CHAPTER 4
AS YOU CREATE A SURVEILLANCE DETECTION route, it is important to note other vital issues. One of the most consistent concerns is to identify hostile surveillance. Ami Toben, who is a pioneer in the field of covert surveillance, defines hostile surveillance as the covert observation of a target for the purpose of collecting information.
Hostile surveillance is a covert effort to look at a target and determine its value. It will also study security procedures that are being used to protect the target. Finally, the hostile surveillance team will identify vulnerabilities and escape routes that can be used after the hostile action has taken place.
There are several components to this process. The first is that it involves physical observation that is done covertly. During the Cold War, the United States Military Liaison Mission, along with its British and French counterparts, patrolled East Germany but were, under relevant postwar agreements, required to do this overtly. That was a crucial point because it meant their activities were officially classified as mere observation rather than espionage. Their tours through East Germany were not classified as surveillance. By contrast, physical surveillance must combine observation with covertness if it is to be regarded as proper surveillance. The goal of hostile surveillance is to collect information that can be used in planning an attack against a target.
There is generally some type of preoperational hostile surveillance that is conducted prior to an attack. Preparing for such an attack is a long process that begins with a member of a surveillance team acting as a scout moving through the neighborhood in which the target is located. This person should study the general environment in order to advise his team on how to blend in with the people seen near the target. If it is located next to a university, it is likely that the people on the street will look like students. If members of the team dress like homeless people, they will be conspicuous and be spotted by the most basic security forces protecting the target.
The scout should identify vantage points that can be used for long term observation of the target site. The vantage point should be one that gives the operative a broad view of the target itself so he can collect visual information about it such as the types of security measures that are in place. Before selecting a vantage point, the scout should find a location from which the vantage point can be studied. This location should not be one from which the target is seen since the goal here it to learn about the vantage point. If it is in a park, he needs to know what sort of people are normally in the park so his team members can assume the correct identities. If the vantage point is a bench, he must determine what sorts of people normally occupy the bench during proposed observation times.
A well-publicized example of an incident that highlighted the significance of hostile surveillance and the need for counter surveillance efforts was the so-called “mansion murders case” in 2015. It began with a fire in an exclusive home in the Woodley Park neighborhood of Washington, DC. As firefighters fought to suppress the blaze, they found the bodies of three adults and one child, all of whom had been murdered. The home belonged to Savvas Savopoulos, the CEO of a construction company known as American Iron Works. The tenyear old Savopoulos child had apparently been tortured in an effort to get his father to comply with demands made by the intruder. What the killer sought was apparently $40,000 in cash, since that amount of money was later delivered to the home by a Savopoulos assistant. Shortly after the funds arrived, the home was set on fire and a sports car owned by Savopoulos was found burning in a church parking lot in Maryland.
While Savopoulos and his family waited for the money to be delivered, which took until the next day, two pizzas were delivered to their house. The pizza was instrumental in the apprehension of Daron Wint, whose DNA was found on a partially uneaten pizza crust. Wint was a former employee of American Iron Works and had been fired for threatening another worker with a knife in 2005.
There was a decade between the time Wint was fired and his attack on the Savopoulos home. As Wint had difficulty maintaining a job, he apparently focused on his being fired by Savopoulos as a key event in his troubles. A home invasion such as this required considerable planning and was not the result of an angry impulse. Investigators noted that in 2010, an armed Wint had been arrested at a gas station across the street from the American Iron Works. Such a location could serve as a “surveillance perch” for Wint if he intended to follow Savopoulos home after work.
A home invasion such as this requires extensive surveillance in order to determine patterns associated with the home and the neighborhood. An attacker would need to learn what protective measures existed and how to best enter the home and control the occupants. This is all part of the attack cycle and it is during this time that a would-be attacker is vulnerable to observation. Had Savopoulos developed any plans for how to protect his home, he or a security employee might have observed someone watching. Even a personal situational awareness effort might have saved him and his family. Because Wint had no professional surveillance training, he would likely have made obvious mistakes, but since no one was looking, he remained unseen.
In a city such as Washington, there are numerous companies that provide counter surveillance services, and if he had employed one, the attack could have been prevented. Many executives routinely employ counter surveillance personnel to protect themselves. One simple intelligence tool that would have been useful is a duress code, a simple warning word that could have been included in his communications when Savopoulos communicated with his staff to arrange for the collection and delivery of the money for Wint.
There is no doubt that Wint, as a non-professional, likely used poor techniques and could have been easily detected. But that could have happened only if someone had been observing and practicing situational awareness. There are four major elements in training people to be observant in protecting their interests or their clients. They are time, environment, distance, and demeanor. Together, trainers use the acronym TEDD as a reminder of these vital concerns. The starting point for this equation is to notice whether you keep seeing the same person or people over a fairly long period of time. If someone “just happens” to appear as you travel to work each morning, perhaps in the same subway car, and later as you are having lunch, you need to remember this person. It is a clue that you may be under surveillance. If an individual thinks he is being targeted, he should then consider the other TEDD factors. TEDD is relevant for an individual who is being targeted for a complex home invasion such as in the “mansion murders.” None of this applies to a situation in which a location, rather than an individual, is the target. A person who had the bad luck to visit the World Trade Center on September 11, 2001 could have done nothing to protect himself. On the other hand, a person who happened to be at a concert that was hit by an armed terrorist might have been able to note the suspicious demeanor of the terrorist planning to attack the location.
Of course, a trained terrorist conducting surveillance will be better able to avoid detection by changing his appearance. A change of clothing, even a reversal of the jacket, or the application of a wig, will do a lot to make the surveillance team member harder to see. Because of this, a counter surveillance person should pay more attention to the demeanor of individuals in their area. Even more important is to note the person’s build, facial features like ears or noses, and how a person walks. These are things that cannot be easily changed.
There will always be critical places that should be watched in order to detect hostile surveillance. The gas station across the street from the American Iron Works was such a location. It gave Wint a good view of the factory and allowed him to see the choke point created at the exit from the factory. This was a critical place for someone hoping to follow Savopoulos to his residence. The front door of the office or home of a target is another critical location for hostile surveillance efforts. By identifying such places, they can be monitored by teams protecting a possible target. Finding trash or an assortment of cigarette butts might be an indication that the perch was being used for hostile surveillance.
One way that a hostile surveillance team member might expose himself is through improper demeanor. A person who is spying on a possible target must fit in the environment even though he knows he is an alien presence. This uneasiness can be hidden by a trained professional, but usually not by an amateur. Untrained surveillance operatives will react when they fear they have been seen. It is natural that they will try to hide their faces or abruptly turn around if they encounter their target. A well-trained person will be able to hide their normal reactions even when they are stricken with fear of exposure. An unexpected jump or an exclamation could insure their capture by security personnel.
Maintaining proper cover will contribute to the success of a surveillance operation. There are two aspects of cover. The first is cover for status, which refers to one’s cover identity. This could be obvious identities such as businessman, student, or repairman. The second is cover for action which explains what a person is supposed to be doing. It could be as basic as sitting on the bench at a bus stop or attending a conference.
To have credibility, the components must be consistent so that the person conducting surveillance looks normal and fits into the environment. If the surveillant happens to be wearing a suit when his target goes to the beach, consistency is lost. A cover for action would fail if the surveillant appears to be walking his dog but has none of the gear needed to pick up after the dog, simply does not allow the dog to stop and do his business, or obviously is not liked by the dog.
Other demeanor failures would be getting up and moving immediately after your target moves. This creates a clear impression that you are following that person. Making a cell phone call each time the target moves is another example of a demeanor failure. Even more obvious is showing that you are part of a team by gesturing to other people in the area. Of course, there are times when the objective of a hostile surveillance team is to make sure the target knows he is being followed. The purpose of this could be, first, to harass the target. US embassies in Eastern Europe during the Cold War reported that hostile surveillance teams would push embassy personnel into the street. A second purpose of this type of surveillance could be to prevent their target from servicing a dead drop or preventing a meeting between a handler and his agent.
There are numerous demeanor indicators, many of which are almost imperceptible. If a person appears to fidget when you look at him, this might be an indication that something is wrong. It may not indicate criminal intentions, but it is still suspicious. A person’s eyes can also be a demeanor indicator. A stubborn refusal to make eye contact or eye contact that conveys hostility are warning signs that someone might be a threat and should be avoided if possible.