This guide accompanies our TSCM services in the Netherlands. For the core definition, see the wiki: what is TSCM?
What surveillance actually costs when it succeeds
The cost of a successful surveillance operation against a business is rarely a single incident. A competitor who hears your M&A offer before it is tabled adjusts their counter-offer. A counterparty who knows your settlement floor in arbitration never settles above it. A state actor collecting pre-regulatory intelligence from your boardroom shapes policy that disadvantages your sector. None of these outcomes shows up on a police report because the information was never visibly stolen — it simply arrived where it should not have.
Documented cases of commercial surveillance in Europe consistently show the highest-value targets are board meetings before major decisions, legal meetings during litigation or arbitration, and executive residences and vehicles during high-stakes transactions. The common factor is a moment of high information density where one party's advance knowledge of the outcome has measurable financial value to someone else.
What a TSCM programme protects
A structured TSCM programme provides four categories of protection. First, it removes devices already in place — RF transmitters, NLJD-detectable semiconductor implants, and physical audio recorders placed during access events. Second, it deters future placement by making the risk calculus unfavourable for an adversary who cannot be certain a sweep is not imminent. Third, it produces a documented baseline of each environment, making anomalies detectable on subsequent sweeps. Fourth, it provides defensible evidence of due diligence — relevant for organisations subject to NIS2, GDPR data-protection obligations, or client-confidentiality duties under professional regulation.
For law firms and financial advisers, the last point carries specific weight. Professional-body obligations to protect client confidentiality do not disappear because the threat is electronic rather than physical. A documented TSCM programme is evidence that reasonable technical precautions were taken — the absence of one is evidence of the opposite.
The deterrence value of a known sweep programme
Not all TSCM value is in discovery. The deterrence effect of a sweep programme that is known to exist — by staff, contractors, and anyone who has been on the premises — is substantial. Technical surveillance requires access to place a device. Access opportunities are weighed against the risk of the device being found. A site that is known to conduct regular sweeps is a higher-risk placement environment than one that has never been swept.
This deterrence dynamic means TSCM programmes have asymmetric value. The cost of a sweep programme is fixed. The cost of what it deters — a successful intelligence operation against your organisation — can be orders of magnitude higher. The calculation for any organisation handling commercially, legally, or diplomatically sensitive information strongly favours a programme over reactive response.
When to start a TSCM programme
Three circumstances make starting a TSCM programme straightforward to justify. The first is a trigger event: a suspected information leak, a relationship breakdown with someone who had site access, or an upcoming event (board meeting, transaction, negotiation) with a defined high-stakes window. The second is a structural exposure: the organisation operates in a sector or geography where state or commercial surveillance is a known active threat. The third is a due-diligence requirement: professional obligations, client contracts, or insurance underwriting conditions require documented technical security measures.
Organisations that begin with a one-off sweep typically move to a scheduled programme once the first sweep establishes a baseline and confirms the threat is real. Mission Support can design a programme scaled to the organisation's actual exposure — from an annual sweep of a single boardroom to a quarterly multi-site programme covering all sensitive meeting environments.
Frequently asked
How do I know if my organisation needs TSCM?
If your organisation handles information that would have financial, legal, or strategic value to a competitor, counterparty, or state actor, a TSCM assessment is warranted. High-exposure sectors include law, finance, pharmaceuticals, defence supply chain, government contracting, and any organisation involved in M&A or major litigation.
What is the return on investment of a TSCM sweep?
ROI on TSCM is asymmetric and hard to calculate precisely — the value is in what does not happen. The most useful frame is: what is the cost of your next major negotiation, board decision, or client engagement being intercepted? A TSCM programme costs a fraction of any single high-stakes transaction it protects.
Does TSCM cover cyber threats and network interception?
Physical TSCM (RF, NLJD, physical search) and cyber/network security address different attack surfaces but often overlap in sophisticated operations that combine a physical implant with network exploitation. Mission Support's advisory team can assess whether a combined approach is warranted for your environment.