Counter-surveillance should be understood as lawful protective security: assessing whether there is credible evidence of unwanted monitoring, reducing unnecessary exposure, checking premises or devices where justified, preserving evidence and improving security without escalating the situation. It should not be treated as a handbook for defeating lawful surveillance, and it does not justify jamming signals, hacking accounts, interfering with other people's property or taking retaliatory action.
At Trojan Investigations, we distinguish between a genuine security concern and understandable anxiety caused by coincidence. A professional assessment starts with facts: what has happened, what evidence exists, who could realistically have access, whether there is an immediate safeguarding risk and which lawful checks are proportionate.
Published: 20th March 2024 | Updated: 4th September 2026
What Is Counter-Surveillance?
Counter-surveillance is a broad term for protective measures used to identify, assess and reduce the risk of unwanted observation, tracking, interception or monitoring. Depending on the circumstances, this can include:
- a structured review of suspicious incidents;
- physical-security and access-control checks;
- reviewing account and device security;
- checking whether location sharing or connected devices are exposing information;
- specialist technical inspection of premises or equipment where there is a credible reason to do so;
- preserving messages, images, logs or devices that may later be needed as evidence; and
- referral to police, safeguarding services, legal advisers or cyber specialists where the concern is outside a private investigator's role.
The objective is protection and evidence, not confrontation.
Why the Old “Spy Versus Spy” View Is Misleading
Modern surveillance concerns may involve physical observation, connected devices, online accounts, location-sharing features, social media, vehicle technology, compromised credentials or ordinary CCTV. A person can therefore feel monitored even when there is no single hidden device to find.
At the same time, unusual coincidences do not prove surveillance. A credible assessment should separate observations from assumptions and consider innocent explanations before escalating to expensive or intrusive measures.
| Concern | What it may indicate | Initial safe response |
|---|---|---|
| Unexpected account alerts | Compromised credentials, attempted login or benign security notification | Use the provider's official security controls, change compromised credentials and preserve alerts |
| Unknown location sharing | Account settings, family sharing, app permissions or unwanted access | Review authorised devices and sharing settings without confronting a suspected person |
| Unexplained device or object | Could be ordinary equipment or something requiring specialist assessment | Photograph in place and obtain advice before dismantling or destroying it |
| Repeated unwanted following or watching | Could form part of harassment or stalking depending on pattern and context | Keep a factual incident record and prioritise police or safeguarding advice if risk is present |
| Sensitive conversations becoming known | Human disclosure, account compromise, insecure meeting practice or technical monitoring | Review who knew the information and secure likely disclosure routes |
| Business information leaking | Insider, supplier, compromised account or accidental disclosure | Preserve access evidence and start a scoped corporate investigation |
Counter-Surveillance Is Not the Same as Avoiding an Investigator
A legitimate protective-security service is designed for people or organisations concerned that they are being monitored without justification or are suffering a security compromise. Teaching a subject how to defeat lawful observation is different and can create safety, legal and ethical problems.
Where our clients require ordinary investigative observation, we provide professional surveillance services within a defined objective. Where a client believes surveillance is being conducted against them, the risk assessment starts from a different question: what is the evidence, what harm could result and what lawful protective action is justified?
Physical Counter-Surveillance Should Begin With Security Basics
Before assuming that specialist equipment is involved, review ordinary access. Who has keys or passes? Have locks or codes been changed after staff, contractors or partners left? Are visitors escorted where needed? Can sensitive rooms be entered without a record? Are spare keys controlled? Is confidential material visible from public or shared areas?
For businesses, this is part of wider protective security. For private clients, it may be as simple as reviewing who legitimately has access to the home, vehicle or digital accounts before commissioning specialist technical work.
Digital Security Is Now Part of Counter-Surveillance
The National Cyber Security Centre's guidance for practitioners supporting victims of technology-facilitated domestic abuse explains that technology can be misused in domestic-abuse, stalking and harassment contexts. That means a security review may need to consider accounts and connected devices as well as physical spaces.
Digital checks that do not require hacking or specialist intrusion
- review the security page of important email and cloud accounts for recognised devices and sessions;
- enable strong multi-factor authentication where the service supports it;
- check location-sharing and family-sharing settings;
- update phones, computers, routers and connected devices;
- remove accounts or devices that no longer need access;
- change reused or exposed passwords through official account settings; and
- preserve suspicious notifications or messages before deleting them.
If abuse, stalking or coercive control is suspected, changing settings can sometimes alert the person responsible. Safety planning should therefore come before a sweeping technical reset, particularly in domestic-abuse cases.
Signal jamming is not an acceptable private counter-surveillance technique
Older articles sometimes recommend signal jammers. That advice is not appropriate in the UK. Government guidance published in 2026 states that section 68 of the Wireless Telegraphy Act 2006 prohibits using apparatus such as a jammer for the purpose of interfering with wireless telegraphy and describes use of a jammer as a criminal offence.
Trojan Investigations does not advise clients to jam mobile, GPS, Wi-Fi or other radio services.
What About Hidden Cameras and Listening Devices?
There is no safe rule that every unfamiliar electronic item is a listening device. Modern premises contain sensors, chargers, network equipment, alarms, smart speakers, cameras and building-management hardware that can be mistaken for surveillance technology.
Where there is a credible reason for concern, a technical inspection should be proportionate to the environment and documented carefully. The client should avoid damaging unknown equipment, because it may belong to a landlord, employer, utility provider or another lawful system and may also be evidence.
Audio Recording Requires Particular Caution
Audio monitoring can be substantially more intrusive than ordinary visual surveillance because it may capture private conversations and information about people who are not relevant to the concern. Organisations considering recording should therefore obtain appropriate data-protection and legal advice rather than treating audio as a routine counter-surveillance measure.
A counter-surveillance concern does not create a blanket right to start secretly recording every conversation. The legal position depends on context, purpose and how the recording is used.
Stalking and Harassment Change the Risk Assessment
Repeated following, watching, spying or monitoring can be relevant in stalking and harassment cases depending on the wider pattern and context. The significance comes from repeated behaviour and impact, not from one isolated incident.
If a client reports fear, threats, repeated unwanted following, domestic abuse or escalating behaviour, personal safety comes before a commercial investigation. Police and specialist safeguarding support may be the correct first route. Our personal investigation services are not a substitute for emergency protection.
When a Business Suspects It Is Being Monitored
Businesses may become concerned after confidential meetings leak, visitors behave unusually, staff report suspicious approaches or information appears in the hands of a competitor. The right response is to establish a baseline and preserve evidence.
1. Define the sensitive information
Identify exactly what became known and when. This immediately narrows who legitimately had access and whether the concern is physical, digital or human.
2. Review access before assuming a technical device
Check meeting invitations, shared folders, email distribution, contractors, advisers, visitors and ordinary staff knowledge. Human disclosure is often easier than technical interception.
3. Preserve suspicious artefacts
Keep original emails, photographs, access logs and unusual devices intact where possible. Do not wipe systems or throw items away simply because they look suspicious.
4. Escalate proportionately
The next step may be cyber incident response, a physical-security review, technical inspection, internal investigation, legal advice or police contact depending on the evidence.
Counter-Surveillance for Executives and High-Risk Roles
Executives, researchers, legal teams and staff involved in sensitive negotiations may hold information that makes them attractive targets for social engineering or unwanted observation. Protective measures should focus on predictable exposures: unsecured devices, public discussion of sensitive travel, uncontrolled meeting rooms, excess account access and online profiles that reveal more than necessary.
Our security services can support a wider review where the issue is protective security rather than a single suspected incident.
What Counter-Surveillance Cannot Lawfully Mean
Protective security has limits
- It does not permit hacking another person's device or account.
- It does not permit deliberate radio-frequency jamming.
- It does not justify trespassing to search another person's property.
- It does not justify damaging a suspected tracker or camera before ownership and evidence issues are considered.
- It does not replace police action where there is immediate danger, stalking, domestic abuse or serious crime.
- It should not become an escalating attempt to confront or “catch” a suspected observer.
How We Assess a Counter-Surveillance Concern
| Question | Why it matters | Possible next step |
|---|---|---|
| What exactly happened? | Separates facts from interpretation | Create a dated incident chronology |
| Who had legitimate access? | Tests ordinary explanations first | Review keys, accounts, permissions and recipients |
| Is there a repeated pattern? | One incident may be coincidence; repetition can change the assessment | Preserve comparable events without provoking a response |
| Is anyone at immediate risk? | Safety takes priority over evidence gathering | Police or safeguarding referral where appropriate |
| Could a device or account be compromised? | Technical monitoring may not require a hidden physical device | Use appropriate cyber or technical specialists |
| What decision must the evidence support? | Prevents open-ended intrusive work | Scope the investigation around a clear objective |
When Is a Technical Sweep Appropriate?
A technical sweep can be appropriate when there is a specific reason to believe a location, vehicle, meeting space or equipment may have been compromised. The scope should be proportionate to the risk, the environment and the type of information at stake.
It is less useful when there is no defined concern and the client expects a single sweep to prove that no form of monitoring exists. A technical inspection is one layer of a wider security assessment, not a guarantee against every possible method of observation or information leakage.
Why Evidence Preservation Matters
When people discover something suspicious, their instinct may be to unplug, dismantle, wipe or throw it away. That can destroy useful evidence. Where it is safe to do so, document the item or alert in its original state, record where it was found and seek advice before altering it.
If a device is causing an immediate safety concern, safety takes priority. Otherwise, preservation can help establish ownership, function, timing and whether the apparent surveillance concern has an innocent explanation.
Counter-Surveillance Should Reduce Risk, Not Create More of It
Effective counter-surveillance is calm, evidence-led and proportionate. It improves control over premises, devices, accounts and sensitive information while identifying when specialist or public-authority support is needed. It does not rely on dramatic assumptions or illegal technology.
If you have a specific concern about unwanted monitoring, suspected devices, information leakage or a pattern of suspicious observation, you can book a confidential consultation with Trojan Investigations. We will first establish what is known and what outcome you need before recommending any investigative or security response.
Technical Surveillance Counter-Measures Have Limits
A technical surveillance counter-measures inspection can help assess a defined physical or electronic concern, but clients should understand what it can and cannot prove. A sweep is an examination of a particular environment at a particular time. It cannot establish that no monitoring has ever occurred, and it may not identify a risk that exists only through an online account, an authorised connected device or a person with legitimate access.
For that reason, technical work should normally sit alongside an access review, account-security review and factual chronology. A technically clean room does not explain why confidential information is leaking if the real route is an email compromise or a person who is authorised to attend the meetings.
Counter-Surveillance in the Workplace
Employees may sometimes believe they are being watched because of CCTV, access control, vehicle telematics or other monitoring used by an employer. A professional counter-surveillance assessment should not assume that all observation is unlawful. Employers can have legitimate security, safety and operational reasons for monitoring, but data-protection rules still require lawful and fair use.
Where the concern is workplace monitoring rather than stalking or covert criminal activity, the appropriate route may include the employer's privacy information, HR process, data-protection officer, trade union, legal adviser or the ICO rather than a technical sweep.
What Makes a Suspicion More Credible?
| Weak indicator | Stronger indicator | Why the difference matters |
|---|---|---|
| Seeing the same type of car twice | The same identifiable vehicle repeatedly appearing at unrelated locations over time | Repetition and specificity make the observation easier to test |
| A phone battery draining quickly | Security alerts, unknown sessions or verified malicious software | Battery behaviour has many ordinary causes; technical evidence is more meaningful |
| A colleague knew something private | Information repeatedly known outside the limited group with authorised access | Creates a definable information-leak question |
| An unfamiliar object in a room | An item whose function and ownership cannot be established after ordinary checks | Rules out routine building or consumer equipment first |
| Feeling watched | A dated pattern of repeated following, waiting, messaging or monitoring behaviour | Documented patterns are more useful for risk and safeguarding decisions |
What Clients Can Do Before a Consultation
Prepare evidence without escalating the situation
- write a chronology using dates, times and places rather than conclusions;
- save original account alerts, messages and screenshots;
- list everyone with legitimate access to the relevant property, vehicle, room or account;
- note any recent changes in staff, relationships, passwords, keys or shared devices;
- avoid posting accusations or details of the concern on social media;
- do not tamper with unknown equipment unless safety requires immediate action; and
- tell us about threats, domestic abuse, court orders or police involvement at the outset.
Why a Proportionate Response Is More Reliable
Counter-surveillance concerns can become expensive quickly if every coincidence is treated as evidence of a sophisticated operation. A staged approach is more useful: confirm the facts, secure obvious exposures, assess risk, then commission specialist work only where it can answer a defined question.
This protects the client from unnecessary cost and from taking actions that could increase danger or destroy evidence. It also produces a clearer record if the matter later needs to be explained to police, a solicitor, an employer or a court.
Sources and References
- National Cyber Security Centre — Guidance for practitioners supporting victims of technology-facilitated domestic abuse.
- National Cyber Security Centre — Small organisations guide to cyber security, 2026.
- Information Commissioner's Office — Guidance on video surveillance, including CCTV, and data-protection principles.
- Crown Prosecution Service — Stalking or Harassment prosecution guidance.
- Protection from Harassment Act 1997 — UK legislation.
- Department for Science, Innovation and Technology — Possession of radiofrequency jammers and the relevant legal framework, 2026 call for evidence.
- Wireless Telegraphy Act 2006 — section 68 and related interference provisions.
- Computer Misuse Act 1990 — UK legislation.