Suspicion of surveillance must be verified with facts, not reinforced by assumptions
BLACKFILE analyzes specific observable events: recurring appearances, time coincidences, changes in routes, access to premises and equipment, confirmed technical indicators and the context in which the concerns arose
We separate ordinary coincidences from repeating patterns, state the limitations of the check, and build a substantiated risk map without premature conclusions about persons involved
If there is an immediate threat to life or safety, contact local emergency services. The BLACKFILE initial form is not intended for emergency response
OBSERVED EVENT
BASELINE
REPETITION
INDEPENDENT CHECK
TECHNICAL SIGNAL
CONFIDENCE LEVEL
Event - ordinary explanation - repetition - independent confirmation - final status
02 / REALITY CHECK
A single unusual episode does not yet form a confirmed picture
In an urban environment, people, vehicles, routes and digital events inevitably recur. Meaning arises when several independent signs consistently coincide in time, place, behavior and context
The check should begin with a neutral description of the event, possible ordinary explanations and predefined confirmation criteria. This reduces the risk of misattribution and unnecessary escalation
The task is to establish whether confirmable deviations exist, not to prove a predetermined version
01
Client observation
Recorded episodes in their original form: time, place, circumstances and available confirmations
02
Independent verification
Comparison against the baseline environment, repetitions, exposure of information and technical facts
03
Final level of confidence
Each indicator is assigned a status: from an ordinary coincidence to a confirmed deviation.
03 / SCENARIOS
When there are specific recurring events or technical indicators
01
The same objects recur
Certain vehicles, persons or locations appear across several independent places and periods connected with the client's movements.
02
Routes or meetings are disclosed without explanation
Third parties obtain information on movements or contacts to which access had been restricted.
03
There is a confirmed corporate or legal conflict
Context creates a reasonable risk of information collection but does not by itself prove the fact of surveillance.
04
A specific technical indicator has been found
A device, configuration change or other verifiable anomaly has been identified on a property owned or lawfully controlled by the client.
05
Recurring incidents occur around the family or team
Several participants independently record similar events connected with the same period or location.
06
An exposure assessment is required before a significant transaction
The client needs to understand which routes, meetings, premises and processes create excessive observability.
SURVEILLANCE DETECTION
Significance arises from recurrence, connection to context and independent confirmation.
04 / OBJECTS OF VERIFICATION
Events, routes, access and technical indicators are examined separately
01
Observed events
date, time and place
description without interpretation
independent witnesses
available photographs or recordings
recurrence in a different context
02
Route pattern
recurring points
connection to specific trips or meetings
ordinary alternative explanations
temporal sequence
stability of the coincidence
03
Information exposure
who knew the route or meeting
where the information was recorded
which calendars and channels were used
which processes created copies
whether the information could have been obtained by ordinary means
04
Authorized premises and vehicles
condition of the property before inspection
access by personnel and contractors
physical alterations
results of technical inspection by authorized specialists
detection limitations
05
Digital context
geolocation settings and shared calendars
confirmed notifications and access changes
logs lawfully provided by the client
leaks through common services
need to refer the technical component to specialist personnel
06
Limitations
late engagement
absence of independent confirmation
changed environment
incomplete chronology
impossibility of reliable attribution
05 / OBSERVATION PATTERN MATRIX
Each event undergoes the same verification before inclusion in the overall picture
01Observed eventFactual description only.
02Base probabilityHow ordinary the event is for the given environment.
03RepetitionWhether it occurred at an independent place or time.
04Connection to contextWhether it coincides with a specific meeting, conflict or disclosure of information.
05Independent verificationWhether separate confirmation exists.
06StatusOrdinary coincidence, requires observation, material deviation or confirmed technical fact.
Observed event
The same car observed twice near the office on working days.
Base probability
A street with high parking density near a business center: repeated cars are ordinary.
Repetition
Outside the office area the car was not recorded.
Connection to context
No coincidence with specific meetings or conflict was identified.
Independent verification
No independent confirmation of interest in the client exists.
Red status is assigned only to a confirmed material deviation or a confirmed technical fact.
06 / AUTHORIZED TECHNICAL REVIEW
The technical part is carried out only at facilities to which the client has lawful access
Where specific grounds exist, inspection of a premises, vehicle or device is carried out by authorized specialists within a pre-agreed scope. The result of the technical work is reviewed together with the access timeline and the context of the incident.
the facility and the client's authority
the date and condition prior to the start
the boundaries of the check
the categories of check used, without disclosing sensitive methods
the facts found
limitations and the probability of non-detection
further actions for the legal or technical team
07 / RESULT
Not confirmation of an alarm, but a structured assessment of facts and limitations
R-01
Event log
Neutral description of recorded episodes, sources and timing.
R-02
Route map
Recurring points, time coincidences and alternative explanations.
R-03
Confirmation matrix
Which indicators have independent confirmation, which remain a hypothesis, and which are not supported by the material.
R-04
Technical report
Results of the authorized inspection of the facility, with the boundaries and limitations of detection, where the technical part was included in the engagement.
R-05
Exposure map
Which processes, calendars, routes and communications make the client's actions predictable without dedicated surveillance.
R-06
Next steps
Practical options for discussion with the client's legal, technical, corporate or security team.
BLACKFILE does not guarantee detection of any surveillance or device and does not substitute for emergency services, law enforcement, lawyers or licensed technical specialists.
08 / CLIENTS
For those who need to check specific indicators and reduce excessive exposure
Wealth owners and Family Offices
Recurring indicators around movements and residences require a quiet check without publicity.
Recurring indicators around movements and residences require a quiet check without publicity.
09 / TYPICAL TASKS
How verification separates explainable coincidence from a meaningful pattern
CS-01A composite example based on typical tasks
Recurring vehicle
Multiple appearances are compared against ordinary traffic density, timing, locations and independent confirmations. A single episode is not considered evidence.
01Episode 1: recorded near the office, ordinary parking density
02Episode 2: different area, time not documented
03Episode 3: coincides with a closed meeting
04Comparison against the baseline environment and independent sources
CS-02A composite example based on typical tasks
Route disclosure
What is checked is not only the external event but also who knew the route, where it was stored, and whether it could have been established from open behaviour.
Route disclosed to a third party
Version: access to a shared calendar
Version: predictability of an open schedule
Each version is checked before a conclusion on surveillance is reached
CS-03A composite example based on typical tasks
Anomaly in the premises
The technical result is assessed together with access authorisations, contractor history and the condition of the site prior to inspection.
Condition of the premises before contractor access
Personnel and contractor access log
Conclusion of authorised specialists
Coincidence of the period with a sensitive process
10 / WORK MODEL
A neutral description of the event precedes any version of its origin
01
Initial contact
A general description of specific indicators without sensitive materials.
02
Admissibility check
Authority, lawfulness and absence of any task to evade lawful measures.
03
Secure briefing
Chronology, locations, participants and available confirmations.
04
Baseline model
Ordinary characteristics of the environment and alternative explanations.
05
Independent verification
Comparison of events, routes, access and technical facts.
06
Confidence assessment
Confirmed, probable, insufficient and refuted.
07
Result
A map of facts, limitations and next steps.
11 / ENGAGEMENT FORMAT
Cost depends on geography, the number of events, objects and the technical composition of the check
01
Initial assessment of indicators
from €4,000
typically 24-48 hours after receipt of agreed information
Structuring of observed events and a decision on the next stage.
Included
structuring of events
baseline timeline
assessment of ordinary explanations
initial route map
decision on the merit of a further stage
02Recommended format
Extended check
7 000-18 000 €
timeframe depends on the number of routes, objects and jurisdictions
Full verification of events, routes, exposure and authorised objects.
Included
several routes or objects
Observation Pattern Matrix
information exposure analysis
independent verification of recurrences
technical component, subject to authority and grounds
final map of risks and limitations
03
International or high-risk project
individual estimate
staged model with regular checkpoint decisions
A complex network of objects and participants with a staged working model.
Included
several countries
complex network of objects and participants
coordination with legal and licensed technical specialists
staged model
regular checkpoint decisions
The exact cost is determined after the initial assessment. Scope, authority, budget and completion criteria are agreed before each stage begins.
12 / ADMISSIBILITY
The verification is not used to evade lawful surveillance or third-party oversight
BLACKFILE does not undertake work that involves:
obstructing lawful actions by government authorities
assisting in the concealment of criminal activity
unlawful surveillance of suspected participants
trespassing on third-party property
accessing third-party devices or accounts
deleting or destroying evidence
installing monitoring equipment on third-party premises
making unsubstantiated accusations against a specific person
Technical inspection is carried out only on premises and devices to which the client has lawful right of access. If the materials indicate an immediate threat or a possible crime, the client is advised to contact a lawyer and the competent authorities.
What is important to understand before the check begins
Usually not. A single episode can have many ordinary explanations. Significance emerges from repetition, connection to context, and independent confirmation.
Not always. Establishing the fact, the method, and possible attribution are separate tasks. Each conclusion is given a separate confidence level, and the absence of confirmation is stated directly.
Only where the client has a lawful right to the property and an agreed technical scope. Such work is performed by authorized specialists and is subject to detection limitations.
A working assessment requires specific observable events: date, place, repetition, available confirmations, and context. If no specific events exist yet, it is useful to start with a neutral observation log, without attempting to independently pursue or check on other people.
Contact local emergency services or the competent authorities. BLACKFILE is not an emergency response service.
No. The verification reduces uncertainty within the agreed scope, but cannot exclude all risks or guarantee detection of every method of surveillance.
CONFIDENCE LEVEL
The verification reduces uncertainty and gives decisions a calm basis.
15 / INITIAL ASSESSMENT
Describe specific observed events
Do not include the names of suspected participants, vehicle plate numbers, exact residential addresses, or other sensitive data in the initial form.
