ESI’S PROTECTIVE INTELLIGENCE AND INVESTIGATIONS COURSE
BY ROB PINCUS

Even if you haven’t read the first parts of this series, you’ve probably heard the name “ESI.” Executive Security International, Ltd. has been in business for over twenty years teaching protection professionals the skills they need to be at the top of their trade. My focus this time is on ESI’s Protective Intelligence & Investigations Course. Bob Duggan, founder of ESI, considers this their most elite course. This course is not nearly as popular as the Executive Protection Course, which accounts for over ninety percent of ESI’s students, but there is no reason that it should not be more heavily attended.

For every individual working professional executive protection, there are probably several licensed private investigators and bail enforcement agents. The Protective Intelligence & Investigations Course would be of great benefit to anyone in, or hoping to enter, any of those fields. While the emphasis is on inves- tigative and intelligence skills that can be of use to the Executive Protector, anyone who deals with or collects information would walk away from this course with a higher degree of competency and awareness. In fact, while very few of the dozen class members I took the course with had any practical protection experience, there were at least three licensed private investigators and several men who had done bail enforcement work.

About one third of the students had already completed their nine distance education courses before attending residency training and would be receiving their credentials upon completion of this course. The rest of us still had some work to do when we got home to complete the entire 650 hour curriculum. These distance education topics include Intelligence Collection & Analysis, Human Intelligence Collection, Competitor Intelligence Collection and Countermeasures and The Legal Aspects of Private Security and Investigation. When combined, this course and The Executive Protection course (to be reviewed in the next installment) qualify a student to earn the ESI Security Specialist credentials.

The residency portion of The Protective Intelligence & Investigations Course is held in Tulsa, Oklahoma and runs for three weeks. Why Tulsa? Two words: Ray Jarvis. Jarvis is a legend in the Technical Surveillance Countermeasures (TSCM) field and Jarvis International Intelligence, Inc. (JII) offers the best training available in the country on the topic. Jarvis spent over twenty years working in the intelligence field for the U.S. Government as a Marine and was attached to various agencies including the CIA and Naval Intelligence Service. In addition to TSCM, JII trains private individuals, law enforcement personnel and members of the most elite military units in methods of entry, executive protection and advanced investigation techniques.

Although the Protective Intelligence & Investigations Course is part of ESI’s curriculum, much of it is taught in conjunction with JII—and all but two days are taught at Jarvis’ facility on the east side of town. Students completing the course receive certificates from JII in TSCM and Advanced Criminal Investigations in addition to their transcripts from ESI.

On orientation day, we were prepared for fourteen-hour days for most of the course (Sundays were scheduled as half days). The syllabus included an overview of the intelligence field, managing human intelligence sources, investigative charting, computer intelligence and security, audio and video surveillance, mobile surveillance, micro-expressions and, of course, TSCM.

The first few days of the course were heavy-duty classroom sessions with Ed Wright. Wright is a former fighter pilot and operator with intelligence experience which would impress even the most jaded professional. He shared many of his experiences with us while giving a thorough presentation on the modern history and process of intelligence gathering, processing and reporting.

The cycle of intelligence was explained from the initial tasking (determination and description of needed information), through development and processing (sources and methods used) to the reporting of the desired intelligence. It was emphasized that violating the protection of any part of the process could ruin an intelligence operation.

The difference between information and intelligence was emphasized. As ESI puts it, “The individuals, agencies and organizations that possess the best information and understand how to put it to use are the winners.” While this may sound a bit abstract, think of it this way. Intelligence is information in context. If you’re hired to get information for a corporation about a competitor ’s future advertising campaigns, the details of their manufacturing processes may be of no value at all, even though in another context it is potentially important.

In today’s world, the sheer amount of information available is obviously staggering. Let’s say that you are placed in charge of procuring a new shotgun for an elite military unit. Run an Internet search on “guns” and you get a huge amount of potentially pertinent information. Read Louis Awerbuck’s review of the Benelli M4 in the July, 2002 issue of S.W.A.T. Magazine however, and you have relevant intelligence. Of course, that’s an example of an “open source.”

The entire class found out just how much information was floating around in open sources when we did a practical exercise to see how much intelligence we could gather from periodicals, the public library and the Internet. From detailed corporate finances to the capabilities of state-of-the-art military hardware, students were able to present impressive reports after only a few hours research and no “covert” activities whatsoever. It was merely a matter of defining what information was important and searching the potential sources in an organized manner.

Wright also covered the processing and reporting of other forms of intelligence collection including informants and covert activities. Wright is a permanent fixture at JII and is involved in teaching many of their courses. He was standing in as an instructor for ESI, as the usual instructor was in Iraq as part of a United Nations inspection team.

John Fritz, ESI alumni and ASIS Certified Protection Professional, joined us to teach video surveillance theory and techniques. Fritz was full of valuable information and tips for the students on all types of optical surveillance, using gear from pin-hole cameras to 35mm and up to IR enhanced low light video and cutting edge digital technology. A great deal of time was spent out of the classroom at night experimenting with low light techniques. Fritz demonstrated very effectively how using an infra-red spotlight in conjunction with a standard black and white CCD video camera could provide an investigator with excellent low-light surveillance at a fraction of the cost of typical “night vision” equipment. Incidentally, this is the same principle at work in the newest “digital night vision” devices being sold by a number of companies. Fritz also covered the installation and use of covert video for security and intelligence gathering. He issued a variety of gear to the class for use in a practical exercise in which we set up effective video surveillance on both the interior and exterior of the Jarvis facility.

One of the highlights of the course was the four days we spent with representatives from Wal-Mart’s Investigative Task Force (ITF)—their internal investigations team. The ITF has been aggressively working against organized shoplifting and fraud groups since 1992. The ITF Advanced Criminal Investigations School (ACIS) shares with law enforcement the valuable lessons learned and techniques developed by ACIS to deal with large and well run criminal organizations. Members of the ITF have even taught at the FBI academy in Quantico (Virginia) on several occasions. They are regular guest instructors at JII and are now adjuncts to the ESI Instructor Staff.

The focus of the ACIS technique is organizational charting, which allows a criminal enterprise and all of its interconnections to be viewed in a clear way. Charting can allow seemingly separate incidents to be connected and will readily show, particularly in a court of law, how individuals at the heart of criminal enterprises directly relate to the individual crimes being committed. It is important to note that developing the process and technique of charting is not easy at first, and the instructors had their hands full trying to get all twelve Type-A personalities in the student body on the same page, so to speak. The Protective Intelligence & Investigations Course is attended by some of the brightest and most creative students that ESI has, and it was especially obvious during this portion of the course. The ITF’s teaching style could be summed up as “try this and then let’s talk about it.” The immediate result was four teams of confident, creative and intelligent guys who thought they had all figured out the best way to chart a sample situation. It took a lot of “talking about it” to get everyone to a common ground. While there may not have been consensus on the best way to chart, everyone agreed at the end of the day that charting was a valuable tool, so long as the team using the chart understood what they were looking at and were able to clearly explain it to a client or courtroom. Part of the confusion may have been caused by a slightly different charting technique that some students were introduced to as part of the distance education course.

In addition to investigations, the ITF does a lot of serious mobile surveillance. Targeting bands of shoplifters that sweep into a town and swipe tens of thousands of dollars worth of merchandise and move on within hours, members of the ITF must be ready to move constantly and to effectively trail seasoned criminals without being spotted—often for days at a time. Catching a transient at the door with a few cans of baby formula doesn’t do much to stop major crime, but piecing together the activities of a criminal network shipping truckloads of products onto the black market each month can. ITF has demonstrated time and time again that the former crime is the first step in a chain that leads to the latter. Much of that work has been done by small teams, which tracked criminals from town to town and documented their activities. After a short course on the theories involved and a requisite briefing on vehicle safety, each team of students was assigned vehicles and communications gear. In truth, it was explained that obeying the traffic laws was not just CYA. What better way to stand out to your target red lights to keep up? The instructors also went into great detail about what to avoid when choosing a surveillance vehicle. Even the most unaware target would notice a big black Excursion with tinted windows, FOP tags and big red stickers keeping pace through city traffic. The ITF recommended having a variety of cars on a team and avoiding both makes and colors commonly used by government agencies. The ITF had devised an intricate practical exercise for us that was probably the best mobile surveillance training I’ve seen. Four vehicles per team were assigned to keep track of the movements and activities of a bad guy and his accomplices. Specifically, we were tasked with documenting the transfer of stolen property and/or cash between persons and vehicles and identifying those involved. Over the course of several hours, the teams trailed the targets over the east side of Tulsa, through residential and commercial areas in a variety of traffic conditions from mall parking lots to interstate highways. The learning curve was steep, particularly for those students with no law enforcement or other practical experience—operating a vehicle and a radio at the same time while trying to remain inconspicuous takes some serious thought. It didn’t help matters that none of us really knew the streets of Tulsa, but by the end of the exercise, all the teams had learned to successfully work together and had identified the criminal activity without having too many students get “heated up” to the point where they had to back off the targets. One of the most unique aspects of the Protective Intelligence & Investigations course was the section on micro-expressions taught by Duggan and Alan Gough. Micro-expressions and behavioral cues are a favorite topic of study and discussion for Duggan and he has included the material in his courses for years. This was the first course that he co-taught with Gough, who has worked as a professional film editor for years. What’s the connection? As a professional editor, it has been Gough’s trade to search an actor’s face, frame by frame, for those “magic moments” that precisely conveyed the emotional content of the script. What he was looking for, though he has not always used this terminology, were micro-expressions. The initial research done of this topic, by Dr. Paul Ekman, revealed that there are seven universal human expressions that translate across gender and culture to represent basic human emotions. These expressions are anger, contempt, disgust, fear, happiness, surprise and sadness. In the normal course of conversation, micro-expressions, by definition, come and go in a fraction of a second and are extremely hard to notice, let alone identify, but on video they can be readily studied. By playing back a video of an interview, an investigator can search frame by frame, like a film editor, for micro-expressions which reveal emotions incongruent with statements. It is important to note that incongruent expressions, for example a flash of disgust while a subject is stating that they like their boss, does not automatically indicate that a subject is lying. It merely indicates that the topic may need to be revisited or investigated. The study of micro-expressions used in conjunction with recorded interviews can yield a great deal of insight for an investigator when applied cautiously.

Gough interviewed four volunteers one evening after class. The subjects were instructed to mix lies in during their interviews, which were recorded and then studied by Gough. Gough played these interviews back for the entire class and they were searched for incongruent micro-expressions. Each interview was about fifteen minutes long and focused on the subject’s backgrounds and thoughts about the course they were attending. Gough was able to identify a significant number of microexpressions and display them, frame by frame for the class. A significant amount of the time these expressions coincided with a lie, but it was also evident that micro-expressions could have a number of other explanations, such as embarrassment, pride or guilt. Even when the statement being given was technically true, a micro-expression often indicated some attempt to conceal or deceive.

Gough shared a story about one interview he did with a subject who had experienced severe trauma during his childhood. The subject simply stated that he couldn’t remember much about his childhood before a certain age, but micro-expressions revealed strong emotions connected with the topic. During a follow up interview, Gough confronted the subject with this information and learned the truth.

The one portion of the course not based at JII, was the portion on Computer Security and Intelligence taught by ESI graduate Tim Collins, president of Inxtec Security International. Collins covered a huge amount of information over the course of two days at a computer learning center located near the hotel. Although most of the students had brought laptop computers, it was important for everyone to be operating a similar machine connected to a network. Students learned how to find and use a wealth of information with their computers from both open sources and through covert means. We were shown a variety of programs which could be used to access information from other computers and protect our own information.

One of the techniques we were introduced to was steganography. This technique uses software, such as Outguess by Niels Provos, to hide a text file within an image file. Using this technique, there is virtually no way that anyone can tell there is another file hidden with the bits of data that make up the picture. Of course, the person you’re sending the file to needs to know how to open it and this reveals the weak link in any secure computer system (or any coded transmission for that matter)—the human element. The easiest way to crack into a “secure” computer, file or network is to obtain a poorly conceived or protected password. That list of usernames and passwords you keep under your mouse pad or taped to the bottom of your keyboard is the equivalent of leaving your car keys in the ignition with the window down. If the human element isn’t disciplined, all the passwords, encryption and physical security in the world will do you little good.

Collins filled his scheduled time to the brim, but every student agreed that this portion of the course should be longer. Duggan himself commented that only a few years ago it would be rare to see a single student at a course with his own laptop and things were obviously changing. Perhaps the pervasive nature of the computer into all aspects of our lives will prompt an expansion of this outstanding portion of the course.

The final section of the course was the six days of Technical Surveillance Countermeasures taught by Ray Jarvis and his staff. TSCM Sweeps are a standard practice in the security field and many firms charge a significant amount of money for a thorough sweep to check for a variety of eavesdropping devices including transmitters, taps and recording devices. TSCM professionals could recoup their course tuition and expenses with only a few contracts. During this portion of the course, students learned about the techniques and tools for sweeps including how to check phone lines for taps, check rooms for recording devices and use tools like spectrum analyzers to search for transmitters. Countermeasures were the focus of the class, but effective sweeping requires knowledge of the techniques employed by those who are trying to obtain information surreptitiously. Like every other portion of the course, this one carried with it the weight of providing information to students that could potentially be used illegally. At every step of the course, students were advised and warned about the possibilities of violating a variety of laws governing the interception of electronic transmissions, the violation of privacy rights or the recording of conversations. Jarvis offers another course to qualified personnel on the “positive” side of electronic eavesdropping and telephone taps—only the essential information was conveyed during the countermeasures course.

Part of our instruction was a crash course in electronics, which formed the basis for building the devices we used and understanding the theory behind finding phone taps using little more than a $50 multi-meter and basic math skills. We used simple items and tools to construct devices for both sweeping and eavesdropping. Many students even built and tested a device that used a simple laser pointer to “read” vibrations off a window and reveal the sounds on the other side. I built one of these devices for less than $30 using what we were taught in the course. My device might not have been very practical due to range and environmental considerations, but the concept is sound. Jarvis manufactures and sells a much more sophisticated device which works on the same principles.

The final part of Jarvis’ course was an overview of the commercial gear involved in TSCM work and a practical list of what was actually necessary to perform effective sweeps. While you could literally spend over $100,000 putting together a sophisticated package of electronic gear, Jarvis brought the number down to under a tenth of that. At the end of the day, like most things in life, effectively sweeping a room or building came down to diligence and thoroughness—there is no magic involved.

I showed up in Tulsa expecting a potentially boring three weeks sitting in a classroom, but was pleasantly surprised to find that the course was engaging, valuable and incredibly informative. While I’m sure that the description of the Protective Intelligence & Investigations course is not nearly as sexy or intriguing as that for a “bodyguard” school, I think more people could actually benefit professionally from the skills taught at this course than at many others I’ve attended. We never did any hand-to-hand combat, didn’t even discuss firearms and at no time did anyone yell “Clear!” but we all learned a lot and I think everyone managed to have a good time doing it.

If you deal with the collection and organization of information, corporate or personal security, competitive intelligence, criminal investigations or have an interest in the private investigations, technical countermeasures or professional security career fields, I highly recommend ESI’s Protective Intelligence & Investigations Course.