A surveillance detection route (SDR) is a structured movement through a series of locations used by CIA case officers and their recruited assets to determine whether they are being followed before, during, or after a clandestine operational meeting. A properly executed SDR forces any surveillant to either reveal themselves through repeated appearances at improbable intersections or break off pursuit.
Standard timing
For an operational meeting in the field, the doctrinal SDR pattern is approximately three hours of surveillance detection before the meeting, two hours for the meeting itself, and a further two-hour SDR home — a total commitment of around seven hours for an asset to deliver intelligence to a case officer.[1]
In high-threat counterintelligence environments — Kiriakou specifically names China, Russia, and Cuba — the standard SDR is eight hours. The longer duration is required because the host service deploys infrared cameras (for body-heat detection through walls and vehicles) and surveillance helicopters, with the cost of detection being the asset’s execution. “They’re going to catch the guy that you’re trying to meet and they’re going to execute him. So you have to really make sure that you’re not being followed.”[2]
Doctrinal mechanics
The mechanics of a properly executed SDR are technically specific:
- Kickoff point — the asset’s starting location: home, office, or wherever they would routinely be at that hour.
- Red road — a major thoroughfare with heavy traffic; surveillance cannot be detected on a red road, so red roads serve only as connective tissue between SDR stops.
- Black road — a residential or minor through-street with low traffic; surveillance is exposed by repeated appearance on a black road.
- SDR stops — three or more visits to plausibly routine errand destinations (dry cleaner, wine shop, fabric store) chosen to look like ordinary errands. At each stop the asset notes the make, model, color, and license plate of every nearby vehicle.
- The provocative phase — the “stair-step”: a sequence of provocative directional changes (block right, block left, block right, block left) that no ordinary driver would execute. Surveillance has no way to follow without revealing itself.
- Final approach — between the third stop and the meeting, deliberately bizarre driving maneuvers (pulling halfway down a residential block, into a driveway, U-turning, into another driveway, U-turning) to expose any surveillance not already detected.
- Abort — if surveillance is confirmed, the asset returns home without making the meeting and re-attempts the SDR 24 hours later.[3][4][5][6][7][8]
The operative definition: “The definition of surveillance is multiple sightings at time and distance. So you see the car multiple times at different places.”[5]
The host-service tradecraft response
Host surveillance services adapt to the SDR with techniques designed to defeat each layer of detection:
- Plate changes mid-tail
- Wardrobe and disguise changes (wigs, mustaches, hats)
- On-foot pickups — operators bail out of the surveillance vehicle and continue on foot, subway, or bus when the asset transitions out of their car
- Pre-positioned rental cars in parking garages, used by Kiriakou himself in high-threat areas as a switch vehicle
- Infrared cameras and helicopters in China, Russia, and Cuba[9][2]
Pattern of life
A related personal-security discipline is the deliberate disruption of one’s daily pattern of life. A CIA officer in a high-threat environment varies the time of departure from home and the route to work daily; an asset under surveillance from a hostile service must vary their visible routine (the time at which they leave home, the coffee shop they visit, the route they walk) to deny the hostile service a reliable strike opportunity.[10]
In John Kiriakou’s tour in Athens (1998–2000) — when Revolutionary Organization 17 November was active — his commute from home to the U.S. embassy could take anywhere from twenty minutes to two hours on a given day. “You’re going to be in eventually. We’re all working 12- and 14-hour days anyway, so it’s not like you’re not going to put in your eight hours. So we’re just driving like crazy people all over the city.”[10][11]
A single failure of this discipline can be fatal: Kiriakou overslept on the morning of March 2000, was forced to take Kifissias Avenue (the most direct, concrete-Jersey-barrier-bounded route to the embassy), and arrived in heavy traffic alongside the assassinated vehicle of Stephen Saunders, whom 17 November had killed in his place.[12][11]
The “mad minute”
The first sixty seconds of any operational meeting between case officer and asset must cover four standard questions, asked in immediate succession in case the meeting is interrupted:
- Were you followed?
- Are you in fear for your safety?
- How much time do you have for this meeting?
- The case officer and asset must commit a date, time, and place for the next meeting before any other business is discussed.[13][14]
This protocol is referred to internally as the mad minute.[14]
Asset SDRs
Case officers verify that their assets are actually executing SDRs as claimed, since an asset’s claim of “yes, I did one” is unreliable. The standard verification procedure is for the case officer to request a surveillance team from headquarters that observes the asset along the asserted route. One Athens asset of Kiriakou’s executed “a surveillance detection route that was so ridiculously good” that the CIA surveillance team broke off rather than risk their cover being blown.[15][13]
Kiriakou as instructor
Kiriakou served as a surveillance and surveillance-detection instructor at the CIA in parallel with his day job; instructor duties ran at night. He has stated that his first book contains an extended account of how seriously he took surveillance during his Athens tour, and that he subsequently wrote a separate later volume — The CIA Insider’s Guide to Surveillance and Surveillance Detection — devoted entirely to the subject. He taught a university-level course on it at George Washington University.[16][17]
Following his departure from the agency, Kiriakou maintained the discipline and identified the FBI following him almost immediately. He observes that the population of plausible surveillants is wider than usually assumed: “It could be a private eye because your spouse doesn’t trust you, it could be a carjacker or a mugger, or the FBI, or the local cops.” He discontinued routine SDR practice only in approximately 2025.[18][19]