Zkitszo - The Real
September 28, 2026

Same Shoes, New Hat- Old School Surveillance

Everything I read about surveillance lately is about data- phones, cameras, plate readers, the metadata trail we all leave around like breadcrumbs. Then this crossed my path.. a 2018 DEF CON talk about the old way. People. Cars. Someone on a bus reading a paper who is not reading the paper.

I'm saving the gist of it here mostly for me to remember, because the techniques have barely changed in decades- they still work. If the online side of disappearing is more your thing, I went through that over in Disappear from Online. This one is the offline half.. the "grey man" half.

Heat State, or How to Make Toast

The one idea that makes everything else click: every operator and every vehicle on a surveillance team carries a "heat state". It starts the day cool. Every time they are exposed to the target- seen twice, caught looking, parked somewhere odd- it goes up. Enough exposure and that person or that car is burned for the rest of the operation. At the end of the day each operator reports where they think their heat state sits. The talk's slang for a burned operator is "toast"...

So, as the person being followed, your whole job is making toast. You don't need to shake anyone off in a car chase- you need to make them show themselves.

(I couldn't find the term written down anywhere official- it lives in UK training slang as far as I can tell. The idea behind it, exposure adds up and burned people get swapped out, is all over the public tradecraft material.)

Heat state- every exposure adds up start of the day: cool seen twicesame face again caught lookingeyes met parked oddlybacked in, alone in the lift"got the time?" TOAST swapped out You don't have to lose them. Make enough of them toast and the team can't follow you.

The Pickup, the Follow, the Housing

Three stages. The pickup is getting eyes on you at the start of the day- where you are, what you're wearing, which way you're headed. The follow is the long middle, where most of the fun happens. The housing is putting you to bed at the end of it.

For the pickup they need somewhere to watch from. A static observation post- a neighbouring house or flat. The famous one is 2619 Wisconsin Avenue in Washington, across from the Russian embassy, which neighbours say was an FBI observation and listening post dressed up as a house from roughly 1990 to 2013. Or a covert camera pointed at your door and watched remotely.

Or the classic van.. an actual ex-FBI 1989 Dodge Ram surveillance van turned up at a government auction, went on YouTube, then sold on eBay. Antenna housing on the roof, microphones in the lights, cameras in the roof mounts, a toilet and air con inside. If you ever spot one of those parked on your street... someone screwed up.

The sneakier version is the "boot fit" (trunk fit, for North America)- an ordinary car with an operator folded up in the trunk, filming. Uncomfortable, short-lived, and a lot harder to spot than a van.

Once you're moving, the team talks in brevity codes and spot codes. Instead of "turning left toward the junction of High Street and Water Lane" on an open radio, it's something like "at Red Six, intending right" off a spot map every car carries. Anyone listening in hears gobbledygook. A full team is something like eight cars and sixteen people with binders of maps. That isn't cheap.

In the Car- the Floating Box

They drive whatever the locals drive. Pickup trucks in Texas, sedans in the city, not the black SUV with government plates (except maybe in DC..). Agency teams hold multiple plates per car and swap a plate when its heat gets too high. That can't be done at the roadside- someone unscrewing a plate on the shoulder gets the cops called on them- so that car leaves the follow while it happens.

Iowa is a nice example of how common this is: a state report found thousands of "confidential" plates issued to government vehicles so they don't trace back to an agency.

And they don't sit behind you. There will be two or three cars between you and them, with others on parallel roads getting ahead. On a grid city, the pattern is the floating box:

city grid T Target drives east. Nobody sits on its bumper- the box moves with it. Target turns. The call goes out, every car turns at its next chance. Still boxed in: parallels either side, one car waiting ahead.

You turn, the call goes out, every car turns at its next chance. Blowing through an amber light does nothing- someone on the parallel street just picks you up at the next block. The other thing I didn't expect: losing you is fine by them. On a long job it's better to lose the target for the day than to show out and let the target know there's a team at all.

Anti-Surveillance or Counter-Surveillance?

People use these interchangeably. They're not the same thing.

Anti-surveillance is you, alone, doing things to see whether you're being followed. Counter-surveillance is when a third party- your own friendly team- follows you to spot the people following you. Add another team watching that team and it's counter-counter-surveillance.. turtles all the way down.

Everything below is the anti kind. What you're after is to see them without them seeing you look.

Breaking the Pattern From the Driver's Seat

The whole approach is tempo. You're the one being followed, so you lead- set a rhythm, then change it, and force the team into quick 50/50 calls. Every bad call puts someone too close, or puts the same face in front of you twice.

Vary the route- and not just from your front door.

Get out of the car. Drive somewhere, park, get on a bus or into a cab. Buses and cabs go places cars can't (the bus lane, for one.. try explaining what you were doing in there). Now they have to decide- why did you get on that bus? Are you meeting someone? Do they put somebody on with you? Meanwhile you get to look at everyone who boards.

Choke points. A car ferry is the textbook one: the road around the lake in the example was something like 47 miles of slow going, the ferry was minutes. Do they drive the long way round, or put cars on the boat with you where you can look at them for the whole crossing?

The "long look"- a long straight road with no parallel roads. Operators are taught to spot these on the map ahead of time, because anyone following has to come down it behind you in plain view. Nobody can put the whole team down it at once without it looking like a convoy.

Parking is another choke point you control, a multi-storey car park especially. Do they follow you in, where you can watch who comes up the ramp? Or take a cab and say "drop me here" on a street with no parking. Now the team has to switch from car to foot right now, with whoever happens to be closest.

Now the salt and pepper... there's a myth, straight out of police and military habits, that you should always reverse-park for a quick getaway. On a street or car park where everyone has pulled in nose-first, the one car backed in is the one a surveillance-aware eye goes straight to. A trained operator parks like everyone else.

Walk back to your car past the other cars, too. These are pros, but they're people. There's the story from the talk about two surveillance instructors whose parked car got reported as suspicious. The police looked in the window and found a radio handset sticking out from under the seat.. not a normal thing to see in a car in the UK.

Why not just use a tracker?

A fair question- the speakers were asked the same thing. A tracker can be found. A technical target who finds one knows for sure. It also only tells you where the car stopped. "He's at the mall" is useless when he's already inside and you're a mile out. The point of a follow isn't where someone goes, it's what they do and who they meet there. For that you need people close enough to go in after them on foot.

The Two-Choke-Point Plate Trick

This is the bit that made me want to write this down. If you have a friend to help: have them film every car through a choke point for ten minutes either side of you passing in the morning. Do the same at a completely different spot later in the day. Two lists of plates. Any plate that shows up on both lists deserves a closer look.

The talk ran the phone footage through OpenALPR, dumped the results to JSON, then SQL. Automatic plate readers misread blurry frames, so you get near-duplicate plates. The fix is just counting- the plate read in the most frames is the real one.

Heads up on the tools: OpenALPR was bought by Rekor in 2019 and the paid product became Rekor Scout. The open source repo is still up (AGPL, last push January 2024) but it's effectively frozen. fast-alpr is a maintained MIT-licensed alternative. The old command line from the OpenALPR README looks like this (-c is us or eu, -j is JSON output):

alpr -c eu -j morning.mp4 > morning.json

And a small Python script to compare the two lists- a plate has to show up in at least two frames of the first clip to count, which drops most one-off misreads. I tested it on sample JSON in OpenALPR's output shape, not on real footage:

import json, sys
from collections import Counter

def plates(path, min_hits=2):
    seen = Counter()
    for line in open(path):
        line = line.strip()
        if not line.startswith("{"):
            continue
        for r in json.loads(line).get("results", []):
            seen[r["plate"]] += 1
    # a plate read in several frames is the real one; one-off misreads drop out
    return {p for p, n in seen.items() if n >= min_hits}

a, b = plates(sys.argv[1]), plates(sys.argv[2], 1)
for p in sorted(a & b):
    print("seen at both spots:", p)
python3 compare_plates.py morning.json afternoon.json

Mind where you do this- filming traffic in public is one thing, keeping databases of other people's plates is regulated in plenty of places.

On Foot- the Grey Person

What do you picture? Big guy, short hair, earpiece with a curly wire, big watch? If you can see the earpiece, the wire and the push-to-talk button hanging out of a sleeve.. that's overt surveillance. They want you to see them.

The real ones aim to be the "grey man"- the person you can't describe five minutes later. Better yet, the grey person: teams use women because everyone is watching for the big guy. The newbies fall into an unofficial uniform of their own, everyone dressing "differently" in a way that ends up the same. Black t-shirt and jeans. Khaki shorts in the summer.

The kit hides under clothes:

  • Earpiece. Wireless, sits deep in the ear. Up close you might catch the little retrieval stem.
  • Inductive neck loop. Worn around the neck, feeds the earpiece, carries the microphone.
  • Antenna. Usually a T-shape across the shoulders and down the centre of the back.
  • Pressel switch. The push-to-talk, tucked somewhere inside the clothing, not down the sleeve.
  • The vest. Radio one side, battery the other, to spread the bulk.

That's a lot of gear, so they need enough clothing to cover it. Remember that one.. it comes back.

Changes of appearance are real. The Stasi archive photos are the famous set- East German officers training in wigs, fake moustaches, plain-glass specs- and agency teams still use that, because it breaks up the outline. We don't really look at people. We draw a rough outline around them.

But.. they spend all day on their feet. Hat, coat, glasses, hair- all of it changes. The comfortable shoes do not. Same with a watch (ex-military folks love their watches) and jewellery- wedding rings, necklaces, earrings. New jacket, same shoes, same watch? Make a note.

Change the outline, keep the shoes 9 a.m. 2 p.m. same watch same shoes Cap, hair, glasses, top, trousers, a bag- all new. The shoes they've been on their feet in all day are not.

The ABC Behind You

The standard foot pattern is three people:

main road side street Who is who T target pink = control, the only "eyeball" grey = backing / trail, hanging back Watch C on the far pavement- the corner is where roles rotate. T A B C A has eyeball. B backs. C trails across the road. Target turns the corner. C can see it from across the street. C takes control. A crosses and becomes the trail.

A is in control- the only one with "eyeball" on you. B is backing, ready to take over. C is the trail, across the road and a bit behind. When you turn a corner, C can see from across the street whether you kept walking or stopped to wait for whoever comes round after you. C passes that on, A crosses and becomes the trail, C takes control. Meanwhile the rest of the team are on parallel streets further back, swapping in so no one face stays on you too long.

Which is why the "I'll just follow that person" instinct is a trap- one or two people can't do this. And why, when you're checking, the person to watch is often not the one behind you. It's the trail on the other side of the road, who gets complacent because they aren't directly behind and rotate less.

Use Your Surroundings

You pick the ground. Some of the ones from the talk that stuck with me:

  • Window shopping- shop glass reflects. Look for who's on the opposite pavement, again and again.
  • The mirrors in subway and underground tunnels.
  • Escalators. Turning round on an escalator is normal behaviour. You get a free look at whoever is one floor below, coming up.
  • A payphone. Yes, really. It's a reason to stop and look around. When you stop, a trained follower needs a reason to stop too- "cover for action". Pretending to use the phone is one of their go-tos, and you've just taken it.
  • Dead ends- a one-way street with nothing at the bottom but a café nobody goes to. Anyone who follows you down it is interesting.
  • Places people don't follow, like the men's room, or any spot where another person tagging along needs explaining. (They have women on the team, so it's not foolproof.)
  • Elevators. Do they put someone in a small metal box with you, at arm's length, where you get a proper look? If nobody gets in, press three or four floors and get off at yours. Despite the films, nobody is sprinting up fifteen flights of stairs to beat you. And if someone suspicious does get in.. ask them the time. Now you've got a face, a voice, and they've got heat.
  • The pool. Remember the vest? Nobody wearing a radio, a neck loop and an antenna is getting in the pool or the spa with you!

Misdirection

They're trying to work out who you meet, so give them too many answers. Shake hands with strangers, hug a friend you're only having a milkshake with, stand next to somebody far more interesting than you. In a café, pick the seat that shows you the door and note everyone who comes in. When you leave, fold your newspaper and tuck it somewhere it won't get cleared away- between the planters, say. Now they have a decision to make. Is that a drop? Do they leave people watching the paper? If they split the team to cover both, you've just halved the number of people following you.

And steal their own trick: they've been looking for a red cap and a blue top for six hours. Hat off, coat off, into the bag.

This Still Happens- the Illegals

If this all feels very Cold War.. in June 2010 the FBI arrested ten Russian "illegals" at the end of an investigation it called Operation Ghost Stories. Two of them lived as Richard and Cynthia Murphy, a pleasant suburban couple with two kids. They were actually Vladimir and Lidiya Guryev, SVR agents who'd been in the US for years. The case ran close to a decade, because a follow like that is a long game- you want the handlers, the handlers' bosses and how the whole thing works.

A correction worth making: the talk puts the Murphys in "a small town in upstate New York". They lived in Hoboken and then Montclair, New Jersey- the raids that June were in Boston, Montclair, Yonkers and Northern Virginia.

The released FBI surveillance footage is the fun part.. a bit embarrassing for the other side, too. Someone digging at a dead drop with a shovel, filmed from a camera hidden in a tree. Brush passes in a crowded station that are anything but brushed. Someone loitering in a subway stairwell for what felt like forever. A café hand-off filmed from a camera in a bag on the next table- with, by the speakers' count, three FBI people sitting close enough to touch and nobody noticed them. The cameras got there because a surveillance team on foot found the spots first.

What It Boils Down To

Use your environment. You're the leader- they have to follow you, so choose where you go and never walk into where they're already waiting. Set a tempo, change it, and make them decide fast. Split them up if you can. Always be making toast.

And the one that stuck with me the most, which is for the journalist meeting a source more than anyone- if you're in any doubt, abort. Maybe you're being paranoid. Maybe you aren't- and if you aren't, you just kept someone else from being dragged into it.

Everything in there is public- the speakers made a point of it. The same material is spread across plenty of books on the subject. I also wrote up a DEF CON badge and ADS-B project a while back in Badge, a Data Project, and the Best ADS-B Antenna if you're in that mood.

Have you ever had that feeling of the same face turning up twice in one day? Did you do anything about it.. or talk yourself out of it? Leave a comment- I'd love to hear the stories, the paranoid ones too.

Oh- and the UK surveillance course the talk mentions, the one where you show two forms of ID and walk out formally qualified? Those Level 3 and Level 4 covert surveillance awards run roughly £900 to £2,000 plus VAT these days. The "that's like 200 bucks in Brexit money" line from the stage was a joke.. I think.

Glossary

  • ALPR / ANPR — automatic licence plate recognition; software that reads plate numbers from images or video.
  • Anti-surveillance — what you do on your own to find out whether you're being followed.
  • Boot fit — a normal-looking car with an operator hidden in the trunk (boot), filming.
  • Brevity codes — short radio codes a team uses so an eavesdropper can't follow the conversation.
  • Brush pass — handing something over while passing someone, meant to look like nothing happened.
  • Choke point — a place everyone has to pass through, like a ferry, bridge or car park ramp.
  • Control / eyeball — the one operator who currently has the target in sight.
  • Counter-surveillance — a friendly third party watching you to spot the people watching you.
  • Cover for action — a believable reason for being where you are, doing what you're doing.
  • Dead drop — a hiding place where one person leaves something for another to collect later.
  • Floating box — vehicle surveillance using parallel and cross streets around the target instead of tailing directly.
  • Grey man — someone so ordinary you can't describe them afterwards.
  • Heat state — how exposed an operator or vehicle has become to the target; too much and they're "toast".
  • Housing — putting the target to bed at the end of the day's follow.
  • Illegals — spies living under false civilian identities, with no diplomatic cover.
  • Long look — a long straight road with no alternatives, where the target can see everything behind them.
  • Overt surveillance — being followed by people who want you to know they're there.
  • Pickup — getting eyes on the target at the start of an operation or day.
  • Pressel switch — the push-to-talk button for a covert radio.
  • Spot map / spot codes — a shared map with coded points, so locations can be called over the radio without naming streets.
  • Trail — in the ABC pattern, the operator across the street and a bit behind the target.

Sources

Comments

Post a Comment

← Newer