"The best intelligence operation is the one the target never knew happened."
Counter-Surveillance Techniques
Instructor Sele: Counter-surveillance is the active practice of detecting, monitoring, and neutralising hostile surveillance before it can support an attack. It is a discipline built on patience, observation, and discipline. CS operators see without being seen — and they never act on what they see. They report.
Section 1 — The Counter-Surveillance Mandate
The CS team's mission is clear and limited: Detect — identify individuals or vehicles conducting hostile surveillance; Document — record every detail using SALUTE format; Report — immediately pass all contacts to the TL-CS and Intelligence Coordinator.
CS operators do not approach, challenge, or confront surveillance subjects, do not follow them beyond their assigned observation zone, do not physically intervene, and do not make independent escalation decisions — they report, and the CP TL decides.
The reason is operational: a CS operator who confronts a surveillance subject destroys the intelligence opportunity, alerts the threat to the SD capability, and may trigger a premature attack. Observe and report. Always.
Section 2 — Fixed Point Observation (FPO)
An FPO is a static, covert observation position from which an operator monitors a specific area over time. Effective FPOs have a clear unobstructed view of the target area, provide natural cover (a café window, a parked vehicle, a market stall), allow the operator to blend in without drawing attention, and are established before the surveillance subject arrives (you are in position before they appear).
FPO operators log all activity in the observation zone systematically — not just suspicious activity. A full log creates the pattern-of-life record that makes deviations visible.
Section 3 — Mobile Counter-Surveillance
Mobile CS operators follow the principal's route ahead of and behind the principal's vehicle, observing for surveillance at choke points and trigger points. They use parallel routes (running parallel to the principal's route to observe without appearing part of the convoy), leap-frogging (CS vehicles alternate between leading and following positions to cover different observation arcs), and foot coverage in areas too congested for vehicles.
Mobile CS operators communicate on a separate encrypted channel from the CP team to maintain operational separation.
Section 4 — Covert Communication Protocols
CS operators use pre-agreed non-verbal and coded communication to avoid alerting surveillance subjects: All Clear (no suspicious activity observed); Possible Contact (potential surveillance indicator — monitoring, not yet confirmed); Confirmed Contact (3× rule threshold met — immediate report to TL-CS); Abort (surveillance has detected the CS team — withdraw to secondary positions).
All voice communications are brief, coded, and on encrypted channels. CS operators never use subject descriptions over open radio.
- •CS mandate: Detect, Document, Report — never confront or intervene
- •FPO positions are established before the surveillance subject arrives — always in position first
- •Mobile CS uses parallel routes and leap-frogging to maintain coverage without detection
- •All contacts are graded: All Clear / Possible Contact / Confirmed Contact / Abort
- •A CS operator who confronts a surveillance subject destroys the intelligence operation
"I had an operator who broke the cardinal rule. He recognised a man he'd been watching for three days and walked up to him to 'get a better look.' The man made a call within 60 seconds and was gone. We never saw him again, and the surveillance network we were mapping disappeared overnight. One undisciplined action cost us three weeks of careful work. CS operators are cameras with legs. They observe. They do not act."
Counter-surveillance team operators should: