Your Cyber Security Budget Won’t Stop Someone Listening in Your Boardroom

You have firewalls, multi-factor authentication and an incident response plan. Your staff sit through phishing training. Your building has swipe cards and cameras, and your IT provider runs penetration tests every year.

Then your board meets in a room nobody has checked, and talks openly about the acquisition, the restructure, the tender price and the litigation strategy.

Most corporate security protocols protect the data. Very few protect the conversation. And the conversation is usually where your most valuable information exists first, before it is ever written down, encrypted or filed. That is the gap TSCM (technical surveillance countermeasures) closes when it becomes part of your corporate security protocol.

Why this is a board-level risk now

ASIO has publicly named espionage and foreign interference as Australia’s principal security concern. That isn’t only a government problem. Commercial espionage targets the same things: pricing, deals, intellectual property, negotiating positions and the movements of key people.

If a conversation can move money, someone has a reason to hear it. The person listening might be a competitor, a counterparty, a disgruntled insider, an activist or a foreign interest. They don’t need a sophisticated operation. They need one device in the right room.

What technical surveillance looks like today

The listening device of the spy films is long gone. Here’s what you are actually up against.

Eight technical surveillance threats today: mobile network bugs, record now send later devices, hidden cameras, tampered technology, mobile phones, vehicle trackers, the hybrid workplace, and the people with access. — Your Cyber Security Budget Won't Stop Someone Listening in Your Boardroom 1

Mobile network listening devices. A device with a SIM card lets someone dial in and listen from anywhere in the world. There’s no receiver parked outside. Many are built into everyday objects: power boards, phone chargers, USB adaptors, smoke detectors.
Devices that record now and send later. Some devices record silently and transmit in short bursts, or never transmit at all and are collected later. A quick radio scan at the wrong moment won’t see them. Finding them takes physical inspection and equipment that detects electronics whether they are switched on or not.
Hidden cameras. Pinhole and Wi-Fi cameras are cheap, tiny and sold openly. A camera over a whiteboard or a laptop screen captures what a microphone can’t.
Tampered everyday technology. Modified charging cables and adaptors, compromised conference room audio-visual systems, smart TVs and smart speakers. The technology you invited into the room can become the device.
Mobile phones. Your executives carry a microphone, camera and location tracker everywhere they go. A compromised phone is the most complete surveillance tool there is.
Vehicles and trackers. GPS trackers, Apple AirTags and other BLE (Bluetooth Low Energy) devices on an executive’s car tell someone where they go and who they meet. Site visits, acquisition targets and confidential meetings all show up on a map.
The hybrid workplace. Board papers are read and deals are discussed in home offices, hotel rooms and offsite venues that sit completely outside your security perimeter.
The people with access. Cleaners, contractors, fit-out crews, visitors and “gifts” all put objects into your spaces. Most devices are planted by someone who was allowed in.

Why a one-off sweep isn’t a protocol

Plenty of organisations call for a bug sweep once, after something has already leaked. That is a response, not a protocol.

A protocol means TSCM happens on a schedule and on a trigger, just like your other security controls. In practice that looks like this:

Six parts of TSCM as a security protocol: scheduled sweeps, trigger sweeps, event and travel sweeps, vehicles and phones, sweeps after any change to your space, and a written report every time. — Your Cyber Security Budget Won't Stop Someone Listening in Your Boardroom 2

Scheduled sweeps of your boardroom, executive offices and key meeting rooms, at a frequency that matches your risk.
Trigger sweeps before high-value events: mergers and acquisitions, major tenders, litigation, executive changes and sensitive negotiations.
Event and travel sweeps of offsite venues, hotel meeting rooms and temporary offices.
Executive vehicles and mobile phones checked as part of the program, not as an afterthought.
After any change to your space: a fit-out, renovation, move, new furniture or a difficult staff departure.
A written report to your security or risk committee after every sweep, so TSCM sits in your governance like any other control.

Between sweeps, simple habits close most of the remaining gaps: phones out of the room for the most sensitive discussions, control over who enters meeting rooms, and a policy on gifts and unsolicited equipment.

Our Boardroom Assurance Program builds exactly this into your security protocol, set to your premises and your risks.

What to look for in a TSCM provider

Not every “bug sweep” is equal. Before you engage anyone, ask:

Five questions to ask a TSCM provider: who does the work, what equipment they use, whether the method is layered, how they protect confidentiality, and whether you get a written report. — Your Cyber Security Budget Won't Stop Someone Listening in Your Boardroom 3

Who actually does the work, and what is their background? Will the provider you engage be in the room, or will they pass the job to someone else?
What equipment do they use? A handheld detector bought online is not a sweep.
Is the method layered? Radio spectrum analysis alone misses devices that aren’t transmitting.
How do they protect your confidentiality, before, during and after the job?
What do you get at the end? You should receive a clear written report, not a verbal “all clear”.

Watch: TSCM in your security protocol

Why The Australian Bug Detection Group

The Australian Bug Detection Group has delivered technical surveillance countermeasures for corporate, government and residential clients since 2014.

You deal with the specialist, not a salesperson. The director, an internationally trained technical specialist, personally leads your sweep, alongside his team. He works on every job, and your project is never subcontracted to another provider, so you know exactly who has been in your boardroom.
Professional-grade equipment, layered methods. An OSCOR Green 24 GHz spectrum analyser with Kestrel TSCM software analyses the radio spectrum. A non-linear junction detector finds hidden electronics even when they are switched off. FLIR thermal imaging reveals concealed devices by their heat. Lens detection finds hidden cameras, and Wi-Fi analysis identifies rogue networks and connected devices. Each method covers what the others can miss.
The whole surface, not just the room. Offices, boardrooms, homes, vehicles and mobile phones.
100% Australian owned and operated, based in Melbourne and operating across Australia.
Licensed and insured. The Australian Bug Detection Group holds a Victorian Security Licence and million public liability and professional indemnity insurance.
Discretion is the job. The Australian Bug Detection Group never discusses clients or their work.

Many sweeps find no technical threat, and that is a good outcome. It means your board can speak freely and your leadership can stop wondering. Certainty is the real product.

Talk to us before your next sensitive meeting

If you are building TSCM into your corporate security protocol, or you have a sensitive meeting, tender or negotiation coming up, The Australian Bug Detection Group is happy to have a confidential conversation about what fits your organisation. Send through your floor plan for a confidential quote. Call 0410 092 207 or get in touch.