The Surveillance Skills Everyone Should Know

There is a principle widely understood in intelligence and security work, captured most famously in a line by Ian Fleming in Goldfinger.

Once is happenstance. Twice is coincidence. The third time it is enemy action.

The line is fiction, but the principle behind it is not. By the third sighting, the odds of randomness have collapsed and the only sensible response is to treat the pattern as intentional. It does not matter whether you turn out to be right or wrong. If you act on the assumption that the person you have seen three times is there deliberately, the worst case is that you have been mildly inconvenienced by your own caution. If you ignore it and turn out to be wrong about it being innocent, the worst case is significantly less forgiving. Surveillance awareness is built on the principle that the cost of being wrong in the cautious direction is almost always lower than the cost of being wrong in the trusting direction.

This is a piece about what it feels like to notice that pattern in real time, the signs to look for if you ever find yourself in the same position, and what to do once you have.

A Quick Word on Terminology

Two terms come up in this piece and they are not the same thing.

Both come up in this story, both matter.

At the time, I was on a protection detail working night shifts, securing someone whose situation had drawn attention from two very different directions. There was potential press interest because the individual we were protecting had become newsworthy, and separately, there was the potential for adverse actors with reasons of their own for wanting to reach the asset too. The team was large and experienced, mostly ex-military/ex-police, and we had been briefed that surveillance from either direction was a realistic possibility. That kind of briefing has a way of making you sharper without making you paranoid. You move through the world in roughly the same way you always do, but the filter behind your eyes shifts slightly.

I was coming off a night shift at around seven in the morning, heading home on the underground. The platform was not crowded, when I noticed a man standing at a distance, looking in my direction. Once, that means nothing. People look at each other on platforms, it is not unusual.

The tube pulled in and that is when the picture changed.

He moved towards my carriage. It was not the carriage closest to him. It was not a carriage that made sense for whatever direction he might naturally have been heading. He could have stepped on at his end of the platform and not given it a second thought. Instead he walked a stretch of the platform to make sure he boarded where I boarded.

Inside the carriage he had options. There were empty seats nearer the doors. There were empty seats at his end. He walked past several of them and sat down about five seats from me. Close enough to keep me clearly within his line of sight. Far enough to look unremarkable to anyone who was not paying attention.

Then he did the thing that confirmed it for me. He kept his rucksack on his back as he sat down. Most people take their bag off the moment they sit on a tube. They put it on their lap, on the floor between their feet, on the empty seat beside them. Anything that allows them to relax for the duration of the journey. Keeping it on while seated is uncomfortable and slightly unusual. It is also the posture of someone who has decided in advance that they may need to move quickly.

By that point I had moved from instinct to certainty. Once was nothing. Twice was the carriage choice. The seat selection and the rucksack made three, and so the pattern was complete.

Once was nothing. Twice was the carriage choice. The seat selection and the rucksack made three, and so the pattern was complete.

The priority now was not confirming what I already knew, the priority shifted to making sure he did not see where I lived. I was not going to let him follow me to my front door under any circumstances. I began running anti-surveillance drills there and then, working the route deliberately, using the environment, varying pace and direction, creating opportunities to break his line of sight without making the breaks themselves look intentional. Throughout all of this I was messaging the team and my manager, briefing them on what was happening. Reporting in real time matters -If one of us has been picked up, the working assumption has to be that others might be too, and the rest of the team needs to know so they can run their own drills on their way home. The information moves faster than the threat does and that is how you protect each other.

I was exhausted, I had just come off a twelve hour night shift and every part of me wanted to be in bed. None of that mattered anymore, the job that morning had quietly extended itself from protecting the asset to protecting my home address. Eventually I lost him. Not because he chose to break off, but because the drills worked and I thankfully left him behind.

I went home. I did not sleep particularly well.

My alarm went off at 1700, ready for the next night shift. I woke up to a series of messages on my phone explaining that a small counter-surveillance team had been quietly deployed during the day to the area around my address. They were already in position by the time I read the messages, conducting counter and waiting for me to leave for work. The plan was straightforward and elegant, in that my job was to do nothing different from any other day, while theirs was to watch the environment around me carefully for anyone who might be watching me. There was something quietly comforting about the journey in that evening, knowing that beneath the appearance of an ordinary commute I was moving through a bubble of highly skilled operators whose only job was to make sure I was safe. Anti-surveillance was not the point this time. The point was to find out whether I was still being followed, and that meant I had to become the prey.

Read more