03Discipline

TSCM Sweeps

Technical surveillance countermeasures for the rooms where the sensitive conversations actually happen — and where the assumption that they are private has never once been tested.

Discuss a sweep Physical security

The Premise

Everything sensitive is discussed out loud somewhere.

Organizations spend heavily to protect data at rest and in transit, then hold the actual decision in a conference room that has been renovated twice, serviced by four vendors, and never inspected once.

The economics of technical surveillance changed. Capable audio and video devices are cheap, small, and available to anyone — a competitor, a departing employee, a party to a dispute, a foreign collector with a specific interest in your program.

The likely vector is rarely exotic. It is a device someone with legitimate access left behind: a contractor, a cleaner, a vendor's technician, a former employee who kept a badge for two weeks longer than anyone noticed. Or it is not a device at all — it is a smart display, a conferencing system, or a networked appliance doing exactly what it was designed to do, in a room where nobody decided it should.

A sweep answers a question you otherwise cannot answer: as of today, is this room what you think it is?

Sweep · At a glance

Layers: RF & spectrum · physical · infrastructure
Scope: Single room to full floor or campus
Timing: After hours or under cover, by default
Cadence: Event-driven or recurring
Product: Written findings with location, method, disposition
On discovery: Preserve in place, notify, then sequence response

Coverage

What gets inspected

A layered inspection, not one instrument. In practice the physical work finds more than the spectrum work does — because a device that is not transmitting at the moment you walk in is invisible to a receiver.

RF and spectrum analysis — the relevant bands, with attention to intermittent, burst, and store-and-forward behavior rather than a single pass
Physical inspection — furniture, fixtures, wall and ceiling voids, power and data outlets, HVAC penetrations, and anything recently installed, moved, or serviced
Telephony and conferencing — handsets, room systems, microphones and DSPs, and the paths in and out of them
Audio-visual and IoT — smart displays, cameras, assistants, sensors, and networked appliances that belong to the building rather than to IT
Infrastructure and building services — cabling, risers, conduit, adjacent spaces, and the plenum the room shares with its neighbours
Acoustic exposure — what is audible through walls, doors, glass, ducts, and shared returns, without any device at all
Documentation — a written record of what was inspected, how, and what was found, suitable for security files and for counsel

Read: when is a TSCM sweep actually worth doing? →

Where authority matters Some inspections in accredited environments must be performed by specific government-designated authorities, and TEMPEST matters rest with certified authorities. We coordinate with the cognizant security office where the program requires it, and we will tell you plainly when a requirement falls outside what we should be doing — rather than performing work that will not count.

Triggers

When a sweep is worth doing

The wrong time is "when we get around to it." The right time is when the value of a specific conversation goes up, or when trust in a space changes.

Before it matters

Ahead of negotiations, a transaction, a board decision, a proposal, or a program milestone — while the discussion is still ahead of you.

After access changed

An insider departure or termination, a contractor's unsupervised access, a renovation, or a vendor service call in a sensitive space.

When something is off

Information appearing where it should not, a dispute or investigation underway, or a concrete reason to suspect eavesdropping.

On a cadence

Recurring coverage for spaces where sensitive discussion is routine — program rooms, executive suites, labs, and secure areas.

Spaces

Where we sweep

Program and project spaces — defense technology, aerospace, and advanced manufacturing rooms where controlled or proprietary work is discussed
Executive suites and boardrooms — the concentration point for everything that has not been announced yet
Secure and accredited areas — as part of a broader ICD 705 or NISPOM engagement, coordinated with the cognizant office
Research and test environments — labs, integration bays, clean rooms, and test cells where the design itself is the asset
Data center meet-me rooms and control spaces — where physical access, telemetry, and tenant conversations converge
Off-site and temporary spaces — hotel meeting rooms, war rooms, and leased space nobody controls

Questions

On TSCM

What does a sweep actually consist of?

A layered inspection rather than one gadget. RF and spectrum work across the relevant bands to find transmitting devices; physical inspection of furniture, fixtures, wall and ceiling voids, power and data outlets, and anything recently installed or serviced; inspection of telephony, conferencing, audio-visual, and network infrastructure in the room; and examination of the building services that enter it. Findings are documented with location, method, and disposition. The physical inspection typically finds more than the spectrum work does.

When is a sweep worth doing?

When the value of a specific conversation just went up, or when trust in the space changed. In practice: before negotiations, a transaction, or a program milestone; after an insider departure, a termination, or a contractor's unsupervised access; when litigation or an investigation is live; on a recurring cadence for spaces where sensitive discussion is routine; and any time someone has a concrete reason to suspect eavesdropping.

Can you sweep accredited spaces?

We support secure spaces as part of physical security and ICD 705 work, and we coordinate with the cognizant security office and certified TEMPEST or counterintelligence authorities where the program requires it. Some inspections in accredited environments must be performed by specific government-designated authorities — we will tell you plainly when that is the case rather than doing work that will not count.

How discreet is this?

Fully. Sweeps are routinely conducted after hours or under an unremarkable cover for the building's occupants, findings go to the smallest possible number of people, and we do not name clients. If the concern is a named individual inside the organization, say so on the call and we will scope accordingly.

What happens if you find something?

We stop, preserve it in place, and talk to you before touching anything further — because a device is potentially evidence, and how it is handled in the first hour determines whether it is ever useful in an investigation or a proceeding. Then we help you decide the sequence: counsel, law enforcement, counterintelligence, or internal, in the right order.

Next Step

If the room matters, test the assumption.

Tell us the space and the concern in one paragraph. Keep specifics general in writing — details belong on a call.

Start a conversation

Prefer to talk? 866.960.7475 · info@orbitalfederal.com