Counter-surveillance: the complete guide to TSCM equipment, inspections and cyber protection

1. What is counterespionage?

Counterespionage aims to prevent, understand and counter the hostile collection of information. At the state level, it can encompass intelligence and national security missions. For an individual or a company, the need is generally more concrete: to protect exchanges, identify illicit surveillance, preserve a commercial secret or secure a sensitive space.

Counter-surveillance refers to measures intended to identify or reduce surveillance. It can concern people, places, vehicles and digital systems. A technical inspection constitutes a component of this set; it does not replace access management, document protection or account security.

What does TSCM mean?

The English acronym Technical Surveillance Countermeasures covers countermeasures to technical surveillance. The NIST Glossary provides this terminology guide. A TSCM mission searches for devices and technical vulnerabilities within a defined perimeter. It can combine visual inspection, RF search, line analysis, optical verification and silent electronics examination.

Audit, removal of doubt and periodic control

A doubt removal examines a specific anomaly. An audit evaluates an environment and its weaknesses. A periodic check looks for changes from a baseline situation. These services do not necessarily require the same duration, the same instruments or the same level of investigation. The first question to ask is therefore: what decision should the result allow us to make?

2. What are counterespionage and countersurveillance used for?

The first objective is to protect information before it is exposed: negotiation, commercial strategy, health data, family discussion or sensitive travel. The second is to establish facts when an incident is suspected. The third is to reduce the opportunities for recidivism through simple and lasting measures.

An organization can have an excellent intruder alarm while still maintaining a video conference room accessible from an old administrator account. A home may not contain any hidden cameras, but remain exposed by a shared cloud account. A car can transmit positions via its original connected service without an additional box having been installed. The reasoning must cover all access paths to information.

Define what we protect

List what data is truly sensitive, who accesses it, where it is discussed and the consequences of its disclosure. Then rank the scenarios according to their plausibility and impact. Scanning for a microphone in an office addresses a different problem than scanning a compromised email account. A proportionate approach avoids spending the entire budget on a spectacular threat while leaving an ordinary vulnerability open.

The expected result may be a room usable under certain conditions, a vehicle inspected over a documented perimeter, an anomaly explained or a list of security actions. It must be described before the intervention.

3. Counter-espionage for individuals

At home and in shared accommodation

Privacy at home starts with physical and digital access. Review the equipment you own, home automation accounts, guest users, and objects added after an intervention. In shared accommodation, ownership of a device does not give a general right to record other occupants.

A noise, a battery failure or an unusual object is not enough to establish espionage. Describe the facts: date, location, event observed and people authorized to intervene. A lamp that heats up may simply function normally. The verification must make it possible to distinguish between domestic equipment, an electrical fault and an anomaly requiring expertise.

How can you check for a hidden camera in a hotel room or Airbnb?

To check for a hidden camera in a hotel room or Airbnb, start with a non-destructive visual inspection of areas where privacy is expected: review the overall layout, objects facing private spaces and clearly unusual items. Do not dismantle electrical installations or damage housing equipment. If a discovery seems serious, leave the sensitive area to communicate and contact the manager, the platform or the authorities depending on the context.

The Airbnb Camera and Recording Devices Policy prohibits security cameras inside affected accommodations, with specific details and exceptions specific to certain accommodation categories. Authorized external devices are subject to declaration and positioning conditions. This platform rule should not be confused with an exhaustive presentation of local law.

Preserve your personal safety

If the suspected surveillance involves threats or violence, an account change or removal of a device can alert the person who controlled access. Organize the procedures using a reliable means of communication and seek appropriate support. The emergency is firstly the protection of the person, then the conservation of useful elements.

4. How can you detect a hidden GPS tracker in a car?

A vehicle inspection against GPS trackers must distinguish added accessories, manufacturer equipment, fleet tools and services associated with the user account. A box on a diagnostic socket may be legitimate; a shared automobile account can allow you to consult a position without an additional device.

Physical verification and access verification

The perimeter may include accessible areas of the passenger compartment, accessories, connectors, power supplies and parts of the vehicle that can be safely examined. Disassembly, access to the underside of the vehicle and sensitive circuits are the responsibility of competent personnel. Do not handle unfamiliar equipment near an airbag or electrical harness.

At the same time, review the manufacturer's app authorized users, digital keys, location services and sharing histories. An RF search does not automatically identify a connection belonging to the vehicle. Activity should be interpreted taking into account normal functions and observation conditions.

Why a short inspection may miss a tracer

A tracker can remain silent during immobilization, record locally, or delay transmission. The absence of emissions at the time of the check requires completing the method, not concluding that no equipment exists. The duration of observation and the parts physically inspected must appear in the report. An authorized control of the vehicle also protects the data of its drivers and passengers: the expertise must not become an undifferentiated collection of their communications.

5. Corporate counter-espionage and protection of trade secrets

The information sought is not always industrial plans. A list of customers, a purchase price, a call for tenders schedule, margins, a formula, a recruitment project or a litigation procedure can represent a considerable challenge. The protection of commercial secrets combines contractual confidentiality, access control, IT security and protection of exchanges.

Meeting rooms and management offices

Define rooms suitable for sensitive discussions. Reduce unnecessary devices, control video conferencing accounts, and identify who can manage the room's microphones and cameras. A maintenance provider, a former employee or a forgotten technical account can retain access that is no longer justified.

Research, industry, firms and businesses

In a laboratory, information can be visible on a screen or board before it is even spoken. In a practice, they can be displayed via a shared workstation. In a showroom, visitors can photograph documents left in the background. The analysis must therefore include people flows, paper supports and work routines.

A useful intervention leads to responsibilities: who validates access to the room, who monitors the work, who manages the keys, who closes digital access and who decides to request a new verification? Secrecy is not only protected on the day of an audit. It depends on the ability to maintain a known environment between two checks.

For a multi-site company, a common method and a shared inventory make it easier to compare results. Local vulnerabilities nevertheless remain to be addressed depending on the building, networks and activity.

6. Institutions, administrations, embassies and consulates

The protection of an embassy, a consulate or a sensitive administration requires an organization adapted to the issues, responsibilities and applicable rules. A public guide can explain confidentiality principles, but does not replace official procedures or the teams authorized to handle protected information.

Control the life cycle of premises

Risks may appear during the initial layout, delivery of furniture, technical intervention or replacement of an audiovisual system. The traceability of objects and stakeholders is as important as final control. An inspected room loses its reference state if undocumented work is subsequently carried out there.

Control of service providers, areas accessible to visitors and connected equipment must be coordinated with security managers. Inspection documents, plans, photographs and measurement logs may themselves reveal sensitive information; their distribution must be restricted.

Adapt the means to the level of sensitivity

The choice of specialized equipment depends on plausible threats, authorizations and skills. Laboratory tools, imaging and communications analysis are not interchangeable with a handheld detector. Contractual requirements may relate to the qualification of participants, confidentiality, data processing and reporting methods. No device sold to the public should be presented as an automatic approval of a government environment.

7. Understand the devices you are looking for

A technical threat can capture an image, sound, location or data. It can transmit immediately, delay sending or retain the information until physical recovery. To choose a search method, separate three functions: capture, store and transmit.

The categories overlap: a Wi-Fi camera can also record on a card; a tracker can have memory and a microphone; a connected device can be hijacked without visible modification to its case. The presence of an electronic circuit therefore does not, in itself, reveal its purpose. We must bring the indices of the inventory and actual operation closer together.

8. RF detectors: how to find a spy microphone that is transmitting

A radio frequency detector searches for radio energy in a given range. Depending on its architecture, it can indicate overall intensity, distinguish certain bands or record events. It does not automatically recognize malicious intent. An authorized telephone and a clandestine microphone can use common bands.

Sensitivity, dynamics and environment

The maximum frequency displayed is only a criterion. Sensitivity, antennas, response to brief signals, selectivity and the ability to operate near powerful transmitters also matter. An external source or a nearby terminal can dominate the measurement and mask a smaller variation. The same device can behave differently depending on its antenna and its position.

The check begins with a description of the environment: known devices, usual networks and expected variations. An anomaly must then be verified by several independent observations. The operator retains the parameters useful for interpretation, rather than just a photograph of the screen showing a high level.

What the RF cannot guarantee

A recorder not transmitting, a camera powered off, or a transmitter not active during pass-through may escape an RF search. Out-of-band signals and wired links require other means. The tool must therefore be chosen according to the scenario and integrated into a method. Review signal detectors by comparing their documented functions, not just advertised range in a favorable environment.

9. Spectrum analyzer, receiver and portable scanner

A counterespionage spectrum analyzer represents activity based on frequency and, depending on its functions, time. A receiver allows certain compatible signals to be examined. A radio scanner scans defined channels or ranges. The term “handheld scanner” describes a convenient format, without guaranteeing the same scanning capacity between devices.

Understanding the temporal dimension

A temporal view, often called a waterfall, makes it easier to compare successive appearances. The memory of maximum levels retains certain traces; it does not replace a usable record of events and their conditions. The revisit time, the instantaneous width analyzed and the capture modes influence the possibility of observing a brief signal. The HSA-Q1 documentation illustrates the functions of a specialized instrument.

Portable or surveillance installation?

The portable format makes it easy to move around and examine multiple pieces. A device left for observation can provide a longer history. The choice depends on the objective: first verification, search for a source, comparison of several days or control of a site after change. It is also necessary to plan the power supply, storage and the person responsible for interpreting the results.

SDR software can be a complementary tool for a trained operator. It does not automatically offer the dynamics, coverage, capture features, or reliability of a specialized TSCM system. Receiving a broadcast does not give the right to intercept its content either.

Examples from the catalog: compare tools in images

Scroll horizontally through the gallery. The photographs open the files for this store; check the current version and specifications.

10. NLJD detectors: searching for switched-off microphones and cameras

A nonlinear junction detector, or NLJD, searches for the response of junctions present in electronic components when they are acted upon by its signal. It can help locate electronics without relying on a transmission produced by the device being searched. This is a fundamental difference from a passive RF detector.

Why examine harmonic responses?

Semiconductors exhibit nonlinear behavior. The instrument notably compares harmonic responses to assist the operator in interpretation. The EDD-24XT manufacturer sheet shows this analysis logic. A response indicates an item to examine; it does not identify the owner or function of a circuit.

Applications and false positives

The NLJD completes the search for small recorders, concealed circuits and standby devices. It can also react to perfectly normal electronics. Metallic contacts and certain corrosion phenomena can produce responses requiring interpretation. A relevant result is confirmed by more precise localization and, when authorized, visual inspection or another method.

Materials, shielding, depth, geometry and environment influence the search. It would be misleading to advertise a universal detection depth or to claim that an NLJD finds all turned off devices. The instrument transmits itself: the conditions of use and the constraints of neighboring equipment must be taken into account. Consult our category NLJD detectors to compare the available references.

11. Thermal camera: spotting temperature anomalies

A counter-surveillance thermal camera represents differences in thermal radiation associated with the observed surfaces. It can help spot unusual heating and then guide an inspection. It does not automatically recognize a camera or microphone and does not constitute proof of surveillance.

Contextual help, not vision through walls

As FLIR on the limits of thermal imaging explains, the device observes the surface of the wall, not directly what is behind it. A hidden source can sometimes modify this surface by thermal transfer, but this phenomenon depends on the materials, the power dissipated and the time elapsed.

A charger, power supply, conduit, or reflection off a shiny surface can produce a surprising image. Conversely, a turned off, low consumption or isolated device may not create a usable signature. Observations must be compared to normal operation and conditions documented: heating, sunlight, ventilation and power-up time.

What to compare before choosing?

Thermal resolution, sensitivity to temperature differences, focus, field of view and image recording must match the mission. High video resolution of the built-in visible camera should not be confused with the resolution of the thermal sensor. Physical confirmation remains necessary before attributing an anomaly to a spy device.

Examples from the catalog: compare tools in images

Scroll horizontally through the gallery. The photographs open the files for this store; check the current version and specifications.

12. X-rays and portable imaging systems

The X-ray of a suspicious object can show an internal organization: metallic elements, connections, battery or circuit, depending on the geometry and the system used. It is of interest to certain expertise when immediate opening of the object is not desirable. However, an image does not automatically reveal the exact function of a component.

Transmission Imaging and Specialized Systems

The configurations differ: access to both sides of an object for certain systems, positioning constraints, traversed thickness, dimensions of the zone and resolution. Other imaging technologies have different principles and restrictions. “Handheld scanner” therefore does not mean that an operator can examine any wall or furniture in a few seconds.

A supervised professional service

Ionizing radiation involves skills, radiation protection measures and applicable authorizations. In France, ASNR presents the framework for industrial radiography. Possession of portable equipment does not exempt you from these obligations. Neighboring people and areas must be taken into account in preparation.

In a counter-espionage mission, the use of imagery is decided based on an anomaly and a specific objective. It must be included in the estimate if necessary; this should not be assumed in any standard service. The report distinguishes between what was observed, what remains hidden and what requires further verification.

13. Endoscope camera and inspection of hard-to-reach spaces

An endoscopic inspection camera gives a view of areas accessible through a suitable opening: rear of furniture, technical cavity or hidden space. Its interest is concrete: to visually check an anomaly without immediately dismantling the entire environment. It does not see through a wall and does not provide radio analysis.

Really useful features

The diameter of the head, the length and stiffness of the cable, the focusing distance, the illumination, the orientation of the view and the ability to retain images matter more than a single resolution number. A camera advertised as very defined may remain unsuitable if it does not focus at the necessary distance.

An articulated probe can facilitate the examination, but does not exempt you from understanding the environment. The announced tightness of the head does not guarantee that of the whole. Live circuits, mechanical parts and dangerous areas must not be explored without appropriate skill and authorization.

Document what we see

Associate images with an understandable location. A photograph of a circuit without indication of location or scale is difficult to use. If the inspection device communicates via Wi-Fi, its own signal must be identified in the mission inventory. inspection endoscopes complement other tools when the question is: what object is actually in this space?

14. Optical detection, line analysis and other equipment

Optical objective detectors

An optical detector looks for certain reflections associated with a lens. It can operate without radio transmission from the desired camera, but requires a favorable line of sight and geometry. A reflection is not proof: glass, screws and shiny surfaces can produce bright spots. A obscured or poorly oriented lens may remain invisible. Compare hidden camera detectors according to the intended conditions of use.

Cabling analyzers and reflectometry

Line analyzers examine electrical properties and, depending on their functions, wiring anomalies or signals. Reflectometry can help identify a discontinuity, which must then be interpreted. An old connection, a legitimate diversion and a malicious alteration are not always distinguished on a single measure. The TALAN range from REI illustrates this family of instruments; its presence does not mean that any electrical network can be connected directly to it.

Accessories and protection

Lighting, mirrors, approved inspection tools, suitable antennas and building documentation can be decisive. Faraday pouches aim to attenuate communications when fitted and properly closed; they do not erase spyware and do not necessarily prevent local recording. Acoustic masking generators and ultrasonic devices require real-world testing: coverage, obstacles and targeted microphones influence their effectiveness. None should be presented as a universal shield.

Examples from the catalog: compare tools in images

Scroll horizontally through the gallery. The photographs open the files for this store; check the current version and specifications.

15. Frequencies: Wi-Fi, Bluetooth, GSM, 4G, 5G and other connections

There is no such thing as a “counterespionage frequency”. Surveillance devices use bands also used by legitimate services. The research plan must take into account the country, technologies, building and ranges covered by the instruments.

These examples constitute neither an exhaustive list nor an authorization to broadcast. Encryption does not remove the physical presence of a signal, but energy sensing does not provide access to its content. Neighboring Wi-Fi devices, phones and home automation account for much of the activity encountered. Consulting information from the national spectrum authority is part of preparing for an international mission.

16. GPS trackers: standby modes and intermittent transmissions

A GPS tracker with intermittent transmissions can calculate or store positions at one interval and upload them at another. Satellite reception, local storage and mobile data transmission are separate functions. Receiving GNSS signals does not create a continuous outgoing radio signal for a detector to follow.

Standby does not necessarily mean switched off

Depending on the design, some components remain powered to detect an event while others shut down. Movement, a timer or another condition may wake the device. Radio silence does not establish the electrical state of the entire tracker. Check what the manufacturer means by deep sleep and long battery life for the particular model.

One transmission every twenty-four hours

Some configurations upload data at long intervals, for example in a daily batch. A short RF scan may therefore miss the transmission. An authorised inspection may require longer monitoring alongside physical examination, checks of wiring and power connections, a search for concealed electronics and a review of location-sharing accounts.

There is no universal monitoring period after which every device must have transmitted. The report must state the observation window and the conditions covered. If a plausible operating cycle falls outside that window, this limitation must remain explicit. Extending the monitoring period can improve coverage, but cannot turn a missing event into proof that no tracker exists.

17. Short signals, frequency hopping and advanced monitoring

An emission can be difficult to observe because it is brief, weak, intermittent or distributed between several frequencies. Frequency hopping consists of changing channels according to an organization specific to the system. This property also exists in ordinary technologies; it is not in itself an indication of espionage.

Why instruments are not all equivalent

Successive scanning does not necessarily monitor all frequencies at all times. A signal may appear while the instrument is examining another part of the spectrum. Real-time modes, when existing over a given width, capture functions and history must be evaluated within the limits of the device. We must avoid using the term “real time” without specifying what is actually observed.

The correct answer is a combination of methods and an honest assessment of coverage, rather than announcing an absolute ability to detect any technology. Observing signals does not automatically attribute a source to a person. Expertise can establish an event, then request additional analysis to identify it.

Differentiate between sophistication and probability

A leak may come from a file share that remains active rather than a sophisticated transmitter. The advanced threats chapter should shed light on detection limits, without leading to ignoring common causes. Investments are decided according to the established risk and the value of the information to be protected.

18. How can power-line carrier eavesdropping be investigated?

The line carrier current carries a signal on a conductor that already serves another function, notably a power supply. Legitimate home equipment uses this principle for networks. A wired monitoring link can also use a dedicated cable or divert existing infrastructure: these situations should not be confused.

Why a handheld RF detector may not respond

The question here is the signal path. A broadcast primarily conducted on cable is not just a Wi-Fi connection in the air. Secondary radiation may exist, without their absence or presence being sufficient to identify the device. Diagnosis requires knowing the lines and distinguishing their normal operation from anomalies.

How is an authorized search prepared?

The operator reconciles plans, inventory, power supplies and recent changes. Instruments suitable for line analysis and couplers intended for the use in question can complete the physical verification. Electrical conductors must not be connected directly to a measuring device not designed for this voltage. The tests are entrusted to competent people, with the necessary authorizations and protections.

A home powerline is not evidence of spying, and randomly removing accessories can interrupt services without resolving the problem. The report must identify the network examined, the method, the limits and any investigations to be continued. The detection of an unknown circuit is confirmed by its real role and its connection.

19. Laser microphones, Lamphone and optical eavesdropping

Laser microphone: a threat of another nature

A laser microphone can exploit vibrations of an observed surface to seek to reconstruct acoustic information. Feasibility depends on line of sight, surface area, geometry and environmental conditions. This is not guaranteed listening through any window.

Protection begins with the study of lines of sight and spaces where exchanges take place. The choice of room, appropriate occultation and a specialized assessment of surface exposure can reduce the risk. A search for optical radiation requires means compatible with wavelength and geometry; the absence of an alert on a general device is not enough.

A distinction must be made between a detector which searches for objectives by retro-reflection and a sensor designed to signal incident laser radiation. Our catalog offers optical instruments whose functions must be read precisely: their commercial name does not promise the detection of all laser tapping.

Lamphone: what the research shows

The work Lamphone by Ben Nassi and his co-authors studied the recovery of sounds from optical variations linked to the vibrations of light bulbs, in experimental configurations. This passive approach should not be presented as a laser microphone: it does not require the same principle of active illumination. Results depend on specific conditions; they do not prove that any light bulb can listen to any conversation.

This research reminds us that techniques are evolving and that protection must take into account the visual and acoustic exposure of the premises. For a sensitive site, a regular threat analysis is more useful than purchasing equipment presented as definitive.

20. Spyware on phones and compromised computers: the cyber side of counter-surveillance

In 2026, limiting counterespionage to hidden objects leaves out a major part of the exposure. A compromised computer or phone can provide access to documents, messages, images, sounds and locations, depending on the permissions and capabilities of the attack. It is then not necessary to add a microphone in the room.

The ANSSI documents the threat to mobile equipment. The DGSI describes compromises of telephones for industrial espionage purposes, with capabilities that may include microphone, camera, and location data. The cyber chapter must therefore be part of the scope discussed before the intervention.

A compromised device is not necessarily visible to the RF detector

A phone already communicates normally with networks. The presence of an expected broadcast does not distinguish a legitimate application from malicious software. A radio audit can reveal an uninventoried device without certifying the integrity of its system. Conversely, an IT audit does not replace the inspection of an independent hidden object.

Endpoint encryption and security

The encryption of communications protects their transport under the planned conditions. It is not enough if the information is recovered on an already compromised terminal, before encryption or after decryption. Disk encryption protects certain data access scenarios at rest; it does not mean that any software installed on an open session is safe. Protections must match the exact risk.

21. Cloud accounts, computers and applications: examine real access

The account may be sufficient to expose the information

Access to an email, backup, shared album or location app can reveal information without sophisticated malware. Active sessions, associated devices, transfer rules, and permissions given to third-party apps are worth reviewing. A password change does not necessarily revoke all access depending on the service and settings.

Computers and workstations

Browser extensions, remote control tools, videoconferencing software and administrator rights are part of the inventory. Some tools are legitimate in an organization; their presence alone does not prove an intrusion. It is necessary to check their authorized deployment, the people with access and the available traces.

In the event of a serious incident, immediate reinstallation can remove useful traces. The decision to preserve, isolate or rebuild the station is made with a competent team, depending on the needs for continuity and investigation. Screenshots do not always replace documented technical collection.

Concrete protection measures

Updates, limited rights, enhanced authentication, deletion of unnecessary accounts and review of associated devices reduce opportunities for abuse. The NIST Enterprise Mobile Equipment Security Guide provides a lifecycle management framework. The tools and procedures must also cover the departure of an employee, the loss of a device and changes in service provider.

A cyber expertise must specify the systems examined and the exclusions. “Phone Control” alone does not describe a complete analysis of backups, accounts, applications and other linked devices.

22. Connected objects, videoconferencing and connected vehicles

A TV, smart speaker, IP camera or meeting system can have perfectly ordinary audio and video functions. The security question concerns access, configurations and associated services. A room containing only known material may remain exposed if a remote account is poorly controlled.

Make an actionable inventory

For each device, note its function, its manager, its network access and the people authorized to administer it. Identify devices that remain active outside of meetings. Check the activation conditions of microphones and cameras rather than relying solely on appearance or an indicator.

Segment and reduce unnecessary functions

A network dedicated to guests or connected objects can limit certain movements of an attacker, provided that the rules are effectively configured. Segmentation does not address device-specific vulnerabilities. Updates, passwords and cloud access still need to be managed. Equipment without software monitoring may justify replacement rather than an accumulation of compensatory measures.

In a connected vehicle, manufacturer services, mobile applications and fleet access must be considered with the same seriousness as physical hardware. After a sale, rental or driver change, removing old access and correctly linking accounts are essential steps. A useful inspection identifies the boundary between the embedded system, remote services and added accessories.

23. How does a professional counter-espionage operation take place?

Before the mission: define and authorize

The service provider collects the facts, constraints and objective. The principal specifies the places, vehicles, objects and systems that he is authorized to have examined. Access conditions, authorized dismantling and confidentiality are agreed. Digital subjects must be described separately if the service includes a cyber investigation.

During the mission: cross-reference observations

The team establishes a reference state, inspects accessible spaces and applies the planned methods. Anomalies are qualified: known device, point to be explained, inaccessible element or discovery requiring a particular procedure. Instruments are used to answer questions, with their known limitations.

Proof is not just an alarm

An intense signal, an NLJD response or an optical reflection guides the examination. The conclusion must link several elements: location, behavior, documentation and verification of function. We must preserve the distinction between observation and hypothesis.

After the mission: return and maintain

The report indicates the actual scope, methods, conditions, limits and recommended actions. Recommendations are prioritized according to impact and feasibility. Inaccessible or untested points must remain visible. A successful mission is not measured by the number of measures announced, but by the quality of the evaluation and the decisions it makes possible.

When to renew the check?

A change of premises, major maintenance, an incident or an exceptionally sensitive meeting may justify a new evaluation. The periodicity is not established solely by habit: it depends on access and the stability of the environment.

24. Duration, conditions of observation and limits of a negative conclusion

A control is an observation within a scope and a period. The size of the premises does not alone explain the duration: furniture, density of equipment, access to cavities, networks and activity constraints also play a role. Two identical surfaces may require very different interventions.

What should be written in the report

The areas inspected, the areas excluded, the equipment present and the observation conditions determine the scope of the conclusion. If a vehicle was only examined when stationary or if a technical area was inaccessible, the report must say so. Digital tests should not be equated with an audit of all accounts without them having been included.

“No device identified under the conditions of the control” is a different conclusion from “no monitoring is possible”. The first can be precise and useful; the second generally exceeds what a spot inspection can establish.

Process changes

Keep an inventory and history of interventions. The baseline becomes more useful when changes are documented: new screen, replacement of a router, delivery of furniture or addition of a service provider. Monitoring transforms a succession of isolated checks into a prevention approach. It also makes it possible to explain a radio appearance or an unknown device without multiplying unjustified alerts.

25. How much does a professional counter-surveillance inspection cost?

The cost depends on the scope, access, technical complexity, time required and deliverables. A search on a vehicle, a premises audit and a computer analysis do not represent the same service. The price must be compared to what is actually included.

These amounts are Intellis Conseil indications communicated for this guide, not a market average nor a firm quote. They are expressed in euros and excluding taxes; taxes, travel and intervention conditions must be specified in the offer. Their mention on a foreign store does not mean that the service is offered everywhere at the same price.

Questions to ask before comparing two offers

Ask if the quote includes preparation, physical inspection, measurements, additional research and report. Specify the duration, the excluded areas, any special means and the cyber part. X-ray imaging, significant disassembly, or prolonged follow-up should not be assumed to be included without confirmation.

Equipment alone does not establish the quality of a service. Assess the team’s experience, its inspection method, confidentiality arrangements and the clarity of its report. A short screening visit and a detailed investigation can share a commercial label while offering very different levels of coverage.

26. What to do if you discover a suspicious device?

Start by distinguishing between an immediate danger, an unexplained object and a device whose function has been confirmed. Do not confront a person based on a single signal or resemblance. An object may have a legitimate explanation, but a serious discovery deserves structured support.

Document without destroying the elements

When conditions permit, note the location, time, apparent condition and context. Avoid moving or modifying the object unnecessarily. Do not try to browse its files or connect it to your personal computer. Manipulations can alter data, modify its behavior or expose another system.

Communicate from a reliable environment

If the room or telephone is specifically affected by the doubt, choose another means of communication to seek help. In a company, involve security, IT and legal managers depending on the scope. In accommodation, reporting to the platform can complement a process with the authorities, without replacing it.

Retention of elements and decisions to deactivate them are a matter of context and competent people. A uniform procedure applied to all objects would be misleading. The report must trace the manipulations carried out and the people who had access to the elements. If the situation involves a personal threat, the safety of the person comes before technical research.

27. Prevention: access, acoustic confidentiality and digital discipline

The counter-espionage prevention is based on a controlled environment. A door with known access points, an up-to-date list of providers and an account closure procedure can reduce risks that sophisticated instruments cannot correct.

Before a sensitive meeting

Choose a location suitable for the expected confidentiality. Identify participants and necessary devices. Avoid screens or documents visible from the outside and sensitive exchanges in waiting areas. Room control must integrate videoconferencing systems and their remote access.

After the meeting

Remove documents, erase tables according to internal policy and close temporary shares. Check reusable video conferencing links and who has access to legitimate recordings. Security continues after participants leave.

After work or maintenance

Compare equipment to inventory, validate cabling changes and revoke temporary access. A reference photograph can make it easier to understand a change, without constituting expertise on its own. Schedule a recheck when the sensitivity level requires it.

Acoustic and physical protection must be evaluated in their real environment. Poorly adjusted sound masking can hinder work without providing the expected effectiveness. A poorly closed Faraday pouch can allow a device to communicate. Simple rules, tested and understood by users, are often more reliable than an abstract promise of total protection.

28. Which equipment should you choose according to your needs?

For an individual, a simple device can help with an initial check provided you understand its limits. For a company, the priority is often a reproducible method and usable feedback. For a sensitive institution, the choice is part of its security requirements and procedures.

The examples in the catalog below illustrate families of means; they do not constitute a ranking of performance measured in all scenarios. The photos show the references actually offered on this store. Consult their data sheets for current versions and specifications. Product prices remain those in the catalog, distinct from Intellis Conseil service benchmarks.

View the full legal file

Hotel, rental, company vehicle, equipment and legal investigation: check the framework before an intervention.

Counter-surveillance law: equipment, hotels, Airbnb, work vehicles and lawful investigations

29. Legal framework and authorizations for an inspection

United Kingdom, other English-speaking countries and international work

In the United Kingdom, distinguish between authorized inspection of a place, collection of data and interception of communications. The UK Government and ICO resources on CCTV provide a starting point for checking footage obligations. A company mission must specify the systems examined and the people authorized to access the results. Do not deduce from the right of property a general right to monitor the occupants.

GOV.UK / ICO

Countries with the same language and international context

In the United States, federal and state rules can be combined. For Canada, Australia, New Zealand and other English-speaking destinations, check the local framework before collecting or using regulated instruments.

In the European Union, the GDPR intervenes when personal data is processed, with the relevant national rules. Outside of this space, requirements may be different. For embassies, consulates and sensitive institutions, coordinate the mission with the competent authorities and security managers.

Detection, emission and electrical safety

Detection should not be confused with communications jamming. Local rules for the use of transmitters, radiation protection and intervention on electrical installations remain applicable. The French examples cited in the technical chapters are contextual references, not the law of all countries. Specify in the estimate the necessary authorizations, the competent people and the processing of the report.

30. Glossary and checklist to prepare your project

RF

Radio frequencies: field of radio signals. Detecting activity does not prove that it is malicious.

NLJD

Nonlinear junction detector: means of searching for certain electronic responses without depending on the emission of the object.

GNSS

Family of satellite navigation systems, including GPS. Distinct from the network used to send a position.

Reference state

Documented description of a known environment, useful for interpreting changes.

CPL

Line carrier current: transport of a signal on conductors, with legitimate uses and specific verifications.

False positive

Alert or observation interpreted as a threat when another explanation justifies it.

Information to prepare for a first exchange

• The location, surface or vehicle to be examined and the authorization available.
• Observed facts, their chronology and recent changes.
• The information to be protected and the possible consequences of its exposure.
• Known equipment, networks and people with access to the premises.
• Activity constraints, impossible access and possible dismantling.
• The possible need for a cyber analysis and the systems involved.
• The level of confidentiality expected for the mission and the report.

This preparation helps to choose a proportionate intervention. It also makes it possible to distinguish questions that an inspection can answer immediately from those that require longer observation or additional expertise. The objective remains concrete protection, based on a method, appropriate means and conclusions whose scope is clearly explained.

31. Counter-surveillance: frequently asked questions

View categories and related guides

Counter-Surveillance

• Signal Detectors
• Inspection Endoscopes
• Spy Camera Detectors
• Encryption
• Non-Linear Junction Detectors
• Ultrasonic Jammer | Faraday Bag
• Counter-Espionage Equipment
• Counter-Surveillance Guide: How to Detect Hidden Cameras, Spy Microphones and GPS Trackers Effectively
• Counter-Surveillance by Design: How to Create Rooms and Workflows That Resist Hidden Cameras, Spy Mics and Trackers
• Counter-Surveillance Equipment Guide: What Tools You Really Need to Detect Hidden Devices
• After You Find a Hidden Camera or Bug: Counter-Surveillance Response, Evidence Protection and Security Recovery
• How to Find a GPS Tracker on a Car: Counter-Surveillance Guide for Real Vehicle Searches
• Counter-Surveillance Baseline Guide: Find Suspicious Signals in Smart Homes and Offices
• Passive Bug Detection Guide: How to Find Wired, Dormant and Non-Transmitting Surveillance Devices

Technical and institutional sources

References consulted on November 2, 2026. The Intellis Conseil prices are the VAT indications provided for this guide.

• NIST Glossary
• Airbnb Camera and Recording Devices Policy
• HSA-Q1 documentation
• EDD-24XT manufacturer sheet
• FLIR on the limits of thermal imaging
• ASNR presents the framework for industrial radiography
• TALAN range from REI
• Lamphone by Ben Nassi and his co-authors
• ANSSI documents the threat to mobile equipment
• DGSI describes compromises of telephones for industrial espionage purposes
• NIST Enterprise Mobile Equipment Security Guide
• GOV.UK / ICO