By Scott Stewart

Last week’s Security Weekly discussed how the criminal planning cycle is very similar to the terrorist attack cycle. As one reader noted in response, this is because many terrorist actions such as murders, arsons, kidnappings and even bombings can also be done for criminal rather than political motives. Indeed, terrorism and criminality have long been closely intertwined, with terrorist groups using armored car heists and bank robberies to finance their activities. Even today, in places like Yemen and the Sahel, jihadist groups are using crimes such as smuggling and kidnapping for ransom as important sources of financial support.

Some other readers have written in to argue that criminals do not follow a process but rather irrationally respond to impulses. While there certainly are some people who engage in criminal activity as a result of being mentally disturbed, in a fit of passion or heavily under the influence of an intoxicating substance, such individuals tend to be quickly apprehended. In my experience, most criminals are quite rational, even if they have no moral qualms about preying upon fellow human beings. They want to escape and enjoy the fruit of their crime, and they rationally plan their crimes accordingly. This brings us back to the criminal planning cycle.

As mentioned last week, as part of the planning cycle, nearly all criminals need to conduct surveillance while they are planning a crime. Some criminals such as scammers and hackers can do their work by phone or by Internet, never needing to make physical contact with their target. But most types of criminals do conduct physical surveillance of potential targets. The amount of time a criminal will spend conducting this surveillance varies, depending on the type of criminal involved. A stalking-type criminal such as a kidnapper will conduct far more surveillance than an ambush-type criminal such as a purse-snatcher. Nevertheless, all these criminals are vulnerable to detection if someone is looking for them. And in this week’s Security Weekly, we are going to describe what criminal surveillance looks like and how potential victims can spot it.

Criminal Surveillance

Just because criminals need to conduct surveillance to plan a crime does not mean that they are good at it. In fact, most criminals are terrible at surveillance. But they are able to succeed despite their shoddy tradecraft because most people simply do not practice good situational awareness and do not pick up on the surveillance mistakes criminals make. Now, there are some exceptions. For example, the high-end jewel theft group from the Balkans that Interpol has labeled the Pink Panthers has demonstrated a very high degree of surveillance tradecraft. But such sophisticated surveillance tradecraft is the exception rather than the rule.

I am purposefully using the term “tradecraft” to describe surveillance technique. Tradecraft is an espionage term that refers to techniques and procedures used in the field, but the term also implies that effectively practicing these techniques and procedures requires a bit of finesse. Tradecraft skills tend to be as much art as they are science, and surveillance tradecraft is no exception. As with any other art, you can be taught the fundamentals, but it takes time and practice to become a skilled surveillance practitioner. Also, as with art, some people are simply more gifted at surveillance than others and can seemingly disappear in a crowd.

Most individuals involved in planning crimes are not trained to conduct surveillance, and they do not devote the time and effort necessary to master the art of surveillance. Because of this, they tend to display terrible technique, use sloppy procedures and generally lack finesse when they are conducting surveillance.

When teaching surveillance detection, the U.S. government uses the acronym TEDD to explain the elements of identifying potential hostile surveillance. TEDD stands for time, environment, distance and demeanor. In other words, if you see someone repeatedly over time, in different environments and at a distance, or if you notice someone who displays poor surveillance demeanor, you can assume you are under surveillance.

These elements can also be used while looking for criminal surveillance, but the time, environment and distance elements are only applicable to stalking-type criminals conducting extensive surveillance for a crime such as a kidnapping. In many cases potential victims only encounter the criminal in one place and time and therefore will not be able to make time, environment or distance correlations. Therefore, when we are talking about recognizing criminal surveillance, demeanor is the by far the most critical of the four TEDD elements. Demeanor also works in tandem with all the other elements, and poor demeanor will often help the potential victim spot the criminal conducting surveillance at a different time and place or in a different environment.

More on Demeanor

Demeanor is a person’s outward behavior and bearing — how those watching an individual perceive that person. In order to master the art of surveillance, one needs to master the ability to display appropriate demeanor for whatever situation one is in. Practicing good demeanor is not intuitive. In fact, the things one has to do to maintain good demeanor while conducting surveillance frequently run counter to human nature. Because of this, intelligence, law enforcement and security professionals assigned to work surveillance operations receive extensive training that includes many hours of heavily critiqued practical exercises, often followed by field training with a team of experienced surveillance professionals. This training teaches and reinforces good demeanor and helps surveillance practitioners hone their tradecraft.

Criminals typically do not receive this type of training, although in some cases, trained operatives may become criminals. In criminal groups that practice good surveillance tradecraft, such as the aforementioned Pink Panthers, it is likely that the group includes trained former members of intelligence or security services who have taught surveillance tradecraft to the other members.

At its heart, surveillance is watching someone while attempting not to be caught doing so. Therefore, it is an unnatural activity, and a person doing it must deal with strong feelings of self-consciousness and of being out of place. People conducting surveillance frequently suffer from what is called “burn syndrome” — the belief that the person/people they are watching have spotted them. Feeling “burned” will frequently cause the person conducting surveillance to do unnatural things, such as hiding their faces or suddenly ducking back into a doorway or turning around abruptly when they unexpectedly come face-to-face with the person they are watching.

People inexperienced in the art of surveillance find it difficult to control this natural reaction. Even seasoned surveillance operatives experience the feeling of being burned; the difference is they have received a lot of training and they are better able to control their reaction and behave normally despite the feeling of being burned.

Cover for Status and Action

In addition to doing something unnatural or stupid when feeling burned, another very common mistake made by criminals when conducting surveillance is the failure to get into proper character for the job or, when in character, appearing in places or carrying out activities that are incongruent with the character’s costume. The terms used to describe these role-playing aspects of surveillance are “cover for status” and “cover for action.” Cover for status is a person’s purported identity, his costume. A person can pretend to be a student, a businessman, a repairman, etc. Cover for action explains why the person is doing what he or she is doing — why that particular character has been standing on that street corner for half an hour.

The purpose of using good cover for action and cover for status is to make the presence of the person conducting the surveillance look routine and normal. When done right, the person conducting surveillance fits in with the mental snapshot subconsciously taken by the target as the target goes about his or her business. Inexperienced people who conduct surveillance frequently do not use proper (if any) cover for action or cover for status, and they can be easily detected. An example of bad cover for status would be someone dressed as “a businessman” walking in the woods or on the beach. An example of bad cover for action is someone pretending to be sitting at a bus stop waiting for the bus but who remains seated at the bus stop even after the bus for that route has passed.

For the most part, however, inexperienced operatives conducting surveillance practice little or no cover for action or cover for status. They just lurk and look totally out of place. There is no apparent reason for them to be where they are or for doing what they are doing. This is the demeanor displayed by most criminals.

In addition to plain old lurking, other giveaways include a person moving when the target moves, communicating when the target moves, avoiding eye contact with the target, making sudden turns or stops or even using hand signals to communicate with other members of a surveillance team or criminal gang. Those conducting surveillance can also tip off the person they are watching by entering or leaving a building immediately after the person they are watching or simply by running in street clothes.

Sometimes, people who are experiencing the burn syndrome exhibit almost imperceptible behaviors that the target can sense more than observe. It may not be something that can be articulated, but the target just gets the gut feeling that there is something wrong or odd about the way a certain person is behaving toward them. Innocent bystanders who are not watching someone usually do not exhibit this behavior or trigger these feelings.

As mentioned above and last week, most criminals are terrible at surveillance and exhibit hostile demeanor. They are able to succeed in their crimes by the fact that most people simply are not looking for them. For potential crime victims who practice good situational awareness, the poor surveillance tradecraft exhibited by criminals is good news. It means that criminals can be detected and avoided.