Preparing for the Audit
The Inspection
The area should not be prepared or altered from its normal condition. No conversations concerning the audit should take place within target offices or on target telephones. In the case of a real-time monitoring audit the occupants of the target areas should not necessarily be aware of it taking place. It is imperative that no warning be given to eavesdroppers which may enable them time to remove or switch off listening devices. If possible the TSCM Auditor should be given a briefing as to the reason for the inspection (routine or special) and any other relevant information which may allow the Auditor to tailor the inspection for the particular circumstance.
When Should the Inspection Take Place?
The inspection should take place at a time when it would be expected that a listening device was going to be active. In the case of remotely activated devices this should occur during business hours and preferably during a meeting. It is not always convenient or practical to conduct full audits at these times and if possible the audits should be split so as to provide a satisfactory coverage.
Who Should Know?
The possibility of someone discussing the intended audit in a target area is obviously increased as the number of people “in the know” increases. The less people that know that a TSCM audit is to take place the better the chance of catching the eavesdropper off guard.
It is good practice for a prominent person within the organisation to introduce the TSCM Auditor to the target area and personnel so as to demonstrate that the TSCM Auditor has the backing of management for their inspection. Their cover may take the form of a Building Inspector, Management Consultant, Communications Consultant, etc., anything that may detract from their real purpose and yet allow the Auditor to conduct the inspection without hindrance.
What Form Should It Take?
- Physical Searches
- Scanning of the Radio Frequency (RF) Spectrum
- Optical Scanning of the Environment
- Electronic Scanning of Furniture and Fittings
- Inspection of Communication Systems
The Follow Up
At the end of the inspection the TSCM Auditor will provide a report indicating what was inspected and what the result was.
For clients that require protection on a regular basis, audits should be scheduled for times of greatest risk. The level of inspection will depend upon the frequency of the audits. Audits should occur at least once a month and especially after renovations and equipment installation or maintenance.
The TSCM Auditor should establish a communication channel with the client that is based on cooperation and trust. Understandably this will take some time to establish, however it is an integral part of the Countermeasures Strategy.
