A surveillance detection route (SDR) is a structured movement through a series of locations used by CIA case officers and their recruited assets to determine whether they are being followed before, during, or after a clandestine operational meeting. A properly executed SDR forces any surveillant to either reveal themselves through repeated appearances at improbable intersections or break off pursuit.
Standard timing
For an operational meeting in the field, the doctrinal SDR pattern is approximately three hours of surveillance detection before the meeting, two hours for the meeting itself, and a further two-hour SDR home — a total commitment of around seven hours for an asset to deliver intelligence to a case officer.[1]
In high-threat counterintelligence environments — Kiriakou specifically names China, Russia, and Cuba — the standard SDR is eight hours. The longer duration is required because the host service deploys infrared cameras (for body-heat detection through walls and vehicles) and surveillance helicopters, with the cost of detection being the asset’s execution. “They’re going to catch the guy that you’re trying to meet and they’re going to execute him. So you have to really make sure that you’re not being followed.”[2]
Doctrinal mechanics
The mechanics of a properly executed SDR are technically specific:
- Kickoff point — the asset’s starting location: home, office, or wherever they would routinely be at that hour.
- Red road — a major thoroughfare with heavy traffic; surveillance cannot be detected on a red road, so red roads serve only as connective tissue between SDR stops.
- Black road — a residential or minor through-street with low traffic; surveillance is exposed by repeated appearance on a black road.
- SDR stops — three or more visits to plausibly routine errand destinations (dry cleaner, wine shop, fabric store) chosen to look like ordinary errands. At each stop the asset notes the make, model, color, and license plate of every nearby vehicle.
- The provocative phase — the “stair-step”: a sequence of provocative directional changes (block right, block left, block right, block left) that no ordinary driver would execute. Surveillance has no way to follow without revealing itself.
- Final approach — between the third stop and the meeting, deliberately bizarre driving maneuvers (pulling halfway down a residential block, into a driveway, U-turning, into another driveway, U-turning) to expose any surveillance not already detected.
- Abort — if surveillance is confirmed, the asset returns home without making the meeting and re-attempts the SDR 24 hours later.[3][4][5][6][7][8]
The operative definition: “The definition of surveillance is multiple sightings at time and distance. So you see the car multiple times at different places.”[5]
The host-service tradecraft response
Host surveillance services adapt to the SDR with techniques designed to defeat each layer of detection:
- Plate changes mid-tail
- Wardrobe and disguise changes (wigs, mustaches, hats)
- On-foot pickups — operators bail out of the surveillance vehicle and continue on foot, subway, or bus when the asset transitions out of their car
- Pre-positioned rental cars in parking garages, used by Kiriakou himself in high-threat areas as a switch vehicle
- Infrared cameras and helicopters in China, Russia, and Cuba[9][2]
Pattern of life
A related personal-security discipline is the deliberate disruption of one’s daily pattern of life. A CIA officer in a high-threat environment varies the time of departure from home and the route to work daily; an asset under surveillance from a hostile service must vary their visible routine (the time at which they leave home, the coffee shop they visit, the route they walk) to deny the hostile service a reliable strike opportunity.[10]
In John Kiriakou’s tour in Athens (1998–2000) — when Revolutionary Organization 17 November was active — his commute from home to the U.S. embassy could take anywhere from twenty minutes to two hours on a given day. “You’re going to be in eventually. We’re all working 12- and 14-hour days anyway, so it’s not like you’re not going to put in your eight hours. So we’re just driving like crazy people all over the city.”[10][11]
A single failure of this discipline can be fatal: Kiriakou overslept on the morning of March 2000, was forced to take Kifissias Avenue (the most direct, concrete-Jersey-barrier-bounded route to the embassy), and arrived in heavy traffic alongside the assassinated vehicle of Stephen Saunders, whom 17 November had killed in his place.[12][11]
The “mad minute”
The first sixty seconds of any operational meeting between case officer and asset must cover four standard questions, asked in immediate succession in case the meeting is interrupted:
- Were you followed?
- Are you in fear for your safety?
- How much time do you have for this meeting?
- The case officer and asset must commit a date, time, and place for the next meeting before any other business is discussed.[13][14]
This protocol is referred to internally as the mad minute.[14]
Asset SDRs
Case officers verify that their assets are actually executing SDRs as claimed, since an asset’s claim of “yes, I did one” is unreliable. The standard verification procedure is for the case officer to request a surveillance team from headquarters that observes the asset along the asserted route. One Athens asset of Kiriakou’s executed “a surveillance detection route that was so ridiculously good” that the CIA surveillance team broke off rather than risk their cover being blown.[15][13]
Kiriakou as instructor
Kiriakou served as a surveillance and surveillance-detection instructor at the CIA in parallel with his day job; instructor duties ran at night. He has stated that his first book contains an extended account of how seriously he took surveillance during his Athens tour, and that he subsequently wrote a separate later volume — The CIA Insider’s Guide to Surveillance and Surveillance Detection — devoted entirely to the subject. He taught a university-level course on it at George Washington University.[16][17]
Following his departure from the agency, Kiriakou maintained the discipline and identified the FBI following him almost immediately. He observes that the population of plausible surveillants is wider than usually assumed: “It could be a private eye because your spouse doesn’t trust you, it could be a carjacker or a mugger, or the FBI, or the local cops.” He discontinued routine SDR practice only in approximately 2025.[18][19]
Bahrain — what happens when you don’t go home
John Kiriakou described a political officer in Bahrain who, on detecting surveillance during the second phase of her SDR, abandoned doctrine and instead led the surveillance team on a high-speed chase across the island. The consequence was that she was identified as an undercover CIA officer and placed under surveillance every single day for the following three years, while Kiriakou — who had gone to the grocery store and the hardware store on the same day — was never bothered again.[20][21][22][23]
The class that caught the FBI
John Kiriakou recounts teaching a surveillance detection route course at George Washington University in the summer of 2012. Walking a dozen 18-year-old students through a route across the P Street Bridge in Washington, he spotted the FBI team tailing him — two on foot, a woman “reading a newspaper” in a parked car — and had the students note their descriptions and plates. His lawyer then called: the FBI had complained he was “acting very suspiciously.” Kiriakou’s message back was that a group of first-day students had spotted the vaunted Bureau’s surveillance.[24][25][26]
Old-school tradecraft, now used by ICE (HOPE 2025)
John Kiriakou says domestic agencies like ICE now use the low-tech surveillance the CIA once relied on: multiple cars breaking on and off a target, static watchers with binoculars, and a French technique the CIA adopted — sending 50 people walking toward a target so he never notices the ones who peel off to follow.[27][28]
”Discreet to lose”
Kiriakou says FBI counter-surveillance against him post-CIA follows a style he calls “discreet to lose” — surveillants stay far enough back to avoid detection, at the risk of losing their target entirely. He confirms he is under surveillance by spotting the same vehicle multiple times, such as a pickup truck with a distinctive snow plow he says the FBI was not subtle enough to disguise.[29] This is a recurring lesson he traces to his CIA training and his two years in Athens: never set a pattern of behavior, because as soon as adversaries detect a pattern, “they’re going to kill you.”[30] He gives the CIA’s operational definition of surveillance as “multiple sightings at time and distance” — seeing the same person repeatedly, at different places and different times of day.[31]
Layered counter-surveillance on a walk-in pickup
Kiriakou describes arranging to meet a suspected hostile walk-in outside a Marriott, riding in a car with a security officer while a team of a dozen CIA officers covertly photographed the surveilling Iranian team and their license plates to identify which foreign service was running the operation.[32] He notes the Iranians sometimes added a secondary counter-surveillance layer on motorcycles to follow their own followers — sophisticated tradecraft, in his assessment, though the Iranians were unaware the CIA had positioned yet another layer behind that.[33]
The red helmet (Pakistan)
While serving in Pakistan, Kiriakou noticed a man on a motorcycle wearing a red helmet working hard to stay in his blind spot on his commute; the same man reappeared later that day and again the next morning at different times and locations, meeting his own operative definition of surveillance — “multiple sightings at time and distance.”[34] He reported it to his station’s security officer, and by that afternoon — worried enough that he told colleagues he was prepared to kill the man if he saw him again — confronted a local-service general directly at a shared safe house, asking, “General, are you following me?” He never saw the man again.[35][36] Kiriakou later learned the officers of the local intelligence service had suspected his friendliness was a ruse — “nobody’s that nice” — and had deliberately assigned their worst surveillance officer to test him; had he not confronted the general that afternoon, he believes the man would have ended up dead.[36][37]