What a TSCM sweep actually covers, and what it cannot tell you

Most people who ask for a counter surveillance sweep have a specific worry: a negotiation that went badly, a leak with a short list of people who could have caused it, or a board discussion that turned up somewhere it should not have. It is worth being precise about what a sweep can and cannot settle.

What a sweep covers

A technical surveillance counter measures inspection has three parts, and a sweep that skips any of them is not a sweep:

• Radio frequency: looking for transmitters in and around the space, across the bands a device would realistically use.
• Thermal and physical inspection: walls, ceiling voids, furniture, fittings, power outlets and the devices already in the room. A great deal of what is found is found by taking something apart, not by watching a spectrum analyser.
• The environment around the space: adjacency, sightlines, cabling routes, and who else has legitimate access.

Vehicles are inspected on the same principle, and are worth including more often than clients expect: a car is a private conversation in a space that is left unattended in public car parks for hours at a time.

What a sweep cannot tell you

A sweep is a point in time finding about a physical space. It is evidence about the room on the day. It is not a guarantee about tomorrow, and it says nothing about the far more common routes by which information actually leaves an organisation: a compromised mailbox, a phone, a contractor with more access than anyone remembered granting, or a person who simply told someone.

A clean sweep is a genuinely useful result. It narrows the problem. What it does not do is close it, and any provider who tells you otherwise is selling certainty they cannot supply.

How to read the report

A findings report should tell you what was inspected, what was found, what was not able to be inspected and why, and what to do about each finding in order of priority. The section people skip is the second last one. Areas that could not be checked, such as a locked comms room, a floor still occupied, or a vehicle that was not on site, are the areas your assurance does not cover, and they belong in the report rather than in the gap between what was promised and what was done.

Timing matters. A sweep conducted with the room in normal use tells you less than one conducted out of hours, and a sweep announced to the building a week ahead tells you least of all.

Empire Protection arranges sweeps through licensed, insured and accredited specialists, and reviews every findings report before it reaches the client.

Read next

• Counter surveillance and TSCM
• Physical security assessment
• Penetration testing