The Concern
A growing EPC company was bidding for large infrastructure contracts. Read More
What We Did
We agreed the scope with the MD and the company’s legal counsel: the boardroom, leadership cabins, the main conference room and two executive vehicles. Read More
What We Found
The boardroom was compromised. An unauthorised audio device, capable of transmitting conversations, was hidden inside a piece of boardroom equipment. Read More
The Outcome
The company confirmed a physical point of compromise, so it no longer had to suspect its own leadership team without evidence. Read More
The Concern
A growing EPC company was bidding for large infrastructure contracts. Over [eight months] it lost [three] tenders, each to a competitor that came in just below its price. The margins were too small to put down to chance.
Final bid figures were known to only four people: the MD, the CFO and two business heads. They discussed those figures almost entirely in the boardroom.
Leadership didn’t want to suspect its own people without a reason. It also couldn’t keep bidding on the assumption that its discussions were private. Before looking at people, it needed to know whether the rooms themselves were secure.
An internal IT check would cover networks and devices, but not physical rooms. Bringing in a vendor through normal channels could also alert whoever was behind the leak. The company needed a sweep that was specialist, independent and confidential, and finished before the next bid review.
What We Did
- Defined the scope. We agreed the scope with the MD and the company’s legal counsel: the boardroom, leadership cabins, the main conference room and two executive vehicles. Only three people knew about the engagement, and all work was scheduled outside business hours.
- Conducted the technical sweep. We carried out a structured inspection of each space, combining physical examination, radio-frequency analysis and checks of electronics, fittings and wiring. We also reviewed connected equipment, such as conference systems and display screens, for configurations that could expose conversations.
- Preserved the evidence. When we identified a device, we photographed it in place and recorded it under a proper chain of custody. We then removed it safely and handed it to legal counsel.
- Examined how it got there. We reviewed access records and the room’s recent history to find out how the compromise had become possible.
- Made it actionable. Leadership received a clear report covering what was found, where and in what condition, what it indicated, and which vulnerabilities had allowed it.
Confirmed findings were kept separate from open questions.
What We Found
- The boardroom was compromised. An unauthorised audio device, capable of transmitting conversations, was hidden inside a piece of boardroom equipment.
- The other spaces were clear. The leadership cabins, the conference room and both executive vehicles showed no sign of compromise.
- There was a clear window of opportunity. The boardroom had been refurbished [four months] earlier. During that work, contractor staff had been allowed into the room without an escort, and their access had not been logged.
- The facts pointed to a gap in process. We did not try to name an individual, because that would need a separate investigation. We set out the facts so the company could decide its next steps with counsel.
- Â
The Outcome
- Clarity on the leak: The company confirmed a physical point of compromise, so it no longer had to suspect its own leadership team without evidence.
- Evidence preserved: The device and its documentation were preserved, and legal counsel advised on whether to report the matter to the authorities.
- Secured spaces: Sensitive bid discussions resumed in a room that had been verified as clear.
- Stronger protocols: On our recommendation, the company introduced escorted and logged contractor access to sensitive areas, periodic TSCM sweeps before major bids, and a policy of designating specific rooms for confidential discussions.
The company had been asking who was leaking. The first question should have been whether the room was secure.Most organisations protect their data carefully. Far fewer protect the rooms where their most valuable decisions are actually made.