“I think I found a bug!”

Now, what do I do?

A security director once called and said, “I think I’ve found a bug. What should I do now?”

This type of call is far more common than most people imagine.

In many cases, the mystery object turns out to be harmless—an Annoy-a-tron prank gadget or another odd piece of electronics that looks “spy-like” to the untrained eye. People frequently stumble on items covered in Chapter 27 — Eliminating Red Herrings.

But sometimes the discovery is real.

In this incident, the director found a digital voice recorder with voice activation. It had been taped inside a wastebasket in the Boardroom, where a meeting was scheduled the next morning. The adhesive failed, the recorder fell, made a loud metallic thud, and was discovered by an employee who assumed a rodent was rustling inside the can. By the time we arrived on an emergency call, the device had already been removed and heavily handled—an error that contaminated valuable evidence.

Why Routine TSCM Inspections Matter

In this case, the client was lucky: a failed piece of tape exposed the device. Had anyone arrived earlier to retrieve it, the opportunity to identify the culprit would have been lost. Had a scheduled pre-meeting TSCM inspection been performed, luck wouldn’t have been a factor at all.

Organizations with robust security profiles conduct TSCM inspections quarterly or semi-annually, before board meetings, before critical off-site events, and during periods of legal or competitive sensitivity (e.g., mergers, lawsuits).

Organizations that neglect TSCM procedures rarely know they’ve been compromised. As the espionage axiom goes: Rule #1 — Be invisible.

The situation underscores a critical question:

If you think you’ve found an eavesdropping device, what should you do?

Immediate Actions to Take

Many things look like they could be bugs. Read Chapter 27 , if you are unsure about what you found. You may solve your mystery instantly. Once you have eliminated a red herring:

1. Do not touch or move the device.
2. Treat it as evidence.
3. Do not alert the eavesdropper.
4. Continue behaving normally. Write notes or use hand signals if necessary. If the object may be a camera or transmitter, drift casually out of its view.
5. Secure the area without drawing attention.
6. Create a natural excuse to restrict access. Consider the space a potential crime scene.
7. Stay nearby, but hold sensitive conversations elsewhere.
8. Don’t leave the device unattended long enough for someone to retrieve it.
9. Tell only people with a genuine need to know. Anyone else could be the perpetrator. Warn those you brief to keep the discovery strictly confidential.
10.  Document everything. Take close-ups, midrange photos, and wide shots showing placement. Record who found the device, when, what triggered the discovery, who was present, who handled the device (if anyone), and every subsequent step taken.

Your Next Step: Contact a Professional

From a secure location using a “safe” phone or computer, contact your technical information security consultant. The International Association of Professional Security Consultants (iapsc.org) is one place to locate qualified experts—preferably someone capable of serving as an expert witness if necessary.

When the consultant arrives, they will:

• Identify the device.
• Complete and formalize the documentation process.
• Conduct a full TSCM inspection for additional or supplementary devices.
• Recommend strategies for identifying the eavesdropper.
• Evaluate the situation and advise on next steps.
• Help you develop a future information-protection plan.

Internal Notifications for Businesses

In a corporate environment, notify:

• the security director,
• corporate counsel,
• appropriate senior management.

This group determines how to proceed. Options include:

• Covert counter-surveillance: Set a hidden camera to see who services or retrieves the device—especially effective if the device is battery-powered or stores data locally. Sometimes a mild “malfunction” (blocking its view or introducing noise) forces the perpetrator to return.
• Internal investigation: Handle the matter in-house until more facts emerge.
• Law enforcement: For employee-on-employee voyeurism (such as a spycam under a desk), contact local police or the county prosecutor. For more sophisticated attacks or matters touching national security, contact the highest-level federal unit available (in the US, the FBI). Request a technically trained investigator.

BUY NOW