SCS Field Manual — Surveillance & Counter-Surveillance Fundamentals

1. 1

   Protective-Intelligence Doctrine & The Threat Model

   Establishes what surveillance is, why criminals and state actors invest in it, and the defensive mindset that makes detection possible. Doctrine first — every later chapter assumes it.

   What Surveillance Is — And Is Not

   Surveillance is the deliberate observation of a person, place, vehicle, or activity over time, by a hostile party, in order to build a pattern of life sufficient to act on. The two operative words are 'deliberate' and 'over time'. A neighbour glancing out a window is not surveillance. A vehicle parked on your block on three separate evenings with a driver who exits only when you leave the building, is. Surveillance is not paranoia; it is a behaviour with observable preconditions, observable activity, and observable post-conditions. The defender's job is not to feel watched — it is to detect the signature.

   Why Hostiles Surveil — The Attacker's Cycle

   Every targeted physical attack, kidnapping, robbery, stalking, doxx, hit, or sophisticated fraud is preceded by surveillance. The attacker cycle is: target selection → pre-operational surveillance (also called 'casing') → planning → rehearsal → execution → escape → exploitation. Pre-operational surveillance exists to answer specific questions: When is the target alone? Where are the choke points? What does the protective detail look like? What is the predictable daily pattern? Detection during the surveillance phase is the cheapest possible disruption — once execution begins, the defender's options collapse to seconds.

   The Target's Pattern of Life

   A 'pattern of life' is the routine that an outsider could reconstruct after watching you for two weeks: when you wake, what door you use, which gym, which coffee shop, who picks the children up, which days you travel, which routes you favour, which phone you carry, which car you take. Hostiles do not need to be near you for most of this — open-source posts, food delivery receipts, fitness-app routes, parking apps, and dating-app last-seen times leak it. Defensive doctrine asks two questions every week: 'What in my pattern is exploitable?' and 'What in my pattern can I vary without losing my life?' The answer is rarely 'change everything' — it is usually 'vary the variable nodes (time, route, door) and harden the fixed nodes (home, car, child pickup).'

   The Defender's Mindset — Condition Yellow

   Jeff Cooper's colour code remains the simplest framing. White = unaware, oblivious. Yellow = relaxed alertness, baseline known, eyes up. Orange = a specific anomaly has flagged, attention is now directed. Red = a threat indicator is confirmed and you are acting. Black = under attack, fight-or-flight engaged with no plan. The professional spends their public life in Yellow. The amateur spends it in White and is forced to jump to Red without the intermediate steps. Yellow is not exhausting once it becomes habit — it is the absence of the phone-down, head-down posture that marks the soft target.

   Risk = Threat × Vulnerability × Consequence

   Protective intelligence is not equal-opportunity paranoia. The defender allocates attention proportional to risk, and risk is a product, not a sum. Threat is the existence and capability of an adversary willing to act against you. Vulnerability is the openings in your pattern, posture and environment. Consequence is what is lost if the threat connects. A C-level executive with a public stance on a controversial industry, who walks the same route at the same time daily, whose home address is in property records, faces a different risk than the same person whose driver varies the route and whose home is registered to an LLC. Lower any of the three multipliers and the product drops.

   Ethics & Legality of Defensive Tradecraft

   This manual teaches defensive surveillance detection and counter-surveillance — observing your own environment, varying your own behaviour, hardening your own posture. It does not teach offensive surveillance of third parties, GPS tagging of vehicles you do not own, accessing accounts without authority, or pretexting law enforcement. The line is sharp: collecting on yourself and your environment is defensive; collecting on a private third party without legal authority is surveillance, and in many jurisdictions criminal. Maintain a written ethics policy and a logged decision trail for any grey-zone choice. Defensive credibility evaporates the moment the defender becomes the surveillor.

2. 2

   Baseline, Anomaly & Reading the Environment

   Detection rests on a single skill: reading what is normal for a place, then noticing what is not. This chapter turns that intuition into a repeatable practice.

   Establishing a Baseline

   A baseline is the answer to the question 'What does normal look like here, right now?' It is environment-specific (a quiet residential street at 06:30, an airport curb at peak departure, a hotel lobby at check-in time), and it is time-specific (the same street at 23:00 has a different baseline). The defender builds a baseline by scanning four channels on entry to any space: people (number, posture, attention direction, grouping), kinetics (movement vectors, pace, congestion), sound (volume, content, anomalies of silence), and objects (vehicles parked, bags unattended, doors propped). A baseline is built in seconds and updated continuously. You cannot detect an anomaly against a baseline you never established.

   Anomalies — The Things That Do Not Fit

   An anomaly is anything that breaks the baseline in a way the environment does not explain. Anomalies come in two flavours: presence anomalies (something is here that should not be — a parked vehicle with engine running and no driver activity, a person in business attire in a beach café at 07:00) and absence anomalies (something is missing that should be present — the always-loud neighbour's apartment is silent, the regular doorman is replaced by a stranger). Most defenders are trained on presence anomalies and miss absence anomalies entirely. A professional surveillance team is good at blending presence; they are very bad at preventing absence anomalies in their wake.

   Behavioural Indicators of Surveillance

   Hostile observers exhibit a recognisable behavioural signature because their attention is locked on a target rather than on their cover activity. Indicators: eyes that track you and snap away when you look, a phone or newspaper held up but never read, a coffee that never gets drunk, a meal ordered but barely touched, lingering at a location with no purpose, repeated entry/exit from the same vehicle, talking into a wrist or collar, communicating in short bursts on a phone with no conversational rhythm, occupying a vantage point with the back to the wall and the eyes on the door. Any single indicator is noise. Three indicators on one person, or one indicator across multiple people in apparent coordination, is signal.

   The Three-Sighting Rule

   A foundational counter-surveillance heuristic: the same person, vehicle or signature observed at three different times and places, where the only common factor is you, is operating against you until proven otherwise. The rule is not about coincidence — it is about probability. Two sightings can be coincidence. Three sightings, geographically separated, time-separated, with no innocent explanation, are vanishingly unlikely without targeting. Document each sighting (time, place, description, photo if safe and lawful) before invoking the rule; the defender's worst failure mode is acting on a remembered sense of repetition that turns out to be three different people who shared a jacket colour.

   Dress, Vehicle & Communication Signatures

   Surveillance teams hide behind ordinariness, but ordinariness has cost: they cannot constantly change wardrobe, vehicles, or comms. So they recycle. The defender notes signatures that persist across sightings even when the person changes: the same shoes under different trousers, the same bag with a different jacket, the same vehicle with a different licence plate cover, the same earpiece in a different ear. Vehicle signatures are particularly stable — even when the colour, plate or driver changes, the wheel rims, dash-mounted devices, antenna pattern, dent location, and tint quality usually do not. Photograph anomalies. Compare. Patterns emerge in the comparison, not in the memory.

   Environmental Sense-Making — Cover-for-Status & Cover-for-Action

   Surveillance operators rely on two covers: cover-for-status (the plausible reason to be in this place — tourist, jogger, delivery driver, contractor) and cover-for-action (the plausible reason to be doing this specific thing — taking a photo, lingering, walking slowly, sitting on a bench). The defender attacks the seams between them. The 'jogger' (cover-for-status) who never gets winded, never sweats, runs the same 50-metre loop, and stops when you stop (broken cover-for-action) has a credible status but no credible action. Mismatched cover is the most common analytic tell, and the cheapest to detect once you train the eye.

3. 3

   The Surveillance Lifecycle & Operator Roles

   Detection improves dramatically once the defender understands how a surveillance operation is actually structured. This chapter walks the lifecycle from tasking to wash-up.

   Tasking, Planning & Rehearsal

   Professional surveillance begins long before the defender sees anyone. The team receives a tasking that defines the target, the intelligence requirement, the box (the geographic area of interest), the operational tempo, the duration, and the OPSEC constraints. They rehearse: drive the routes, walk the choke points, photograph the box, establish trigger points (locations where the target's presence kicks off coverage), and pre-position vehicles and operators. The defender will not see this phase directly, but will see its artifacts: a vehicle parked at a vantage point days before, a 'contractor' photographing your street, a 'delivery' that knocks on the wrong unit but maps the entry layout.

   Static Surveillance

   Static (or 'fixed') surveillance posts a team at locations the target must pass — the home, the office, a habitual café, a school gate. Static is high-coverage but low-flexibility; it is the easiest type to detect because the cover-for-action problem is severe (why is this person in this place for this long?). Indicators: vehicles parked with line-of-sight to entry/exit, occupants who stay in the vehicle, foggy or wiped clear viewing area on a tinted window, repeated arrivals at shift change times (typically 8-hour rotations), discarded coffee cups or food wrappers consistent with multi-hour occupation, parking choice that prioritises vantage over convenience.

   Mobile Surveillance — Foot, Vehicle, Mixed

   Mobile coverage moves with the target. Foot teams use the ABC drill (one operator close behind, one on the opposite pavement, one further back) and rotate roles at intersections. Vehicle teams use a 'floating box' — a lead vehicle ahead of the target, a control vehicle behind, and command vehicles on parallel streets — passing the target between them at junctions so no single car is visible for long. Mixed surveillance hands the target from vehicle to foot at choke points (transit stations, parking garages, hotel lobbies). The defender's job is not to identify which vehicle is which role; it is to notice that the same vehicles keep reappearing in the same order around them.

   Technical Surveillance

   Technical surveillance supplements human coverage with persistent collection: GPS trackers on vehicles, cellular IMSI-catchers, drive-by Wi-Fi sniffers, drone overflight, fixed cameras on lamp posts, doorbell-camera compromise, and acoustic devices. The defender controls what they can: garage parking instead of street, weekly visual sweep of wheel wells and bumpers for unfamiliar magnetic devices, Faraday pouches for sensitive devices in transit, encrypted messaging by default, RF detection during sensitive meetings, and a 'clean device' policy for travel into elevated-threat environments. Most importantly, the defender does not type sensitive plans inside the home or vehicle assumed to be uncompromised — they assume compromise and design around it.

   Hand-Offs, Wash-Ups & The 'Last-Light' Tell

   Every surveillance shift ends with a hand-off (the next team taking over) and a wash-up (the team de-briefing back at a base). Hand-offs produce a detectable signature: two vehicles meeting at a quiet location, one departing immediately after, an unusual concentration of foot operators at a transit junction at a predictable shift-change hour. The 'last-light tell' is the operator who, having just had the target handed off, can be seen exhaling and dropping their cover posture — phone down, shoulders relaxed, lighting a cigarette, walking with no further purpose. Once you have seen this once you will not unsee it.

   Hostile vs. State vs. Investigative Surveillance

   Not all surveillance is the same threat. Hostile criminal surveillance (robbery, kidnap, assault) intends to act against the target and is the most dangerous to ignore. State surveillance (intelligence, security services) is typically information-gathering and rarely culminates in physical harm in the operator's own jurisdiction; the appropriate response is OPSEC, not confrontation. Investigative surveillance (private investigator hired by an opposing counsel, a journalist, an insurer) is information-only and generally legal. The defender's response scales with intent: deny information always; alter pattern when targeted; involve law enforcement when intent shifts toward action.

4. 4

   Detection — Single, Multiple & Vehicular Coverage

   How to convert suspicion into evidence using deliberate provocations that force the surveillance signature out of cover, without escalating.

   Passive Detection

   Passive detection is observation without provocation: walking, driving, sitting, transacting normally while running the baseline / anomaly / three-sighting loop. It is the default mode. Passive detection is sufficient for low-skill surveillance and for confirming the presence of coverage you already suspect. It is insufficient against professional teams because the team rotates operators specifically to defeat single-operator memory. Move to active detection only when (a) you have probable signal, (b) you have a reason to confirm, and (c) you can do so without alerting the team that you are aware.

   Active Detection — Surveillance Detection Routes (SDR)

   A surveillance detection route is a pre-planned movement designed to force the coverage team to reveal itself by following a path that is unnatural to anyone with an innocent reason for being there. A good SDR includes: a choke point with a single ingress and a single egress (a one-way street, a footbridge, a single hotel-lobby door), a reverse (turning back the way you came at a point that has no destination behind it), a long line-of-sight segment (so anyone following must remain visible), a hand-off opportunity (a transit station — observe who exits with you), and an obvious end point with no follow-on reason to be there. SDRs are run on the way to non-sensitive destinations precisely so that running one is itself unremarkable.

   Detection in Multiple Coverage

   Against a floating-box vehicle team or a multi-operator foot team, no single operator stays visible long enough for the three-sighting rule to fire on one face. The defender therefore shifts to detecting the team rather than the individual: the same three vehicles keep cycling through the box around you, even though no single vehicle is behind you for long; foot operators appear at every choke point even though the faces change; communications signatures (an earpiece, a wrist-microphone touch, the brief radio-check head-tilt) recur across different people. Multiple coverage detection is a pattern-of-patterns problem and rewards photographic documentation over memory.

   Vehicular Counter-Surveillance Drills

   Driving drills that surface coverage without escalating: take three consecutive right turns (forming a square — any vehicle behind you for all four sides is interested); enter and exit a roundabout twice; pull into a parking lot, observe what enters behind you, and exit by a different lane; drop speed on a clear road and observe who matches; take an off-ramp and immediately re-enter the highway; pull into a service station, do not refuel, observe what enters and stays. None of these are evasive driving — they are observational driving. Evasive driving is a last-resort skill taught in a closed environment; observational driving is the discipline used every day.

   Counter-Surveillance vs. Anti-Surveillance

   The terms are often confused and the distinction matters. Counter-surveillance is the act of detecting whether you are under surveillance. Anti-surveillance is the act of defeating or evading surveillance once detected — losing the team, breaking the box, denying them the next observation. The amateur jumps to anti-surveillance the moment they feel watched and immediately alerts the team to their awareness. The professional confirms with counter-surveillance first, documents quietly, decides whether the operational benefit of losing the team outweighs the OPSEC cost of revealing awareness, and then either continues normal pattern (deny intelligence) or executes anti-surveillance at a moment of their choosing (deny continuity).

   The Cardinal Rule: Do Not Confront

   Confronting a suspected operator — photographing them aggressively, approaching them, asking 'why are you following me?' — is the single most common mistake the alerted defender makes. It achieves nothing useful: a professional will deny and disappear, an amateur will lie and stay, and a hostile actor with intent to act may now accelerate the timeline. The correct response sequence is observe → document → report → adjust pattern → involve protective services or law enforcement as appropriate. Confrontation forfeits the defender's single most valuable asset: the operator's belief that they remain unobserved.

5. 5

   OPSEC, Digital Pattern-of-Life & The Soft Target Problem

   Most modern targeting begins online and ends in physical reach. This chapter closes the open-source attack surface the defender controls.

   The Targeting Funnel Begins Online

   For ninety percent of contemporary targets — executives, journalists, prosecutors, victims of fraud, family members of public figures — the surveillance operation begins not with a parked car but with a name typed into a search bar. The funnel runs: name → email → social profiles → home address (property records, voter rolls, court filings, leaked databases) → daily route (geo-tagged photos, fitness apps, food delivery reviews, parking apps) → schedule (LinkedIn calendar, Eventbrite tickets, conference speaker lists) → relationships (tagged photos, family posts, school district mentions). By the time anyone parks on your street, they already know your front door, your dog's name, your child's school and your departure time. Defending the front door alone is too late.

   Personal OPSEC Doctrine

   OPSEC is the deliberate suppression of indicators an adversary would correlate to your pattern of life. Practical doctrine: register the home in a trust or LLC where lawful; use a UPS or attorney mailbox for all paper mail; opt out of data-broker sites quarterly using a structured removal list (Spokeo, BeenVerified, Whitepages, Radaris, PeopleFinder, Intelius, and the dozen aggregators downstream); separate professional and personal handles fully; disable geotagging on all cameras at the OS level; never post in real time — post on a delay or after departure; remove EXIF before any photo upload; lock fitness-app routes to private; use a dedicated 'public' phone number that forwards; treat any reward-card sign-up as a permanent data-broker leak.

   Device, Travel & Lodging OPSEC

   On the move, posture compounds. Use full-disk encryption on every device; enable lock-screen after 30 seconds maximum; use eSIM for travel rather than burning your primary number into a foreign carrier's logs; never plug a device into an unknown USB (juice-jacking is trivial); assume hotel-room Wi-Fi is hostile and route through a known-good VPN; ask for a room above the second floor and not at the end of a corridor; do not give the room number aloud at check-in; place the do-not-disturb sign on departure and use a door-wedge alarm at night; never leave devices in the room safe (they are mastered); never accept the room you were assigned over the phone in advance — change it at the desk.

   Family OPSEC

   The professional defender hardens themselves and forgets the family is the soft path. Indicators an adversary exploits: a partner who tags location, a child whose school posts the class list, a teenager who shares their location with the family group and friends, a parent who is on a residents' WhatsApp that leaks the building entry code, a domestic helper posting photos inside the home. Family OPSEC begins with an honest, age-appropriate briefing — not paranoia, just rules: no location tagging, no real-time school posts, no answering unscheduled deliveries, no opening the door to unidentified contractors, a coded duress word, and a single agreed family rendezvous point if anyone arrives home and the environment feels wrong.

   Social Engineering as Surveillance

   Much of what defenders attribute to physical surveillance is in fact social engineering: the 'maintenance' call to verify the alarm code, the 'school' email asking for an emergency contact update, the 'driver' confirming the morning pickup time, the 'concierge' verifying a delivery instruction. Each interaction harvests one EEI (essential element of information) that, alone, looks trivial; aggregated, they reconstruct the pattern of life. Defensive rules: never confirm any detail proposed by an unsolicited caller — make them state it first; verify any change of routine through a known number called out from your end; treat any urgency framing ('we need this now') as a deception indicator until proven otherwise.

   OPSEC for Public-Facing Roles

   Executives, journalists, prosecutors, witnesses and public commentators cannot disappear from the internet — their job requires presence. The discipline for them is to leak only intentional information: a publicist or comms team controls all professional posts; personal posts are made on a delay (no real-time); any content involving the family is opt-in by the family and stripped of identifying detail; speaking engagements are listed but the arrival method, lodging and departure are not; office locations are public but home neighborhoods are not. The principle is asymmetry: maximum signal where you choose to project, minimum signal everywhere else.

6. 6

   Personal Safety Planning & Hard Routine

   Doctrine, OPSEC and detection only pay off if they are wired into a daily routine the defender actually executes. This chapter turns it into operational habit.

   The Hard Routine vs. The Soft Routine

   Every defender lives in one of two postures: a soft routine (predictable, public, untimed, default settings) or a hard routine (varied, OPSEC-disciplined, timed, deliberate). The soft routine is the resting state most people occupy because it is comfortable. The hard routine is invoked when the threat picture warrants — a credible threat, a sensitive operation, travel into an elevated-risk environment, the period around a court testimony, the days after a significant public statement. The professional defender is fluent in both and knows the trigger conditions to escalate. The amateur defender lives soft and is forced to invent a hard routine under stress.

   Route Variance & The Vulnerable Choke Points

   The most dangerous moments in a target's day are predictable, recurring and geometrically constrained: the exit from the home, the entry to the office, the school drop-off, the gym lot, the consistent lunch venue. These are the choke points an attacker rehearses against. Defensive countermeasures: vary departure time by ±30 minutes, vary route between at least three alternates, vary parking position, never sit in a stationary vehicle in the driveway, scan the street before exiting any vehicle, never exit into a blind side, prefer covered entrances, prefer staffed lobbies, never linger between the vehicle and the door. None of this requires armoured cars — it requires varying the variable.

   Residential Hardening

   The home is the one location the defender cannot vary. Hardening priorities, in order of cost-effectiveness: solid-core front door with a long-throw deadbolt and a strike plate screwed into the framing stud, peep-hole or doorbell camera with cloud recording, motion-activated exterior lighting, trimmed landscaping (no 1.5-metre-to-2-metre concealment zone around windows), a marked alarm-system sign even if the system is modest, alarm sensors on all ground-floor windows, a safe room with hardened door and a charged independent communications device, a fire-extinguisher inside the safe room, a written rendezvous plan with each family member, and a relationship with the local precinct or estate security before there is an incident.

   Vehicle Hardening & Drills

   The vehicle is the second most exploited surface after the home. Drills: never leave the engine running with the doors unlocked, never approach with hands full, scan the back seat through the window before unlocking, walk around the vehicle once on approach (looking for tampering at fuel cap, wheel wells, bumpers), maintain at minimum half a tank of fuel at all times, keep one full vehicle-length of escape space at every stop (sufficient to pull out without reversing), lock doors immediately on entry, do not use cruise control in unfamiliar areas, plan two exit routes from every parking decision. None of this is paranoid; it is the same set of habits taught to every diplomatic driver.

   If You Confirm You Are Under Surveillance

   The confirmed-surveillance response sequence: (1) do not show awareness — complete the current movement normally; (2) document — photograph, note vehicles, times, descriptions; (3) verify it is not lawful (process server, law enforcement, journalist on assignment); (4) report — to your protective service if you have one, to law enforcement, to your employer's security team, and where appropriate to a private protective-intelligence firm; (5) adjust pattern — change routes, change times, change exits, sleep in a different location if the threat warrants; (6) preserve evidence in original digital form; (7) brief your household; (8) only then, if necessary, execute anti-surveillance to break the coverage. Stay in this order even when adrenaline argues otherwise.

   When To Escalate to Professional Protection

   Most defenders do not need a protective detail and would not benefit from one. The escalation triggers are specific: a credible direct threat to person or family, repeated confirmed surveillance, a stalker with a history of escalation, a court appearance against an organised actor, a documented home approach by a hostile party, a hostile-environment travel requirement, or a public-facing event with credible counter-protest threat. The professional response is to engage a vetted protective-intelligence firm to conduct a residential security survey, a route survey, an open-source exposure audit, and where warranted to stand up a discreet protective detail. Asking for help is doctrine; trying to self-protect under genuine targeting is not.

7. 7

   Incident Documentation, Reporting & The Defender's File

   An undocumented incident is an analytic loss. This chapter is the reporting discipline that converts experience into evidence usable by law enforcement, courts and protective teams.

   The Suspicious Activity Report (SAR) Format

   Every event the defender judges anomalous is captured in a structured SAR within 24 hours, while memory is intact. The minimum fields: date and time in local and UTC, location with precise address or coordinates, weather and lighting conditions, narrative in chronological order written in plain past tense, persons observed (height, build, clothing top-to-bottom, hair, distinguishing marks, behaviour), vehicles observed (make, model, colour, plate where lawfully obtained, distinguishing features, occupant count), what the observer was doing at the time of observation, attached photos/video with capture metadata, the observer's assessment with a confidence judgement (low/moderate/high). A SAR is not a conclusion — it is a primary document.

   Chain of Custody for Defensive Evidence

   If the SAR may end up in a court file, an insurance claim or a protective-order application, it must survive challenge. Original digital files are preserved in their native form with SHA-256 hashes recorded at capture; copies, not originals, are annotated and shared; capture devices are noted (model and serial of the camera or phone); transfers are logged with date, time, recipient and method. Screenshots are not evidence on their own — they are convenience copies of evidence. The original photo, with its EXIF intact, is the evidence. Treat every captured file as one a defence attorney will eventually examine line by line.

   Working With Law Enforcement

   Law enforcement is a partner, not an opponent, and the defender's job is to make their work easy. Provide a written timeline (not a verbal one), provide artifacts on a single thumb drive with a chain-of-custody letter, provide a contact log of every prior interaction with the suspected actor, distinguish what you observed directly from what was reported to you by others, name the specific outcome you are requesting (a welfare check, a protective order, an active investigation, a referral), and follow up in writing after every meeting. Officers rotate; a written, well-indexed file outlives any individual officer's memory of your case and is the single biggest determinant of whether your file moves forward.

   Briefing a Protective Detail or Security Provider

   When you engage a protective-intelligence firm, the quality of their work is bounded by the quality of your brief. They need: a written pattern-of-life document covering a representative week, a residential survey response (entries, alarm, cameras, household members, helpers, deliveries), a current digital-exposure snapshot (which sites have your address, which broker has your phone), a list of known hostile actors with documentation, a copy of every prior SAR, the most recent threat communications in original form, and a written statement of your appetite for visible vs. discreet protection. Vague briefings produce vague details. Detailed briefings produce detailed protection.

   The Personal Threat File

   Every defender at any elevated risk maintains a single personal threat file, kept current. Contents: the most recent residential security survey, the route survey, the family OPSEC charter, every SAR ever filed, every communication with law enforcement, every protective order or restraining order in force, the digital-exposure audit and the quarterly broker-removal log, the emergency contact card (medical, legal, security, family), the rendezvous plan, and the duress-word register. The file is encrypted, replicated in two locations (one off-site), and reviewable on five minutes' notice. The presence of this file, more than any other indicator, distinguishes the prepared defender from the eventually-prepared one.

   From Fundamentals to Advanced — What Comes Next

   This manual completes the Fundamentals tier: doctrine, baseline reading, surveillance lifecycle, detection of single and multiple coverage, OPSEC, safety planning and reporting. SCS Advanced — Executive & Travel Protection extends the framework into protective-detail operations: advance work and venue surveys, motorcade and arrival-departure (AD) drills, hostile-environment travel posture, surveillance detection routes designed and run at operational standard, attack recognition (the seven-stage attack cycle, weapon-assault indicators, kidnap-attempt geometry), evasive driving theory, and protected-person doctrine for the principal who must remain effective inside a security envelope. Fundamentals is what the defender owes themselves. Advanced is what the protective cell owes the principal.

GACS.app — Protective Intelligence Standards Division