The vocabulary of counter-surveillance, in plain English.

TSCM (Technical Surveillance Countermeasures)

The professional discipline of detecting, locating and neutralising covert surveillance, and of closing the pathways that let information escape. A TSCM inspection is what most people mean by a "bug sweep", though a credible engagement covers infrastructure and practices as well as devices.

Bug sweep

The everyday name for a TSCM inspection. We use it too. The term undersells the work: devices are one of several ways a room leaks.

Electronic privacy audit

A broader exercise than a sweep. It asks by what pathways sound, video and data can leave a sensitive space: planted devices, yes, but also conference systems, telephony, smart-building infrastructure, personal devices and meeting habits. Delivered with a prioritised remediation plan.

Non-linear junction detector (NLJD)

An instrument that finds semiconductor electronics whether or not they are powered on or transmitting. It is how inspectors find the device that was switched off, ran out of battery, or never transmitted at all.

Store-and-forward recorder

A covert recorder that stores audio locally rather than transmitting it, defeating purely radio-based detection. Because the operator must return to retrieve it, a discovered store-and-forward device creates an attribution opportunity.

GSM / cellular device

A surveillance device that transmits over the mobile network, letting the operator listen from anywhere in the world by dialling in. Detectable through RF analysis and physical search.

Carrier-current attack

A technique that sends captured audio over existing building wiring, such as mains power or telephone cabling, instead of by radio. One of the reasons a credible inspection examines infrastructure, not just airspace.

RF spectrum survey

Wideband analysis of the radio environment compared against a baseline, identifying unauthorised transmitters including devices that transmit in short bursts or on schedules designed to evade detection.

Covert optical device

A hidden camera. Modern examples are embedded in chargers, smoke detectors, clocks and furnishings, and may record locally, transmit over Wi-Fi, or both. Detection combines lens-detection optics, physical search, and RF and network analysis.

Auto-answer compromise

A video-conference endpoint or speakerphone configured to accept incoming calls silently, turning a meeting room into a dial-in extension for anyone with the address. Among the most common findings in modern boardrooms, and no device is involved.

GPS tracker

A location device attached to a vehicle, magnetically or hardwired, reporting position over the mobile network. Tracking is usually the preparation for something else: litigation ambush, hostile negotiation, extortion or physical threat.

Telematics compromise

Abuse of a vehicle's own connected systems, including OBD dongles and infotainment, to capture location or cabin audio without adding hardware the owner would notice.

Commercial spyware / stalkerware

Software covertly installed on a phone or computer to capture messages, calls, location and ambient audio. A compromised phone follows its owner into every room, which is why device checks belong in a serious privacy audit.

Insider threat

Information loss attributable to a person with legitimate access. The majority of confirmed losses in our casework involved an insider or trusted third party, whether as the channel itself or as the hand that placed a device.

Elicitation

Extracting information through apparently innocent conversation, so the source never realises they were a source. The recruitment method of choice against assistants, advisers and junior staff.

Controlled-information operation

An investigative technique that introduces uniquely identifiable material, sometimes called a canary or barium meal, through suspected channels. When a specific version surfaces, the channel is confirmed and attributable.

Leak-path analysis

A structured reconstruction of where compromised information existed, who had access, and which technical, human or procedural channels could have moved it. The first analytical step of an espionage investigation.

Chain of custody

The documented, unbroken record of who held an item of evidence, when and why. Without it, a discovered device may be legally worthless. It is the difference between finding a bug and proving a case.

Counter-espionage

The combined technical, investigative and procedural measures used to detect, attribute and defeat hostile intelligence collection against an organisation or family.

Counter-intelligence

The wider discipline of which counter-espionage is a part: understanding who is collecting against you, by what means, and denying them. In commercial practice the terms are often used interchangeably.

In-place monitoring

Permanently instrumented critical rooms with continuous technical monitoring between physical inspections. The highest tier of assurance for the highest-exposure environments.

Pre-occupancy inspection

A sweep of a hotel suite, meeting venue or new property completed before your team occupies it and speaks freely in it. Standard practice for sensitive travel and off-site negotiations.

Cover arrangement

An agreed innocuous explanation for inspectors' presence, such as facilities works or an IT upgrade, so staff outside the engagement never learn an inspection took place.

Counsel-directed engagement

An engagement commissioned through external counsel so that findings and working papers may attract legal professional privilege. Recommended for any matter that is, or may become, contentious.

Sweep cadence

The frequency of scheduled inspections under a monitoring programme. Set by exposure, varied in pattern so the schedule itself never becomes predictable, and reviewed annually against the threat model.

Missing a term you have seen elsewhere? Ask us directly. If it matters to your matter, we will explain it without the mystique.