What a sweep verifies
A technical surveillance countermeasures (TSCM) sweep, commonly called a bug sweep, systematically checks a space for listening devices, hidden cameras and similar surveillance tools. What you get at the end is a documented answer about the state of the space at the time of the sweep, including which areas were checked with which method and which could not be.
Stage 1: Secure first contact
The sweep starts with the first conversation, which should happen outside the suspected space and devices. If there’s a bug in your office and you discuss the sweep on a phone in that office, whoever placed it may learn of it and remove it before sweep day. Use a device you don’t suspect, ideally away from the space. You don’t need to give details in the first message: city, type of space and a safe time to talk are enough.
Stage 2: Assessment and threat review
Next we agree what needs protecting. Who might want what information, and how? That shapes scope and priorities; a boardroom sweep and a home sweep during a separation have different focuses. We also cover size, number of rooms, ceiling and panel access, electronics density and timing, sometimes with a short site visit. You then receive a written quote covering scope, duration and price.
Stage 3: The on-site sweep
RF survey
The sweep usually starts by mapping radio activity with an RF spectrum analyzer. Known signals such as Wi-Fi, Bluetooth, cellular and broadcast are accounted for, and anything unexplained is traced to its source. Because some devices only transmit under certain conditions, this is done under near-normal conditions and for long enough.
Electronic sweep: NLJD, thermal and optical
Then every surface is swept. The NLJD detects circuits even when devices are off, the thermal camera shows working electronics, and the optical lens finder catches camera lenses. Each targets a different threat and sees what the others miss.
Physical inspection
Sockets, switches, junction boxes, light fittings, smoke detectors, furniture and suspicious objects are opened or inspected by endoscope, and ceiling voids are checked. This is how other methods’ alerts are verified and how non-transmitting devices are found.
Line and network checks
Where relevant, phone lines, intercoms and building cabling are measured electrically, and the network and wireless environment are checked for rogue devices and fake access points.
Verification
Every suspicious reading is physically verified. Alerts from innocent electronics are ruled out; real findings are photographed and documented in place. An unverified reading is not a finding.
Stage 4: The report
You receive a written report: areas inspected, methods used in each, suspicious readings and how they were verified or ruled out, findings and recommendations. If nothing is found, it says so. Points that couldn’t be inspected and the limits of each method are part of the report.
How long it takes
Duration depends on the size and number of rooms, how much furniture and electronics there are, ceiling access, whether line and network checks are in scope, and whether the space is empty during the sweep. A single meeting room or vehicle often takes a few hours; a multi-floor office or large house can take more than a day. A rushed sweep can mislead, so methods shouldn’t be dropped to save time.
How to prepare
- Don’t discuss the sweep in the suspected space, on its phones or on corporate email.
- Use a neutral calendar entry and tell as few people as possible.
- Arrange access to rooms, ceiling hatches and electrical and distribution panels.
- Have floor plans and cabling drawings ready if available.
- Don’t tidy up or rearrange; the normal state tells us more.
- Note why you’re suspicious, plus recent visits, maintenance and access events.
- If you think you’ve found a device, don’t touch or move it.
After the sweep
A sweep verifies the space at that moment. Controlling access to critical rooms afterwards preserves its value. If you swept before a sensitive meeting, keep the room locked or supervised until it starts. If you need ongoing protection, regular sweeps planned as a programme make more sense.