How a check for signs of surveillance helped protect a EUR 12 million transaction

The engagement began with a phrase we hear regularly: "Perhaps I am imagining it." A business owner preparing a major transaction began noticing recurring coincidences around his usual movements. Nothing conclusive: not a single episode that could be stated with certainty

He himself understood the weakness of his position. A person who knows that a significant transaction is coming begins to look more closely - and attention itself produces findings. A city one has lived in for years suddenly turns out to be full of repetitions that had simply gone unnoticed before.

This is precisely why he did not approach us with a request to "check whether I am being followed", but with a more honest question: help me understand whether there is a system here or whether this is my own anxiety at work. The difference between these two framings is fundamental and determines the entire course of the work that follows.

The task was formulated as a structured risk assessment. What exactly was recorded, and when. What ordinary explanations are possible for each observation. Whether there is a connection between separate episodes that goes beyond coincidence. And what level of risk follows from the whole picture rather than from any single episode.

We stated from the outset what this work is not. It does not establish the fact of surveillance and does not identify anyone who might be conducting it. It answers a question about the level of risk and about what actions are reasonable at that level.

The first impulse in such a situation is almost always wrong. Below are typical reactions and what each of them leads to. We discuss these with the client before work begins, not after.

Methodology is not described here - and this is a deliberate decision, not caution for form's sake. A public description of how indicators are assessed is equally useful to those defending themselves and those who would prefer to remain unnoticed. Below are only the principles for working with the client's observations.

First principle: a single observation means nothing. Only the aggregate matters, and it is assessed by consistency, not by vividness. One memorable episode carries less weight than several minor ones that recur in the same configuration.

Second principle: an ordinary explanation is formulated for every observation without exception. Coincidence in time and place in a city with a dense rhythm is the norm, not the exception. Until an ordinary explanation is excluded on independent grounds, the observation remains a coincidence.

Third principle: anxiety is taken into account as a factor. A person expecting a major transaction observes the world differently. Part of the episodes in this matter fell away for exactly this reason: they belonged to a period when the client was already on alert and had no counterpart in the earlier period.

The result was not a statement that "there is an observation" or "there is no observation", but an assessment of the level of risk, indicating what it is based on and how confident it is. Such a formulation looks less convincing than a definitive answer, and it is the only honest one.

In parallel with the assessment of indicators, a second question was considered: whether a rational interest in the client's information exists at all during this period. Without an answer to this, any risk assessment is left hanging.

The work here concerned the context, not people. What was assessed was how sensitive the upcoming transaction is for the market, who could in principle have a commercial interest in its terms or timing, and what circumstances make the client's business information valuable to outsiders specifically now.

A fundamental limitation: no specific person or organisation was checked as a suspect in this part of the work. We did not establish who might be behind the observation, and we did not construct hypotheses of this kind. This is not only a legal limitation but a methodological one: a hypothesis about a specific culprit almost always begins to fit the facts to itself.

The result was a sensitivity map: what information is of value during this period, through what channels it could become accessible, and what circumstances increase the likelihood of interest. There is not a single name on this map.

This approach gives the client what is actually applicable. Knowing exactly who is watching is not something he needs in a practical sense and, most likely, is not obtainable through lawful means. Knowing what exactly is vulnerable and how to close it - is needed and attainable.

We describe the measures taken at the level of categories - the specific recommendations from this engagement are not published, since publishing them would devalue both these measures and comparable measures for other clients.

The general principle behind all recommendations is to reduce the value of the information rather than to counteract anyone. This is the only approach that works regardless of whether the surveillance was real, and that does not create escalation.

The first category is discipline in handling business information: who knows the parameters of the deal and at what stage, through which channels the terms are discussed, and what information should not leave the narrow circle at all. Most leaks in such situations occur not through surveillance but through ordinary operational carelessness.

The second category is a gradual change in the predictability of the routine - not an abrupt change, which is itself a signal, but a smooth reduction in regularity at points where it is not needed. The specific recommendations of this engagement are not disclosed.

The third category is work with the client's environment: who actually has access to their schedule and plans, whether this circle corresponds to necessity, and where it has expanded without a clear reason.

Separately, a course of action was agreed for the case where the indicators intensify: what to record, whom to contact, and at what point the matter stops being private and passes to the competent authorities.

First. When doubt interferes with work. This is the most practical criterion. If anxiety affects decisions, it needs to be resolved - by confirming the risk or ruling it out. Uncertainty costs more than an assessment.

Second. When the cost of error is high on both sides. A major transaction, sensitive negotiations, a public position. In such circumstances, both underestimation and panic are equally costly.

Third. When self-directed checks have already begun. Once a person starts checking on their own, things only get worse from there: attention produces findings, findings intensify anxiety, anxiety intensifies attention. Breaking this cycle from within is nearly impossible.

Fourth. When it is important not to create escalation. A professional assessment differs from a self-directed one precisely in this respect: it is structured so as not to alert anyone to the existence of suspicions and not to provoke a response.

Fifth, and this is a limitation. If there are signs of a direct threat to life or health, risk assessment is not the first step. The first step is the police and the competent authorities. A private company does not replace them.

And finally. Nine days and the procedure described are the circumstances of this example, not a standard. A different situation may require substantially more time, and an honest result may turn out to be a conclusion that there are no grounds for concern.

Signs of a task addressed through a structured risk assessment. This is not a diagnosis and not a promise of a result.