting of something suspicious is a note. Two sightings is a concern. Three sightings in unconnected locations is confirmed surveillance. The 3× Rule is the analytical standard that prevents both false alarms and missed threats. This module teaches you how to apply it — and how to force surveillance to expose itself.
Section 1 — The 3× Rule
The 3× Rule is the operational standard for confirming hostile surveillance. Surveillance is confirmed when the same suspicious indicator appears three or more times in locations that cannot be explained by coincidence.
Three conditions must all be met: same indicator (the same person, vehicle, or behaviour — not three different suspicious things); three or more sightings; and the locations cannot be explained by coincidence (separated enough that a legitimate explanation is implausible).
Example: A white vehicle is noted outside the client's residence on Monday morning. The same vehicle is noted near the client's office on Wednesday afternoon. The same vehicle is noted on the alternate route on Friday. Three sightings, three different locations, no plausible innocent explanation — this is confirmed surveillance.
Section 2 — Recording Sightings (SALUTE)
Every potential surveillance contact must be immediately documented using the SALUTE format: S — Size (how many people/vehicles); A — Activity (what were they doing exactly); L — Location (precise location: GPS, street intersection, landmark); U — Unit/Uniform (description of clothing, vehicle make/model/colour, registration); T — Time (exact time, 24-hour clock); E — Equipment (cameras, radios, binoculars).
SALUTE reports must be submitted to the Intelligence Coordinator within 15 minutes of the contact.
Section 3 — The Surveillance Detection Run (SDR)
An SDR is a planned movement specifically designed to flush out surveillance by creating situations that force a watcher to expose themselves. The SDR routes the principal (or a decoy) through a series of choke points — locations where anyone following must commit to a decision: continue following and be seen, or break off and lose the target.
SDR design principles: choke points (narrow alleys, specific turns, one-way streets); trigger points (locations where a legitimate person would have no reason to stop but a surveillance operator would); time gaps (built-in pauses that let SD operators observe followers); coverage zones (areas where SD operators are pre-positioned in cover).
The principal does not drive the SDR. A specially briefed driver follows a pre-planned route. The CP and SD teams observe from cover.
Section 4 — Pre-Movement Surveillance Detection
Before every principal movement, a pre-movement SD protocol is conducted. 60 minutes before departure: SD operators begin observing the departure point and surrounding area. 30 minutes before departure: route coverage positions are taken. 15 minutes before departure: SD team confirms "clear" or declares any contacts to the TL. Departure: the principal moves only after the SD team's "clear" signal.
If the SD team declares a contact before departure, the movement is delayed and the threat assessed before proceeding.
- •The 3× Rule: same indicator, three or more sightings, in locations that cannot be coincidence
- •SALUTE reports must be filed within 15 minutes of every surveillance contact
- •An SDR is a planned route designed to force surveillance to expose itself at choke points
- •Pre-movement SD begins 60 minutes before departure — not at departure time
- •If a contact is declared before departure, the movement is held until the threat is assessed
"I ran an SDR for a banking executive we suspected was under surveillance. We designed a route with four choke points through different parts of Monrovia. At the third choke point, a motorbike that had been behind the decoy vehicle since choke point one appeared again — the rider had taken a parallel street to maintain the follow. One sighting in isolation: nothing. Three sightings at three choke points: confirmed surveillance. We had our confirmation before the principal ever left the building."
The 3× rule states that surveillance is confirmed when: