Surveillance Detection for Small Teams

Surveillance detection is the deliberate practice of looking for signs that someone is watching the principal, the residence, or the pattern, before that watching turns into planning. On a small team it is a routine discipline layered onto work you already do, not a specialist unit you stand up.

Most teams treat it as a capability they cannot afford. Three agents, a driver, a principal who moves on short notice, no analyst behind them. A dedicated detection element is out of reach. What is in reach: a set of habits, a place to write things down, and an agreement about what happens when something looks off.

Why hostile planning leaves something to see

Attacks against protected people are rarely improvised. Someone has to learn where the principal lives, when the vehicle stages, which door gets used, how many people move with him, and where the ground favors an approach. That learning happens through observation.

It takes time, because a pattern only becomes a pattern after several looks. It takes repetition, because one sighting of a departure says little about whether that departure is reliable. It takes proximity, because most of what a planner needs cannot be collected from far away. Those three conditions put a person or vehicle near your principal more than once, which is the only reason detection is possible.

Be clear about what this buys. Surveillance detection raises the cost of collecting against your principal and raises the odds that someone notices. It guarantees nothing. Competent surveillance rotates people and vehicles, works from static positions, or uses technical means that never put a body on your street. A team that believes it will catch everything makes worse decisions than one playing a probability game.

TEDD in plain language

TEDD is a memory aid for the four ways a repeat sighting becomes meaningful: Time, Environment, Distance, Demeanor. It is common vocabulary in protective work, and it holds up because it describes how a watcher gives himself away.

Time. The same person or vehicle across separate occasions. A gray sedan sits on the corner across from the residence Tuesday at 0640 and again Thursday at 0645. Neither morning is remarkable by itself.

Environment. The same person turns up in settings with no reason to overlap. A man in the office lobby Monday and outside a restaurant twelve miles away Wednesday night is a different problem than the man who is always in the lobby, who probably works there.

Distance. The same face or plate at separated points along a movement. Somebody at the departure point and again at the arrival point has either coincidence or intent behind him, and coincidence thins with every mile.

Demeanor. Behavior that does not fit the setting: a person sitting in a parked car for forty minutes without using a phone, someone whose attention tracks your principal rather than the thing he appears to be doing, a pedestrian who reverses direction when the motorcade does. Demeanor is the softest of the four and the most likely to produce a false positive. It carries the least weight alone and the most on top of another.

One sighting is nothing

This is the part teams get wrong. A single observation, however strange it felt, carries almost no information. The discipline lives in the second sighting, which means it lives in whether anyone remembered the first well enough to recognize it.

Memory is a poor instrument for it. The agent who noticed the gray sedan Tuesday was thinking about the arrival, not cataloguing vehicles, and by Thursday it is gone. The two sightings may also belong to two people who never compare notes. Three agents with three separate impressions have nothing. The same three observations written into one place have a correlation.

So the mechanism is a shared log: a notebook, a document, a running file anyone on the detail can append to. What matters is a small, consistent set of fields. Date, time, location, description of person or vehicle, plate if visible, behavior observed, who saw it. Keep it factual. Records like this get read later by people who were not there, sometimes by counsel, and speculation recorded as fact ages badly.

The same instinct drives the concern file, the running record on individuals who have drawn attention through communications, approaches, or presence. Surveillance observations belong alongside it, since a face in both is a different order of problem than a face in either alone. More on that habit in protective intelligence without an analyst.

What a small team can actually run

Treat detection as a layer on tasks the team already performs, assigned to whoever is already looking in that direction.

Vary departure times where the principal allows it. A fifteen-minute band of uncertainty costs a planner days of observation and costs you nothing. It is a negotiation, and it lands better as a small ask than a security lecture.

Use the walk-out look. The agent who exits ahead of the principal has a few seconds with nothing else to do. Spend them on occupied parked vehicles, on windows and rooflines with a view of the door, and on people whose posture suggests waiting. Reverse it on arrival.

Give the driver mirror discipline. The person behind the wheel has the only sustained rear view the team owns. Vehicles that appear in the mirror at two separate points on a movement are worth a note whether or not they follow the whole way. Route knowledge makes this easier, one return on the work described in route surveys that hold up.

Take a static observation minute before loading. One person, one minute, looking outward rather than at the vehicle. Most teams already have this dead time and spend it on the phone. Photograph plates and people only where it is lawful and appropriate to the setting, and know where that line falls before you start.

None of this requires another body. It requires that someone owns each task by name, and that what they see reaches the log.

Where pattern surveillance concentrates

Fixed points carry the pattern. The residence and the office are where the principal reliably is, at times that repeat, through doors that do not move, so a planner working from either gets clean observations cheaply. Collecting against movement is harder: guess the route, keep up unseen, accept that any given trip may not repeat.

That asymmetry tells you where to spend attention: the block, the parking structure, the loading area, the lines of sight into the arrival door. Treat those locations as standing survey products rather than one-time checks, part of what the security advance is for.

What not to do

Do not confront. Do not chase. A detail that peels an agent off to approach a suspicious vehicle trades protective coverage for information it probably will not get, and tells a planner exactly what the team noticed. Avoid making a scene, too: a loud reaction in a lobby creates a record, a complaint, sometimes a video, and does nothing for the principal's safety.

Report it, document it, and change the pattern. Changing the pattern is the countermeasure available to every team regardless of size, and it works whether the suspicion was correct or not. Different departure time, different door, different route, an extra stop, a night in. If somebody was collecting, you have degraded the collection. If nobody was, you spent very little.

Legal and ethical limits

Photographing, recording, and logging information about identifiable people carries legal limits that vary by jurisdiction and setting, and private teams lack the latitude a government detail may have. Keep entries factual, restrict access to those who need it, and set a retention practice. Before any of this becomes routine, get counsel's guidance on what the team can collect, keep, and share.

Adapt it to your team

This is one way to run surveillance detection on a small detail. Other teams weight demeanor more heavily, or push more of it onto the driver, and their reasoning may fit their principal better than ours fits yours.

Two boundaries hold regardless. The executing team owns the call on what to do with a detection in the moment, because they are the ones on the ground with the information. The principal has final say over his own movement unless something is actively going wrong.