S9 Advanced_Ops
Published in

S9 Advanced_Ops

Conducting surveillance offshore

The practicalities and risks involved with conducting surveillance as part of an overseas assignment.

From time to time an overseas assignment may require surveillance on a human target or a facility.

Surveillance in your home country is already a complex task. If you’re conducting surveillance in a foreign country, it will be even more difficult, with a unique set of risks. You will need to be careful with your planning and risk management, and highly selective with the types of equipment you do (and don’t) use.

In this article I’ll discuss some of the factors you’ll need to consider when planning and conducting surveillance operations overseas.

I’ll start off by explaining why offshore surveillance operations are different, and what that will mean to you in practice. From there I’ll work through relevant aspects of area familiarisation and the development of cover stories or pretexts. I’ll discuss key aspects of static, foot, and mobile surveillance, highlighting the differences between normal operations and how you’ll need to adapt these when operating overseas. I’ll wrap up by sharing a few points on counter-surveillance.

To be clear, the focus here is on commercial work, not government work.

This is part of our “Advanced_Ops” series of articles, where we explore some of the more dynamic aspects of operating in complex and higher-risk environments. This builds on a series of articles called “The Basics”, which lays the foundation for operating successfully and safely in challenging environments.

How are offshore surveillance operations different?

While some of the mechanics of overseas surveillance operations don’t differ significantly from what you may do in your home country, the approaches you are comfortable using at home won’t necessarily work in an overseas context.

You will be faced with a number of different operational constraints that you’ll need to work within (and around). These constraints will have a significant impact on what’s going to be achievable. You’ll need to temper your expectations considerably, and in many cases you’ll need the patience of a saint.

Aside from the operational aspects of surveillance, which I’ll focus on below, perhaps the most important difference when operating offshore is the consequence of compromise. If a commercial surveillance operation is compromised at home, it may just result in a bit of professional embarrassment. If a surveillance operation is compromised overseas, it could result in you being arrested and charged with espionage. This can have serious penalties in many countries, including capital punishment. The authorities won’t have to prove that you’re a spy — you’ll have to prove that you’re not. This is an almost impossible task due to the fact that covert intelligence gathering operations are, by definition, deniable.

This brings me to a key point: before you even consider conducting surveillance in an overseas country, conduct a detailed risk assessment. While there are very few countries I would say are too risky to conduct surveillance in, there are quite a number where I would apply extremely rigorous protocols to protect myself and the operation.

Leading from this, an obvious question is whether or not you should even be conducting surveillance yourself. If you have a project where surveillance is required, your first consideration should be to hire a local company to conduct the surveillance on your behalf. You may even explore other intelligence collection techniques you could use to gather the information, instead of getting on the ground yourself.

This article is designed to provide information for situations where these options aren’t available to you, and you need to conduct the surveillance yourself. Often these will be smaller ad hoc efforts designed to support other activities.

The task

There are a few contexts where you may need to conduct surveillance overseas:

  • Following a contact before or after a meeting as part of your vetting processes.
  • Surveilling a meeting location in advance of a meeting.
  • Surveilling a facility as part of a due diligence investigation or a competitor analysis.
  • Surveilling one of your own facilities to identify security vulnerabilities or as part of an investigation.

As with surveillance operations you do at home, surveillance overseas may have a number of different objectives:

  • See the locations the target goes to, for example, identify their residence, place of work, meeting places, or recreational venues.
  • Confirm the target’s associates.
  • Confirm the target’s security arrangements.
  • Identify the vehicles the target uses.
  • Identify patterns and routines.
  • Identify security vulnerabilities at a facility.

These objectives don’t necessarily change when you are doing surveillance offshore. What does change is how you approach the problem.

The target

Who your target is depends on your operation and its objectives.

One point to note is that as a civilian, you shouldn’t be in the business of surveilling people from the host government, military or police. If you do that, and get caught, the consequences could be dire.

The challenges

There are a host of different factors working against you when conducting surveillance overseas:

  • You’re a foreigner. You stand out. You don’t belong. People will notice you due to your physical appearance and mannerisms, even if you’re not doing anything suspicious. The minute you take a photo or act suspiciously it will be noticed.
  • Rarely will you have the opportunity to work as a team. This will make surveillance significantly harder, but in practice it’s preferable, because a group of foreigners will stand out even more than a single foreigner.
  • You may not have a good trusted local network. This will make it difficult to get support for specific aspects of the task.
  • Your target may know you. As mentioned above, you could be surveilling a contact as part of efforts to verify their bona fides. Coupled with the point above that you will stand out, this will make you vulnerable to detection.
  • You are unlikely to have access to the tools you would normally use for surveillance. You won’t be able to use radios (if you’re operating alone, this isn’t an issue) and it will be difficult to find opportunities to use imaging equipment. You’ll also be restricted regarding the types of imaging equipment you can use.
  • You will be unfamiliar with your operating environment. By not knowing the ground, you won’t know which areas are safe and which aren’t. It will be difficult to remain orientated, and it will be easy to get yourself into trouble.

There’s a lot working against you here. You’re a foreigner, working alone, with minimal local support, and potentially against a target who will recognise you if they see you.

You will need to be very circumspect regarding what’s going to be achievable. This may require a considerable lowering of your expectations compared to what you may be used to.

Area familiarisation

One of the aspects of surveillance that doesn’t change when operating overseas is that it will benefit you considerably to have a high level of familiarity of your operating environment. Specifically to surveillance, this extends beyond just knowing where you are. You also need to build a sense of what’s normal and what’s not normal on the street. This not only assists with your surveillance efforts, but also protects you against potential threats — you don’t want to unknowingly follow your target into a dangerous part of town.

An important aspect of area familiarisation is that while you’re getting used to the area, the area is getting used to you. You need to strike a fine balance here — you want people to be sufficiently used to your presence that they ignore you, but not so used to you that they start getting inquisitive or start learning things about you.

In many places as a foreigner you’ll stand out. This makes your work significantly more difficult.

Establishing a viable cover story

You will need a cover story or pretext for your assignment in case you are confronted during your surveillance. When designing your cover story, one thing to consider is who your cover story is designed for. Is it designed for the immigration officer when you’re entering the country? Or is it designed for the police officer that stops you on the street and asks you why you’re taking photos. It may even be for the target (who you may know), when they ask you why you were following them.

In practice, you may find that it will serve you to have multiple cover stories, designed for the context you are operating in at the time. Provided of course that there’s no opportunity for any of these people to exchange notes. Your cover stories will need to be layered to provide a rationale for being in the country, in the city, in the neighbourhood, and in that street at 10pm with a camera in your hand.

This is another advantage of operating alone. If you’re coordinating with a team, there’s a larger surface area for someone to detect your operation. If a team member is apprehended and questioned, it’s significantly more difficult to coordinate a viable cover story.

Whatever cover story you choose, it will need to be airtight. As a foreign national, you can’t expect to be given much latitude.

At each stage of your operation, you’ll need to have a valid reason for being in the area you are in, doing what you are doing, and carrying the equipment you are carrying. This doesn’t need to be an elaborately back-stopped cover — just sufficiently plausible to enable you to continue with your work.

If you’re relying on using traditional camera gear to support your surveillance, you’ll need to be very careful regarding your selection of equipment. In the era of great cameras on your phone it’s fairly unusual to see people moving about with DSLR cameras and long telephoto lenses. If you’re carrying such equipment, you’ll need to have a very good reason for doing it.

Where possible, rely on an iPhone in the streets and only pull out the more serious gear if you’re working from a covered observation post. In such cases you can carry the gear in a daypack then set it up once you’re in the post. The gear itself should be innocuous (no DSLR or obviously long telephoto lenses), so it can potentially be explained away provided you’re able to manage the media.

When you think about the gear you’re taking in, imagine a scenario where you’re in the back room of a police station and they’ve stripped your gear down and have it all laid out neatly on a table. What type of traveller carries all this kit? Who do you look like now?

Using local assets

Surveillance operations are not impossible to do alone, but it’s certainly more difficult. When you’re planning your operation, you should consider the requirement to engage local assets to assist you in aspects of your surveillance.

These individuals could have a number of roles:

  • Part of your surveillance team
  • Fixer or facilitator
  • Driver
  • Counter surveillance
  • Spotter

Unless you have trusted staff available to you in the country, hiring individuals for these roles is obviously problematic.

You’ll need to vet your local assets very carefully. You will want to avoid is them sharing information of your work with their friends and family, or even with the authorities.

Some year ago I used local assets to assist in offshore penetration testing that involved surveillance and the eventual access of a facility. This involved forging identification, making company uniforms, and reconnaissance and surveillance over several weeks. The local asset also acted as a spotter when I breached the facility. Interestingly, at no time did they ask for any proof that this was a legitimate task.

You can reduce your risk exposure by only hiring one or two local assets. You can also managing your exposure by having local assets operating independently of each other (each does not know of the involvement of the other). This will also allow you to provide each them with a different cover story. When planning cover stories, fast forward and visualise what they may say if picked up and interrogated by the police or intelligence services. Simple is good.

Using local assets introduces a lot of risks to your operation but, depending on your task, may be essential.

Static surveillance

Observation posts are one of the simpler aspects of surveillance to execute in your home country. In most cases the only threat is extreme boredom. When in another country, they are significantly more difficult to plan and maintain.

Urban observation posts

If you’re operating in an urban environment, you’ll be very constrained in where you can set up an observation post for extended periods. It will be difficult to find an optimal location, and it will be difficult to remain there for long periods of time without attracting some form of attention. You can’t just knock on someone’s door and ask to set up next to their living room window, and you can’t sit in a street cafe for hours on end. Not only that, but using any kind of photography equipment will be nearly impossible.

The best you can hope for is an abandoned building overlooking your target, but even then you may find yourself dealing with local people and street kids living inside, as well as the occasional pack of wild dogs.

In practice, you’ll need to temper your expectations regarding what can be achieved through static surveillance in an urban environment. If your objective is to see who your target meets at a restaurant, you may have to be happy with a couple of photos taken at the start of the meeting, and then leave the area. You could miss who comes along later, but at least you’ve managed to collect some information without unnecessarily exposing yourself.

Rural observation posts

The other other type of observation post you may find yourself setting up is more old fashioned — concealed in a thicket with imaging equipment observing a target. This will require the application of more traditional skills, such as infiltration and camouflage and concealment.

An example of a situation where you may establish a rural OP is to surveil a facility in a remote area. This may be part of a due diligence investigation or a competitive intelligence project. If you are conducting a penetration test, surveillance will be a key aspect of identifying facility security measures, particularly patrols and other routines.

There are huge risks with operating an observation post in a rural area. If you’re detected and apprehended, it’s something that can’t really be explained away. The operation needs to be planned in detail with a good level of knowledge of local activities and routines.

Locals will be able to identify when a blade of grass is out of place. The worst case scenario is a situation where locals spot you but don’t approach you, and then call the authorities. The authorities will have time to mobilise and plan an interception, and it’s unlikely you’ll be able to get out.

The key therefore is not to be detected by locals. To do this, make sure you’re well away from local paths and footpads. Do some anti-tracking as you approach your post to ensure your tracks aren’t detected and followed.

Camouflage will be essential during the day, but it’s not particularly deniable, so you’ll need to be careful regarding what you wear and what you carry. Similarly, if operating at night you’ll need excellent light and sound discipline if you want to avoid detection.

You’ll need reliable imaging equipment for a rural observation post, but again you’ll need to be highly selective in the equipment you choose. Binoculars, spotter scopes, and night vision gear will be useful, but can’t be explained away. If such equipment is essential for the task, make sure that you can get it to and from your selected post without any risk of compromise. Also ensure that you are able to rapidly conceal the gear if you are likely to be compromised while in the post itself.

When you’re planning a long-term observation post, don’t forget the basics. Think about how you’ll rest, eat, and go to the toilet. Also consider where you’ll leave your vehicle. You may choose to have a trusted local asset drop you off somewhere nearby and collect you again when your work is finished.

Have plans in place for a range of contingencies. If you have a local asset supporting you, you could establish an emergency rendezvous with them where they can pick you up if compromised.

Making use of technology

Technology can certainly make static surveillance easier, but you need to selectively apply technology to the task at hand.

In situations where establishing an observation post is impossible, I’ve made do with remote video units that I’ve placed and then recovered later. These have been disguised as pieces of trash or camouflaged to fit in with grass and shrubbery. Where I place a device like this I will normally sit off a safe distance so that I’m able to observe the device. If the device is discovered, I want to know who discovered it. If it’s a random person on the street, I’m less concerned. If the target or someone in their security team discovers it, that could compromise the operation.

Where these devices have been useful have been to collect data on vehicles entering or leaving a facility over a period of time. You don’t need to be sitting there physically doing this — the remote video unit will do a much better job.

If you are placing remote equipment, rehearse the process to make sure you get the setup right. You may only get one shot at placement, and the camera must be positioned correctly and properly concealed. Make sure you have reliable line of sight to your target. Consider where people might stand, where vehicles may park, and what the wind may carry into the frame (particularly if the camera is mounted low). You’ll need to have a cover story for being in the area to place and collect your device.

Collecting the device will be the most vulnerable part of the plan, particularly if the device has been detected and is being monitored to see who comes to collect it. Remember you don’t need to collect the device immediately. Provided it’s well concealed, you could collect the device a few days later. You could even send in a local asset to collect it (provided you fully trust them and have a good cover story in place).

I’m yet to use drones on a project, however there’s clearly an application for these for surveillance, particularly in remote areas. A scenario where they may be useful is to gather information on a facility in a rural area where you’re not able to approach on foot.

Drones can be noisy, but are getting quieter. The DJI Mavic Platinum, for example, uses a new propellor design that reduces noise to around 70 decibels. That’s not too loud provided there’s background noise. Even then, I’d only consider using them at night.

If considering using drones, remember that you’re not operating in your own country, and the laws and norms will be different. Drones may not be widely used, so the use of a drone may be highly conspicuous. As with your other equipment, you will also need to consider how you’ll explain the fact that you’re carrying around a drone.

If you’re targeting a facility, an option that I’ve found effective is to do a single pass in a vehicle with a high resolution video camera at a high frame rate. Once you return to your accommodation you can go through the video frame by frame to identify key details of the facility. A single pass reduces your exposure. Make sure you have a cover story for why you are in the area and why you are driving past the facility in case you are stopped at a checkpoint. Ensure that the camera gear you use is innocuous and can easily be mounted and dismounted. Once you’ve captured the footage, be sure to swap out your storage.

Foot surveillance

As with observation posts, foot surveillance when overseas is an entirely different ballgame. As a foreigner you’ll stand out, and your operation won’t survive more than a few instances where you’re spotted, particularly if your target is surveillance aware.

Probably the only advantage you will have is that your target may not expect to be under surveillance by a foreigner.

Once piece of good news is that if you’re operating alone you won’t need any radio gear. That’s one less thing to try to explain to the local constabulary. Even if operating with a small local team, be very cautious about the use of radio gear. You’re better off not using any at all, and relying on well-practiced procedures and the occasional mobile phone call to make adjustments.

You’re better off avoiding using radio equipment when conducting foot surveillance.

If you’ve trained up a local asset to assist you with your surveillance, you can use them to go into buildings the target has entered (where required). If you follow the target into buildings yourself, there will be a high probability of compromise, or at least being noticed.

Maintaining orientation

When you’re following your target, you will need to know where you are, and what areas you’re being led into. You’ll need to be able to recognise changes to your own risk exposure, and be prepared to pull back where necessary.

It will be difficult to check maps and maintain orientation while at the same time ensuring you don’t lose the target and don’t get dragged through a counter-surveillance choke point. This is why time spent doing comprehensive area familiarisation is so important. You should know every inch of the ground.


As much as possible, reduce the number of photos you take during foot surveillance. Each time you take a photo you’re increasing your signature. A foreigner walking along the street is one thing. A foreigner walking along the street regularly taking photos is something different altogether.

Be patient

Foot surveillance in an offshore location will require a significant amount of patience. Expect to repeatedly lose your target. Take a longer-term approach.

Mobile surveillance

Surveilling a target that’s moving by vehicle is far more difficult offshore than it is at home. You probably won’t be driving yourself, and you can’t just jump into a local taxi or Careem and ask the driver to “follow that car”. It doesn’t work that way.

If you need to conduct surveil a target in a vehicle, you will need a vetted and trusted local asset as a driver. You’ll need to provide them with training so that they’re able to make decisions on the fly without you having to continually prompt them.

If you’re operating with a single vehicle only, you won’t have the opportunity to rotate vehicles. If your target or their team is surveillance aware, there’s a high likelihood you’ll either be compromised or you’ll lose the target because you’ve had to sit back too far.

Satellite tracking

Another option is to use place a GPS tracking device on the target’s vehicle. This will allow you to monitor the vehicle’s location, however if the device is discovered it may make the target increase their level of surveillance awareness. They may even report the device to the authorities. The device must be deniable (untraceable back to you) and the operation to plant it and remove it must be watertight. This could be a task for a trusted local asset who’s able to get close to the target’s vehicle.

Managing media

If you’re apprehended with a device full of surveillance photos or video, that could result in you getting into serious trouble. You need to be able to get rid of any suspicious media and be able to show completely innocuous photos or video. Remember, the camera can’t be empty if you’re carrying it around, and you can’t just pop the SD card out and throw it behind a bush — that will also be suspicious.

Switching out media quickly is difficult in most devices. If your camera allows for it, one technique is to have an SD card in your device that has innocuous imagery that aligns with your cover story. In addition to this SD card, have a small SDD attached to your camera for still and video that you can quickly rip off the camera and conceal somewhere for later collection. You can apply matte tape to the SSD to make it harder to notice. You also want to ensure that if someone does happen to find the SSD before you’re able to recover it, the media is not accessible.

If you’re relying on your phone as a camera, another option is to continually take photos of other things around your target. If there is a pattern of innocuous photos, and you have a solid reason for being there, you should be able to convince whoever confronts you that you haven’t been up to any mischief. I adopted this approach on one assignment. After taking a bunch of photos of a facility (not a government facility) I was stopped by armed military personnel, who demanded to view my photos. I was able to take them through my morning of sightseeing with lots of photos of other buildings, which merged fairly seamlessly into the photos of the target facility. The soldiers demanded that I delete the photos I took of the facility. I apologised and deleted the photos immediately, making a point to show them as I did it. The good new is that the iOS Photos app allows you to recover photos. I was able to delete all the photos they wanted me to, knowing I could recover them later. A key point here is that I had taken these photos overtly with full knowledge I’d be stopped. Given how exposed I was this was preferable to attempting to try to take the photos covertly and being caught out.

Recording data and reporting

For static surveillance, recording data will be similar to what you’re used to. You’ll maintain a log, and you may have time stamped photos as well to support your task. Instead of a hand written log, it’s preferable to maintain a digital log by recording details on your phone. You can use a secure notes application. Using a locked note in the iOS Notes application is a pretty reasonable solution. I sometimes record voice memos, which are also time stamped. Whatever option you choose, I recommend that you periodically save the log to a remote server just in case you lose your phone (iOS notes syncs automatically).

For foot surveillance you’re always going to be up front. It’s going to be nearly impossible for you to take notes, so you’ll need to rely on memory and the occasional photo. One option is to take photos at key checkpoints along a route, providing a time and location stamped record of your movement.

Counter surveillance

If you’re planning to conduct surveillance in an offshore location, it’s critical that you conduct your own counter surveillance. This is significantly beyond the scope of this article, but suffice to say if you fail to do it properly, you could find yourself compromised fairly quickly.

In some locations foreigners are routinely placed under surveillance, often just out of curiosity regarding who you are and what you’re up to. Be aware of this as you work through your planning.

Electronic security should also be a major consideration. Again, well beyond the scope of this article, but you’ll need to be very careful regarding what you carry with you and how you use it.

Final thoughts

Conducting surveillance offshore is a high risk operation. You’ll be faced with a significant number of constraints that will reduce your effectiveness and may force you to adjust your objectives or expectations.

There are also significant risks involved, particularly if your operation is compromised by local law enforcement.

Plan your work carefully, and work through all possible contingencies. Spend as much time as you’re able to conducting area familiarisation, and ensure that your cover stories or pretexts are well developed and tailored for different contexts. You need to be completely confident that, if stopped, you’ll be able to talk your way out of it.

Good luck. You’ll probably need it!

Grant Rayner is the founder of Spartan9. His work primarily involves supporting clients to navigate complex and higher-risk environments, amongst other things.




Advanced techniques for successfully and safely operating in complex and higher-risk environments.

Recommended from Medium

Network Packet Sniffer on Various Network Protocols working on both saved pcap file or on Live…

Our New White Paper: Achieving Transformation At Scale

{UPDATE} Let it Goat Hack Free Resources Generator

Ethereum-Push-Notification-Service (EPNS)

How To Spot A Scam Website

Security Testing Tools

Up To 1,500 Businesses Could Be Affected By Latest Ransomware Scheme

Get the Medium app

A button that says 'Download on the App Store', and if clicked it will lead you to the iOS App store
A button that says 'Get it on, Google Play', and if clicked it will lead you to the Google Play store
Grant Rayner

Grant Rayner

Founder, Spartan9.

More from Medium

Piecing Together the Profiles of Two NIST Chemists Taken Too Soon

Unbabelvision: what our team love about the annual musical extravaganza

Buffy, Supernatural & Charmed: how to end a long-running genre tv show

Celebrating Armenian History Month in Los Angeles, California