The Executive Security Blind Spot: Expert Q&A on Hidden Devices at Work and Home

A. No. We discuss this constantly within my team and among the partners we work with. When will the next corporation be hit? It was only a matter of time. I doubt it will be the last incident we hear about during the next year.

A. TSCM is a detailed survey, or sweep, of a space to find illicit recording or tracking devices, and the vulnerabilities that would allow someone to plant them. This can be a boardroom, an executive suite, a residence, a vehicle, a maritime vessel, or an aircraft. We look at the electronic side, meaning anything that is transmitting in the space or any hidden electronics (even when switched off). We also look at the physical side, meaning what items are in the room and what is plugged into them. And we look at security as a whole, including how someone could get into the space, where they could place something, and even what they could potentially hear from outside the room.

A. Threats are coming more from the inside than from the outside. An unknown person walking into a building is far less likely to attempt this type of activity than someone on the inside. Often, the outside threat finds inside access.

The term we use is "time on target." By that, I mean, how easy is it for someone to get into a specific area, plant a device, leave it, and come back later? Years ago, a device would have been buried in a wall or above a ceiling tile. Now the devices are so small they can be fixed under a table or hidden in plain sight. So, we look for what does not belong. 

A. We see it constantly. For example, Amazon sells a charging block with a built-in camera for less than $50. In fact, I used one during a demonstration recently. Someone can plug it in, return after the meeting, remove it, and take out the memory card. One version has a visible lens, and the other has a false face that conceals it entirely. Charger cables do the same thing for a few hundred dollars. Once plugged into a phone, the cable becomes a listening device or loads malware that opens the microphone and camera.

We see it in the field in our work with clients. During a routine TSCM sweep at a principal's residence, for example, our team often finds standard mobile device chargers. We caution our clients not to purchase these through a third-party seller or Amazon. The reason is that there are mobile device chargers that resemble charging cables but are embedded with hardware linked to malware. When found, this prompts an immediate review of purchasing protocols and digital security awareness training for household staff.

A. Complacency, more than anything. I discuss this with finance clients in particular. They have invested in high-technology security, and the assumption that follows is that nobody can get in. Security cards, or key cards, are a good example of an access control item that can be cloned. I carry a reader that can copy a key card with a single tap, and the copy opens every door the original does. Anything electronic can be corrupted, and nothing is outside the scope of entry. Finding devices in boardrooms is our specialty. But what we usually find first is a client who did not believe anyone could reach the room.

A. Unless it is a single small room, a sophisticated survey is not a one-hour process. A true TSCM survey takes a minimum of three to four hours and up to eight or more, depending on the square footage and what is in the space. A primary residence with electronics in every room takes longer than a sparsely furnished second home.

We use REI (Research Electronics International) equipment exclusively, and it is the industry standard for TSCM. We use the OSCOR, the MESA, the ORION, and the ANDRE because no single tool can do everything. Each of our technicians carries all four and is certified on each, which is the standard among law enforcement, government, and corporate security firms.

In our surveys, we look at everything, including windows. I am based in South Florida, where many of our clients overlook the water. Is there adequate window screening to keep conversations from being picked up through the glass by a laser microphone?

We see the same issue in corporate settings: a boardroom facing another building forty feet across the street, with nothing to dampen the vibration. We examine charger cables, charger blocks, and USB ports, precisely because of what occurred at OpenAI. We inspect the IT closets. And we survey vehicles, vessels, and aircraft, where we are looking for tracking devices as much as recording devices.

A. Once we complete a sweep, the space is clear as of that time. The moment we leave, the area is vulnerable to whoever comes and goes. For corporate environments, we recommend a cadence throughout the year, whether that is monthly, quarterly, or twice annually. That is the client's decision, and the budget is part of it.

A. Many clients look at the overall figure and push it into a future budget. What we can do is tailor the survey to the most vulnerable locations. In a corporate setting, we don't need to cover an entire 18,000 square foot floor; we can concentrate on the executive suite and the boardrooms, where sensitive conversations occur. The same applies to residences. For a 17,000 square foot home, we ask: realistically, where could the client's conversations be exposed to recording? Certain clients will never see the kitchen, for example, and so we reduce the square footage accordingly.

A. They may have close protection and residential security in place, but there are blind spots, particularly for principals who work on company networks as well as home setups. Cyber is frequently not on their radar. And it comes back to physical security. A device planted in a residence tells someone the principal leaves every day between 9 a.m. and 4 p.m. This is why TSCM and a residential security assessment belong together.

A. Do not share devices. Do not accept charger cables or blocks from anyone outside your inner circle. Buy directly from the manufacturer wherever possible and go to the store rather than buy a thirty-pack online for $20. At the corporate level, mark your cables so staff know which devices are yours and that they have not been tampered with. It is risk and reward. And like insurance, it is a cost of doing business. The cost of a TSCM survey is known before we begin. The cost of a trade secret in a competitor's hands is often not known until it is too late to remedy.

Crisis24 Private Strategic Group conducts TSCM surveys of offices, boardrooms, residences, vehicles, maritime vessels, and aircraft worldwide. Every survey is performed by certified technicians, scoped to the spaces where sensitive conversations occur, and delivered with a written report of findings and recommendations. Surveys may be commissioned as a single engagement or as a recurring program and are often paired with a residential security assessment for families or an executive protection program for organizations. 

To discuss a TSCM survey of your residence, executive offices or boardroom, contact us at [email protected] or visit Crisis24 Private Strategic Group to learn more.