Digital security—encrypted messengers, zero-knowledge cloud vaults, and VPNs—is completely useless if an adversary physically follows an investigative journalist to a clandestine rendezvous with a confidential source.

In hostile intelligence environments, state security services, private corporate intelligence contractors, and organized crime cartels do not rely solely on digital wiretaps. They deploy physical surveillance teams: coordinated foot and vehicular tracking squads designed to shadow reporters, map their human networks, and identify whistleblowers before disclosures can occur.

When meeting high-risk sources, investigative reporters must operate with intelligence-grade field tradecraft. They must know with mathematical certainty whether they are being followed, without alerting the surveillance team that they have been detected.

Furthermore, when physical meetings are too hazardous, reporters deploy dead drops—clandestine transfer points where encrypted storage media is exchanged without the source and the journalist ever coming into physical contact.

This manual provides an operational guide to planning and executing Surveillance Detection Routes (SDR), establishing physical and digital dead drops, and defending against contactless tracking.

1. Principles of Hostile Physical Surveillance

To detect surveillance, an investigator must understand how a professional surveillance team operates:

                            THE 4-CAR SURVEILLANCE BOX
                                        │
           ┌────────────────────────────┼────────────────────────────┐
           ▼                            ▼                            ▼
      CAR 1 (THE EYE)              CAR 2 (THE FLANK)            CAR 3 (THE STAKE)
   Direct line of sight         Parallels target on           Parks ahead along predicted
   Maintains trailing distance  adjacent city streets         chokepoints (bridge / exit)

The “Rotating Eye” Technique

Professional teams do not tail a subject with a single car or a single person in a trench coat. They utilize rotating observation: * Person A follows the journalist for three blocks, then turns off into a shop. * Person B picks up the tail on the opposite side of the street. * Person C boards the same subway car. * A target who simply looks over their shoulder for a suspicious follower will never spot a professional surveillance team.

Detection requires Surveillance Detection Routes (SDR) that force the surveillance team to make repeated, unnatural maneuvers.

2. Planning a Surveillance Detection Route (SDR)

A Surveillance Detection Route is a planned transit course through an urban environment designed to test for surveillance while maintaining complete plausible deniability.

[STARTING POINT (OFFICE)] ──► [PHASE 1: THE DISCOVERY LEG] ──► [PHASE 2: TIMING TRAP] ──► [PHASE 3: CHOKEPOINT BREAK] ──► [CLEAN RENDEZVOUS]

The 4 Mandatory Rules of an SDR:

1. Plausible Purpose: Every stop on the route must have a natural, logical explanation (e.g., buying a book, having lunch, returning an item). Never wander aimlessly or act suspicious.
2. Never Look Behind You: Direct eye contact with a tail alerts them that you are surveillance-aware. Use store window reflections, camera selfies, and natural $90^\circ$ turns to observe who is behind you.
3. No Sudden Sprints: Running, ducking into dark alleys, or jumping through closing train doors confirms to the surveillance team that you have operational secrets to protect.
4. The Abort Rule: If at any point during the SDR you confirm hostile surveillance, immediately abort the meeting with the source. Proceed to a benign public destination, conduct your ordinary business, and go home.

3. The 3 Diagnostic Surveillance Traps

To separate random pedestrians from active surveillance operators, an SDR incorporates three specific terrain traps:

┌────────────────────────────────────────────────────────────────────────┐
│                   THE THREE TERRAIN SURVEILLANCE TRAPS                 │
├────────────────────┬────────────────────┬──────────────────────────────┤
│ 1. THE TIMING TRAP │ 2. THE DEAD-END LEG│ 3. THE CHOKEPOINT FILTER     │
│ Enter a large café │ Walk down a quiet  │ Transition through a single- │
│ with two exits;    │ residential street │ file pedestrian bridge or    │
│ purchase coffee and│ with zero through- │ ticket turnstile where       │
│ watch who rushes in│ traffic. No reason │ following vehicles cannot    │
│ after you.         │ for others to turn.│ physically follow.           │
└────────────────────┴────────────────────┴──────────────────────────────┘

The Subway “Last-Second Board” Protocol

1. Stand on a crowded subway platform near the center car doors.
2. Wait for the departure chime to ring and the doors to begin closing.
3. Step onto the train at the final second—or step off the train at the final second.
4. A standard commuter will simply wait for the next train; a surveillance operator under pressure to keep “the eye” on you will be forced to make an abrupt, unnatural physical lunge through the closing doors.

4. Dead-Drop Hygiene: The Non-Contact Exchange

When a physical meeting between a reporter and a source carries an unacceptable risk of physical apprehension or violence, the exchange is executed via a Dead Drop:

                       THE ASYNCHRONOUS DEAD-DROP CYCLE
                                       │
     [WHISTLEBLOWER] ──► [SECRET DEPOSIT] ──► [SIGNAL SITE] ──► [JOURNALIST HARVEST]
     (Places USB drive   (Under park bench     (Chalk mark on    (Harvests USB drive
      in hollow bolt)     or loose brick)       utility pole)     4 hours later)

The Selection of the Drop Site:

• Zero Public CCTV Coverage: The drop location must be audited in advance for street cameras, building security domes, and automated license plate readers (ALPR).
• High Plausible Foot Traffic: A public park, a botanical garden, or a historic library where someone pausing for 15 seconds to tie a shoe or sit on a bench does not attract attention.
• Environmental Protection: The storage media must be enclosed inside a waterproof, dustproof container (e.g., magnetic key vaults, simulated rusty bolts).

5. Digital Dead Drops: Air-Gapped USB Exchange Hygiene

Never plug an unknown USB flash drive retrieved from a dead drop directly into an internet-connected newsroom computer. State adversaries routinely seed fake dead drops with malicious hardware:

┌────────────────────────────────────────────────────────────────────────┐
│                   DEAD-DROP USB HARDWARE THREATS                       │
├────────────────────┬────────────────────┬──────────────────────────────┤
│ 1. USB KILLER      │ 2. BADUSB / RUBBER │ 3. FIRMWARE EXPLOITS         │
│ Contains high-     │ DUCKY: Emulates a  │ Malicious controller chips   │
│ voltage capacitors │ keyboard, injecting│ that execute malicious code  │
│ that discharge     │ high-speed payload │ before the OS mounts the     │
│ 220V into USB bus! │ terminal commands! │ filesystem.                  │
└────────────────────┴────────────────────┴──────────────────────────────┘

The 4-Step USB Quarantine Protocol:

1. Physical Visual Inspection: Inspect the USB drive casing. Check for signs of tampering, glue lines, or secondary microcontroller chips.
2. The Hardware USB Condom: Connect the drive through a specialized hardware USB data blocker that physically severs the power charging lines or restricts data lines.
3. The Disposable Sandbox Laptop: Connect the drive exclusively to an air-gapped, battery-powered laptop running Tails OS or a Qubes OS Disposable VM with networking physically removed.
4. Check for BadUSB HID Emulation: Observe whether the computer registers the device as a storage drive (sdX) or as a human interface keyboard (hid). If the OS detects a keyboard, disconnect it immediately.

6. The Post-Mission Debrief

After harvesting a dead drop or concluding a rendezvous: * Never travel directly back to your primary home or office. * Execute a short 30-minute exit SDR to confirm that no vehicle picked up your trail after leaving the drop site. * Once home, verify the cryptographic PGP signatures on the retrieved documents before initiating reporting.

By combining disciplined physical movement with uncompromising hardware hygiene, investigative reporters protect the human lives that make public interest journalism possible.