Detecting the Undetectable: Subtle Indicators of Physical Surveillance

Many people assume that detecting physical surveillance is simply a matter of spotting someone who looks suspicious, out of place, or overly nervous. While those traits might occasionally surface, the first lesson any well-trained surveillance operative learns is how not to exhibit them.

As discussed in an earlier article, some of the more subtle signs that someone may be conducting surveillance include—but are not limited to—observing or photographing the target, moving in coordination with a mobile target, or communicating or gesturing in response to a target’s movements or actions.

To appreciate just how subtle these indicators can be, consider this scenario: A CEO walks into a crowded restaurant for a scheduled lunch meeting with an important client. As the CEO sits down, a person seated near the back of the restaurant picks up his phone, types briefly, and sets it down. Forty-five minutes later, when the CEO and client stand to leave, that same person—already holding his phone—types a few things again, pays his bill, and departs a few minutes after the CEO.

On its face, there’s nothing remarkable about someone using a phone in a restaurant. Nearly everyone does. But a trained observer might notice the timing—activity coinciding precisely with the CEO’s arrival and departure—and the location—a vantage point with a clear view of the target. These tiny, seemingly harmless actions can be enough to communicate, record, or track a target’s movements without ever attracting attention.

Correlation Over Time and Distance

Another form of correlation, previously discussed, involves time and distance. This type of pattern can be much harder to detect, since no specific action—no photographing, communication, or movement—is necessarily observed. The only consistent factor is the repeated presence of the same individual (or individuals) in different places where the target happens to be.

The absence of detectable actions might reflect the operative’s skill, the use of covert devices, or even limitations in the surveillance detection (SD) team’s capabilities. This isn’t about failure or blame—SD operatives are human, after all—but rather about staying open to all available possibilities when identifying potential indicators.

What makes correlation over time and distance especially difficult to detect is not the person in the moment, but the recognition of that same person across multiple settings. It’s the ability to realize that someone from today’s crowded restaurant was also in yesterday’s busy café, and perhaps near last night’s event venue. This adds a new layer of complexity—real-time detection isn’t enough.

An effective SD approach may require recording or mentally noting all individuals who occupy key vantage points around the target throughout the day, regardless of whether they display any suspicious actions. Later comparisons across different times and locations can reveal recurring individuals—potential correlations that might otherwise go unnoticed.

The Challenge of False Positives

Naturally, this process produces plenty of false positives. People are creatures of habit. The same individual sitting near a window every morning in a coffee shop across from a secure facility might simply be a regular customer who enjoys that seat. Balancing vigilance with realism is crucial.

Experience and analytical tools can help filter out background noise, but there are no foolproof methods that guarantee zero false positives. Think of it this way: you want more potential positives than actual ones—but not so many that you overwhelm yourself with noise. If you flag fifty potential operatives at a single location, the odds of finding the real one among them plummet.

A simple rule of thumb:

  • Once — coincidence.
  • Twice — suspicious.
  • Three times — correlation.

It’s not perfect, but it provides a practical starting point.

The “Where’s Waldo?” Exercise

A useful way to grasp the concept of correlation over time and distance is through a mental exercise I call “Where’s Waldo?” (or “Where’s Wally?” for the UK readers). The premise is simple: identify the individual who keeps showing up in different places and times.

The twist in surveillance detection, of course, is that you don’t know what “Waldo” looks like. Before you can start looking for him, you first have to figure out who he is.

Try it for yourself with the following series of photos. The quality is intentionally low—because in real life, surveillance detection rarely comes with perfect resolution and lighting. These images were all taken in the same downtown area over the course of two hours. If some photos seem empty, confusing, or frustratingly ambiguous, then you’re getting a small taste of what real SD work feels like. See if you can spot the same individual in all the photos, but don’t worry if you can’t. Remember—all you need is a minimum of three.

Final Thoughts

As always, no article, book, or seminar can truly teach someone how to perform surveillance detection. Although some of the phrasing here may sound instructional, this article is not intended to train anyone in operational SD techniques. Its purpose is to shed light on the complexity, subtlety, and discipline required to recognize what most people never notice.

Get my new espionage thriller, Ghost Echo – on Amazon, December 15th.