GreyOps
Insight · 27 October 2026

About minions, cola bottles, undetectable microphones and walls with ears

  1. About minions, cola bottles, undetectable microphones and walls with ears. What adversaries do, and how a technical surveillance countermeasures TSCM inspection addresses it. Above it two police photographs: a soft-toy minion and a cola bottle, both with a hidden camera lens.
  2. Why this guide? First the adversary. Then the measuring equipment. A TSCM inspection starts with what an adversary can do. Operational details help adversaries evade detection. Therefore: cases with directly usable questions. A TSCM inspection then gives a factual, substantiated picture of your space.
  3. From the outside. The spy doesn’t need to get inside. Two 17-year-old boys, recruited via Telegram, walked through The Hague last year with a sniffer past Europol, Eurojust and the Canadian embassy. In Washington, the GRU hacked a neighbouring company in order to then hack the target via wifi. TSCM question: which signals from your building can also be picked up outside? Source: NOS, 26 September 2025.
  4. Through access. Sometimes it starts at the access pass. A Russian espionage network in Great Britain had access passes, delivery uniforms and left behind everyday objects with cameras inside. TSCM question: who can get in, and when? Who do you let carry out work unsupervised? Source: Crown Prosecution Service.
  5. Insider threat. He didn’t need a fake access pass. OpenAI found a self-built recorder in the USB port of a meeting-room screen. An employee is suspected of planting it. He had no access to the meetings with delegations held in that room. TSCM question: who has access to the room, and when was the installed equipment last examined for unauthorised additions? Source: NOS, 14 October 2026. Image: CCTV still from the court documents, with a red circle around the suspect’s face behind the screen.
  6. In a shared space. The camera wasn’t in the meeting room. In June of this year, a camera was found behind a ceiling panel in a pantry of a government building. Among other things, sensitive conversations about the controversial Chinese mega-embassy, and possible cable interception point, in London were held in the building. TSCM question: does the scope of the inspection realistically end at the meeting-room door? Source: ITV News, 9 June 2026.
  7. In the construction. The wall listened in for years. Moscow, 1960s to 1980s: dozens of microphones were built into the walls of the American embassy. Also all kinds of loose diodes and pieces of metal meant to mislead sweeps. All of this was only established when the building was demolished. TSCM question: which methods do you apply, and how, based on the threat picture? Source: Seattle Times, 18 June 1990, and Wikipedia, Operation Monopoly. Image: a non-covert wall camera.
  8. Historical example. Barely detectable microphone. The SRT107 is a well-known example of a microphone that is undetectable in untargeted sweeps. Conceived and developed in the Netherlands: old technology that can now be built smaller with commonly available means. TSCM question: which methods do you deploy, and to what depth, based on which threat picture? Source: Crypto Museum. Photo: Crypto Museum.
  9. Despite inspections. Missed by the thermal camera. At a Swiss company, a hidden recorder went unnoticed despite repeated technical inspections. A piece of black tape, where the other components were fixed with cable ties, ultimately led to the discovery. TSCM question: were visual and physical inspections carried out in addition to technical ones? Source: Blick, 8 June 2024.
  10. Without a device. A lamp can betray conversations. Researchers were able to eavesdrop on conversations in a room from 25 metres away, based on the vibrations of a simple bulb in a pendant lamp. Without any covert devices present. TSCM question: are the room and its interior adequately taken into account in the threat profile and scope? Source: Nassi et al., Ben-Gurion University and Weizmann Institute, 2020.
  11. The twist. Not every find is malicious. In Poland, 2024, the alarm was raised just before a cabinet meeting about items that had been found. They later turned out to be cables of an old public-address system. Potentially, they could still be misused. TSCM question: a TSCM inspection provides usable interpretation, risks and explanations, not necessarily a find. Source: Notes from Poland and RMF24, 7 May 2024.
  12. Not every threat leaves a device behind. And not every suspicious device is a threat. A TSCM inspection starts with what your adversary can do and ends with a substantiated picture of how resilient your environment is against it. GreyOps, the physical last meter in cybersecurity.

Sources

  1. NOS, 26 September 2025 (Dutch).
  2. Crown Prosecution Service.
  3. NOS, 14 October 2026 (Dutch); images from the court documents via The Register.
  4. ITV News, 10 June 2026.
  5. The Seattle Times, 18 June 1990.
  6. Crypto Museum, SRT-107.
  7. Blick, 8 June 2024 (German).
  8. Nassi et al. (Ben-Gurion University and Weizmann Institute), 2020, via New Atlas.
  9. Notes from Poland and RMF24, 7 May 2024 (Polish).

Read more about our electronic security surveys and TSCM sweeps.

Further reading

Written by · Published