Technical Surveillance Countermeasures (TSCM) prevent, detect, and neutralize the threats that eavesdropping and surveillance devices pose to organizations.
TSCM is a service that prevents, detects, and neutralizes the threats that eavesdropping and surveillance devices pose to organizations.
These days, the physical security of an office or meeting space is a forgotten aspect of an organization’s enterprise security strategy, but it’s not unimportant.
In a previous post, we discussed the importance of physical security at the corporate, government, and residential levels. With Technical Surveillance Countermeasures (TSCM), an organization can improve its physical security and reduce the risks associated with corporate and nation-state espionage against personnel, proprietary information, and sensitive data.
THE PROBLEM
All it takes is one disgruntled employee or a bribed maintenance worker to plant a $30 listening device in the ceiling of an office or under a conference room table. This makes scanning for surveillance devices particularly important as there are few barriers that prevent determined actors from surveilling spaces.
Most organizations recognize the threat that cyberattacks pose these days. Firms large and small are investing heavily in securing their networks and information systems, but most continue to overlook physical security. Technical surveillance is especially pernicious because it allows devices to clandestinely collect and transmit a target’s information. While the most damaging cyberattacks often require highly experienced hackers and months of work, use of technical surveillance can be remarkably cheap and simple.
Current employees pose the greatest threat to organizations because they have physical access to offices. Disgruntled employees that seek to harm their former employers pose both a physical and cybersecurity risk because they can plant surveillance devices or leak or steal sensitive information. After-hours maintenance workers, building managers, and custodians also pose significant risks to organizations. Lower-paid workers may be susceptible to bribes and could allow any random person access if offered enough money. Once inside, these intruders could secretly plant surveillance devices and then disappear without anyone knowing. This can be devastating to organizations because it is extremely challenging to preemptively catch malicious actors.
THE SOLUTION
TSCM experts address this problem by using advanced radio-frequency and electronics detection technologies to discover threats. TSCM is the physical security equivalent of network penetration testing in that TSCM professionals use a similar process to find and mitigate threats. The three steps of a TSCM sweep are:
- Planning
- Scanning
- Reporting
During the planning phase, the TSCM team walks through a space and learns about the security systems in place and then identifies how and where surveillance devices could be planted. Additionally, the team uses radio-frequency technology to develop a base frequency assessment to get an idea of legitimate devices’ signatures. This planning stage is essential as it helps identify which frequencies are normal and therefore negligible. TSCM technicians also consult with clients to determine their plans of action if a surveillance device is actually found. Finding a device is typically shocking, so having a plan in place is essential for guiding organizations’ responses. For instance, ripping out the device is not recommended as it destroys the evidence if an organization wishes to prosecute the criminal.
During the scanning phase, the TSCM team performs a variety of tests and inspections:
- Electronic Device Detection
- Telephone & Line Inspection
- Radio-Frequency Spectrum Analysis
- Electro-Optical Bug Inspection
Electronic device detection is a process in which a counter-surveillance expert finds and then reports back the location of electronic surveillance devices, the type that might be hidden in locations where electronics would normally not be found. Telephone and line inspections hunt for signs of wire taps and call intercepts by looking for physical implants and nefarious signals. Radio-frequency spectrum analyses allow TSCM teams to home in on the sources of unknown or disruptive rogue transmissions. Electro-optical bug inspection specifically searches for hidden cameras.
The last phase is analysis and reporting of what was found during the scanning phase. This includes a thorough assessment of how an organization may be at risk and if the team found any suspicious devices. A typical assessment includes a summary of the results found during the planning and scanning phases, including any identified physical security gaps, abnormal heat signatures, telephone line vulnerabilities, and rogue radio frequencies.
Technical Surveillance Countermeasures are essential for any organization that wants to protect its sensitive information. Organizations in merger talks, fundraising rounds, or prospective client meetings should be especially aware of their physical security environment. It is best practice to perform TSCM sweeps semiannually as well as before big meetings. With TSCM, an organization can be prepared for one of the most dangerous and least remembered security threats.
