"The best intelligence operation is the one the target never knew happened."
Surveillance Detection in Close Protection Operations
Instructor Sele: In EP operations, intelligence and surveillance detection are not separate functions — they are integrated into every movement, every advance, and every static post. This module shows you how SD and CP work together as a single protective system.
Section 1 — The Integrated CP-SD Model
The most effective EP operations combine the CP team's protective function with the SD team's intelligence function into a single co-ordinated system. The SD team provides advance intelligence on routes, venues, and pre-departure areas. The CP team moves the principal based on the SD team's threat picture. The Intelligence Coordinator synthesises all SD reporting into operational decisions. The CP TL has final authority over all movement decisions, informed by the SD team's product.
Neither team operates in isolation. The CP team cannot protect effectively without the SD team's eyes. The SD team's observations are only valuable if they reach the CP TL in time to act.
Section 2 — The Adversary Surveillance Cycle
Understanding how a threat actor conducts surveillance helps the SD team identify the most vulnerable phase for detection and disruption.
The critical window is Phase 2 (Reconnaissance) — this is when the surveillance is visible and detectable. A well-run SD programme detects the attack during Phase 2, before the attack is ever planned. Phase 4 (Rehearsal) is the second opportunity — unusual movement patterns around the client's premises before a known event.
| Phase | What Happens | Detection Opportunity |
|---|---|---|
| 1. Target Selection | Attacker identifies potential targets | Low — rarely observable |
| 2. Reconnaissance | Attacker surveys target locations and routines | HIGH — this is where SD detects |
| 3. Planning | Attacker plans the attack based on intelligence | Medium — may reveal communication |
| 4. Rehearsal | Attacker practices approach and escape | HIGH — unusual movement patterns |
| 5. Attack | The attack is executed | Very low — too late for prevention |
| 6. Escape | Attacker withdraws | Low — reactive only |
Section 3 — SD Integration in Pre-Movement Protocol
For every principal movement, the integrated SD-CP protocol is: T-60 minutes — SD team deploys to observe departure area and approach routes; T-45 minutes — SD team confirms pattern-of-life baseline or declares contacts; T-30 minutes — CP team receives SD brief; TL confirms or adjusts route based on intelligence; T-15 minutes — SD team confirms final "clear" or escalates threat assessment; T-0 — principal moves only on SD confirmation; SD team continues coverage during movement.
Section 4 — Post-Movement Debrief
After every principal movement, the CP and SD teams debrief jointly. SD reports all contacts, possible contacts, and all-clears observed during the movement. CP team reports any in-movement observations. Intelligence Coordinator grades and files all reports. Threat assessment is updated if the debrief produces new intelligence. Lessons learned are incorporated into the next operation's planning.
This debrief cycle is what makes the intelligence system self-improving over time.
- •CP and SD operate as an integrated system — neither is effective without the other
- •The critical detection window is Phase 2 (Reconnaissance) of the adversary surveillance cycle
- •Pre-movement SD protocol begins 60 minutes before departure
- •Principal moves only on SD team confirmation — not on schedule alone
- •Post-movement debrief updates the threat assessment and improves the next operation
"The best result I ever had from an integrated SD-CP operation was the one where nothing happened — because we detected surveillance at T-60, changed the route, and the attacker found an empty road. He had positioned two vehicles at choke points on the original route. We never told the client what nearly happened. The SD team got a quiet debrief and a bonus. That is what success looks like in this business — an empty road where an attack was planned."
Which phase of the adversary surveillance cycle presents the greatest opportunity for detection and prevention?