A bug sweep is a professional inspection designed to identify covert surveillance devices and security weaknesses within a property, vehicle or other sensitive environment. The technical discipline behind this work is known as Technical Surveillance Countermeasures, or TSCM.

A professional inspection is not limited to searching for a hidden microphone. Depending on the circumstances, it may include a physical search, radio-frequency analysis, examination of telephone and network infrastructure, detection of concealed cameras, inspection for GPS or Bluetooth trackers, and a review of how an unauthorised person could gain access to the space.

Modern surveillance equipment is widely available, inexpensive and easy to conceal. Cameras and microphones may be built into smoke detectors, alarm clocks, USB chargers, power strips, picture frames, air fresheners, electrical fittings or other everyday objects. Some devices transmit continuously; others record locally, remain dormant or communicate only at intervals. This is why no single detector or phone app can establish that a room is secure.

The purpose of TSCM is to establish what is present, assess what may have happened and recommend what should happen next. In many assignments, the most useful outcome is not the discovery of a device but the identification of a vulnerability before it is exploited.

What can a professional bug sweep detect?

The methods used depend on the location, the suspected threat and the information at risk. A properly scoped inspection may look for:

• Hidden microphones and audio transmitters, including devices designed to operate intermittently.
• Covert cameras concealed within everyday objects, fixtures or the fabric of a building.
• GPS, cellular and Bluetooth tracking devices attached to vehicles, luggage or personal possessions.
• Unauthorised radio-frequency transmitters and suspicious wireless activity.
• Hard-wired devices connected to power, telephone, data, alarm or conferencing systems.
• Passive or dormant electronics that may not be transmitting during the inspection.
• Physical signs of tampering, covert entry or unusual alterations to a room, vehicle or device.
• Security weaknesses involving access control, temporary staff, contractors, meeting protocols or confidential information.

Effective TSCM combines specialist equipment with a methodical physical examination and an investigator’s understanding of concealment techniques, access opportunities and likely adversary behaviour.

When should you consider a bug sweep?

A sweep may be appropriate following a specific incident, when unexplained information leakage is suspected, or as part of a planned security programme. Common situations include:

• Confidential business discussions, mergers, acquisitions, litigation or sensitive negotiations.
• Suspicion that private information is reaching an unauthorised person.
• Unexplained knowledge of conversations, movements or commercial decisions.
• Stalking, harassment, coercive control or concern about an unwanted tracker.
• A change of occupancy, staff departure, relationship breakdown or dispute involving access to premises.
• Executive travel, temporary accommodation or meetings held away from a controlled office.
• Preparation for a high-profile event or the arrival of a sensitive client or delegation.
• Periodic assurance for boardrooms, executive offices, family offices and other high-risk locations.

A perceived privacy breach can also have an innocent explanation. A professional assessment should begin with the facts, avoid assumptions and consider both technical and non-technical causes.

For travel-specific risks, read our guide to hidden cameras in rentals, hotels and temporary accommodation.

What happens during a TSCM bug sweep?

1. Confidential threat assessment

Before attendance, the team should establish why the sweep is required, who has had access, what information may be at risk, which rooms or vehicles are relevant, and whether there is an immediate safety or evidential concern. This determines the scope, equipment, personnel and timing of the inspection.

2. Site control and preparation

Where possible, the environment is kept in its normal operating state until the inspection begins. Discussion of the planned sweep should be restricted. If a hostile party knows an inspection is imminent, a device may be removed, disabled or altered before the team arrives.

3. Physical and technical examination

The team conducts a systematic inspection of the agreed area. This may involve visual examination, radio-frequency surveying, spectrum analysis, non-linear junction detection, thermal imaging, optical camera detection, examination of power and communications infrastructure, and specialist inspection of furniture, fixtures and vehicles.

The order and combination of techniques matter. A device that is silent during one test may be identified through another method or through the physical evidence surrounding its installation.

4. Assessment and evidential handling

Not every unusual signal or object is a surveillance device. The team should distinguish legitimate electronics from suspicious equipment and document anomalies. If an item may be evidence of stalking, voyeurism, blackmail, corporate espionage or another offence, its position and condition may be important. Removal should be considered alongside personal safety, legal advice and the need to preserve evidence.

5. Reporting and recommendations

The client should receive a clear report explaining the areas inspected, methods used, significant findings, practical limitations and recommended actions. Advice may cover access control, meeting procedures, key management, network configuration, vehicle security or the frequency of future inspections.

Can a phone app or consumer detector replace TSCM?

Consumer tools can sometimes identify obvious Bluetooth devices, visible camera lenses or strong radio signals. They can also produce false positives and may miss dormant, hard-wired, passive, shielded or carefully concealed equipment. A device that records to local storage or transmits only intermittently may not appear during a basic scan.

A consumer check may be a useful immediate precaution, but it should not be treated as proof that an environment is secure, particularly where personal safety, litigation or highly confidential information is involved.

What should you do if you find a suspicious device?

Avoid confronting a suspected perpetrator or immediately destroying the item. If it is safe, photograph the device in position, restrict access to the area and seek professional advice. Where stalking, threats, voyeurism or another offence may be involved, contact the police. If the item could be relevant to litigation, speak to your legal advisers before it is moved or examined.

Residential, corporate and vehicle sweeps

Residential TSCM

Residential assignments may arise from stalking, relationship disputes, unauthorised access, domestic staff, contractors or high-profile family circumstances. The work should be discreet and trauma-informed, particularly where coercive control or personal safety is involved.

Corporate TSCM

Businesses can find more detail in our guide to corporate electronic sweep services.

Corporate inspections commonly focus on boardrooms, executive offices, legal departments, meeting facilities and communications infrastructure. The technical sweep should form part of a wider security plan covering access, visitor management, document handling, smart devices and the use of temporary meeting locations.

For vehicle and personal tracking concerns, see our practical guide to AirTag and covert GPS tracker detection.

Vehicle sweeps

Vehicles can be targeted with GPS, cellular, Bluetooth or audio devices. A proper inspection may require a secure location, lifting equipment and enough time to examine the exterior, interior, wheel wells, body cavities and relevant electronic systems.

Choosing a TSCM provider

• Confirm that the proposed scope covers the actual rooms, vehicles and threat concerns.
• Ask who will conduct the work and what relevant technical and investigative experience they have.
• Understand what the report will contain and whether evidential support is available if a device is found.
• Check how confidential information, photographs and technical findings will be stored and shared.
• Be cautious of guarantees that no surveillance is present; every inspection has practical limitations that should be explained.

Learn more about Conflict International’s Counter-Surveillance and Bug Sweeps (TSCM) service.

Professional Bug Sweep and TSCM Services

Conflict International provides discreet TSCM and counter-surveillance support for private clients, businesses, legal teams and organisations in the UK and internationally. Assignments can be scoped for residential properties, corporate premises, temporary meeting locations and vehicles.

Concerned that a property, meeting space or vehicle may be compromised? Contact Conflict International in confidence. We will assess the circumstances, explain the available options and recommend a proportionate next step.