Training, Education, and Career Issues
Getting started in TSCM is tough, there is a steep learning curve in gaining proficiency in electronics, communications, computers science, security, and investigations. However, TSCM is not an investigative service, it's a technical service. Most the equipment and activities are based around technical things, with only the smallest amount involving any investigative skills.
A TSCM student should a strong background in practical electronics, and experience in both computer hardware and software before they start learning TSCM.
It's impossible to learn TSCM in a one or two-week course, but sadly that is often the only formal technical training many private sector or government TSCM people obtain. It has often been compared to attending a one day first aid course and then believing that it qualifies you to perform brain surgery.
The first thing we do, is kill all the lawyers.|
Complete at least 13 weeks of basic electronics (520 classroom and lab hours) prior to attending any TSCM training. Also, get several advanced telecommunications and computer courses under your belt.
Plan to complete at least 500 hours (13 weeks) of TSCM training before doing an actual sweep or anyone allowing you to assist with a sweep. You must be an expert on the subject matter before anybody will allow you to work with them.
This is a deadly serious business, and there's no room for on the job training.
The following is the recommended program for training TSCM specialists to deal with the modern eavesdropping threat:
Phase I, Basic Electronics (26 weeks/1024 hours)
Basic Electronics, Technical Mathematics, DC Circuits, AC Circuits, Solid State Devices, Oscillators, Amplifiers, RF Circuits, Communications Systems, Methods of Modulations, Signal Theory, Receivers, Transmitters, Digital Principles, Hybrid Circuits, Computer Systems, Telephone Systems, Telecommunications, Networks, Basic Instrumentation. This block of instruction is covered by either a four-year college degree in electrical engineering (at least 85 credits in electronics) or by attending a military school on electronics at least six months in length. Within military circles this is referred to DASE - Phase I/II Defense Against Sound Equipment, and is roughly 20 weeks long.
Phase II, Computer Science (13 weeks/520 hours)
This is primarily a computer programming and administration block of instruction including: UNIX, C/C++, Network Operating Systems, Computer Security, Network Security, and Systems Administration. The student is normally taught a major UNIX platform (ie: Sun, HP, SGI, DEC) and at least one mainstream desktop system (Mac or PC). This training will also include word processing and specific applications training. This block of instruction is covered by either a two-year college degree in computer science (at least 40 credits in computer science) or by attending a military school on computer programming at least four months in length.
Phase III, "Spook Craft" (26 weeks/1024 hours)
Intelligence Operations, Intelligence Analysis, Physical Surveillance, Counter Surveillance, Technical Intelligence, Intercept Operations, Audio Intercept, Telephone Intercept, Video Systems, Night Vision Systems, Facsimile Systems, Pager Intercept, Mobile Tracking Operations, Physical Security Countermeasures, Picks and Clicks, Alarm Bypass, Combines Operations, Undercover Operations. At least a fourth (6-8 weeks) of this segment should involve locksmithing, physical security countermeasures, alarms systems, and safe/vault repair. This block of instruction is normally restricted to military special operations and intelligence operators.
Phase IV, Protective Services (8 weeks/320 hours)
This block of instruction is strongly recommend for both government and corporate TSCM specialists. The largest "consumer" of TSCM services in the world are protective agents, bodyguards, and executive protection details. Due to this the TSCM specialist must have a basic understanding of this field, and how it relates to protective detail operations. The optimal series of training will start with a 2-3 week resident program (like ESI), followed by a series of subject specific courses.
Phase V, Forensic Science/Criminalistics (6 weeks/200 hours)
The student should obtain at least six weeks of training on forensic science, not so they can process a crime scene (remember they are not investigators). If an eavesdropping device is found the specialist must know how to secure the scene to preserve evidence. Also, many of the techniques and disciplines used in forensic science to locate and identify evidence also apply to TSCM (ie: Fluorescence Examination, Macro Photography, Examination of Fibers, Laser Imaging, Forensic Lighting, Collection of Trace Evidence, Tools Marks, etc...) If possible the student should try to obtain at least 13 weeks of training in this area, however; 6 weeks is a good initial start.
Phase VI, Advanced Instrumentation (8 weeks/320 hours)
This is an introduction to modern advanced instrumentation used by the TSCM industry such as digital spectrum analysers, vector signal analysers, search receivers, portable X-ray equipment, Time Domain Reflectometers, MSS systems, network analysers, and so on. (The student must be an expert on each of these instruments). This training is not specific to TSCM equipment, but is general training on the instruments.
Phase VII, Basic TSCM Skills (13 weeks/520 hours)
Introduction to fundamental skills and procedures used to locate and identify specific technical threats and activities. This training primarily involves the student learning to perform specific technical and administrative tasks, in a classroom or laboratory environment. This training includes NLJD, DF, Space Domain Analysis, Signals Identification, Frequency Allocation, and almost 100 other topics. The student also learns to complete standardized written reports, operate specific TSCM software, and gain a very strong understanding of operational security. This is the first point where actual TSCM skills are being taught.
Phase VIII, Intermediate TSCM Skills (6 weeks/240 hours)
This segment usually begins with the newly trained TSCM "expert" performing a simulated two-day sweep with his classmates. The students quickly discovers that their instructors are "Heartless Bastards" who have planted devices the students are unable to find via electronic instrumentation. The students are then taught a block on instruction called "Knee-pads" as the students spend the next six weeks down on all fours hunting for miniature microphones, fine/micro wire installations, and the "dirty, nasty, and unpleasant" part of TSCM. The purpose of this block of instruction is to identify any weaknesses with the students training received to date and to take appropriate corrective action. This segment of training also begins to apply dynamic simulations to the training.
Phase IX, Advanced TSCM Skills (4 weeks/160 hours)
And now the fun part... The students are split into small teams and dispatched to various facilities to perform TSCM services (all over the world). These services range from a simple one day vulnerability analysis, one day low threat sweeps, to fully instrumented high threat multi-day inspections. The purpose of this segment is to teach the student the successful logistics involved in moving personnel and equipment to any location worldwide. A very strong portion of this training is operational security and covert techniques to move the equipment and perform the service without alerting the eavesdroppers.
Phase X, Certification (2 weeks/80 hours)
This is the part where the TSCM specialist develops ulcers, and starts to seriously contemplate a new line of employment. The student is administered an intense battery of written examinations, and then must perform all tasks of all TSCM services while being evaluated by an instructor. To become certified the student must have FLAWLESS performance.
You will notice that it has taken just over two years of full time study to obtain TSCM certification.
Phase XI, Advanced Subjects (4 weeks/160 hours)
Each year the TSCM specialist will attend at least 4 weeks of advanced technical, and/or security courses. The specific course will depend on the communications technology present at that time. This training is not specific to TSCM.
Phase XII, Annual Re-Certification (2 weeks/80 hours)
Each year the TSCM specialist must update their TSCM specific training and receive re-certification. This involves a review of current techniques, procedures, protocols, and of course, re-testing. Failure to re-certify each year will usually cause a TSCM'er to loose their job. Phase XI and Phase XII is repeated every year (6 weeks total).
Phase XIII, TSCM Leadership/Management (2 weeks/80 hours)
When a TSCM specialist is chosen to become a team leader (after 4-5 years in the field) they will be sent to a TSCM leadership program. This course is specific to TSCM and helps the new manager utilize the teams full potential. This is generally a non-technical course concentrating on TSCM policy, team management, and operational security.
Technical Security Orientation (1 weeks/40 hours)
This course is taught to "consumers of TSCM services" (executives, managers, attorneys, protective details, etc...) The purpose is to teach what is involved in a TSCM sweep, the technical intelligence threat, counterintelligence, operational security, legal issues, reporting penetrations and hazards, service requests, and logistics. The initial three days of this course is always taught in a classroom/auditorium environment and is taught at a non-technical level. The next two days are optional and allows the students to observe a simulated TSCM sweep using TSCM equipment. The students themselves are then allowed to perform a "mini-sweep" to take away the mystery of TSCM services and enhance their level of security awareness (and to instill a healthy level of paranoia).
Follow on Training:
Now it is usually possible to get on board with a government team , corporate team, or private TSCM firm as an apprentice or assistant, expect to spend 2-5 years working in this position before you will be allowed to lead a team or go out to do a sweep on your own.
While working as an apprentice or assistant you should take training in PBX admin/installation, craft techniques, Cat-5/BISCI wiring systems, computers, alarm systems, fiber optics, advanced TSCM, executive security, building trades, surveillance, and "black-bag" operations.
Training on the actual installation of network and PBX systems is an absolute must, this is best acquired by working with a "inside premises" team to install WAN, LAN and PBX facilities at a large company (at least 250 telephones). The student must understand how a facility is constructed, and how monitoring devices can be introduced at the various stages of construction.
Plan to personally run at least 250,000 feet of cable, and make thousands of punch-down connections. You must be able to work every step of the installation from the "pulling" of the cable in a new building, to final system programming and commissioning of all telephone and computer systems.
The TSCM technician must have the ability to design (from scratch) and totally install (from scratch) the complete communications system for a large corporate office building (one million plus square feet) including LAN, WAN, Telephone/PBX, Alarm, Intercom, etc...
Highly recommend the AT&T Definity School in Denver (6 weeks), the Systimax courses at Lisle (4 weeks), Pacific Bell Craft Course (7 weeks), Siecor Fiber Program (3 weeks), BICSI RCDD Program, Siemon Cat-5 (2 weeks), and various Northern Telecom courses.
Additionally, it's a good idea to take several weeks of training in how to process a crime scene. The ability and discipline needed to locate trace amounts of evidence is invaluable to someone involved in a TSCM sweep.
Also try to squeeze in a short one or two-week course on bomb search procedures; the careful attention to detail that the bomb search team member learns is invaluable to the TSCM sweep (and something rarely taught in TSCM schools, even government schools).
While few people realize it; the Xerox machine, photocopier, laser printer, and fax machine are all prime targets for bugging (it's very simple to do). Because of this, you should have at least four to six weeks of training on modern imaging devices.
It's important that you learn "how the other side thinks," but always remember to keep your white hat on.
Keep in mind that a TSCM specialist is not a private investigator, nor is a PI a TSCM specialist... Try to stay within your area of expertise... You hire a private investigator to take surveillance pictures, not wedding pictures. You hire a PI to install covert video camera's and conduct surveillance, not to find bugs!
It is extremely tough, expensive, and painful to "break into" the TSCM business cold.
The preferred path is through the military communications maintenance, SIGINT/IMINT or Crypto (at least 6+ month) schools. Followed by visits to the various civilian TSCM two-week schools and private sector technical and security schools while on annual leave. (plus numerous college level math, physics, and electronics courses).
Additionally, it's also good to complete at least a technical 4 year college degree while on active duty (easy to do on a 4 year active duty enlistment).
If you are interested in the military TSCM or SIGINT training schools, apply for it only at the end of your first enlistment (after you've obtained your degree and youčre at least an E-5, or O-3).
Good Luck, happy hunting, and let us know how your doing periodically!
and the most important quality:
What motivates a man to devote himself to the craft of intelligence?
To be contacted for a confidential consultation |
please E-mail: firstname.lastname@example.org
or send a letter via US Mail to: