Building An Internal TSCM Service Capability – Part 2

So, your organisation needs to decide whether to develop and maintain an internal TSCM (technical surveillance counter measures) service or to contract the services of an external service provider. How do you decide which is the best option for you?

Establishing and maintaining an in-house capability is not quick, easy or cheap, but it is possible. Having your own internal service means no exposure to external TSCM providers. You can decide when a TSCM survey takes place. You have a readily available resource. Your internal TSCM operators know your organisation intimately. Using an external supplier is simple, but comes with the added issues regarding how you evaluate the service you receive and availability issues (e.g. will the service provider be available at short notice and when you require them? How do you quality assure the service you receive? What due diligence do you conduct on the service providers? etc)

UNDERSTANDING THREAT

Before building your internal TSCM services, it’s necessary to ensure that you understand threat. You need to know what TSCM is and of equal importance what TSCM is not! Seek TSCM Awareness Training from a reputable TSCM training provider (of course we offer this at our Verrimus TSCM Training facility). Before you can establish what you need to build, you need to have a firm grasp of what you are attempting to mitigate with this service. Learn what is possible and what is probable regarding methods of technical surveillance attacks for your organisation. Understand how different attacks are installed, work and are detected.

DESIGN YOUR TSCM SERVICE REQUIREMENTS

Once you have an understanding of threat, you can now decide how mitigating those threats will meet your organisational risk appetite.

Ask yourself questions such as;

• How often will the service be required? (e.g. every boardroom surveyed daily/weekly? Or 2 surveys of the whole organisation a year? Only senior executive offices to be surveyed regularly? Travel involved? What about the residences of senior personnel? Hotel and business travel accommodations required to be surveyed?)

• How will the TSCM survey fit into the organisation’s existing security landscape?

• Will ‘conducting TSCM services’ be added to an existing personnel’s role or will you be hiring new personnel?

COST THE SERVICE OPTIONS

Cost is often the deciding factor when determining which service is most suitable for your organisation;

a) an in-house TSCM service provision,

b) an external TSCM service provision or

c) a hybrid (internal and external) TSCM service.

An in-house TSCM service will require;

• personnel recruitment and training (again, will these be employees already or are you needing to recruit?)
• purchase of measurement equipment, required to cover the threat domains relevant to your organisation (eg. RF counter-surveillance receivers, GSM threat detection, Bluetooth threat detection, telephone line analysers, NLJDs, thermal imaging cameras, search tools, etc)
• ongoing TSCM threat awareness training (emerging threats, new counter measures processes etc)
• ongoing TSCM operational evaluations (identify areas of skill fade or challenges to team cohesiveness and dynamics)
• equipment maintenance/upgrades
• carnets for temporary import and export of specialist equipment may be required.

An external TSCM service provision will require;

• provision of an RFQ/tender document
• ability to compare service proposals
• evaluation of the service provider to ensure they continue to meet your requirements

Obviously, a hybrid service requires a decision regarding how the service will be provided by internal and external providers. For example, we’ve supported some of our clients to build an in-house QPD (quick plant device) TSCM team, who conduct regular pre-meeting surveys of boardrooms and then they ask Verrimus to conduct more in-depth bi-annual/quarterly full TSCM surveys for other areas.

Whatever you decide best suits your organisational risk appetite, processes and threat level, the starting point is to ask for support from a reputable and experienced TSCM service provider.

Contact us if you’d like to discuss your needs.