What does your technician use to do a proper TSCM sweep?

The reality: a sweep is not one tool
A thorough TSCM sweep combines different technologies and physical search skills to cover the range of threats. Different detectors find different threats. A single detector simply cannot reliably detect everything. Below are the main categories and examples of the tools we use at RIVICA and what each one actually does.

• Wide-band RF spectrum analyser (OSCOR Green, 24 GHz) — scans radio frequency (RF) bands quickly and captures transmitting devices and strange emissions across a broad range. Essential to detect active RF transmitters and to map spectrum activity over time. Research Electronics International
• Telephone and line analysers (TALAN family) — inspect analogue, digital and VoIP lines for audio leakage, tapping hardware, suspicious signalling or anomalies on the wiring that a pure RF sweep will miss. These instruments combine oscilloscope, line-noise analysis, and packet/FFT views for modern telecoms. Research Electronics International
• Non-linear junction detectors (NLJD, e.g., ORION series) — detect semiconductor junctions in walls, furniture and devices. NLJDs can locate electronics even when they are switched off or not transmitting. They are a physical-property detector rather than a simple RF listener. Research Electronics International
• Specialist near-field and broadband receivers — these identify low-power near-field transmissions and can be tuned to pinpoint and characterise modulation types and signal sources. These receivers complement the spectrum analyser and NLJD. (These are examples of devices used alongside the above categories.) Research Electronics International+1
• Digital forensics and device analysis tools (Cellebrite UFED & Physical Analyser) — when mobile devices or memory cards are relevant, properly licenced forensic extraction and analysis tools are required to preserve evidence and produce admissible reports. These are not consumer apps. They are full forensic toolkits used by law enforcement and professional examiners. cellebrite.com

Why this matters

• Modern threats are multi-vector. A covert camera may transmit over Wi-Fi, a spy microphone may be hard-wired into a telephone pair, and a tracker may be a passive device that only responds to a close interrogation. No single detector covers all modalities. Research Electronics International+1
• Tools need calibration, interpretation and cross-correlation. Spectrum traces, waterfall plots and NLJD returns are not self-evident. You need trained operators who can separate benign signals from malicious ones, and who understand building wiring, shielding effects and RF propagation. Research Electronics International+1
• Forensic handling is required for chain of custody. If a device or data is recovered, the way it is extracted, documented and analysed determines whether it will be usable in a legal or commercial dispute. That requires the right hardware and accepted forensic processes. cellebrite.com

My frustration
Too many operators announce themselves as “TSCM” after buying a single scanner and a weekend course. That risks giving clients a false sense of security. A sweep performed without the right combination of tools, methodical search, and experienced interpretation can miss a threat or, worse, produce false positives that cost time and money. TSCM is a professional service. Presenting it as a cheap, fast checkbox undermines the profession and puts clients at risk. QCC Global

Experience matters
I have spent three decades working in policing and covert investigations. In my earlier roles my unit installed covert devices for authorised operations. That background informs how I approach a sweep. Knowing how devices are installed and their capabilities, helps you identify the likely hiding places, the indicators of compromise, and the correct countermeasures. Experience teaches you what to trust in a trace and what requires further physical inspection or forensic follow up. My team’s work blends equipment, process and practical experience to deliver defensible results. (This is a personal statement of experience.)

Practical advice for anyone buying a sweep

• Ask for the equipment list. A credible provider will be transparent about the tools they use and why. Research Electronics International+1
• Ask about training and qualifications. TSCM is a skills discipline taught by specialist providers. Weekend familiarity is not the same as operational competence. QCC Global
• Ask about reporting standards and chain of custody. If a device or data is found, you will need properly documented evidence. cellebrite.com
• If your concern involves mobile phones or digital evidence, ensure the provider has access to recognised forensic extraction tools and follows accepted forensic processes. cellebrite.com

A final note
If you need assurance, do not gamble on a single tool or a weekend course. A proper sweep is an investment in certainty. If you would like more information on the equipment we use and the methodology we apply, get in touch. The photograph attached to this article shows a portion of the kit we deploy on complex sweeps. Equipment alone is not the answer; disciplined methodology and experienced operators are what make a sweep reliable.

If you would like to discuss TSCM for your organisation, boardroom, vehicle or residence, contact us at RIVICA Investigations & Covert Solutions. I will be happy to explain the process and provide a tailored proposal.