EP-024-covert-protection-playbook-collection

[OPERATION - ENGAGEMENT REF] - Covert Protection / Surveillance Detection Map

EP-024 Covert Protection Playbook - execution workspace for a covert protective-surveillance and/or surveillance-detection task. Central topic = this covert or SD tasking (one element, one mode decision, one duration window). Branches are the ordered gates and phases the covert element runs; tick steps as the task executes, do not pre-fill findings. Governing plans: EP-007 (protective surveillance plan), EP-008 (surveillance detection reporting method); standing-service wrapper EP-014; overt counterpart EP-023. → feeds deliverable EP-024; seeded by EP-007 and/or EP-008 tasking and ART-protective-intel-assessment. Close-hold: distribution beyond the tasked element is Team Leader decision only (EP-024 Handling & Legal Caveat).

00 * Process Plan - Gates & Triggers

The trigger that opens this tasking and the gates it must clear before the element goes covert. → executes EP-024 SS1 Mission Snapshot and gates the whole runbook.

Gate 1 - Tasking confirmed

• Governing plan on file: [EP-007 ref] and/or [EP-008 ref]
• Engagement reference and duration window confirmed: [ ]
• Mode pre-selected in planning (Protective surveillance / Surveillance detection / Combined): [ ]
• Principal witting status confirmed: [Yes / No / Family office only]
• Element size and vehicle count confirmed: [N operators / N vehicles]

Gate 2 - Authority to task

• Where principal is unwitting: client principal / lawful guardian authority on file in the engagement letter → EP-024 S2
• Absent that authority: tasking declined and logged (do not proceed to Gate 3)
• Region package legal annex checked for covert-work licensing and cross-border operator status → EP-024 S2
• Team Leader sign-off to open tasking: [ ]

Gate 3 - Read-on complete

• EP-007 plan read on
• ART-protective-intel-assessment read on
• Principal pattern baseline (EP-001 extract) read on
• Venue and route set (EP-002 / EP-003, where they exist) read on → executes EP-024 S3.1

Task-close trigger

• Decision: [ ] task duration expired / stood down by Team Leader / transitioned to overt (→ 05)
• Final session log closed and handed to 99 Execution Admin

01 * Mode Selection & Legal Boundary

Confirms the mode set in EP-007 planning and locks the legal and ethical limits before any operator is fielded. → executes EP-024 S1 Purpose and Mode Selection and S2 Legal and Ethical Boundaries.

Mode confirmation

• Field: [ ] Mode in effect: [Protective surveillance / Surveillance detection / Combined]
• Field: [ ] Rationale for covert over overt (principal refusal / business optics / provoking effect avoided): [ ]
• Decision: [ ] Mode change mid-engagement - logged as a Team Leader decision against the plan, never an element improvisation
• Combined-mode boundary between covert early-warning and overt response fixed in the OPORD (EP-010) → executes EP-024 S9

Legal and ethical boundary checklist

• Observation confined to public space or property-holder consent; no entry, no pretext access to private space
• No device planting, no communications interception
• Imagery confined to lawful public-space capture; no intimate-space imagery under any vantage
• Element briefed: no detain, no confront, no interdict - identified hostile actor renders report / increase standoff / harden posture via overt detail / hand off to law enforcement only
• Licensing verified: covert protective work licensed status confirmed for this jurisdiction and any cross-border operator status
• Decision: [ ] Authority and legal boundary cleared - proceed to 02 / hold - return to Gate 2

02 * Element Stand-Up & SD Box / Coverage Plan

Fields the element under cover, then holds the box (protective surveillance) or seeds the detection positions (SD) per the coverage plan. → executes EP-024 S3 Element Stand-Up and S4 Protective Surveillance Execution (box structure).

Element stand-up

• Cover for status and cover for action assigned per operator: who, why, verifiable-enough, rehearsed
• Appearance and equipment dressed to environment baseline; no visible kit signatures (earpieces, tactical brands, badge bulges)
• Vehicles: environment-typical, no branding or registration visible to the firm
• Comms plan: dedicated covert net stood up per SYS-003 / EP-011, brevity codes issued for principal status, contact report, compromise
• Field: [ ] Covert net never carries names or client identifiers in clear - confirmed
• Drills rehearsed: box-collapse drill, handoff-to-overt drill, compromise-withdrawal drill

Box position serial

Clone per named location or transit leg the box covers.

• [location / transit leg - e.g. Residence → Office]
  • Box positions assigned to cover approaches to the location, not the principal personally
  • Foot and vehicle positions set per EP-007 for this location
  • Watcher task confirmed: early detection of approach / fixation / pre-attack behavior (ATAP indicator set), not response
  • Movement coverage: leapfrog plan along the transit corridor briefed
  • Box re-formed at destination before principal arrival, staffing permitting
  • Field: [ ] Thin box reported (never silently accepted): [Yes / No - describe]
  • Exposure rule: no operator holds this position across [2] consecutive principal visits
  • Vehicle plates-in-view positions rotated
  • Field: [ ] Session log: positions held, persons/vehicles of note with descriptors, box gaps
• [location / transit leg 2]

03 * Detection Serials

Observation runs to correlation: is the principal under systematic observation. Every sighting is logged whether or not it seems significant; correlation happens on the record. → executes EP-024 S5 Surveillance Detection Execution and S6 Correlation and Reporting Standard.

Baseline register (per named location / time window)

• [location - e.g. residence / office / school / gym / recurring route]
  • Field: [ ] Normal pattern at this location and window: [ ]
  • Baseline confirmed before detection reads deviations against it
• [location 2]

Detection observation serial

Clone per detection session (static position or movement run).

• [session - e.g. static perch watch / movement-leg detection run, date/time]
  • Detection positions sited on the perches, approach overwatch, and logical trigger points a hostile watcher would need (per EP-008 planning) - watching the watching positions, not the principal
  • Designated movement legs observed for repeat presence across time and space separation
  • Field: [ ] Sighting: person/vehicle descriptor, time, place: [ ]
  • Imagery captured lawfully (public space only)
  • Time-place-descriptor logged regardless of apparent significance
  • Field: [ ] Principal routine altered to bait/provoke: [No - confirmed] (pattern changes route to Team Leader as a recommendation only)
• [session 2]

Correlation and reporting

• Decision: [ ] Correlation rule met - same person/vehicle at [N, default 3] separated named areas of interest, OR [2] sightings with matched behavioral indicators (mirroring, trigger response, camera work)
• Sighting promoted to surveillance indicator and graded (Admiralty A-F x 1-6)
• Indicator reported per EP-008 format into PIR flow (EP-019, PIR-6) same day
• Decision: [ ] Confirmed hostile surveillance - flash traffic to Team Leader per EP-011 immediately → route to 05
• Negative/clean cycle reported with coverage stated (absence of indicators recorded as evidence, not silence)

04 * Compromise Discipline

Pre-decided responses to exposure events; a burned element never re-covers the same gap the same way. → executes EP-024 S7 Compromise Discipline.

Compromise event serial

Clone per compromise event as it occurs; select the matching event type.

• [event - Operator burned (subject or third party shows awareness)]
  • Break contact by routine, cover-consistent means; no acknowledgment
  • Operator rotated out of the box for [period]
  • Positions restructured
• [event - Cover challenged (venue staff, police, resident)]
  • Deliver cover for status; comply with lawful direction
  • Withdraw if pressed
  • Logged; Team Leader assesses position viability
• [event - Element association exposed (two operators linked)]
  • Both operators rotated
  • Vehicle set refreshed
  • Coverage plan re-cut per EP-007
• [event - Media/online exposure of coverage]
  • Do not engage or confirm
  • Team Leader and client decide posture
  • Decision: [ ] Possible transition → route to 05
• [event - Detection element itself surveilled]
  • Treated as confirmed hostile interest
  • Flash report issued
  • Decision: [ ] Section 8 assessment → route to 05
• [event - additional occurrence, clone block]

Plan-change confirmation

• Confirmed: the plan changed (positions, covers, or vehicle set), not just the faces, before the same gap is re-covered

05 * Transition-to-Overt Drill

A pre-decided drill, not a debate under fire: covert-to-overt handover and the interface with the standing overt detail. → executes EP-024 S8 Transition to Overt Protection and S9 Interface with the Overt Detail.

Trigger check (any one fires the drill)

• Decision: [ ] Imminent-threat behavior toward the principal (weapon indicators, final-approach behavior per ATAP set)
• Decision: [ ] Confirmed hostile surveillance with capability and intent assessed at [High / Critical]
• Decision: [ ] Compromise cascade - coverage no longer covert in fact
• Decision: [ ] Client or principal direction

Transition drill steps

• Declared on the net with brevity code; every element switches to overt posture rules (EP-023 authorities apply from this moment)
• Nearest operators close to the principal and control the immediate space; remaining elements cover approaches overtly
• Imminent-threat case: nearest element moves overt immediately to deny access and shield the principal (lawful defensive effect only)
• Overt detail (where standing) handed the principal per the interface standard below; covert element withdraws from view before debrief
• Law enforcement notified where the trigger involved criminal indicators; documented record supports the referral → 99 product register

Interface-with-overt-detail standard

• Boundary between covert early warning and overt response fixed in the OPORD (EP-010) coordinating instructions
• Field: [ ] Visibility default confirmed: covert element sees overt detail’s plan; overt operators know coverage exists only to the OPORD-stated degree
• Contact reports routed from covert net to overt Shift Lead through [Team Leader / designated bridge] only - never operator crossing nets in clear
• Principal handoff between elements called and acknowledged; principal never left unowned between elements

99 * Execution Admin

Running decision/deviation log, product register, sign-offs, and the referral-ready record. → executes EP-024 S10 Records and Product Feed and closes out Gate/task-close triggers from 00.

Decision / deviation log

• [date/time - decision or deviation - who authorized]
• [date/time - decision or deviation - who authorized]

Product register

• Session logs and indicator records filed as engagement-file records under CLASSIFICATION.md handling
• Detection findings fed to EP-008 reporting
• Coverage execution and gaps fed to EP-007 plan revisions
• After-action inputs staged for EP-017 at engagement close
• Confirmed-indicator package (chronology, descriptors, grading, imagery) maintained referral-ready for law enforcement handoff at Team Leader decision

Sign-offs

• Prepared by: [ ]
• Reviewed by: [ ]
• Approving officer: [ ]

Open actions / RFIs

• [open item] → route to [02 coverage / 03 detection / 04 compromise / 05 transition]
• [open item]