TSCM Guide: Bug Sweeps and Protecting Sensitive Meetings

The most sensitive conversations in an organisation, board meetings, deal negotiations, incident war rooms, often happen in rooms nobody has checked for listening devices, cameras or compromised conferencing kit. Technical surveillance countermeasures (TSCM) is the discipline of finding and defeating those threats, and it is much broader than an occasional "bug sweep". This guide explains what TSCM covers, the realistic threats, how to protect meeting spaces day to day, when and how to commission a sweep, what staff should do if they find a device, and the legal limits that apply. It is written for security managers, executive protection and facilities teams, CISOs who own meeting room technology, and anyone planning off-site sensitive meetings.

Key takeaways

TSCM is a programme, not a single sweep. The US Department of Energy defines it as measures to detect, deter, isolate and nullify technical surveillance penetrations and technical security hazards, delivered through surveys, inspections, in-conference checks, advice during building work and staff education.
The phone in the room is the most likely microphone. Compromised smartphones, laptops, smart speakers and conferencing systems are easier routes into a meeting than a planted transmitter; device rules matter as much as sweeps.
Not every threat is inside the room. UK NACE warns that laser eavesdropping can work from up to 500 metres by reading vibrations on windows, with no device installed at all.
A sweep is a snapshot. It shows the room was clean at that moment; access control, zoning, tamper evidence and change control keep it clean afterwards.
Finding a device is an investigation. Do not touch it or talk about it in the area; report it from elsewhere, preserve it and involve legal and law enforcement.

What technical surveillance looks like

The Department of Energy's technical security chapter describes technical surveillance penetrations as information leaving an area through unauthorised technical means: installed surveillance devices, software manipulation, interception of unintended emanations and deliberately created hazards. In a commercial setting that translates to the categories below.

Threat category	Examples	Typical attacker	Main countermeasures
Planted audio devices	Battery or mains-powered transmitters, GSM or LTE "bugs" with a SIM, recorders that store audio for later collection	Competitors, private investigators, insiders, state actors	Access control, physical inspection, RF analysis, tamper-evident seals
Hidden cameras	Pinhole cameras in smoke detectors, chargers, clocks; Wi-Fi cameras in rented spaces	Insiders, voyeurs, hostile landlords or hosts	Visual and optical lens detection, network inspection, venue vetting
Compromised IT and AV	Malware enabling microphones and webcams on laptops and phones; tampered conference room systems; smart speakers	Criminal groups, state actors	Device policy, endpoint security, AV system hardening and inventory
Wired taps	Interception on telephone, network or AV cabling passing through shared spaces	State actors, sophisticated insiders	Cable route inspection, physical protection of risers, encryption
Remote acoustic collection	Laser microphones on windows; listening from adjacent rooms, ceiling voids or corridors	State actors and well-funded corporate espionage	Room selection, heavy blinds or curtains, sound masking, avoiding line of sight
Hardware additions to endpoints	Keylogging adapters, rogue USB devices on meeting room PCs	Insiders, visitors	Port control, asset inspection, visitor escorting

MITRE ATT&CK covers the endpoint side of this: T1123 Audio Capture and T1125 Video Capture for malware that switches on microphones and cameras, T1056.001 Keylogging and T1200 Hardware Additions for devices plugged into meeting room equipment. Treat these as part of the TSCM scope, not a separate IT problem. See the Mobile Device Security Guide and the Bluetooth, RFID and NFC Security Guide.

Protecting sensitive meetings day to day

Most of the risk reduction comes from routine controls, which the UK National Protective Security Authority (NPSA) sets out in its ten steps to mitigate state threats.

Zoning: designate specific rooms for sensitive discussion and confine those conversations to them, so unauthorised people cannot overhear. NPSA recommends restricting mobile technology in the most sensitive areas.
Device rules: phones, smartwatches and personal laptops stay outside the room in lockers or pouches for the most sensitive meetings. Disable or remove smart speakers and unused voice assistants in meeting spaces.
Access control and logging: lock designated rooms when not in use, control and log who enters, and audit access rights regularly. Cleaners, contractors and AV engineers need escorts or recorded access. See the Physical Access Control Systems Security Guide.
Visitor screening: NPSA advises screening visitors and staff for unauthorised devices such as recording media and escorting visitors where necessary.
Tamper evidence: seal ceiling tiles, floor boxes, AV cabinets and network points in designated rooms, and check seals before meetings.
Change control: new furniture, gifts, electronics or building work in a sensitive room trigger an inspection. The Department of Energy's TSCM inspection service exists for exactly these changes.
Window and acoustic discipline: UK NACE recommends heavy blinds or curtains, avoiding offices with line of sight to other buildings (especially high-rise flats), and a clear desk policy to reduce objects that pick up vibration. Add sound masking at doors and shared walls.
Conferencing hygiene: maintain an inventory of every microphone and camera in the room, keep AV firmware patched, remove unused cloud features, and check whether AI meeting assistants or recording are enabled. See the AI Meeting Assistant Security Guide and the IP Camera and CCTV Security Guide.

Types of TSCM service

The Department of Energy describes a tiered set of services that maps well onto commercial practice.

Service	What it involves	When to use it
Full survey	Technical, physical and visual examination of an area, with instrumented anomaly resolution and technical penetration investigation	New or refurbished boardrooms, executive suites, before a high-stakes deal, after a suspected leak
Inspection	Limited check after changes such as new furniture, electronics, construction or gifts	Change control events in a designated room
In-conference inspection	Check of a non-secured space before, during and after a sensitive meeting	Hotels, off-site venues, temporary project rooms
Advice and assistance	Input during construction, renovation or procurement of telephone and video conferencing systems	Office fit-outs, AV procurement
Education	Briefings on threats and the programme	Executives, assistants, facilities and AV staff

A competent commercial survey typically combines radio frequency spectrum analysis, inspection for electronic components in places they should not be, thermal and optical lens detection, examination of telephone, network and AV equipment, and a careful physical search of furniture, fittings and voids. Ask providers to explain their methods, instruments and reporting rather than focusing on equipment brand names. Note that a sweep cannot detect a device that is switched off and stores audio locally if the physical search misses it, which is why the physical search matters as much as the electronics.

Commissioning a sweep: a step-by-step approach

Decide what you are protecting. Identify the rooms, meetings and people that warrant protection, following NPSA's first step of identifying sensitive assets. Not every meeting room needs a survey.
Choose a provider carefully. Ask about experience, insurance, vetting of technicians, methods and a sample report. In the UK, government and critical national infrastructure organisations can seek advice from UK NACE, part of FCDO Services.
Keep the request quiet. The Department of Energy instructs staff never to discuss pending TSCM activity in the area to be checked, by email, or using words like "sweeps" or "bugs" there. Arrange it from a different location and limit who knows.
Maintain normal conditions. Leave computers, phones and AV powered on as normal so active devices are transmitting. Avoid clearing the room in a way that tips off an insider.
Agree what happens if something is found. Decide in advance who is called, whether law enforcement is involved, and who handles evidence.
Review the report. Expect findings on vulnerabilities (poor access control, exposed cabling, windows with line of sight) as well as devices, and assign owners to each.
Set a cadence. Repeat surveys on a risk basis, for example before major transactions and after building work, and use inspections in between.

If a device is found or suspected

The Department of Energy's guidance for staff is a good model for any organisation:

Do not touch, move or disable the device, and do not discuss it in the room or in rooms above, below or next to it.
Carry on normally, then report it in person from outside the area or over a channel you trust.
Secure the area and restrict access until the response team arrives.
Preserve evidence: photograph the device in place, record who had access to the room, and secure access control logs, CCTV and visitor records for the relevant period.
Involve legal counsel and, where appropriate, law enforcement before removing the device; a deliberately left device can sometimes be used to identify who collects from it.
Assess what was discussed in the room while the device could have been active, and treat that information as compromised.
Investigate the insider angle: someone placed the device, and they may have had legitimate access. See the Insider Threat Programme Guide.

Hidden cameras in rented accommodation are a related, everyday issue for travelling staff. Airbnb, for example, has banned hosts from having security cameras that monitor indoor spaces since 30 April 2024, and requires outdoor cameras to be disclosed. Staff who find a hidden camera should leave, report it to the platform and local police, and inform the security team. See the Travel Security Policy Template.

Legal limits for organisations

Countermeasures have legal boundaries, and they differ by country, so take local legal advice.

Jammers: in the United States the FCC states that operating, marketing or selling jamming devices is illegal, with no exemptions for use within a business, classroom, residence or vehicle (Communications Act sections 302(b) and 333). Many other countries, including the UK, also prohibit their use. Do not use jammers to "secure" a meeting room; use device-free zones instead.
Interception devices: in the United States, 18 U.S.C. 2512 makes it a crime to manufacture, possess, sell or advertise devices primarily useful for surreptitious interception of communications, with exceptions for communication service providers and government. Your own security team should not buy covert listening equipment to "test" rooms.
Monitoring staff: recording meetings or monitoring employees raises privacy and employment law issues. Make any recording overt and governed by policy.

Choosing the right level of effort

Small organisations: designate one lockable room, adopt a phones-outside rule for sensitive meetings, inspect the room yourself after changes, and buy a professional survey only before rare high-stakes events.
Mid-sized organisations: add tamper seals, AV inventory and patching, annual surveys of the boardroom and executive offices, and in-conference checks for off-site board meetings.
Large or high-risk organisations (defence supply chain, M&A advisers, critical infrastructure, firms with known state interest): a formal TSCM programme with a named owner, risk-based survey schedule, construction advice for new spaces, executive briefings and integration with the insider threat and executive protection programmes. See the Executive Protection and Digital Footprint Guide.

Detection and measurement

Monitor access control logs for designated rooms (out-of-hours entries, entries without a booking), alert on broken tamper seals, inventory wireless networks and Bluetooth devices seen in sensitive areas, and watch endpoint telemetry for unexpected microphone and camera use on meeting room systems. Metrics:

Coverage: percentage of designated sensitive rooms surveyed or inspected within the agreed cycle.
Change-triggered inspections: share of changes in designated rooms followed by an inspection before next use.
Vulnerability closure: survey findings closed within the agreed time.
Device rule compliance: spot checks showing phones excluded from device-free meetings.
Awareness: proportion of executives, assistants and facilities staff briefed in the last year.

Common failure patterns

A sweep with no follow-up. The room is checked once, then cleaners, contractors and AV engineers come and go without escort or inspection.
Announcing the sweep. Calendar invitations and emails titled "bug sweep" tell an insider to switch off or remove a device.
Ignoring the phones and AV. Money goes on RF sweeps while every attendee brings a smartphone and the room has an unmanaged cloud-connected conferencing system.
Glass walls and windows. Sensitive meetings in rooms overlooked by neighbouring buildings, with no blinds, invite remote acoustic and visual collection.
Jamming instead of controlling devices. Illegal in many countries and it disrupts emergency communications.
Removing a found device immediately. Evidence and the chance to identify who placed it are lost.

Framework mapping

Framework	Reference	Relevance
NIST SP 800-53 Rev 5	PE-19 Information Leakage; PE-3 Physical Access Control; PE-18 Location of System Components	Protecting against leakage through emanations, controlling and siting sensitive spaces
NIST SP 800-53 Rev 5	AC-19 Access Control for Mobile Devices; SC-42 Sensor Capability and Data; AT-2 Literacy Training and Awareness; IR-6 Incident Reporting	Device rules, microphones and cameras, staff awareness, reporting finds
NIST CSF 2.0	PR.AA-06; DE.CM-02; PR.AT-01	Physical access managed, physical environment monitored, staff trained
ISO/IEC 27001:2022 Annex A	A.7.4 Physical security monitoring; A.7.6 Working in secure areas	Monitoring and procedures for secure areas
MITRE ATT&CK	T1123 Audio Capture; T1125 Video Capture; T1200 Hardware Additions	Endpoint and hardware routes to meeting room surveillance

Practitioner checklist

Identify the rooms, meetings and people that need protection and designate sensitive zones.
Apply a device-free rule for the most sensitive meetings, with lockers outside the room.
Control, log and audit access to designated rooms, and escort contractors.
Fit tamper-evident seals and check them before sensitive meetings.
Inventory and patch every microphone, camera and conferencing system in designated rooms.
Fit heavy blinds and avoid rooms with line of sight to neighbouring buildings.
Commission surveys on a risk basis, arranged from outside the area and without announcement.
Brief staff on what to do if they find a device: do not touch, do not discuss, report from elsewhere.
Never use jammers or covert interception equipment.

Technical Surveillance Countermeasures Guide: protect sensitive meetings from eavesdropping and hidden devices