How to Choose a TSCM Service Provider
A Guide for Security-Conscious Organisations
In an increasingly surveillance-savvy world, selecting a reliable (Technical Surveillance Counter Measures) TSCM service provider is not just prudent—it’s essential. Whether you’re a corporate leader, government official, or security manager, choosing the right team to safeguard your privacy from electronic surveillance threats could mean the difference between business as usual and a serious data breach.
But with so many companies claiming to offer “bug sweeping” services, or “bug detection” or “counter eavesdropping” surveys, how can you separate the real professionals from the pretenders? It would be highly unprofessional for us to simply say “hire us, always” or “everyone except us aren’t competent, that’s not true. There are a number of competent, professional TSCM organisations available to select from in the global security service market. Here are key points to consider when choosing a TSCM service provider in the UK or internationally.
1. Independent, Unaffiliated and Focussed
A credible TSCM service provider should be completely independent of any manufacturer, installer, or supplier of surveillance or security equipment. Clearly if a company sells or installs security systems and then offers to ‘check them for bugs’, this is an obvious conflict of interest. The risk of them “finding” or “missing” something (either way) to generate additional sales is simply too high. Obviously, lots of reputable TSCM service providers may sell measurement equipment, however you should definitely question whether their main business focus is selling these pieces of equipment. Do they have equipment sales targets? What percentage of their Companies whom also offer a large range of general ‘security services’ are unlikely to be as competent at TSCM as a company who ONLY provide TSCM services. Beware of companies who offer close protection and TSCM services. Rarely is a close protection specialist also a TSCM specialist. Seeking your TSCM services from a company that does nothing but TSCM ensures you have competent specialists involved who live and breathe TSCM.
2. Military or Government Background
Experience in military or government roles is obviously a strong indicator of genuine capability. Though, simply because someone says they were a member of a specific military unit, for example, doesn’t mean that they had any regular experience of conducting TSCM during their service. TSCM is a highly technical and sensitive field. Basic electronics knowledge is not enough when facing modern surveillance technologies.
3. Real-Time, On-Site Analysis
A common pitfall is hiring companies that collect data on-site but perform analysis back at a separate location. This is not just inefficient—it’s dangerous. To be fair, we were shocked at Verrimus to hear that there are companies out there whom regularly ‘take away’ equipment to inspect it off-site. Maintaining evidential chains is paramount and so removing equipment to ‘check’ off-site should not be a regular occurrence. Any delay in identifying a threat allows an eavesdropper more time to exploit it. A professional TSCM team should conduct all analysis in real time, on-site, using specific threat-domain appropriate measurement equipment. If they cannot detect and interpret anomalies live, and explain those anomalies to you in person, walk away.
4. Transparent Reporting and Evidence Handling
After a TSCM survey, the provider should issue a useable and actionable statement of findings and recommendations. If a company provides a long winded document, full of test data, screen shots, graphs and pretty pictures be wary. As with all business reports, what you need is actionable information. Additionally, if any suspicious device or attack method is discovered, there should be a clear chain of custody process and photographic or video evidence. Reputable firms will also advise on appropriate next steps, whether it’s reporting to law enforcement or further internal investigation. Competent TSCM organisations will discuss with you, prior to the survey taking place, what ‘find procedures’ you would prefer followed. Thus, giving you input to the process that meets your organisational risk appetite and values. Knowing things that you should do to prepare for a TSCM survey, can help you to action any findings swiftly.
5. References and Reputation
Word of mouth still matters. A genuine TSCM provider will have a history of successful operations and satisfied clients—but due to the confidential nature of the work, be wary of companies that boast an excessive list of high-profile clients on their website. A professional TSCM service provider will not provide details of previous clients or tasks. You should be very worried if they do! Be wary of those organisations who make statements like “we provide all of XX banks’ TSCM” or “we undertake TSCM for XX Football Club”, etc. Understandably, this can cause a dilemma for companies seeking to do their due diligence on a provider’s level of competence and experience. It’s worth checking news sources and seeing if the organisation has been involved in any high profile operations which are public knowledge. Again, you can also do quick internet searches on the company to see if they have been awarded any contracts with trusted agencies, which are open source information. Ultimately, of course, if those responsible for procuring TSCM services, understand what TSCM is (and what it is not!) there are simple tips to help you assess the suitability of any provider for your specific risk appetite. Consider taking a TSCM Awareness and Procurement training course or a Technical Surveillance Awareness briefing to help you understand what a TSCM survey should include.
6. International Capability, British Standards
Even if you operate globally, insist on providers that maintain rigorous British operational standards. A UK-based TSCM firm that adheres to MoD-level principles is likely to have a more stringent approach to procedures, equipment use, and discretion. Ask whether their staff have experience working in hostile environments or high-threat regions. Whilst a TSCM company may not discuss previous clients, they will be able to tell you if they have worked in a specific country.
7. Ongoing Relationship, Not One-Off Checks
TSCM is not a tick-box exercise. Threats evolve, and so must your countermeasures. A professional TSCM service provider will help you to build a long-term strategy that includes periodic checks, staff awareness, and secure protocol development. Look for a firm that offers ongoing consultancy and proactive risk assessment—not just reactive sweeps.
Final Thoughts on Selecting a TSCM Service Provider
In the realm of TSCM, it’s not enough to settle for flashy kit or bold claims. True security lies in operational excellence, independence, discretion, and proven competence. Take your time, ask the hard questions, and don’t be afraid to dig deep into a provider’s background. Any professional TSCM service provider will be willing to undertake a quality assurance assessment prior to engagement, during your procurement process.
If you’re serious about safeguarding sensitive information, Verrimus is here to advise and support—with no compromise on integrity, discretion, or results.
Need help evaluating your current TSCM provision or planning a survey?
Get in touch with Verrimus for confidential advice from former British Government-level specialists.
