Everything I read about surveillance lately is about data- our cellphones, cameras, liscence plate readers, the metadata we all leave around without thinking about it. Like breadcrumbs, litteral, a trail of crumbs where those in the know can easilly follow. The naive leave these trails behind them- easilly followed. The techniques have barely changed in decades- they still work. If the online side of disappearing is more your thing, I went through that over in Disappear from Online. This one is the offline half.. the "grey man" half. People. Cars. Someone on a bus reading a paper who is not reading the paper. This is the what, when, where, how of the more traditional surveillence. Feel like someone may be following you? Maybe they are- it is not paranoia- the post goes over what to notice, pay attention to... thier objection is to blend in, your sanity is noticing what they slipped up on- forgetting to take off that wedding ring.
Heat State, or How to Make Toast
The one idea that makes everything else click: every operator and every vehicle on a surveillance team carries a "heat state". It starts the day cool. Every time they are exposed to the target- seen twice, caught looking, parked somewhere odd- it goes up. Enough exposure and that person or that car is burned for the rest of the operation. At the end of the day each operator reports where they think their heat state sits. The talk's slang for a burned operator is "toast"...
So, as the person being followed, your whole job is making toast. You don't need to shake anyone off in a car chase- you need to make them show themselves.
(I couldn't find the term written down anywhere official- it lives in UK training slang as far as I can tell. The idea behind it, exposure adds up and burned people get swapped out, is all over the public tradecraft material.)
The Pickup, the Follow, the Housing
Three stages. The pickup is getting eyes on you at the start of the day- where you are, what you're wearing, which way you're headed. The follow is the long middle, where most of the fun happens. The housing is putting you to bed at the end of it.
For the pickup they need somewhere to watch from. A static observation post- a neighbouring house or flat. The famous one is 2619 Wisconsin Avenue in Washington, across from the Russian embassy, which neighbours say was an FBI observation and listening post dressed up as a house from roughly 1990 to 2013. Or a covert camera pointed at your door and watched remotely.
Or the classic van.. an actual ex-FBI 1989 Dodge Ram surveillance van turned up at a government auction, went on YouTube, then sold on eBay. Antenna housing on the roof, microphones in the lights, cameras in the roof mounts, a toilet and air con inside. If you ever spot one of those parked on your street... someone screwed up.
The sneakier version is the "boot fit" (trunk fit, for North America)- an ordinary car with an operator folded up in the trunk, filming. Uncomfortable, short-lived, and a lot harder to spot than a van.
Once you're moving, the team talks in brevity codes and spot codes. Instead of "turning left toward the junction of High Street and Water Lane" on an open radio, it's something like "at Red Six, intending right" off a spot map every car carries. Anyone listening in hears gobbledygook. A full team is something like eight cars and sixteen people with binders of maps. That isn't cheap. Teams more hip with the times will be using well structured and developed applications. THIS isn't cheap.
When running mobile surveillance operations (such as vehicular tails, foot details, or target boxing), teams use specialized tactical mapping platforms to coordinate movements silently in real time.
Top Platforms in Use
ATAK (Tactical Awareness Kit): The gold standard for tactical situational awareness. Displays real-time GPS locations, heading, speed, live video feeds, and shared pins (e.g., target location, perimeters) across all field devices.
Covert Tracking Systems (e.g., CovertTrack): Integrates magnetic GPS beacons deployed on target vehicles into a unified dashboard, enabling parallel tails and seamless vehicle handoffs without constant line-of-sight.
Real-Time Intelligence Centers (e.g., Axon Fusus): Blends mobile officer GPS with live camera feeds and automated license plate readers (ALPR) for real-time corridor tracking.
ArcGIS Mission: Provides structured command-and-control mapping, geotagged observation logging, and instant route synchronization between dispatch and field operatives.
Key Requirements
Surveillance mapping demands 1-to-5-second GPS refresh rates to handle urban turns, end-to-end encryption over private networks, and visual role designations (identifying who holds the "eyeball") to eliminate unnecessary radio chatter.
In the Car- the Floating Box
They drive whatever the locals drive. Pickup trucks in Texas, sedans in the city, not the black SUV with government plates (except maybe in DC..). Agency teams hold multiple plates per car and swap a plate when its heat gets too high. That can't be done at the roadside- someone unscrewing a plate on the shoulder gets the cops called on them- so that car leaves the follow while it happens.
Iowa is a nice example of how common this is: a state report found thousands of "confidential" plates issued to government vehicles so they don't trace back to an agency.
And they don't sit behind you. There will be two or three cars between you and them, with others on parallel roads getting ahead. On a grid city, the pattern is the floating box:
You turn, the call goes out, every car turns at its next chance. Blowing through an amber light does nothing- someone on the parallel street just picks you up at the next block. The other thing I didn't expect: losing you is fine by them. On a long job it's better to lose the target for the day than to show out and let the target know there's a team at all.
Anti-Surveillance or Counter-Surveillance?
People use these interchangeably. They're not the same thing.
Anti-surveillance is you, alone, doing things to see whether you're being followed. Counter-surveillance is when a third party- your own friendly team- follows you to spot the people following you. Add another team watching that team and it's counter-counter-surveillance.. turtles all the way down.
Everything below is the anti kind. What you're after is to see them without them seeing you look.
Breaking the Pattern From the Driver's Seat
The whole approach is tempo. You're the one being followed, so you lead- set a rhythm, then change it, and force the team into quick 50/50 calls. Every bad call puts someone too close, or puts the same face in front of you twice.
Vary the route- and not just from your front door.
Get out of the car. Drive somewhere, park, get on a bus or into a cab. Buses and cabs go places cars can't (the bus lane, for one.. try explaining what you were doing in there). Now they have to decide- why did you get on that bus? Are you meeting someone? Do they put somebody on with you? Meanwhile you get to look at everyone who boards.
Choke points. A car ferry is the textbook one: the road around the lake in the example was something like 47 miles of slow going, the ferry was minutes. Do they drive the long way round, or put cars on the boat with you where you can look at them for the whole crossing?
The "long look"- a long straight road with no parallel roads. Operators are taught to spot these on the map ahead of time, because anyone following has to come down it behind you in plain view. Nobody can put the whole team down it at once without it looking like a convoy.
Parking is another choke point you control, a multi-storey car park especially. Do they follow you in, where you can watch who comes up the ramp? Or take a cab and say "drop me here" on a street with no parking. Now the team has to switch from car to foot right now, with whoever happens to be closest.
Now the salt and pepper... there's a myth, straight out of police and military habits, that you should always reverse-park for a quick getaway. On a street or car park where everyone has pulled in nose-first, the one car backed in is the one a surveillance-aware eye goes straight to. A trained operator parks like everyone else.
Walk back to your car past the other cars, too. These are pros, but they're people. There's the story from the talk about two surveillance instructors whose parked car got reported as suspicious. The police looked in the window and found a radio handset sticking out from under the seat.. not a normal thing to see in a car. Especially a radio- people get weird about radios.. myself included. What do you think if you see someone with one? Yeah, I thought so. That radio chirps, aka makes any sound- iconnic and specific to a handheld radio- and your senses go on alert. We associate these things with serious situations- see a radio and our suspicions ellevate.
Why not just use a tracker?
A fair question- A tracker can be found. Someone with any sort of technical prowness, a technical target who finds one knows for sure- hmmm, why is this GPS sitting here attached under the wheel well of my car? Though I am not scanning my vehicle or house and home for such devices- any hint at such activities and I may. Maybe using some sort of scanning device- even an SDR-= to listen if there arte any out of the normal signals floating arround- A tip from the wise to you since your scan may bring up nothing... you're all clear you think... Just so you know, many of these tracking devices do not transmit until some kind of trigger initializes them. Weird but worthy of a try.. some devices kick in with noise- clap with your hands while the scanner is going- maybe you'll discover a once dormant device which you've awaken. Or do the scan again when in motion- anything new? Attempts at obfiscating the devices are easilly remedied- and limitted to the object which they've been attached to- the car has stopped. "He's at the mall" is useless when he's already inside and you're a mile out. The point of a follow isn't so much where someone goes, more importantly it's what they do and who they meet there. For that you need people close enough to go in after them on foot.
The Two-Choke-Point Plate Trick
Flip the script...Turn the tables against them- your smart right? Right.
Any area on your route where there's no other option but go through that route? A choke point. If you have a friend to help(this is a rare breed of friend, charish them- most others will dismiss your claims- rather than witnesing or assisting in you endevours to bring to light such actyivity, most would rather ridicule, dissmiss you "oh you're just imagening things"- these are not friends.). Warning aside, friend or no friend, the latter providing its challenges- though more difficult, in some senses not. Easilly rectified utillizing technology- maybe for another post- since the topic is intriguing to a gadget savy individual- a subject we love to devour knowledge about- you're right, this exactly requires a post going into the details by itself.
Friend or not- find a location which can be monitorred- a quickly stashed camera or the friend which in casual conversation agreed to assist: have them film every car through a choke point for ten minutes either side of you passing in the morning. Do the same at a completely different spot later in the day.
Earlier mentioned... get out of the car. Driving somewhere? Park, get on a bus or into a cab. The bus lane, for one.. Buses and cabs go places cars can't. Why did you get on that bus? Do they put somebody on with you? Being on that bus you get to look at everyone who boards.
A car ferry because the road around the lake was miles of slow going, the ferry was minutes. Do they drive the long way round, or put cars on the boat with you where you can look at them for the whole crossing?
A long straight road with no parallel roads aka the "long look"- anyone following has to come down it behind you in plain view. Nobody can put the whole team down a long straight route without it looking like a convoy. The attenrtative easilly notice. The department caught a break at the dealership leasing bulk... liscensing requirement- a lineup of white sedans all having their plates read the same first characters.
Parking is another choke point you control, a multi-storey car park especially. Do they follow you in, where you can watch who comes up the ramp? Or take a cab and say "drop me here" on a street with no parking. Now the team has to switch from car to foot. Easilly observed. Put the ball in your court.
We are focussing on the liscence plates of the vehicles which have no choice but to cross...We diuscussed a few other types of choke points earlier, such as; taking a ferry. One way in, one way out- post up at those points and be attentive- your friend from a perch, documenting... the entrance to the oparkade, the exit. The only one way street into the district... the street with no parking which you requested the taxi drtiver to let you off at- thyese all being areas you control- any manner of docummenting is a huge asset for your endevours- it'll be a huge P.I.T.A. for anyone following to continue without being obviius- at times hillarioussly so.Two lists of plates. Any plate that shows up on both lists deserves a closer look.
The talk ran the phone footage through OpenALPR, dumped the results to JSON, then SQL. Automatic plate readers misread blurry frames, so you get near-duplicate plates. The fix is just counting- the plate read in the most frames is the real one.
Heads up on the tools: OpenALPR was bought by Rekor in 2019 and the paid product became Rekor Scout. The open source repo is still up (AGPL, last push January 2024) but it's effectively frozen. fast-alpr is a maintained MIT-licensed alternative. The old command line from the OpenALPR README looks like this (-c is us or eu, -j is JSON output):
alpr -c eu -j morning.mp4 > morning.json
And a small Python script to compare the two lists- a plate has to show up in at least two frames of the first clip to count, which drops most one-off misreads. I tested it on sample JSON in OpenALPR's output shape, not on real footage:
import json, sys
from collections import Counter
def plates(path, min_hits=2):
seen = Counter()
for line in open(path):
line = line.strip()
if not line.startswith("{"):
continue
for r in json.loads(line).get("results", []):
seen[r["plate"]] += 1
# a plate read in several frames is the real one; one-off misreads drop out
return {p for p, n in seen.items() if n >= min_hits}
a, b = plates(sys.argv[1]), plates(sys.argv[2], 1)
for p in sorted(a & b):
print("seen at both spots:", p)
Mind where you do this- filming traffic in public is one thing, keeping databases of other people's plates is regulated in plenty of places.
On Foot- the Grey Person
What do you picture? Big guy, short hair, earpiece with a curly wire, big watch? If you can see the earpiece, the wire and the push-to-talk button hanging out of a sleeve.. that's overt surveillance. They want you to see them.
The real ones aim to be the "grey man"- the person you can't describe five minutes later. Better yet, the grey person: teams use women because everyone is watching for the big guy. The newbies fall into an unofficial uniform of their own, everyone dressing "differently" in a way that ends up the same. Black t-shirt and jeans. Khaki shorts in the summer.
The kit hides under clothes:
Earpiece. Wireless, sits deep in the ear. Up close you might catch the little retrieval stem.
Inductive neck loop. Worn around the neck, feeds the earpiece, carries the microphone.
Antenna. Usually a T-shape across the shoulders and down the centre of the back.
Pressel switch. The push-to-talk, tucked somewhere inside the clothing, not down the sleeve.
The vest. Radio one side, battery the other, to spread the bulk.
That's a lot of gear, so they need enough clothing to cover it. Remember that one.. it comes back.
Changes of appearance are real. The Stasi archive photos are the famous set- East German officers training in wigs, fake moustaches, plain-glass specs- and agency teams still use that, because it breaks up the outline. We don't really look at people. We draw a rough outline around them.
But.. they spend all day on their feet. Hat, coat, glasses, hair- all of it changes. The comfortable shoes do not. Same with a watch (ex-military folks love their watches) and jewellery- wedding rings, necklaces, earrings. New jacket, same shoes, same watch? Make a note.
The ABC Behind You
The standard foot pattern is three people:
A is in control- the only one with "eyeball" on you. B is backing, ready to take over. C is the trail, across the road and a bit behind. When you turn a corner, C can see from across the street whether you kept walking or stopped to wait for whoever comes round after you. C passes that on, A crosses and becomes the trail, C takes control. Meanwhile the rest of the team are on parallel streets further back, swapping in so no one face stays on you too long.
Which is why the "I'll just follow that person" instinct is a trap- one or two people can't do this. And why, when you're checking, the person to watch is often not the one behind you. It's the trail on the other side of the road, who gets complacent because they aren't directly behind and rotate less.
Use Your Surroundings
You pick the ground. Some of the ones from the talk that stuck with me:
Window shopping- shop glass reflects. Look for who's on the opposite pavement, again and again.
The mirrors in subway and underground tunnels.
Escalators. Turning round on an escalator is normal behaviour. You get a free look at whoever is one floor below, coming up.
A payphone. Yes, really. It's a reason to stop and look around. When you stop, a trained follower needs a reason to stop too- "cover for action". Pretending to use the phone is one of their go-tos, and you've just taken it.
Dead ends- a one-way street with nothing at the bottom but a café nobody goes to. Anyone who follows you down it is interesting.
Places people don't follow, like the men's room, or any spot where another person tagging along needs explaining. (They have women on the team, so it's not foolproof.)
Elevators. Do they put someone in a small metal box with you, at arm's length, where you get a proper look? If nobody gets in, press three or four floors and get off at yours. Despite the films, nobody is sprinting up fifteen flights of stairs to beat you. And if someone suspicious does get in.. ask them the time. Now you've got a face, a voice, and they've got heat.
The pool. Remember the vest? Nobody wearing a radio, a neck loop and an antenna is getting in the pool or the spa with you!
Misdirection
They're trying to work out who you meet, so give them too many answers. Shake hands with strangers, hug a friend you're only having a milkshake with, stand next to somebody far more interesting than you. In a café, pick the seat that shows you the door and note everyone who comes in. When you leave, fold your newspaper and tuck it somewhere it won't get cleared away- between the planters, say. Now they have a decision to make. Is that a drop? Do they leave people watching the paper? If they split the team to cover both, you've just halved the number of people following you.
And steal their own trick: they've been looking for a red cap and a blue top for six hours. Hat off, coat off, into the bag.
This Still Happens- the Illegals
If this all feels very Cold War.. in June 2010 the FBI arrested ten Russian "illegals" at the end of an investigation it called Operation Ghost Stories. Two of them lived as Richard and Cynthia Murphy, a pleasant suburban couple with two kids. They were actually Vladimir and Lidiya Guryev, SVR agents who'd been in the US for years. The case ran close to a decade, because a follow like that is a long game- you want the handlers, the handlers' bosses and how the whole thing works.
A correction worth making: the talk puts the Murphys in "a small town in upstate New York". They lived in Hoboken and then Montclair, New Jersey- the raids that June were in Boston, Montclair, Yonkers and Northern Virginia.
The released FBI surveillance footage is the fun part.. a bit embarrassing for the other side, too. Someone digging at a dead drop with a shovel, filmed from a camera hidden in a tree. Brush passes in a crowded station that are anything but brushed. Someone loitering in a subway stairwell for what felt like forever. A café hand-off filmed from a camera in a bag on the next table- with, by the speakers' count, three FBI people sitting close enough to touch and nobody noticed them. The cameras got there because a surveillance team on foot found the spots first.
What It Boils Down To
Use your environment. You're the leader- they have to follow you, so choose where you go and never walk into where they're already waiting. Set a tempo, change it, and make them decide fast. Split them up if you can. Always be making toast.
And the one that stuck with me the most, which is for the journalist meeting a source more than anyone- if you're in any doubt, abort. Maybe you're being paranoid. Maybe you aren't- and if you aren't, you just kept someone else from being dragged into it.
Everything in there is public- the speakers made a point of it. The same material is spread across plenty of books on the subject. I also wrote up a DEF CON badge and ADS-B project a while back in Badge, a Data Project, and the Best ADS-B Antenna if you're in that mood.
Have you ever had that feeling of the same face turning up twice in one day? Did you do anything about it.. or talk yourself out of it? Leave a comment- I'd love to hear the stories, the paranoid ones too.
Oh- and the UK surveillance course the talk mentions, the one where you show two forms of ID and walk out formally qualified? Those Level 3 and Level 4 covert surveillance awards run roughly £900 to £2,000 plus VAT these days. The "that's like 200 bucks in Brexit money" line from the stage was a joke.. I think.
Glossary
ALPR / ANPR — automatic licence plate recognition; software that reads plate numbers from images or video.
Anti-surveillance — what you do on your own to find out whether you're being followed.
Boot fit — a normal-looking car with an operator hidden in the trunk (boot), filming.
Brevity codes — short radio codes a team uses so an eavesdropper can't follow the conversation.
Brush pass — handing something over while passing someone, meant to look like nothing happened.
Choke point — a place everyone has to pass through, like a ferry, bridge or car park ramp.
Control / eyeball — the one operator who currently has the target in sight.
Counter-surveillance — a friendly third party watching you to spot the people watching you.
Cover for action — a believable reason for being where you are, doing what you're doing.
Dead drop — a hiding place where one person leaves something for another to collect later.
Floating box — vehicle surveillance using parallel and cross streets around the target instead of tailing directly.
Grey man — someone so ordinary you can't describe them afterwards.
Heat state — how exposed an operator or vehicle has become to the target; too much and they're "toast".
Housing — putting the target to bed at the end of the day's follow.
Illegals — spies living under false civilian identities, with no diplomatic cover.
Long look — a long straight road with no alternatives, where the target can see everything behind them.
Overt surveillance — being followed by people who want you to know they're there.
Pickup — getting eyes on the target at the start of an operation or day.
Pressel switch — the push-to-talk button for a covert radio.
Spot map / spot codes — a shared map with coded points, so locations can be called over the radio without naming streets.
Trail — in the ABC pattern, the operator across the street and a bit behind the target.
This site uses cookies from Google to deliver services, personalise ads and analyse traffic. By using this site you agree to its use of cookies. Learn more.
Comments
Ever had that feeling of seeing the same car, or the same face, twice in one day? What did you make of it?
Post a Comment