Techniques

Covert audio surveillance devices are electronic devices, typically microphones, hidden by an adversary to collect audio data.

Covert location surveillance devices are electronic devices hidden by an adversary to collect location data.

Covert video surveillance devices are electronic devices, typically cameras, hidden by an adversary to collect video data.

Arson forensics (also known as fire investigation) is the application of science to the investigation of arson. Arson forensics has two distinct phases: fire scene investigation, which focuses on evidence at the scene of the fire, and fire debris analysis, which focuses on evidence removed from the scene and analyzed in a laboratory.

Ballistic forensics (also known as firearm examination) is the application of science to the investigation of firearms and bullets. When a bullet is fired from a gun, the gun leaves microscopic marks on the bullet and cartridge case. These marks are like ballistic fingerprints.

DNA forensics (also known as DNA analysis) is the collection, storage, and analysis of DNA traces for the purpose of matching DNA traces to individuals.

Digital forensics is the retrieval, storage, and analysis of electronic data that can be useful in criminal investigations. This includes information from computers, hard drives, phones, and other data storage devices.

Facial recognition is the analysis of the features of human faces for the purpose of matching one face to another.

Fingerprint forensics is the collection, storage and analysis of the impressions left by the ridges of human fingers.

Gait recognition is the analysis of the walking style and pace of individuals, for the purpose of matching one walking style and pace to another.

Handwriting analysis is the analysis of handwriting samples, typically for the purpose of matching one sample to another.

Forensic linguistics is the application of linguistic knowledge to identify the author of a text or the person behind a voice. Author identification (also called stylometry) is based on the analysis of certain patterns of language use: vocabulary, collocations, spelling, grammar, etc. Voice identification is based on speech sounds (phonetics) and the acoustic qualities of the voice.

Trace evidence is the tiny fragments of physical evidence that can be transferred between objects, or between objects and the environment. This transfer can occur when two objects touch, or when small particles are dispersed by an action or movement. Trace evidence can be analyzed to establish links between people, objects, and places.

Civilian snitches are people who are not part of an adversary's security force, but who would inform the adversary if they saw something suspicious.

Mass digital surveillance is the large-scale collection, storage, and analysis of the digital communications of an entire or substantial portion of a population.

Police files are physical or digital records maintained by law enforcement agencies. Police files contain vast amounts of data about many things, are kept indefinitely or for long periods of time, and can be efficiently analyzed and cross-referenced using digital tools.

Mass video surveillance (also known as close-circuit television, or CCTV) is the large-scale collection, storage and analysis of video and audio data from video surveillance cameras. Mass video surveillance aims to capture the identity of people who pass through a space and to extend its coverage to as much space as possible. Some countries now have more surveillance cameras than citizens.

Aerial physical surveillance is the direct observation of people or activities from the air for the purpose of gathering information. In many countries, helicopters have traditionally been the predominant tool for this purpose. As drones become less expensive, their use is becoming more common. Surveillance planes are also occasionally used and are much more covert than helicopters.

Mobile physical surveillance is the direct observation of a moving target for the purpose of gathering information. It is typically conducted by a surveillance team of five to twenty operators using multiple vehicles. During a mobile physical surveillance effort, the surveillance team has two goals: to successfully follow the target and to avoid being detected by the target.

Overt physical surveillance is the direct observation of people or activities when the surveillance operators intend to be, or do not mind being, detected by their targets. This is common practice at demonstrations and gatherings to identify participants, whether to facilitate network mapping or to incriminate individuals for actions carried out during the demonstration.

Authentication bypass is the process by which an adversary bypasses the Full Disk Encryption that protects access to a digital device. An adversary can achieve authentication bypass through human error, weak passwords, or technical exploits.

An IMSI-catcher (also known as a Stingray) is an eavesdropping device used to collect information about all mobile phones that are turned on in a limited area (from a few meters to several hundred meters) around it. A passive IMSI-catcher simply listens to the traffic, while an active IMSI-catcher acts as a “fake” cell tower between the phones and the legitimate cell towers.

Malware is malicious software installed on a digital device such as a computer, server, or mobile phone, to compromise the device. Malware can do many different things, but against anarchists and other rebels, it typically aims to gain visibility into the compromised device through remote screen capture and remote keylogging (recording the keys pressed on a keyboard), and to track the location of the device (in the case of phones).

Network forensics is the monitoring and analysis of network traffic.

Physical access is the process by which an adversary physically accesses an electronic device in order to read its data or compromise it.