What a TSCM sweep can and cannot show
Technical surveillance countermeasures, or TSCM, is the work of finding covert listening and recording devices and the means used to run them. This guide explains what a sweep checks, how it is done, and where its limits lie.
What TSCM means
TSCM covers the detection and assessment of covert surveillance: audio and video devices, location trackers, and devices that send what they pick up over a network or a radio link. It is concerned with whether a space is being watched or heard, and with how that could be happening.
How a sweep is carried out
A sweep starts with a scope: the rooms, the buildings and the equipment in them, and what the space is used for. The scope decides what is checked and in what order.
The physical inspection looks at the places a device is easily hidden: fittings, furniture, ducts, sockets and objects that have been moved or added. A specialist looks for what does not belong, and for what has been changed.
A radio frequency survey looks for signals in the spectrum a device might use. It shows what is transmitting, where, and at what strength, and it is repeated, because a device may only transmit at certain times.
A non-linear junction detector can find electronic components even when a device is switched off, because it responds to the semiconductor junctions inside. It helps where a device has been placed to stay quiet until it is needed.
What a sweep cannot show
A sweep is a snapshot of a space at a particular time. A device installed after the sweep is not in it, and a device that records and stores its data, and transmits later, may not reveal itself during the survey.
A clean result is therefore not proof that a space is safe. It is a finding that nothing was found in the areas checked, by the methods used, on that day. A good report says exactly that.
When a space is worth sweeping
A sweep is usually considered before a sensitive meeting or negotiation, after a suspected leak of information, where a space is used for confidential work, or after people with access to it have left in unclear circumstances.
Working with a provider
A sweep should be carried out with the right authority. A space the client controls can be swept with that control; a space that belongs to someone else needs their agreement first. The provider should confirm this before any work starts.
Ask for a report that sets out the methods used, the areas and times covered, what was found and what was not, and the limits of the result.