Surveillance is not one capability. An illustrative case study in how the separate elements fit together, and how the mix changes as a task grows

Dr Simon Lee Maryan

Business Development Director, Greyveil Ltd

Third in a series on the family office security footprint

The word does too much work

Surveillance is one word carrying at least six distinct disciplines. They have different purposes, different outputs, different legal weight and different costs. They are not interchangeable, and buying the wrong one is the most common and most expensive mistake made in this area.

The confusion is understandable. To an outside observer the activity looks similar: people watching things. The distinction lies not in what is done but in what question is being answered, and who or what the effort is directed at. One is directed at a subject of concern. One is directed around a principal. One is directed at the ground. One is exercised by the individual themselves. Two exist to sustain or shape the others.

What follows is a constructed teaching example, built to show how the elements are distinct and how they combine as a task grows. It describes purposes and outputs only. It does not describe method, and it is not intended to.

Illustrative scenario. The following is a composite teaching example constructed for this article. It is not drawn from any Greyveil engagement and does not describe any real client, individual, property or matter. Names, locations and sequence are invented. No operational methodology is disclosed at any point.

The scenario concerns a European family office and a principal we will call the subject of protection. Over nine months the concern escalates in six stages. At each stage a different question arises, and a different element answers it.

Six stages, six questions

STAGE ONE — THE QUESTION IS WHO

Correspondence arrives at the family office. At first it is odd rather than alarming: long, personal in tone, addressed to the principal by first name, asserting a relationship that does not exist. Over four months the tone hardens. Then a photograph arrives at the general enquiries address showing the principal’s vehicle parked outside a building the family office has never publicly associated with the principal.

The family office now has an emotional reaction and no facts. The question is not what to do. The question is who this is and whether it matters.

That is an investigative task. Investigative surveillance is directed at a subject of concern, for a defined period, to establish fact: identity, circumstances, whether the interest is sustained or episodic, whether there is any capability to act on it. It is bounded by a written tasking, a recorded lawful basis, a proportionality assessment and a retention schedule, because its product may end up in front of a court and because the subject of an investigation has rights that do not disappear because somebody finds them frightening.

In this example it produces a decision-quality answer. The individual is identified, lives some distance away, has a documented history of similar behaviour toward others, and shows no sign of travel or preparation. The family office takes a legal route. No protective measure is deployed, which is itself the correct outcome and one that a provider selling manpower has no incentive to recommend.

STAGE TWO — THE QUESTION IS WHETHER THEY ARE ACTING

Five months later the picture changes. The individual relocates to the principal’s city. The correspondence stops, which is not reassuring. The family office asks for a close protection detail. The principal declines: he has school-age children, he does not want them growing up beside visible security, and he takes the reasonable view that an obvious detail announces that there is something worth protecting.

This is the gap that protective surveillance exists to fill. It is directed around the principal rather than attached to them. The principal moves normally, unaccompanied in appearance, while a capability sits in the environment with the task of identifying hostile interest and creating time and options if it appears. Its product is early warning and decision space.

The trade is worth stating honestly. Protective surveillance preserves normality and buys warning. It does not put a person between the principal and a threat. Where the assessed risk is of immediate physical violence, it is the wrong answer and close protection is the right one. Where the risk is of approach, fixation, intrusion or reconnaissance, it is frequently the better answer, and it is the answer that principals will actually accept, which matters more than it should.

STAGE THREE — THE QUESTION IS WHETHER ANYONE IS WATCHING US

Now something unconnected surfaces. A member of the household mentions a vehicle that has been present on the approach to the residence on three separate mornings, each time with someone inside it, each time leaving before the school run. The individual from stage one is accounted for elsewhere. So this is either coincidence or a second and more capable problem.

The question has flipped. It is no longer about a person. It is about the ground.

Counter-surveillance is directed at the environment rather than at the principal or at a named subject. It is deployed to establish whether anybody is conducting surveillance against a location, a route or a pattern. It is tasked independently and it can return three answers: yes, no, or insufficient to say. The third answer is the one clients find least satisfying and the one an honest provider will give most often.

This is also where the value of the earlier stages compounds. A counter-surveillance effort that knows what normal looks like on that street, at that hour, is doing something quite different from one deployed cold.

STAGE FOUR — THE QUESTION IS WHAT THE PRINCIPAL CAN DO ALONE

Deployed capability is expensive and finite. It is not present on every journey, on every day, for the rest of a principal’s life, and any provider implying otherwise is describing an invoice rather than a plan. On most days the principal, a family member, or a driver is the only resource available.

Anti-surveillance is what the individual does themselves to confirm or deny that they are under surveillance. The distinction from counter-surveillance is the point that is most often lost and most worth holding onto: counter-surveillance is other people looking for watchers on your behalf, while anti-surveillance is you establishing it through your own movement and attention.

Of the six elements this is the only one available on every day of the year, the only one that costs nothing once taught, and the only one that cannot be outsourced. It is also the one most frequently skipped, because it requires the principal to learn something rather than to purchase something. In the scenario it is taught to the principal, to his spouse and to the two staff who drive, and it is the measure that remains in place long after the deployed elements have stood down.

STAGE FIVE — THE QUESTION IS HOW TO SUSTAIN PRESENCE

The task now grows. The family is hosting a three-day event across two venues with a substantial guest list, a public arrival and confirmed hostile interest from stage three. Any capability that has to hold ground for three days faces a problem that has nothing to do with skill: presence over time creates pattern, and pattern is what gets noticed.

The supporting element, which many organisations call props, exists to solve endurance and plausibility. It is not a discipline in its own right so much as the enabler that allows the others to function for longer than a few hours. Its output is simple to state and difficult to achieve: a capability that has a reason to be where it is, for as long as it needs to be there.

The reason it matters commercially is that it is the element most often omitted from a proposal and most often responsible for a deployment being compromised. A task costed without it is a task costed for a duration it cannot actually sustain.

STAGE SIX — THE QUESTION IS HOW TO MOVE AT ALL

The final stage involves a single movement that cannot be concealed, cannot be rescheduled and cannot be cancelled, with hostile interest confirmed and an assessed intention to intercept.

A decoy element presents an alternative focus in order to absorb or redirect attention away from the actual movement, buying separation and time. It is listed last deliberately. It carries the highest control requirement, the narrowest band of legitimate use and the greatest legal and reputational exposure of anything discussed here. It is appropriate only where hostile interest is confirmed rather than suspected, where the alternative is worse, and where every action taken remains lawful. It is never a means of deceiving police, emergency services or the public, and any proposal that treats it as a routine product should be declined.

In the scenario it is used once, for one movement, and then never again.

The elements side by side

Stripped of the narrative, the distinction between them is a distinction between questions.

Element	The question it answers	What it delivers
Investigative	Who is this and does it matter?	Evidenced fact about a subject, to a standard that supports a legal or protective decision
Protective	Can the principal move normally and still be covered?	Early warning and decision space, without visible security
Counter	Is anyone conducting surveillance against us?	A yes, a no, or an honest not yet, against a location, route or pattern
Anti	Can I establish this for myself, today, alone?	A permanent, self-applied capability that costs nothing after training
Supporting (props)	How do we sustain presence without becoming the anomaly?	Endurance and plausibility, and therefore duration
Decoy	How do we move when the movement cannot be hidden?	Separation and time, at the highest control and legal threshold

Scaling: what is actually deployed

The scenario above is deliberately unusual. It runs through all six elements because it is a teaching example. Real tasks very rarely do.

Most engagements use one element. A smaller number use two in sequence, most commonly investigative work followed by a protective measure, or counter-surveillance followed by a decision to change a routine rather than to deploy anything further. Full integration across the disciplines is rare, expensive, and justified only by a genuinely elevated and evidenced threat picture. A provider proposing it in response to a low-grade concern is selling rather than advising, and the distinction is usually visible in whether the proposal contains a scenario in which nothing is deployed at all.

The recurring error is not under-buying. It is buying the element that answers a different question from the one the client actually has. A visible detail is commissioned where protective surveillance was the fit. An investigative task is commissioned when the real question concerned the ground rather than a person. A counter-surveillance deployment is requested when what was needed was two hours of anti-surveillance instruction for a driver. These are not small misallocations. They consume budget, they produce a product that does not answer the question, and they frequently leave the client feeling that the discipline as a whole does not work.

The first hour of any competent tasking conversation is therefore spent establishing which question is being asked, and it is usually not the question the client opened with.

Authority, legality and the part nobody sells

There is a persistent misconception that private surveillance in the United Kingdom operates under the Regulation of Investigatory Powers Act. It does not. RIPA, and the Investigatory Powers Act 2016 which consolidated much of the interception framework, provide investigatory powers to specified public authorities. A private firm acquires no powers whatsoever by conducting an investigation.

What governs private work instead is the ordinary law, and it is not permissive. UK GDPR and the Data Protection Act 2018 require a lawful basis for processing, and legitimate interests is available but is not automatic: it requires a documented assessment of purpose, necessity and the rights of the individual observed. Article 8 privacy principles inform whether an activity is necessary and proportionate. The Protection from Harassment Act 1997 means that a sustained course of conduct directed at a person can itself become an offence regardless of who commissioned it. The Computer Misuse Act 1990, the law of trespass and the tort of misuse of private information each close off routes that clients occasionally ask about.

Against that, the regulatory position is worth stating plainly because most clients do not know it. There is no licensing regime for private investigation in England and Wales. The Private Security Industry Act 2001 gave the Security Industry Authority the power to regulate it, the relevant provisions were never brought into force, and successive governments have deferred the question since the original 2013 announcement. Scotland operates separate arrangements. In practical terms, anybody in England and Wales may describe themselves as an investigator and offer surveillance services, with no required training, no entry standard and no register for a client to check.

That places the entire burden of assurance on the buyer, and it changes what a family office should be asking for. The useful question is not whether a provider can conduct surveillance. Almost anyone will say yes. The useful questions are these: show me the written tasking and who authorised it; show me the recorded lawful basis and the proportionality assessment behind it; show me the retention schedule and what happens to the product at the end; show me the insurance; and show me the circumstances in which you would tell me to do nothing.

A provider who cannot produce the first four is exposing the client to legal risk on the client’s own instruction. A provider who has no answer to the fifth is not offering advice.

The wider point

Every element described here produces observations. Observation is not intelligence. A log of movements, a vehicle index, a photograph of somebody sitting in a car on three consecutive mornings: on their own these are data, and data can be accumulated indefinitely without anybody becoming safer.

At Greyveil we describe our approach as Behavioural Protective Intelligence. Technology records what happened. Protective intelligence anticipates what might happen. Behavioural intelligence reads intent and pattern, which is what turns three mornings of a parked vehicle into either an explanation or a decision.

The six elements are not a product list. They are answers to six different questions, and the discipline that matters most is the unglamorous one exercised before anything deploys: working out, honestly, which question the client actually has, and being willing to say when the answer is that nothing should be deployed at all.

Protect the whole footprint. Start by establishing what you are actually looking at.

GREYVEIL LTD  ·  PRIVATE SECURITY SERVICES  ·  SPECIAL PROJECTS

enquiries@grey-veil.com   ·   grey-veil.com