I am Marko Tuisk, founder and CTO of TSCM Partners. I have spent more than ten years in this work, from the junior end of a team through to technology leadership. I started at Cope Whiterock. I am still a partner there. I was also CTO of Mobilewatch. Mobilewatch used radio-frequency sensors to place a device indoors, and to show when a personal handset (mobile phone), or a Bluetooth or Wi-Fi communication device, was present in a room where policy said it should not be. That positioning and detection work is the radio grounding behind what follows. Among the team it became a joke that I was the one who kept following unusual surveillance routes until the mechanics were clear. Through TSCM Partners I also serve my own clients. We are based in London, with a specialist team working in France, Germany, and Estonia. Some of what follows is technical. Some of it is simple once you have seen it done. A detector walk around a boardroom is the opening of the brief. The rest of the brief covers computers and phones, the way a room carries sound, radio that appears for a fraction of a second, and physical setups that never install a bug at all.
What a standard brief already covers
Procurement, general counsel, and the board still need the basics done properly. These are the items I expect on any professional sweep before anyone talks about rarer methods.
Listening devices and hidden cameras
Active radio transmitters, recorders that store audio and stay quiet, and concealed cameras in executive rooms. If the team cannot do this layer cleanly, the rest of the brief is noise.
Deal rooms, disputes, and board votes
The loss in a sale, a patent fight, a board vote, or a regulatory hearing is the conversation itself. The sweep is there so that talk stays in the room while the decision is still open.
The building
Untagged network cable, HVAC ducts with no baffle, glass that carries speech into a corridor, and ceiling voids nobody walks. These are physical paths. A radio scan will not show them.
A record counsel can file
Directors are asked, after an incident, what technical care was taken. A written sweep, tied to data-protection duties and to the physical controls in ISO/IEC 27001, is that record. It shows the check happened, who authorised the rooms, and what was examined.
Staff can see that the room is being looked after
A visible, competent visit tells people inside the company that these rooms are on a list. Cheap devices tend to land in buildings where nobody opens a ceiling tile.
What shows up after enough rooms
These points rarely make a brochure. They are where a security or intelligence team gets day-to-day value.
A measured baseline
A first visit should leave a map of the radio noise floor, the thermal picture, and the harmonics on the power line. Later, a short transmission has something to be compared with. Without that map, a burst is just another spike in a noisy building.
Kit nobody remembers
Sweeps keep finding equipment the building forgot: IoT sensors, a smart television left in a setup mode, a small server behind plaster, a building-management controller with a Wi-Fi fallback still switched on. An outside party can use those before anyone plants a new device.
A clean result still answers a legal question
When a leak is already suspected, finding no technical device is useful. It takes the planted-bug hypothesis off the table for that day and those rooms, so counsel and forensic accounting can spend their time on people with access. The report has to say exactly which rooms and which methods that conclusion rests on.
If a device comes out of the wall
When an implant is recovered, the handling matters. Non-destructive work can still yield solder traces, component marks, board batch codes, and what is on the memory. That material goes to the client's threat-intelligence people. It is evidence, so the chain of custody starts on site.
Sound that travels with no electronics
Some wall panels, hollow doors, and duct runs amplify a boardroom into a reception corridor. Nothing was installed. The architecture does the work. A sweep that only hunts transmitters will call that room clear and still leave the corridor able to hear the vote.
Collection that uses the room and the devices already there
A growing share of jobs never starts with a new microphone. The collector uses glass, a phone already in a pocket, a cable, or a power circuit.
Speech off glass, and off a phone's own sensors
A laser interferometer can read speech from a window pane by the vibration. Motion sensors in a phone, the gyroscope and the accelerometer, also register air pressure from voices in the room. Practical answers on site include film or masking on the glass, damping where the pane meets the frame, and a rule for which phones are in the room during a closed session.
Recorders that transmit for a fraction of a second
A device can store audio for a working day and then send it in a cellular or sub-GHz burst of a couple of hundred milliseconds, often in the middle of the night. A team that is only in the building from nine to five will miss that burst. The practical answer is a monitor left in place, watching radio and, where the brief asks for it, the audio spectrum, and alerting when the picture changes.
Signals that sit inside ordinary radio noise
Ultra-wideband, spread-spectrum, and frequency-hopping bursts can look like 5G or Wi-Fi if you only glance at a waterfall. Software-defined radio, with classification on the stream, is how we separate those bursts from the traffic the building is supposed to have. The classifier is an aid. A person still decides what gets reported.
Equipment that arrives already wrong
Video bars, handsets, and monitors can be altered before they reach the room. Before installation we can check new executive kit with a non-linear junction detector and, where the risk justifies it, portable X-ray or backscatter, looking for extra silicon and parts that do not belong on that board.
Devices with no battery
Some collectors take their power from radio energy, vibration, or heat already in the room. There is no cell to find on a thermal camera in the way people expect. The tell is often a small, odd load on a power circuit. Mapping that distortion is now part of a serious electrical check.
Lines of work most corporate briefs never name
These are real mechanisms. They are uncommon on a standard corporate visit, and several of them stay in the research column until a brief, a lawyer, and the physics all line up.
Leaving a found device in place, under control
In a narrow set of cases, a found implant can be left running under written operational control. Different rooms are then given different, marked figures, so that if a number resurfaces you can see which room it came from. That is a counter-intelligence decision. A normal corporate sweep removes what it finds and reports it. This other path needs counsel before it is discussed, and it is not something we do because it sounds clever.
Leakage from ordinary electronics
Keystrokes and screen contents can leave as electrical noise: coil whine from a laptop power brick, a router LED flickering faster than the eye, radiation from an HDMI or DisplayPort cable. TEMPEST work and the related side-channels are why shielding the space sits next to hunting for a planted device. Both belong in the same survey when the information is sensitive enough.
Reading radio while barely disturbing the field
A conventional antenna changes the field it is trying to measure. Laboratory work with Rydberg atoms in a vapour cell can read a very wide band, into the gigahertz and terahertz, with very little of that disturbance. I include it so the ceiling of the method is on the page. A Tuesday boardroom still gets spectrum analysers, a physical search, and monitors we can actually leave behind.
Looking into the wall
Millimetre-wave radar, read as a micro-Doppler signature, can be aimed at the fabric of the room: a person who should not be in a void, or a listening interface set into plaster. The search target is the structure and who is in it, alongside the hunt for a transmitter.
How much could leave a sealed room
One research question sits above the device list. Given this volume, what is the most information that could leave through radio, sound, and vibration, even after every practical search is clean. That bound is a statement about the room. It sits in the report next to the list of devices that were not found.
How this lands on a job
On a serious brief we leave radio monitors in place between visits, and we still open the room by hand. The monitor is there for the transmission at three in the morning. The physical search is there for the duct, the glass, and the cable that was never on the drawing. If you already check a laptop before you trust it with a board paper, apply the same habit to the room: the air, the glass, and the stray radio are part of that check. The categories behind this note are set out in our guide to TSCM threat categories, for anyone who wants the map without the field story.
Questions about these terms
What is a bug sweep in security terms?
A bug sweep is a point-in-time search of a room, vehicle, or workplace for listening devices, hidden cameras, and other technical collection. In security work it is the name most buyers use for that visit. TSCM is the wider discipline around it: how the room carries sound, what the radio environment looks like, and what happens after the team leaves.
What is a radio noise floor?
The radio noise floor is the ordinary level of radio energy in a place: Wi-Fi, mobile phones, building systems, and background hiss. A sweep records that level so a later spike can be compared with what the building usually does.
What is a TSCM baseline?
A TSCM baseline is the measured picture from a first visit: the radio noise floor, the heat picture, and the electrical harmonics on the power line. Later checks use it. A short transmission stands out only if you know what the room looked like when it was quiet.
What is a store-and-burst transmitter?
A store-and-burst transmitter records audio on the device, then sends it in one short radio burst, often a few hundred milliseconds, and often at night. A team present only during the working day can miss that burst. A monitor left in place is there to catch it.
What is an implant in technical surveillance?
In this work an implant is a device placed to collect information: a microphone, a camera, a tracker, or a circuit added to equipment. It is the object a search is trying to find or recover.
What is a non-linear junction detector?
A non-linear junction detector, often called an NLJD, looks for electronic junctions such as diodes and transistors inside walls, furniture, and objects. It is used when a device may be switched off and therefore silent on the radio.
What is TEMPEST?
TEMPEST is the name for unintended electrical leakage from ordinary equipment. Keystrokes, screen contents, and other data can leave as coil whine from a power brick, a status light flickering faster than the eye, or radiation from a video cable.
What is a side-channel in surveillance?
A side-channel is a path that carries information without a planted microphone. Sound through a duct, vibration in glass, and electrical noise from a power brick are side-channels.
What is a waterfall display in radio work?
A waterfall is the scrolling picture of radio energy over time on a spectrum display. A quick look can make a hopping or spread-spectrum signal look like ordinary 5G or Wi-Fi.
What does sub-GHz mean in a TSCM sweep?
Sub-GHz means radio below 1 gigahertz. Some covert transmitters use those frequencies for a short burst because the signal travels through a building more readily than a higher-frequency link.
What is energy harvesting in a surveillance device?
Energy harvesting means the device takes its power from radio energy, vibration, or heat already in the room. There is no battery to see on a thermal camera in the way people expect. The clue is often a small, odd load on a power circuit.
Why would a found listening device be left in place?
In a narrow set of cases, and only with written operational control and counsel, a found device can be left running. Different rooms are then given different marked figures, so that if a number comes back you can see which room it came from. A normal corporate sweep removes what it finds and reports it.
What are Rydberg atoms in radio measurement?
Rydberg atoms are a laboratory method for measuring a very wide radio band while disturbing the field very little. A Tuesday boardroom still gets spectrum analysers, a physical search, and monitors that can be left on site.
What is millimetre-wave radar in a room search?
Millimetre-wave radar can be aimed at the fabric of a room to look for a person who should not be in a void, or a listening interface set into plaster.
What is micro-Doppler?
Micro-Doppler is the small shift in a radar return caused by motion, such as a person or a mechanism moving inside a wall or a void. In a room search it is a way to read that motion.
What is chain of custody when a device is found?
Chain of custody is the written record of who handled a recovered device, from the moment it comes out of the wall to the point it reaches the people who will examine it. It matters because the device may be evidence.