Technical surveillance countermeasures (TSCM) exists because information can leave a room in more than one way. Some paths are electronic. Some are optical. Some are built into the building itself. This guide maps the main TSCM threat categories so newcomers can see what the field covers, and so security, facilities, and legal buyers can scope a sweep or programme against the right risk, not a vague fear of "bugs." Each category opens in plain language, then lists what operators actually hunt. Core categories cover most corporate and private jobs. Expanded categories change method, tools, and time on site. The comparison table lists all twelve categories by target, detection difficulty, and primary defence. For the definition of TSCM itself, see What is TSCM?
How to use this page
TSCM threat categories are the groups of technical and physical routes used to capture conversations, images, credentials, or data from people and premises. A professional job is scoped to the categories that match the site's access and risk: RF and physical search for planted devices; deeper infrastructure, acoustic, and cyber checks when the threat model needs them. If you are new to the field, read the plain line first. If you write scopes of work, use the inventories and the advanced comparison table.
Audio and RF bugs
In plain terms: someone wants the conversation in the room without being in the room. That is the classic bug. Operators look for stand-alone digital audio recorders, GSM callback bugs, VHF/UHF radio-frequency transmitters, and directional laser microphones. Most buyers still picture this category when they ask for a bug sweep. These threats are real, and they are only part of the job.
Visual and optical surveillance
In plain terms: someone wants to see what happens in the room (faces, documents, screens, whiteboards), not only hear it. Operators look for hidden wired or wireless pinhole cameras, covert Wi-Fi lenses, long-range optical trackers, and thermal or infrared recording tools. A clean RF survey does not clear a lens. Visual threats need physical search and optical checks as much as spectrum work.
Mobile and network threats
In plain terms: the compromise sits on phones, cell infrastructure, or computers, not only a transmitter under a table. Operators look for spy-phone malware and trojans, IMSI-catchers (fake cell towers), remote access trojans (RATs), and workstation keyloggers. A TSCM visit does not replace an IT forensic review. Scope these explicitly when phones, guest Wi-Fi, or executive workstations are in the risk model.
Location and IoT devices
In plain terms: trackers and sensors that follow people, vehicles, or rooms. They are often small, cheap, and easy to miss. Operators look for unauthorised GPS vehicle trackers, Bluetooth beacons, AirTags and similar consumer trackers, and compromised smart-office sensors or IoT hardware. IoT clutter raises the noise floor. Continuous wireless coverage between sweeps can matter here; a one-day spectrum snapshot alone may not.
Physical and electromagnetic leaks
In plain terms: information leaves through wiring, fibre, power, or unintended electromagnetic radiation, not only through a planted microphone. Operators look for TEMPEST-style electromagnetic emissions from keyboards or monitors, fibre-optic taps, power-line bugs, and conduit or wiring intrusions. These paths need infrastructure literacy: risers, closets, cable routes, and equipment placement. Gadget detectors alone are not enough.
Emerging and advanced threats
In plain terms: methods that use physics, drones, or everyday objects turned into collection tools. Operators look for high-speed video vibrometry (recovering audio from vibrating surfaces such as window panes via laser or video), drone-borne RF sniffers, and modified everyday items such as USB-C cables or smart appliances. Advanced does not mean fictional. It means rarer, costlier to mount, and easy to miss if the job only hunts yesterday's transmitter.
Supply chain interdiction and hardware trojans
In plain terms: the device arrives already compromised, before it enters your building. Hostile actors may intercept deliveries and embed permanent, microscopic eavesdropping chips into the logic boards of new IT equipment, servers, routers, or even executive furniture. Main defence: X-ray inspection, physical disassembly where justified, and vendor supply-chain auditing. Detection difficulty is usually extremely high.
Power line carrier (PLC) transmitters
In plain terms: the bug talks through the building's electrical wiring instead of broadcasting into the air. Surveillance devices can use existing AC mains wiring to carry captured audio. Rather than radiate RF that a spectrum analyser might catch, they inject high-frequency modulated signals into the electrical grid, often toward a listening post on the same transformer circuit. Main defence: power-line modulation analysers, line filters, and isolated transformers. Detection difficulty is usually high.
Passive acoustic leakage and structural infiltration
In plain terms: no electronic bug is required. The room itself leaks sound. Sound travels through shared HVAC ductwork, unbaffled acoustic ceiling tiles, hollow wall cavities, plumbing lines, or poor door seals. Nearby listeners may use the naked ear or contact microphones. Main defence: acoustic noise generators, sound masking, and structural sound-isolation testing. Detection difficulty is usually medium. Speech-privacy work (acoustic security) complements device-focused TSCM here.
Infrastructure and wireline wiretaps
In plain terms: interception happens in the building's telecom plant, not under the conference-table lip. Attackers may patch physical wiretaps into phone blocks, cross-connect frames, or copper network trunks inside MDF/IDF closets or risers, sometimes well away from the target room. Main defence: time-domain reflectometry (TDR) and physical security of utility areas. Detection difficulty is usually medium.
Optical and LED data exfiltration
In plain terms: a status light becomes a secret data channel, flashing too fast for the eye to see. Malicious software or hardware implants can exfiltrate data from an air-gapped system by rapidly pulsing an equipment status LED. The micro-flashes are invisible to humans but recordable and decodable with a line-of-sight optical receiver or telescope. Main defence: physical lens masking, anti-reflective window films, and light-tight server enclosures. Detection difficulty is usually high.
Acoustic cyber exfiltration (air-gap bridging)
In plain terms: two devices talk in ultrasound (sound above human hearing) to move data across an air gap. A compromised, air-gapped computer can use built-in speakers to beam keystrokes or other data to a rogue smartphone or hidden receiver in the same room. Main defence: continuous audio-spectrum monitoring and disabling unneeded audio hardware. Detection difficulty is usually high.
Comparison of TSCM threat types
All twelve threat categories on this page, with primary target, detection difficulty, and main defence. Use it when briefing boards, facilities, or counsel on scope.
| Threat category | Primary target | Detection difficulty | Primary countermeasure / defence |
|---|---|---|---|
| Audio and RF bugs | Conversations in rooms and vehicles | Medium to high | RF survey, physical search, nonlinear junction detection |
| Visual and optical surveillance | Sightlines, screens, documents, faces | Medium | Physical search, optical inspection, Wi-Fi camera detection |
| Mobile and network threats | Phones, cellular airspace, workstations | High | Device review, IMSI/cellular checks, cyber forensics coordination |
| Location and IoT devices | Vehicles, people, smart-office sensors | Medium to high | Wireless survey, physical search, IoT inventory |
| Physical and electromagnetic leaks | Wiring, fibre, power, unintended emissions | High | Infrastructure inspection, TEMPEST-aware checks, cable tracing |
| Emerging and advanced threats | Windows, drones, modified everyday items | High | Specialist optical/RF methods, item inspection, site geometry review |
| Supply chain interdiction | New IT hardware and furniture | Extremely high | X-ray inspection, physical disassembly, vendor supply-chain auditing |
| Power line carrier (PLC) | Building electrical grid | High | Power-line modulation analysers, line filters, isolated transformers |
| Passive acoustic leakage | Architectural and structural flaws | Medium | Acoustic noise generators, sound masking, structural sound-isolation testing |
| Infrastructure wiretaps | Telecom closets (MDF/IDF) | Medium | Time-domain reflectometry (TDR), physical security of utility areas |
| Optical exfiltration | Equipment status LEDs | High | Physical lens masking, anti-reflective window films, light-tight server enclosures |
| Acoustic cyber (ultrasonic) | Air-gapped computer systems | High | Continuous audio-spectrum monitoring; disable unneeded audio hardware |
What this means for sweep scope
A useful engagement brief names which categories are in scope and which are out. Standard corporate boardroom work usually covers core audio/RF, visual/optical, location/IoT awareness, plus physical search of authorised rooms. Elevated infrastructure risk adds wireline/MDF checks and power-path review. Speech-privacy concern without a planted device adds passive acoustic assessment, often with acoustic specialists. High-assurance or hostile supply-chain context adds hardware assurance methods beyond a typical day-scope sweep. TSCM is a day-scoped judgment of the rooms and systems you authorise, not a lifetime certificate. Access after the visit often matters as much as what was found on the day.
Common questions
What are the main TSCM threat categories? Six core families cover most buyer conversations: audio and RF bugs; visual and optical surveillance; mobile and network threats; location and IoT devices; physical and electromagnetic leaks; and emerging or advanced methods. Expanded categories cover supply chain, PLC, passive acoustics, wireline taps, optical LED exfiltration, and ultrasonic air-gap bridging. Is a "bug" only a hidden microphone? No. Bug is everyday language for planted listening devices. Professional TSCM also covers cameras, trackers, network and mobile compromise, infrastructure taps, and paths that need no planted device. Do all TSCM sweeps cover every category on this page? No. Scope follows the threat model, time, and access you authorise. How is passive acoustic leakage different from an electronic bug? Passive leakage is a building and speech-privacy problem. Closing it often needs acoustic controls, not only RF or physical device search. Can TSCM find malware on phones or air-gap exfiltration by itself? Not as a substitute for cyber forensics or continuous monitoring. Name those seams in scope when they matter.
What to do next
Clarify the definition and day-scope model in What is TSCM. Compare labels buyers use in TSCM vs bug sweep. For bookable UK corporate work, use the commercial sweep path on this site; for London rooms, see the London location page. For speech privacy and structural leakage, see Acoustic Security in the partner ecosystem. For multi-site cadence, see How to manage multi-site TSCM and TSCM Pilot.