Hostile Surveillance Detection for Soft and Hard Targets

By Jim McGuffey, M.A., CPP, PSP, PCI

Following drastic increases in terrorist attacks in recent years facility and security managers must begin to incorporate hostile surveillance detection into their security strategies to better protect their facilities. Without this added security strategy, facilities are highly susceptible to criminal and terrorist attacks. Law enforcement agencies must also receive training in this area.

My experience in surveillance detection training began in 1982 when I started work in the armored car industry in Chicago. My first day on the job as a supervisor, I was required to observe a security video on the importance of being aware of your environment. I recall one example the video shared; observing several cigarettes on the ground near a car window as you approached the location you were servicing might be an indicator of recent suspicious activity. That activity being that person (s) had arrived earlier to observe how you work or that an attack was imminent.

After riding armored trucks for the first three years in the Chicago area, I learned that observing those who might be conducting surveillance was an acquired skill, one which your life depended on. Our security team often found it difficult to observe a crew without being spotted to ascertain if they were operating securely as drivers were trained to be observant and most of the time observed the security person observing their activities which was the desired result management sought.

Unfortunately, during my 26 years of working in the industry, there were times when team members were not observant, resulting in the unpleasant experience of notifying several families, that their sons would not be returning home.

I have since, shared the importance of surveillance detection training before national and international audiences and have taught surveillance detection courses in numerous countries. After asking more than 600 of those attending training sessions, seminars or webinars, how many had received training on this subject, there were less than 10 people who acknowledged received such training. I have also inquired of U.S. police officers both active duty and retired only to be advised in most cases, that no training had been given.

Global terrorist attacks grew from 3 a year in the 80’s to 1 a month in the 90’s to 1 a week from 2001 to 2003 to 1 a day from 2003 to 2015. From 1968 to 2002 there were 11,723 terrorist attacks killing and injuring 37,137 in 147 countries. Whereas in 2016 alone there were 11,072 attacks causing 25,600 deaths and 38,800 injuries (26% killed were perpetrators).

Although most facilities or soft targets do not have sufficient resources or  funding to properly implement a well-trained team of security personnel trained in the area of hostile surveillance detection, there is much that can be done to ensure your facility is not being surveilled without personnel and cost.

Terrorist planning cycle:

  • Preliminary Target Selection
  • Initial Surveillance
  • Final Target Selection
  • Pre-attack Surveillance
  • Planning
  • Rehearsal
  • Execution
  • Retreat & Exploitation

It has been well established that terrorists participate in a planning cycle lasting weeks, months or years, prior to an attack. Hostile surveillance is part of this planning cycle and usually occurs twice during their planning phrase.

Although terrorists and criminals acquire substantial information about potential targets from the internet, employees and open sources, it is important to have a physical presence at sites to observe vulnerabilities and for planning purposes.

Terrorists conduct surveillance to discover a target that will provide the most media exposure following an attack as well as to learn the vulnerabilities or weaknesses of a facility that can be exploited to ensure a successful attack. It is during this surveillance that law enforcement, private security and trained personnel have the best opportunity to observe and report suspicious activities without the surveillants knowledge.

Terrorists conducting hostile surveillance seek to position themselves in positions that provide a safe entrance and exit as well as allowing for observation of vulnerabilities. During the first round of surveillance, less experienced terrorists may be used to collect information to decide which facility to attack. Due to their lack of experience, this may present the best opportunity to detect and report this activity.

Once the target has been identified, terrorists will send more experienced members to assess vulnerabilities within the physical protection system and facility operations. Terrorists have three requirements, safe entry, safe exit and visibility to observe vulnerabilities. Based on these requirements, we can surmise where terrorists will position themselves to conduct surveillance. These positions are known as Red Zone positions. Knowing this, we position security personnel in locations known as green zones to observe red zone operators without being seen.

Red Zones

1) View of the target. Terrorists want to observe vulnerabilities, so they need a good view.

2) Cover and concealment. Terrorists need to be able to apply cover and concealment tactics.

3) Safety and Exit. Terrorists need a safe route to enter and exit the site.

Terrorists often use props and ruses during their surveillance. A prop might be a utility vehicle with a terrorist pretending to work on a utility pole. It is important that security personnel receive training in the use of props and ruses.

Who can and should be trained in surveillance awareness? Law enforcement, security personnel and employees should receive training on Hostile Surveillance Detection.

Most soft targets are unable to support a surveillance team however personnel can be trained in the below noted activities that are indicative of hostile surveillance:

A few suspicious activities are:

  • Taking photos of security systems
  • Avoiding eye contact when approaching
  • Making notes or drawings of things of non-interest
  • Asking questions about security systems and protocols
  • Improper response to questions asked by security
  • Photographing ID’s, HAVC systems, security vehicles, etc.
  • Bending down to tie shoe as someone approaches
  • Pacing off distance at a facility
  • Sitting at a bus or transportation stop while bus or train passes by
  • Alarm activations without apparent cause (testing response)
  • Deliberately causing activation of alarm such as no exit door
  • Taking selfies with security system in background
  • Sitting in a parked car for long period of time
  • Lacking proper responses to questions if confronted
  • Looking suspicious while entering or departing a facility (looking around, ducking or shifting eye contact when someone approaches)
  • Multiple sightings of suspicious people
  • Turning a corner and stopping suddenly to see if being followed
  • Cigarette butts lying on the ground outside a parked vehicle

One or two of these activities alone may not indicate that your location is under surveillance, but it should raise a red flag that additional observation may be warranted. Under no circumstance, do not approach people acting suspicious for your safety and also, we don’t want to chase them away. Report these sorts of suspicious activities to law enforcement who may have had other reports of suspicious activities and want to conduct countersurveillance to see what other information can be learned.

Approaching the suspicious person could result is death or serious injury. Also, if law enforcement is able to observe those conducting surveillance, it could result in lives saved by collecting and sharing intelligence information. Otherwise terrorist will just move onto the next facility which could result in many casualties.

Standard reports should be used to report suspicious persons, vehicles and activities. should be standard so that descriptions used are easily understood. For example, weight description-slight built, medium built or heavy built. Focus on identification of things that don’t change such as scars, etc. Obtaining photos are helpful but are not worth the risk of being observed.

This article is not intended to represent a policy or standard for a Hostile Surveillance program nor is it intended to serve as a detailed description of Hostile Surveillance but rather to highlight the importance of having such a program or security strategy in place to protect facilities from attack by criminals or terrorists.


Jim McGuffey CPP, PSP, PCI served 3 years in the military, 8 years in law enforcement, and 26 years in the armored car industry where during his 26-year tenure he had responsibility for several-thousand armed guards, 50 facilities and a thousand armored vehicles. For the past 7 years he has served as a private security contractor teaching antiterrorism courses in Middle East, Africa, Europe, Asia, South America, Latin America and Mexico for various companies hired by the Department of State; one of the courses is Surveillance Detection. He holds a B.A. in Criminal Justice and M.A. in Management and has worked security cases in the U.S., Canada and South America for both attorneys, governments and private individuals as is often called on by various news media to discuss security incidents.

Jim has been an ASIS member since 1981, serving as past Chair for the Savannah Low Country Chapter, ASIS Assistant RVP, past House of Worship Committee Chair, Physical Security Council, and presently serves on the Cultural Properties Council. Jim serves as a Technical Committee member for several ASIS Standards and is an InfraGard Sector Chief-Commercial Facilities for the SC InfraGard Chapter. He holds a B.A. in Criminal Justice and a M.A. in Management and has delivered 50 antiterrorism training courses in Africa, Middle East, Asia, South America, Mexico and Latin America.