COVERT PROTECTION PLAYBOOK
[ENGAGEMENT NAME - ENGAGEMENT REF]
The COVERT PROTECTION PLAYBOOK is the execution runbook for protective surveillance and surveillance detection operations: standing up a covert element, holding a protective box around a principal who may not know or must not show that protection is present, running detection routes against hostile surveillance, and the disciplined transition to overt protection when the threat demands it. The planning products are EP-007 (protective surveillance plan) and EP-008 (surveillance detection reporting); the retained service wrapper is EP-014. Contrast: overt detail execution is EP-023. This is a repeatable runbook. All engagement-specific values are bracketed placeholders. Do not assert fictional findings or invent data.
Document Control
| Field | Value |
|---|---|
| Report Reference | [REF-YYYY-###] |
| Date of Report | [YYYY-MM-DD] |
| Classification / Handling | [internal / CONFIDENTIAL] |
| Client | [CLIENT NAME] |
| Requesting Party | [REQUESTER NAME / ID] |
| Prepared By | [ANALYST NAME / ID] |
| Reviewed By | [REVIEWER NAME / ID] |
| Approving Officer | [APPROVER NAME / ID] |
| Version | [0.1.0] |
| Distribution | [NAMED RECIPIENTS] |
Handling & Legal Caveat
Handling: [internal / CONFIDENTIAL]. Covert tasking, cover details, and element identities are close-hold; distribution beyond the tasked element is by Team Leader decision only.
Nature of this product: This is an operational runbook for lawful protective surveillance of the firm’s own protected principal and detection of hostile surveillance directed at that principal. It authorizes no surveillance of third parties beyond observation in public space, no trespass, no interception, and no law enforcement powers. Operational language renders to lawful protective effects only; jurisdictional licensing per the region package legal annex governs.
Mission Snapshot
| Field | Value |
|---|---|
| Engagement Reference | [ENGAGEMENT REF] |
| Governing Plan | [EP-007 REF] |
| Mode | [Protective surveillance / Surveillance detection / Combined] |
| Principal Witting | [Yes / No / Family office only] |
| Element Size | [N operators / N vehicles] |
| Duration | [DATES / standing] |
Table of Contents
- Purpose and Mode Selection
- Legal and Ethical Boundaries
- Element Stand-Up
- Protective Surveillance Execution
- Surveillance Detection Execution
- Correlation and Reporting Standard
- Compromise Discipline
- Transition to Overt Protection
- Interface with the Overt Detail
- Records and Product Feed
1. Purpose and Mode Selection
Covert protection is chosen deliberately, not by default. The mode is set in EP-007 planning and confirmed here at stand-up.
| Mode | Use When | Governing Plan |
|---|---|---|
| Protective surveillance | Threat warrants coverage but overt presence is unacceptable (principal refusal, business optics, provoking effect) or must be invisible to be effective | EP-007 |
| Surveillance detection | Indicators suggest hostile surveillance of the principal, residence, or pattern; the question is who, from where, how often | EP-008 method |
| Combined | Standing covert detail (EP-014) holding both the box and detection runs | EP-007 + EP-008 |
- Mode changes mid-engagement are a Team Leader decision recorded against the plan, not an element improvisation.
2. Legal and Ethical Boundaries
- Observation from public space or with the property holder’s consent only; no entry, no pretext access to private space, no device planting, no communications interception.
- Imagery: lawful in public space; intimate-space imagery is never taken regardless of vantage.
- The element does not detain, confront, or interdict. On identifying a hostile actor, effects render lawfully: report, increase standoff, harden the principal’s posture via the overt detail, hand off to law enforcement with the documented indicator record.
- Where the principal is unwitting, the engagement letter must show the client principal’s or lawful guardian’s authority for the coverage; absent that authority, the tasking is declined.
- Licensing: covert protective work is licensed activity in most jurisdictions of operation; verify the region package legal annex before stand-up, including cross-border operator status.
3. Element Stand-Up
- Read on: EP-007 plan, ART-protective-intel-assessment, principal pattern baseline (EP-001 extract), venue and route set (EP-002/EP-003 where they exist).
- Cover for status and cover for action per operator: who you are if challenged, why you are where you are; covers are boring, verifiable-enough, and rehearsed.
- Appearance and equipment: dress to the environment baseline; no visible kit signatures (earpieces, tactical brands, badge bulges); comms per SYS-003 with covert accessories.
- Vehicles: environment-typical, rotated per Section 4 exposure rules; nothing registered or branded to the firm visible.
- Comms plan: dedicated covert net per EP-011 with brevity codes for principal status, contact reports, and compromise; the covert net never carries names or client identifiers in clear.
- Rehearse: box collapse drill (Section 8 trigger), handoff-to-overt drill, compromise withdrawal drill.
4. Protective Surveillance Execution
The element holds a box the principal moves through, not a tail the principal drags.
- Box structure: positions cover the approaches to the principal’s location, not the principal personally; foot and vehicle positions per EP-007 for each named location and transit.
- The watcher’s task is early detection of approach, fixation, or pre-attack behavior (ATAP indicator set) in time for the response element or overt detail to act; response is never the watcher’s first job.
- Movement coverage: positions leapfrog along the transit corridor; the box re-forms at the destination before the principal arrives where staffing allows; a thin box is reported, never silently accepted.
- Exposure management: no operator holds the same position across [2] consecutive principal visits to a location; vehicles rotate plates-in-view positions; dwell times fit the cover activity.
- Logging: every session logs positions held, persons/vehicles of note with descriptors, and box gaps, against the EP-007 coverage plan.
5. Surveillance Detection Execution
Detection answers one question with evidence: is the principal under systematic observation?
- Baseline first: what is normal at each named location and time window (residence, office, school, gym, recurring routes); detection reads deviations against this baseline.
- Detection positions: static observation of the locations a hostile watcher would need (the perches, approach overwatch, logical trigger points identified in EP-008 planning); the detection element watches the watching positions, not the principal.
- Detection runs on movement: designated legs of routine principal movements observed for repeat presence across time and space separation.
- Recording discipline: descriptors and imagery captured lawfully; every sighting is time-place-descriptor logged whether or not it seems significant in the moment; correlation is done later, on the record, not on memory.
- The principal’s routine is never altered to bait or provoke; detection works the pattern as it exists. Pattern changes are a protective recommendation to the Team Leader, not a detection tool.
6. Correlation and Reporting Standard
- Correlation rule per EP-008: the same person or vehicle at [N, default 3] separated named areas of interest, or [2] sightings with matched behavioral indicators (mirroring, trigger response, camera work), promotes a sighting to a surveillance indicator.
- Every indicator is graded (Admiralty A-F x 1-6) and reported per EP-008 format into the PIR flow (EP-019, PIR-6) same day.
- Confirmed hostile surveillance is flash traffic per EP-011: Team Leader immediately; effects decision per Section 8.
- Negative findings are findings: a clean detection cycle is reported with coverage stated, so absence of indicators is evidence, not silence.
7. Compromise Discipline
| Event | Immediate Action | Then |
|---|---|---|
| Operator burned (subject or third party shows awareness) | Break contact by routine, cover-consistent means; no acknowledgment | Operator rotates out of the box for [period]; positions restructured |
| Cover challenged (venue staff, police, resident) | Deliver cover for status; comply with lawful direction; withdraw if pressed | Log; Team Leader assesses position viability |
| Element association exposed (two operators linked) | Both rotate; vehicle set refreshed | Coverage plan re-cut per EP-007 |
| Media/online exposure of coverage | Do not engage or confirm | Team Leader and client decide posture; possible transition per Section 8 |
| Detection element itself surveilled | Treat as confirmed hostile interest | Flash report; Section 8 assessment |
- A burned element never re-covers the same gap the same way; the plan changes, not just the faces.
8. Transition to Overt Protection
The transition is a pre-decided drill, not a debate under fire.
Triggers (any one):
- Imminent-threat behavior toward the principal (weapon indicators, final-approach behavior per ATAP set): the nearest element moves overt immediately to deny access and shield the principal; lawful defensive effect only.
- Confirmed hostile surveillance with capability and intent assessment at [High/Critical]: Team Leader-ordered transition on a planned timeline.
- Compromise cascade: coverage no longer covert in fact; continuing covert is theater with worse geometry.
- Client or principal direction.
Transition drill:
- Declared on the net with brevity code; every element switches to overt posture rules (EP-023 authorities apply from that moment).
- Nearest operators close to the principal and control the immediate space; remaining elements cover approaches overtly.
- Overt detail (where standing) is handed the principal per Section 9; covert element withdraws from view before debrief.
- Law enforcement notified where the trigger involved criminal indicators; the documented record (Section 10) supports the referral.
9. Interface with the Overt Detail
- Where both run concurrently, the covert element is early warning and the overt detail is response; the boundary is fixed in the OPORD (EP-010) coordinating instructions.
- One-way visibility default: the covert element sees the overt detail’s plan; the overt operators know coverage exists only to the degree the OPORD states (need-to-know cuts both ways in staffing-small firms; the Team Leader decides).
- Contact reports from the covert net reach the overt Shift Lead through the [Team Leader / designated bridge], never by an operator crossing nets in clear.
- Handoffs of the principal between elements are called and acknowledged; the principal is never unowned between elements.
10. Records and Product Feed
- Session logs, indicator records, and imagery are engagement-file records under CLASSIFICATION.md handling; retention and destruction per that standard.
- Detection findings feed EP-008 reporting; coverage execution and gaps feed EP-007 plan revisions; both feed EP-017 after-action reporting at engagement close.
- A confirmed-indicator package (chronology, descriptors, grading, imagery) is maintained referral-ready for law enforcement handoff at the Team Leader’s decision.
END OF REPORT
Model wiring
Generated from cell frontmatter at publish time.