Three-Phase Surveillance Detection Route
Suspect, confirm, then collect before changing your behavior
- Difficulty
- Expert
- Time to result
- ~months to results
- Steps
- 6
- Confidence
- 99%
Andrew Bustamante describes a surveillance detection route as a prescribed three-phase process. In phase one, the operator notices indicators such as the same vehicle or profile appearing after several movements. In phase two, a predetermined route changes locations and conditions to confirm whether those indicators persist. Once surveillance is confirmed, a coded warning is sent without visibly changing behavior. Phase three shifts from detection to collection: the operator gathers identifying details while the surveillance team still believes it is unnoticed. Short private labels support memory until fuller notes can be made safely. The method depends on repeated observations across time and place, not intuition from a single encounter.
Origin
Extracted from The Diary of a CEO
Core principles
- 01One sighting is a clue rather than proof
- 02Repeated profiles across changing locations provide stronger evidence
- 03A planned route makes suspicious repetition easier to observe
- 04After confirmation, information collection can be more valuable than immediate evasion
- 05Visible panic can reveal that surveillance has been detected
How to run it
- 1
Form a suspicion
Notice whether the same person, vehicle, face, or broad profile appears after multiple movements. Treat the observation as a hypothesis rather than a conclusion.
Pro tip Track recurrence across location changes, not how suspicious one person looks.
Watch out A single sighting is weak evidence and can produce false certainty.
- 2
Run a planned route
Move through a predetermined sequence designed to create several observation points. Watch whether the same indicators reappear after turns, stops, and mode changes.
Pro tip Memorize the route before entering a high-stress situation.
Watch out Improvising under pressure makes both navigation and observation less reliable.
- 3
Confirm the pattern
Require multiple sites and sightings over time before classifying the activity as surveillance. Look for coordinated handoffs between vehicles and people.
Watch out Do not confront suspected observers.
- 4
Send the warning
Use a prearranged, ordinary-sounding message to tell a trusted contact that something is wrong. Keep the communication consistent with the cover or context.
Pro tip Agree on the warning phrase and response plan before it is needed.
Watch out An improvised alarm can reveal that the surveillance has been detected.
- 5
Collect discreetly
After confirmation, gather recurring profiles, vehicles, and other observable identifiers without signaling recognition. Use short private labels to reduce memory load.
Pro tip Choose labels that are memorable to you but reveal little by themselves.
Watch out Prolonging collection can increase danger; personal safety remains the boundary.
- 6
Reconstruct in safety
Once safe, expand the private labels into detailed notes and compare them with the team's other observations.
Watch out Memory under acute stress can be incomplete, so distinguish observation from inference.
In the wild
Andrew says one vehicle followed him through several turns, disappeared, and returned. A planned route then exposed additional cars and people on foot, including overlap between drivers and walkers. He used short labels such as clothing descriptions, contacted Jihi with a coded message, and later reconstructed the observations with the cell.
→ He concluded that a coordinated surveillance team was following him and warned his colleagues.
Common mistakes
Trying to lose the tail immediately
Abrupt evasion can reveal professional awareness and remove the opportunity to understand the surveillance team.
Showing recognition
Eye contact or a sudden behavioral change can tell observers that they have been identified.
Is it for you?
Best for
Trained professionals conducting authorized security work in environments where hostile surveillance is plausible.
Not ideal for
Untrained confrontation, amateur counter-surveillance, or situations where immediate emergency assistance is safer.
From the transcript
“multiple sites, multiple sightings over a period of time”
“It's in the first phase that you suspect that you're under surveillance. It's in the second phase that you confirm it.”
“The third phase is a collection phase.”
From the episode
Former CIA Spies: "The CIA Tried To Ban This Story!" We're Leaving The US by 2030!