Surveillance detection route
============================

A surveillance detection route (SDR) is a structured movement through a series of locations used by CIA case officers and their recruited assets to determine whether they are being followed before, during, or after a clandestine operational meeting. A properly executed SDR forces any surveillant to either reveal themselves through repeated appearances at improbable intersections or break off pursuit.

Doctrine

What counts as surveillance

The operative definition is a threshold rather than a sighting: "The definition of surveillance is multiple sightings at time and distance. So you see the car multiple times at different places." He gives the same operational definition, "multiple sightings at time and distance", in terms of people rather than vehicles: seeing the same person repeatedly, at different places and different times of day.

Standard timing

For an operational meeting in the field, the doctrinal SDR pattern is approximately three hours of surveillance detection before the meeting, two hours for the meeting itself, and a further two-hour SDR home, a total commitment of around seven hours for an asset to deliver intelligence to a case officer.

In high-threat counterintelligence environments, Kiriakou specifically names China, Russia, and Cuba, the standard SDR is eight hours. The longer duration is required because the host service deploys infrared cameras (for body-heat detection through walls and vehicles) and surveillance helicopters, with the cost of detection being the asset's execution. "They're going to catch the guy that you're trying to meet and they're going to execute him. So you have to really make sure that you're not being followed."

The mechanics of a route

The mechanics of a properly executed SDR are technically specific:

- Kickoff point, the asset's starting location: home, office, or wherever they would routinely be at that hour.
- Red road, a major thoroughfare with heavy traffic; surveillance cannot be detected on a red road, so red roads serve only as connective tissue between SDR stops.
- Black road, a residential or minor through-street with low traffic; surveillance is exposed by repeated appearance on a black road.
- SDR stops, three or more visits to plausibly routine errand destinations (dry cleaner, wine shop, fabric store) chosen to look like ordinary errands. At each stop the asset notes the make, model, color, and license plate of every nearby vehicle.
- The provocative phase, the "stair-step": a sequence of provocative directional changes (block right, block left, block right, block left) that no ordinary driver would execute. Surveillance has no way to follow without revealing itself.
- Final approach, between the third stop and the meeting, deliberately bizarre driving maneuvers (pulling halfway down a residential block, into a driveway, U-turning, into another driveway, U-turning) to expose any surveillance not already detected.
- Abort, if surveillance is confirmed, the asset returns home without making the meeting and re-attempts the SDR 24 hours later.

The mad minute

The first sixty seconds of any operational meeting between case officer and asset must cover four standard questions, asked in immediate succession in case the meeting is interrupted:

1. Were you followed?
2. Are you in fear for your safety?
3. How much time do you have for this meeting?
4. The case officer and asset must commit a date, time, and place for the next meeting before any other business is discussed.

This protocol is referred to internally as the mad minute.

Mapping routes with early GPS (Athens, 1998,2000)

Kiriakou dates the arrival of satellite positioning in his own operational life to Athens in 1998, 1999 and 2000, and stresses how primitive it was: it reported how many satellites were in view and, on a button press, returned geo-coordinates. There was no routing. The station turned that limitation into a record-keeping tool, "we were able to use that in order to to map out surveillance detection routes that had been successful. So it helped us, you know, come up with safer and different surveillance detection routes."

The episode is one of his standard illustrations of commercial off-the-shelf tradecraft: buying an existing technology and finding the operational use afterwards, rather than commissioning one.

The adversary

How host services respond

Host surveillance services adapt to the SDR with techniques designed to defeat each layer of detection:

- Plate changes mid-tail
- Wardrobe and disguise changes (wigs, mustaches, hats)
- On-foot pickups, operators bail out of the surveillance vehicle and continue on foot, subway, or bus when the asset transitions out of their car
- Pre-positioned rental cars in parking garages, used by Kiriakou himself in high-threat areas as a switch vehicle
- Infrared cameras and helicopters in China, Russia, and Cuba

Layers behind layers

Kiriakou describes arranging to meet a suspected hostile walk-in outside a Marriott, riding in a car with a security officer while a team of a dozen CIA officers covertly photographed the surveilling Iranian team and their license plates to identify which foreign service was running the operation. He notes the Iranians sometimes added a secondary counter-surveillance layer on motorcycles to follow their own followers, sophisticated tradecraft, in his assessment, though the Iranians were unaware the CIA had positioned yet another layer behind that.

Old-school technique, now used domestically

Kiriakou says domestic agencies like ICE now use the low-tech surveillance the CIA once relied on: multiple cars breaking on and off a target, static watchers with binoculars, and a French technique the CIA adopted, sending 50 people walking toward a target so he never notices the ones who peel off to follow.

Pattern of life

Varying the routine

A related personal-security discipline is the deliberate disruption of one's daily pattern of life. A CIA officer in a high-threat environment varies the time of departure from home and the route to work daily; an asset under surveillance from a hostile service must vary their visible routine (the time at which they leave home, the coffee shop they visit, the route they walk) to deny the hostile service a reliable strike opportunity. Kiriakou traces the lesson to his CIA training and his two years in Athens, and states it without qualification: never set a pattern of behavior, because as soon as adversaries detect a pattern, "they're going to kill you."

Athens, and the morning he overslept

In John Kiriakou's tour in Athens (1998,2000), when Revolutionary Organization 17 November was active, his commute from home to the U.S. embassy could take anywhere from twenty minutes to two hours on a given day. "You're going to be in eventually. We're all working 12- and 14-hour days anyway, so it's not like you're not going to put in your eight hours. So we're just driving like crazy people all over the city."

A single failure of this discipline can be fatal: Kiriakou overslept on the morning of March 2000, was forced to take Kifissias Avenue (the most direct, concrete-Jersey-barrier-bounded route to the embassy), and arrived in heavy traffic alongside the assassinated vehicle of Stephen Saunders, whom 17 November had killed in his place.

The route in practice

Verifying that an asset ran one

Case officers verify that their assets are actually executing SDRs as claimed, since an asset's claim of "yes, I did one" is unreliable. The standard verification procedure is for the case officer to request a surveillance team from headquarters that observes the asset along the asserted route. One Athens asset of Kiriakou's executed "a surveillance detection route that was so ridiculously good" that the CIA surveillance team broke off rather than risk their cover being blown.

Bahrain, what happens when you don't go home

Kiriakou described a political officer in Bahrain who, on detecting surveillance during the second phase of her SDR, abandoned doctrine and instead led the surveillance team on a high-speed chase across the island. The consequence was that she was identified as an undercover CIA officer and placed under surveillance every single day for the following three years, while Kiriakou, who had gone to the grocery store and the hardware store on the same day, was never bothered again.

The red helmet (Pakistan)

While serving in Pakistan, Kiriakou noticed a man on a motorcycle wearing a red helmet working hard to stay in his blind spot on his commute; the same man reappeared later that day and again the next morning at different times and locations, meeting his own operative definition of surveillance, "multiple sightings at time and distance." He reported it to his station's security officer, and by that afternoon, worried enough that he told colleagues he was prepared to kill the man if he saw him again, confronted a local-service general directly at a shared safe house, asking, "General, are you following me?" He never saw the man again. Kiriakou later learned the officers of the local intelligence service had suspected his friendliness was a ruse, "nobody's that nice", and had deliberately assigned their worst surveillance officer to test him; had he not confronted the general that afternoon, he believes the man would have ended up dead.

Teaching it, and living under it

Kiriakou as instructor

Kiriakou served as a surveillance and surveillance-detection instructor at the CIA in parallel with his day job; instructor duties ran at night. He has stated that his first book contains an extended account of how seriously he took surveillance during his Athens tour, and that he subsequently wrote a separate later volume, The CIA Insider's Guide to Surveillance and Surveillance Detection, devoted entirely to the subject. He taught a university-level course on it at George Washington University. Of the operational training he went through when he moved from analysis into counterterrorism operations, what he took to most was surveillance and surveillance detection, which he calls "the gold standard of situational awareness."

The class that caught the FBI (2012)

Kiriakou recounts teaching a surveillance detection route course at George Washington University in the summer of 2012. Walking a dozen 18-year-old students through a route across the P Street Bridge in Washington, he spotted the FBI team tailing him, two on foot, a woman "reading a newspaper" in a parked car, and had the students note their descriptions and plates. His lawyer then called: the FBI had complained he was "acting very suspiciously." Kiriakou's message back was that a group of first-day students had spotted the vaunted Bureau's surveillance.

"Discreet to lose"

Following his departure from the agency, Kiriakou maintained the discipline and identified the FBI following him almost immediately. He observes that the population of plausible surveillants is wider than usually assumed: "It could be a private eye because your spouse doesn't trust you, it could be a carjacker or a mugger, or the FBI, or the local cops." He discontinued routine SDR practice only in approximately 2025. He says FBI counter-surveillance against him post-CIA follows a style he calls "discreet to lose", surveillants stay far enough back to avoid detection, at the risk of losing their target entirely. He confirms he is under surveillance by spotting the same vehicle multiple times, such as a pickup truck with a distinctive snow plow he says the FBI was not subtle enough to disguise.

The civilian version

Kiriakou has always preferred foot routes to vehicular ones, for two reasons he gives in practical terms. You can stop and look into a shop window and use the reflection to see who is behind you. And you can stairstep, go up a block, turn right, up a block, turn left, right, left, so that every time you stop at a corner and look both ways, the check reads as looking for traffic when what you are actually doing is looking for a follower.

In a car, his minimum is six feet between you and the vehicle in front at a red light, so there is always a way out, and if getting out means jumping a curb or going the wrong way down a one-way street, he says do it and pay the fine later, noting that a police officer who stops you is a police officer protecting you.

The technique he calls the most counter-intuitive of the CIA's teaching is to never play the radio while driving. Instead, describe aloud what you are seeing, "White male, blue jeans, mid-50s, walking a dog, black female, yellow sweater", so that if the same person appears again five miles on, you know you have a potential problem.

He is explicit that this is not a counterterrorism skill in civilian hands. Most people are not being surveilled by a foreign government, but they are being sized up by opportunists, and the tactics are the same: the carjacker, or the thief who sees a handbag on the passenger seat.

Twenty-two years after leaving the CIA, he says the habit has not switched off: he still constantly scans his mirrors, and still sizes people up for their real intentions. "It is so drilled into you. It becomes second nature."

Two ways to be spotted without being followed

Kiriakou gives two illustrations of exposure that no route can prevent, both of which he treats as more instructive than the tradecraft itself.

The first is his own near-burn, and he tells it against himself. Flying to Eastern Europe monthly to handle a recruited asset, he was taken by the asset to a hunting lodge high in the mountains of the man's home village. Kiriakou ordered "a very unusual drink, which I shouldn't have, but it was something my grandmother used to drink and I remembered it from my childhood." Returning the next month, he ordered it again, and the waitress said "I remember you." He denied ever having been there. "And she said, 'yes you have. You're the only person who's ever ordered that drink, and I've been here for 10 years.'" His reckoning afterwards was that the identity of the person who spotted him was luck: "now, she was just a waitress, but what if she had been an intelligence officer posing as a waitress? Or what if she was a police informant who's going to now rat me out to the local cops that I'm meeting with this guy?" He told the asset "I am so sorry, I blew it, we can never ever go back there again," and they never did.

The second runs the other way: evading too well identifies you. A genuine State Department officer he served overseas with came into the office boasting that she had been under heavy surveillance the night before and "took them on a ride that they'll never forget ... going 100 miles an hour down the highway." Kiriakou listened without comment. "What happened was, they determined that because she tried so hard to lose them, she must be the CIA officer. And so they never ever surveilled me, because I'm going to the wine store, and going to the fabric store, and then I'm driving home. But they were plenty interested in her."

Run against the FBI, by mistake

Kiriakou has described using the technique against surveillance he had entirely misidentified. Followed around Warren, Ohio in January 2012 by a car he took for a private investigator hired by his ex-wife, he cut through a neighbourhood he knew well on what he calls a surveillance detection route, having already established that he was being followed.

The confirmation sequence he describes is the ordinary one: slowing until the car behind should have passed and finding that it would not, then making a wide U-turn at an intersection and watching the car make the same turn.

He broke the tail with a red light, turning into a car park, waiting for the signal to change and then running it, leaving the follower caught in traffic. Only four days later, in an FBI conference room, did he learn who had been in the car.

See also

- The CIA Insider's Guide to Surveillance and Surveillance Detection
- Case officer
- Asset acquisition cycle
- The Farm
- John Kiriakou
