2. No Trace Project
3. Threat Library
4. Threat Library - Interface

The case was characterized by a lack of evidence that the defendants were planning a specific attack, and relied instead on interpretation of circumstantial evidence.[^https://web.archive.org/web/20250615210912/https://soutien812.blackblogs.org/wp-content/uploads/sites/1922/2023/11/CompteRenduProces_A4.pdf] For example:

- Libre Flot gained combat experience in Rojava, which was interpreted as an attempt to gain experience in order to carry out attacks in France.
- Libre Flot stole fertilizer from a store, intending to use it to create small explosives. The theft was interpreted as an attempt to obtain fertilizer without leaving traces.
- On two occasions, some of the defendants created small explosives from household or agricultural products, and detonated them in isolated areas where the explosions would not damage anything, which was interpreted as tests for possible future attacks (despite the defendants' claims that they were just doing it for fun).
- Some of the defendants participated in airsoft games, which were intepreted as paramilitary trainings.
- Handwritten notes of one of the defendants contained terms and phrases such as "weapons", "recruitment", "cleaning DNA", "incendiary device" and "are we ready for a comrade to be wounded or killed?", which were interpreted as indicative that the defendant was preparing an attack in France (despite the defendant's claims that the notes were about either airsoft or Rojava).
- In private conversations, some of the defendants made light-hearted, boasting comments such as "I want to burn all the banks, all the cops" and "if a police officer was on ground, honestly I would finish him off", which were interpreted as indicative of violent intentions.
- The defendants used secure digital communication tools, which was interpreted as indicative of "clandestine behavior".

Investigators bypassed the authentication of five encrypted hard drives found in raids:[^Private source.]

- One hard drive by using the very simple password "stopcigeo", which they presumably guessed.
- One hard drive by using a password they found on a post-it note under the computer containing the hard drive.
- One hard drive by using a password given to them in custody by the owner of the computer containing the hard drive.
- Two hard drives by using passwords they found in a text document on a previously decrypted hard drive.

The case was characterized by a lack of evidence that the defendants were planning a specific attack, and relied instead on interpretation of circumstantial evidence.[^https://web.archive.org/web/20250615210912/https://soutien812.blackblogs.org/wp-content/uploads/sites/1922/2023/11/CompteRenduProces_A4.pdf] For example:

- Libre Flot gained combat experience in Rojava, which was interpreted as an attempt to gain experience in order to carry out attacks in France.
- Libre Flot stole fertilizer from a store, intending to use it to create small explosives. The theft was interpreted as an attempt to obtain fertilizer without leaving traces.
- On two occasions, some of the defendants created small explosives from household or agricultural products, and detonated them in isolated areas where the explosions would not damage anything, which was interpreted as tests for possible future attacks (despite the defendants' claims that they were just doing it for fun).
- Some of the defendants participated in airsoft games, which were intepreted as paramilitary trainings.
- Handwritten notes of one of the defendants contained terms and phrases such as "weapons", "recruitment", "cleaning DNA", "incendiary device" and "are we ready for a comrade to be wounded or killed?", which were interpreted as indicative that the defendant was preparing an attack in France (despite the defendant's claims that the notes were about either airsoft or Rojava).
- In private conversations, some of the defendants made light-hearted, boasting comments such as "I want to burn all the banks, all the cops" and "if a police officer was on ground, honestly I would finish him off", which were interpreted as indicative of violent intentions.
- The defendants used secure digital communication tools, which was interpreted as indicative of "clandestine behavior".

Investigators bypassed the authentication of five encrypted hard drives found in raids:[^Private source.]

- One hard drive by using the very simple password "stopcigeo", which they presumably guessed.
- One hard drive by using a password they found on a post-it note under the computer containing the hard drive.
- One hard drive by using a password given to them in custody by the owner of the computer containing the hard drive.
- Two hard drives by using passwords they found in a text document on a previously decrypted hard drive.

The case was characterized by a lack of evidence that the defendants were planning a specific attack, and relied instead on interpretation of circumstantial evidence.[^https://web.archive.org/web/20250615210912/https://soutien812.blackblogs.org/wp-content/uploads/sites/1922/2023/11/CompteRenduProces_A4.pdf] For example:

- Libre Flot gained combat experience in Rojava, which was interpreted as an attempt to gain experience in order to carry out attacks in France.
- Libre Flot stole fertilizer from a store, intending to use it to create small explosives. The theft was interpreted as an attempt to obtain fertilizer without leaving traces.
- On two occasions, some of the defendants created small explosives from household or agricultural products, and detonated them in isolated areas where the explosions would not damage anything, which was interpreted as tests for possible future attacks (despite the defendants' claims that they were just doing it for fun).
- Some of the defendants participated in airsoft games, which were intepreted as paramilitary trainings.
- Handwritten notes of one of the defendants contained terms and phrases such as "weapons", "recruitment", "cleaning DNA", "incendiary device" and "are we ready for a comrade to be wounded or killed?", which were interpreted as indicative that the defendant was preparing an attack in France (despite the defendant's claims that the notes were about either airsoft or Rojava).
- In private conversations, some of the defendants made light-hearted, boasting comments such as "I want to burn all the banks, all the cops" and "if a police officer was on ground, honestly I would finish him off", which were interpreted as indicative of violent intentions.
- The defendants used secure digital communication tools, which was interpreted as indicative of "clandestine behavior".

L'affaire a été caractérisée par une absence de preuves que les inculpé·e·s planifiaient une attaque spécifique, et s'est à la place construite autour de l'interprétation de preuves circonstancielles. Voici des exemples de cette interprétation :[^https://web.archive.org/web/20250615210912/https://soutien812.blackblogs.org/wp-content/uploads/sites/1922/2023/11/CompteRenduProces_A4.pdf] Par exemple :

- Libre Flot a acquis de l'expérience de combat au Rojava, ce qui a été interprété comme une tentative d'acquérir de l'expérience pour mener des actions en France.
- Libre Float a volé de l'engrais à un magasin, dans l'intention de l'utiliser pour fabriquer de petits explosifs. Le vol a été interprété comme une tentative d'obtenir de l'engrais sans laisser de traces.
- À deux reprises, certain·e·s des inculpé·e·s ont fabriqué des petits explosifs à partir de produits d'entretien ou agricoles, et les ont fait exploser dans des zones isolées où les explosions ne feraient pas de dégâts, ce qui a été interprété comme des tests pour de possibles futures attaques (malgré les affirmations des inculpé·e·s qu'iels faisaient ça juste pour s'amuser).
- Certain·e·s des inculpé·e·s ont fait des parties d'airsoft, qui ont été interprétées comme des entraînements paramilitaires.
- Des notes manuscrites d'un·e des inculpé·e·s contenaient des termes et phrases comme "armes", "recrutement", "nettoyage ADN", "objet incendiaire" et "est-ce qu’on est prêt à ce qu’un camarade soit blessé ou tué ?", qui ont été interprétées comme révélatrices de la volonté de l'inculpé·e de planifier une attaque en France (malgré les affirmations de l'inculpé·e que les notes parlaient soit d'airsoft soit du Rojava).
- Dans des conversations privées, certain·e·s des inculpé·e·s ont fait des commentaires légers ou des fanfaronnades comme "j'ai envie de cramer toutes les banques, tous les keufs" et "si un membre des forces de l’ordre était par terre, moi franchement je l'achève", qui ont été interprétés comme révélateurs de leurs intentions violentes.
- Les inculpé.e.s utilisaient des outils de communication numérique sécurisés, ce qui a été interprété comme révélateur de "comportements clandestins".

Investigators bypassed the authentication of five encrypted hard drives found in raids:[^Private source.]

- One hard drive by using the very simple password "stopcigeo", which they presumably guessed.
- One hard drive by using a password they found on a post-it note under the computer containing the hard drive.
- One hard drive by using a password given to them in custody by the owner of the computer containing the hard drive.
- Two hard drives by using passwords they found in a text document on a previously decrypted hard drive.

Les enquêteurs ont contourné l'authentification de cinq supports de stockagedisques dur chiffrés trouvés dans des perquisitions :[^Source non publique.]

- Un disque dur grâce au mot de passe très simple "stopcigeo", qu'ils ont peut-être deviné.
- Un disque dur grâce à un mot de passe trouvé sur un post-it sous l'ordinateur contenant le disque dur.
- Un disque dur grâce à un mot de passe qui leur a été donné par le/la propriétaire de l'ordinateur contenant le disque dur.
- Deux disques durs grâce à des mots de passe qu'ils ont trouvé dans un document texte sur un disque dur préalablement déchiffré.

Surveillance detection is the practice of detecting if you are under [physical surveillance](tl://techniques/physical-surveillance.html), that is, detecting if you are being directly observed by an adversary. There are two types of surveillance detection: passive surveillance detection and active surveillance detection. Counter-surveillance is a sophisticated form of active surveillance detection.

# Passive surveillance detection

Passive surveillance detection is when you detect surveillance without deviating from your normal routine. Examples of passive surveillance detection include:

- Regularly checking the rear and side view mirrors while in a moving vehicle to detect surveillance vehicles following you.
- Listening to the sounds around you to detect drones or helicopters flying overhead.

# Active surveillance detection

Active surveillance detection is when you detect surveillance by doing something outside of your normal routine in an attempt to force a potential surveillance operation to reveal itself. Examples of active surveillance detection include:

- Taking an illogical route to travel between two points, such as a route that isn't the shortest route. If a pedestrian or vehicle takes the same illogical route as you, they may be a surveillance operator. If possible, you should have a valid reason for taking this illogical route (such as stopping at a store along the route), so that a surveillance operation doesn't notice that you are conducting surveillance detection.
- Making an unexpected U-turn while driving. If you are being followed by an incompetent surveillance team (or a single surveillance vehicle), a surveillance vehicle may mirror your U-turn, which would be a clear sign that they are following you. If you are being followed by a competent multi-vehicle surveillance team, the surveillance vehicles will not mirror your U-turn, as this would be suspicious, but your unexpected U-turn can still elicit unnatural reactions from them, which can help you to detect them. If possible, you should have a valid reason for making the U-turn, so that a surveillance operation doesn't notice that you are conducting surveillance detection.

# Counter-surveillance

Counter-surveillance is when you detect surveillance with the help of a trusted third party (i.e., one or more people) who is presumably not under surveillance, and who attempts to detect if you are under surveillance. The following is an example of a counter-surveillance operation:

1. Select a route that you will take during the counter-surveillance operation. The route should appear logical to a potential surveillance operation, but should be illogical for anyone else to take, and should include several stops that are suitable for the third party to attempt to detect a surveillance operation. For example, you can start at your home, stop at three or four hardware stores in your city pretending to price a certain item, and return to your home. This route would appear logical to a potential surveillance operation, but it is unlikely that anyone else would take the same route, stopping at the same stores in the same order as you.
2. As you follow the selected route, the third party ensures that they are present at each stop before you, but without taking the same route as you (so they won't detected by a potential surveillance operation). To accomplish this, the third party can use a faster mode of travel than you, or leave each stop before you to get a head start, or use multiple coordinated teams.
3. At each stop, the third party takes note of pedestrians and vehicles arriving after you. If the third party notices that a pedestrian or vehicle is present at two or more stops, they may be part of a surveillance operation. The third party can also detect behaviors typical of surveillance operators, such as transmitting information through a radio hidden on their body, communicating with each other through visual signals, running unexpectedly, etc.

# Additional considerations

If an adversary notices that you are conducting surveillance detection, they may adapt and become more discreet. Therefore, when conducting surveillance detection, you should avoid revealing that you are doing so, if possible. If you successfully detect surveillance, you should avoid visibly acknowledging or evading the surveillance operation.

# See also

- [Surveillance Countermeasures](res://#surveillance-countermeasures) about the principles and techniques of surveillance detection.
- The ["Physical surveillance" topic](res://#topic=physical-surveillance).
- The related mitigation [Anti-surveillance](tl://mitigations/anti-surveillance.html).

La détection de surveillance est la pratique qui consiste à détecter si tu es sous [surveillance physique](tl://techniques/physical-surveillance.html), c'est-à-dire, détecter si tu es en train d'être directement observé·e par un adversaire. Il y a deux types de détection de surveillance : la détection passive de surveillance et la détection active de surveillance. La contre-surveillance est une forme sophistiquée de détection active de surveillance.

# Détection passive de surveillance

La détection passive de surveillance c'est quand tu détectes la surveillance sans dévier de ta routine habituelle. Voici des exemples de détection passive de surveillance :

- Vérifier régulièrement les rétroviseurs dans un véhicule en mouvement pour détecter des véhicules de surveillance en train de te suivre.
- Écouter les bruits ambiants pour détecter des drones ou hélicoptères en train de voler au-dessus de toi.

# Détection active de surveillance

La détection active de surveillance c'est quand tu détectes la surveillance en agissant en-dehors de ta routine habituelle pour tenter de forcer une potentielle opération de surveillance à se dévoiler. Voici des exemples de détection active de surveillance :

- Suivre un itinéraire illogique pour se déplacer entre deux points, par exemple un itinéraire qui n'est pas le plus court. Si un piéton ou véhicule suit le même itinéraire illogique que toi, il est peut-être un opérateur de surveillance. Si possible, tu devrais avoir une raison valide de suivre cet itinéraire illogique (par exemple t'arrêter à un magasin sur l'itinéraire), pour qu'une opération de surveillance ne remarque pas que tu fais de la détection de surveillance.
- Faire un demi-tour inattendu en conduisant. Si tu es suivi·e par une équipe de surveillance incompétente (ou un seul véhicule de surveillance), un véhicule de surveillance pourrait reproduire ton demi-tour, ce qui serait un signe clair qu'il te suit. Si tu es suivi·e par une équipe de surveillance compétente qui dispose de plusieurs véhicules, les véhicules de surveillance ne vont pas reproduire ton demi-tour, car cela serait suspect, mais ton demi-tour peut tout de même provoquer chez eux des réactions anormales, ce qui peut t'aider à les détecter. Si possible, tu devrais avoir une raison valide de faire le demi-tour, pour qu'une opération de surveillance ne remarque pas que tu fais de la détection de surveillance.

# Contre-surveillance

La contre-surveillance c'est quand tu détectes la surveillance avec l'aide d'un tiers de confiance (c'est-à-dire une ou plusieurs personnes) qui n'est a priori pas sous surveillance, et qui tente de détecter si tu es sous surveillance. Voici un exemple d'une opération de contre-surveillance :

1. Choisis l'itinéraire que tu vas prendre pendant l'opération de contre-surveillance. L'itinéraire devrait sembler logique du point de vue d'une potentielle opération de surveillance, mais cela devrait être illogique pour toute autre personne de le suivre, et il devrait inclure plusieurs arrêts permettant au tiers de tenter de détecter une opération de surveillance. Par exemple, tu peux commencer chez toi, t'arrêter à trois ou quatre magasins de bricolage dans ta ville en prétendant te renseigner sur le prix d'un objet, puis retourner chez toi. Cet itinéraire semblerait logique à une potentielle opération de surveillance, mais il est peu probable que qui que ce soit suive le même itinéraire, en s'arrêtant aux mêmes magasins dans le même ordre que toi.
2. Alors que tu suis l'itinéraire choisi, le tiers s'assure qu'il est présent à chaque arrêt avant toi, mais sans prendre le même chemin que toi (pour éviter d'être détecté par une potentielle opération de surveillance). Pour ça, le tiers peut utiliser un moyen de transport plus rapide que toi, ou partir de chaque arrêt avant toi pour prendre de l'avance, ou utiliser plusieurs équipes coordonnées.
3. À chaque arrêt, le tiers prend note des piétons et véhicules qui arrivent après toi. Si le tiers remarque qu'un piéton ou véhicule est présent à deux arrêts ou plus, il est peut-être un opérateur de surveillance. Le tiers peut aussi détecter des comportements typiques d'opérateurs de surveillance, comme le fait de transmettre des informations via une radio cachée sur eux, le fait de communiquer entre eux par signes visuels, de se mettre à courir de manière inattendue, etc.

# Considérations supplémentaires

Si un adversaire remarque que tu fais de la détection de surveillance, il pourrait s'adapter et se faire plus discret. Quand tu fais de la détection de surveillance, tu devrais donc éviter de révéler que tu le fais, si possible. Si tu détectes avec succès une opération surveillance, tu devrais éviter de le faire savoir de manière visible ou d'échapper à l'opération de surveillance.

# Voir aussi

- [Surveillance Countermeasures](res://#surveillance-countermeasures) (*Mesures contre la surveillance*) à propos des principes et techniques de détection de surveillance.
- Le [sujet "Surveillance physique"](res://#topic=physical-surveillance).
- La mesure d'atténuation connexe [Anti-surveillance](tl://mitigations/anti-surveillance.html).