Special Services • SP-04
Counter-Surveillance
Detect the people watching before they act.
Scope
What the engagement covers.
Hostile acts are preceded by observation. Counter-surveillance detects that phase around residences, offices, routes and events while it can still change the outcome.
Included capabilities
- Hostile surveillance detection around fixed locations and routes
- Pattern-of-life analysis to identify predictable exposure
- Route and timing variation planning
- Digital tracking analysis covering devices, vehicles and accounts
- Coordination with protective and investigative response
Outputs and deliverables
- Surveillance detection report with observation log
- Pattern-of-life exposure analysis
- Route and timing variation recommendations
- Escalation record and coordination log
Workflow
How it is delivered, step by step.
Each step has an owner, an entry condition and an artefact that has to exist before the next step begins.
01BaselineEstablish normal activity patterns around the protected locations.
02DetectSystematic observation for repeated presence and correlated activity.
03AnalyseAssess whether observation is hostile, incidental or commercial.
04DisruptPattern variation, hardening and, where lawful, direct response.
05EscalateCoordinate with protection, investigation and authorities as authorized.
Use cases
Where this is typically applied.
Residences and offices after a specific threat
Executives in contested commercial or political situations
Delivery model
The operating pattern for Special Services.
The same delivery discipline applies across every capability in this line, so combined engagements stay coherent.
Assess
Threat picture, exposure, routine analysis and protective gap review.
Harden
Identity, device, communication, physical and information-domain controls.
Monitor
Continuous intelligence, exposure detection and early warning.
Respond
Containment, recovery, investigation and coordinated escalation.
Review
Post-incident learning, control adjustment and periodic reassessment.
Integration
- Client corporate security, legal counsel and communications functions.
- Existing IT and identity teams for account and device remediation.
- Insurers, local providers and law enforcement liaison where authorized.
- Family office and household staff protocols for the personal perimeter.
Engagement approach
Every mandate is scoped in writing with a named sponsor, defined coverage hours and a stated legal basis. Discretion applies to method and reporting channel, never to whether the work is lawful, authorized and recorded.
Related
Other capabilities in Special Services.
SP-01
Executive Digital Protection
Protect the person, not only the corporate perimeter.
SP-02VVIP Close Protection
Physical protection planned from intelligence, not from habit.
SP-03TSCM
Confirm the room is not listening.
SP-05Threat Intelligence
Early warning built from sources the principal cannot monitor alone.
SP-06Dark Web Monitoring
Find the exposure before it is used.
SP-07Identity & Reputation Protection
Defend the name as carefully as the person.
SP-08Private Investigation
Lawful fact-finding that stands up when it is challenged.
SP-09Strategic Communications
Control the narrative before it controls the outcome.
SP-10Incident Response
When it has already happened, speed and evidence both matter.
SP-11Human Risk
The most reliable way in is still the person.
SP-12Clandestine Offensive Security
Adversary emulation run without warning the defenders.