SEC-03-02
Recognizing and Understanding the Threat
Fixed, mobile, and technical collection — and the vulnerabilities every surveillance effort shares
Lesson 01 covered how a surveillance team organizes and moves. This lesson covers what to call what you’re seeing, why they’re watching in the first place, and — most important — the specific vulnerabilities every surveillance effort has regardless of how well it’s run. This is where SEC-03 ends. Section “The Surveillance Team’s Own Vulnerabilities” below is the exact foundation SEC-07 (Watching the Watchers: Operations) builds on when it teaches you to design and run a surveillance detection route.
Fixed, Mobile, and Technical Surveillance
Recognizing the Difference in Practice
SEC-02 introduced these three categories. This section teaches you to tell them apart in the field, because the response to each is different.
Fixed surveillance is a static observation post: a parked vehicle with sightline to your location, a person stationed in a doorway or vehicle for an extended period, a rented room or vantage point overlooking a location your group uses. Fixed surveillance trades mobility for persistence. Its weakness is exactly that fixed position: it cannot follow you once you leave the area, and its presence, once identified, is a known and stable thing you can watch back.
Mobile surveillance is a team or individual that moves with you — on foot, by vehicle, or a combination. This is what the box and leap-frog techniques from Lesson 01 are built to sustain. It’s more resource-intensive than fixed collection but follows you wherever you go, which fixed surveillance cannot do.
Technical surveillance is collection that doesn’t require a human being physically present at all: a vehicle tracker, a camera on a pole, a compromised phone, an RF intercept. SEC-07 covers detecting technical collection in depth, and COM-03 (COMSEC) and COM-04 (EMCON) cover protecting your own communications and emissions so there’s less to collect in the first place. It matters here because a sophisticated collection effort often blends all three — a fixed camera covering the location, a tracker handling the mobile problem, and a human team only deployed when technical means confirm something worth a closer look. Assuming you’re only up against one type is a mistake.
Telling them apart at a glance
If the same person or vehicle is always in the same place regardless of where you go, that’s fixed. If the same person or vehicle keeps appearing at different places you go, that’s mobile. If nothing visible ever repeats but someone keeps showing up who shouldn’t know where you’ll be, suspect technical.
What They’re Looking For and How They Collect It
Surveillance is never the objective — it’s a collection method in service of some larger question. Understanding what a watcher is actually trying to answer helps you understand why they position where they do, and for how long.
Pattern of life — when you leave, when you return, who you’re with, what route you take. This usually requires the longest observation period and is often built through fixed surveillance over days or weeks before any mobile follow is attempted.
Associations — who you meet, where, and how often. This is frequently the actual objective: not you, but who else shows up when you do.
Confirmation of a suspicion — a shorter, more targeted observation intended to confirm or rule out something already believed. This tends to be brief and can end abruptly once the watcher has what they came for.
Vulnerability assessment — security posture, routine, points where you’re predictable or exposed. Relevant to opportunistic criminal actors as much as to more organized collectors.
The method of collection follows the objective. A team building a pattern of life over weeks will favor fixed observation and infrequent, well-spaced mobile follows to avoid detection through repetition. A team confirming a single suspicion may risk a shorter, closer follow because they don’t need it to go unnoticed for long.
The Surveillance Team’s Own Vulnerabilities
The Foundation SEC-07 Is Built On
A surveillance operation, however well run, is not invisible — it is only harder to see than an amateur effort. Every technique from Lesson 01 exists to manage a real vulnerability, which means every technique has a corresponding signature if you know what you’re looking for. This is the entire premise of a surveillance detection route: you cannot force a team to reveal itself through luck. You can design a route that puts pressure on their vulnerabilities until they do — and that design work is exactly what SEC-07 teaches.
| Team Vulnerability | Why It Exists |
|---|---|
| Repetition | A team has a finite number of people, vehicles, and cover identities. Over a long enough observation period, or across an unusual enough route, the same faces and vehicles start to reappear — the exact Exposure indicator SEC-02 taught you to watch for in yourself now applies to them. |
| Choke points | A team following you through a genuinely unpredictable route has to commit resources to cover every plausible path. A route with a small number of natural choke points forces the team to be visible at a point you control. |
| Reaction to the unexpected | Teams plan around your expected pattern. A sudden, unexplained change in your behavior forces a real-time decision: break cover to stay with you, or lose you. Either choice can be observed. |
| Communication signature | Coordinating a leap-frog or a box requires the team to communicate. That communication is itself a detectable activity in the right circumstances, and it means the team’s actions are synchronized — and synchronized behavior has its own pattern. |
Camp X SOE material on checking for surveillance describes exactly this logic: walk up a comparatively empty street and see who follows; cross the street and see who does likewise; enter and leave a shop and note who lingers outside. Each of these is a deliberate, low-risk action designed to force a genuine surveillance element to make a choice it would rather not make — stay with you and become visible, or break contact and lose you. SEC-07 formalizes this into a designed surveillance detection route rather than an improvised set of checks.
You’ve been designated your MAG’s security lead. Over the past ten days, you’ve noticed a gray sedan twice — once parked near the turn-off to the group’s regular meeting property, and once, several days later, in the parking lot of the feed store you visit roughly weekly. Both times the vehicle was occupied by a single person who appeared to be on a phone. You did not get a plate number either time. You have not yet seen the vehicle a third time, and nothing else about either sighting stood out as unusual on its own.
Student task: Based on this course only (not yet SEC-07), what type of surveillance would this be consistent with if it is surveillance at all — fixed, mobile, or something else? What is the specific vulnerability above that a third sighting, if it happens, would exploit? What would you do differently on your next trip to the feed store, and why, without doing anything that would reveal you’ve noticed? (Worked answer provided after submission.)
Tell fixed, mobile, and technical surveillance apart from a field description.
Explain the four collection objectives — pattern of life, associations, confirmation, vulnerability assessment — and how each shapes the collector’s method.
Name at least three specific vulnerabilities a surveillance effort has regardless of how well it’s run.
Next Course →SEC-07: Watching the Watchers — Operations