Surveillance & Counter-Surveillance Fundamentals

GACS Protective Intelligence Series. A defensive, protective course in situational awareness, behavioral pattern recognition, surveillance indicator detection, counter-surveillance theory, and protective intelligence — drawn from publicly available CIA-style tradecraft, adapted for civilian self-protection.

Module 1 — Foundations of Surveillance

Surveillance is the structured observation of a person, place, or activity over time to gather information. In a criminal context, it precedes targeting, fraud, stalking, kidnapping, robbery, and predatory approach. CIA protective doctrine teaches that almost every hostile act has a surveillance phase — and that phase is where threats are most detectable.

Who uses surveillance

• Law enforcement and intelligence agencies (lawful, regulated, oversight-bound).
• Corporate and physical security teams (lawful, contracted).
• Criminals and fraud crews (unlawful — gathering exploitable patterns).
• Stalkers, predators and harassment actors (unlawful — building approach plans).

Baseline vs anomaly

Baseline is what is normal for an environment at a given time of day. Anomaly is what stands out from that baseline. Protective intelligence analysts do not try to read minds — they read deviations from baseline. Your job as a civilian is the same: learn what 'normal' looks like at your home, your office, your gym, your commute — and notice what doesn't fit.

• Repeated presence of the same person or vehicle across different days.
• Lingering without a normal purpose (no shopping, no phone task, no conversation).
• Apparent interest in entrances, exits, cameras, or security staff.
• Repeated eye contact, or observation from changing positions around you.

Module 2 — Types of Surveillance

Static surveillance

An observer holding a fixed position with a clear view of a target — a parked car facing a building, a person at a café window, an apparent maintenance worker. Indicators: long duration, no logical reason to be there, repeated presence across days, and adjusting posture/position whenever the target moves.

Mobile surveillance (high-level only)

Following a person or vehicle along a route. At a defensive level you don't need to identify formations — you only need to notice the same person or vehicle reappearing at multiple unrelated decision points (a turn you took, a store you entered, a route change you made).

Digital surveillance

Mapping your life through public social media: routines, gym times, school pickups, travel plans, license plates visible in photos, geotagged check-ins. Modern criminal crews build target packages almost entirely from open sources before any physical surveillance begins.

Social engineering surveillance

Friendly but probing conversation designed to fill gaps in a target package — where you live, when you're home alone, who has keys, when you travel, what your security looks like. The marker is that questions consistently drift toward access, routines, and absence.

Pre-attack cycle (high-level)

• Target selection.
• Information gathering (digital + physical).
• Surveillance and rehearsal — testing your reactions and boundaries.
• Final approach.

Module 3 — Behavioral Pattern Recognition

Behavior is meaningful only in context. Photographing a landmark from a tourist lookout is normal; photographing a secure entrance at shift change is not. CIA protective intelligence training emphasises clusters: a single indicator may be innocent, but several indicators stacking together raise concern.

Useful behavioral cues

• Repeated glances at you, your group, or your vehicle.
• Unusual focus on entrances, exits, cameras, guards, or escape routes.
• Apparent waiting with no normal waiting activity (no phone task, no book, no conversation).
• Reactive behavior — adjusting position, pace, or attention whenever you move.

Intuition

A trained gut feeling is data. It often catches a cluster before the conscious mind names it. Treat it as a prompt to elevate awareness and verify — not as paranoia, and not as proof.

Module 4 — Counter-Surveillance Theory (Defensive Only)

Civilian counter-surveillance is awareness plus safe response. It is NOT about confronting suspects, 'outsmarting' surveillants, or evading lawful authorities. It is about confirming a pattern over time and getting yourself to safety.

Pattern confirmation across time and place

One sighting is noise. Same person or vehicle in two unrelated locations is a data point. Same person or vehicle across three unrelated locations, with no plausible reason, is a pattern that warrants documentation and a safety response.

Safe responses

• Move to well-lit, populated areas — stores, hotel lobbies, banks.
• Drive to a police station, fire station, or hospital entrance.
• Call a trusted contact and stay on the line.
• Document time, place, description and behavior in writing.
• Report to authorities when a pattern is established.

What NOT to do

• Do not confront suspected surveillants.
• Do not 'test' them by leading them to isolated places.
• Do not livestream or publicly accuse — that escalates and contaminates evidence.

Module 5 — Protective Intelligence

Protective intelligence is the discipline of identifying, assessing and reducing threats before they reach attack. It is the doctrine the CIA and Secret Service use to protect principals — and the same logic scales down to personal safety.

Pre-incident indicators

• Unwanted contact that does not stop after a clear 'no'.
• Escalating attempts to learn your address, schedule, or travel plans.
• Repeated 'coincidental' encounters across different parts of your life.
• Online harassment, doxxing, or threats — especially when they reference real-world detail.

Personal risk picture

• Who, realistically, might want to target you — ex-partner, scam crew, disgruntled party, public profile risk?
• What about you is already public — address, license plate, employer, daily route?
• Which of your routines are most predictable and most exposed?
• What can be made less predictable, less visible, or less reachable?

Safety plan basics

• Two trusted people you will call if you feel unsafe.
• Two 'safe destinations' on routes you travel often.
• A documentation habit — time-stamped notes with photos when safe.
• A clear threshold for involving police.

Module 6 — Ethical & Legal Boundaries

These skills are protective. Misused, they become stalking, harassment, or unlawful surveillance — which are crimes in most jurisdictions. The ethical line is simple: use awareness to protect yourself and the people around you. Do not use it to target, monitor, intimidate, or follow others.

Generally lawful

• Being aware of your surroundings.
• Noting and documenting suspicious behavior directed at you.
• Protecting your own safety and that of your dependents.
• Reporting concerns to lawful authorities.

Generally unlawful

• Surveilling another person without lawful authority.
• Recording people in private spaces without consent.
• Harassing, threatening, or confronting suspected surveillants.
• Attempting to evade lawful investigations.

Curriculum sources & doctrine

This course is adapted for civilian self-protection from publicly available defensive doctrine. Nothing in this curriculum is classified, restricted, or sourced from non-public material. All offensive surveillance tradecraft is intentionally excluded.

• U.S. Secret Service & U.S. Dept. of Homeland Security — public protective-intelligence guidance, Threat Assessment Center reports.
• FBI Behavioral Analysis Unit — published pre-attack indicator research and stalking-behavior advisories.
• CIA — public protective doctrine summaries on surveillance detection and protective intelligence cycles (open-source material only).
• U.S. State Department — Overseas Security Advisory Council (OSAC) personal-security briefings.
• Academic literature on situational awareness (Cooper Color Code, Boyd OODA loop) and pre-incident indicators (Gavin de Becker, 'The Gift of Fear').

Before you begin the exam

• 60 multiple-choice questions, scenario-based — order is randomized per attempt.
• Pass mark 42/60 (70%). Merit 51/60 (85%). Master 57/60 (95%).
• Single best answer — one option per question.
• Your diploma is auto-issued to your account name when you pass.