TSCM Bug Sweep Toronto: How It Works

Planting a listening device in a private space is a federal offence under Section 184(1) of the Criminal Code, RSC 1985, c C-46, punishable by up to five years in prison. In Ontario, only a licensed private investigator under the Private Security and Investigative Services Act, 2005 may carry out commercial TSCM sweeps for pay.

This guide explains what Technical Surveillance Countermeasures (TSCM) are, which federal statutes define the legal boundaries of both the threat and the response, how a professional sweep is conducted step by step, and what obligations arise when a device is found.

What is TSCM (Technical Surveillance Countermeasures)?

TSCM — Technical Surveillance Countermeasures — is the professional discipline of detecting, locating, and documenting devices capable of intercepting private communications in a physical space. It is defined by the statutory framework in Section 183 of the Criminal Code, RSC 1985, c C-46: “intercept” means to “listen to, record or acquire a communication or acquire the substance, meaning or purport thereof,” and the covered devices include any “electromagnetic, acoustic, mechanical or other device” capable of doing so.

A TSCM sweep does not include installing any surveillance device, intercepting any communication, or monitoring network traffic in real time. Those activities fall under distinct Criminal Code provisions; a TSCM firm operates detection and scanning equipment, not interception hardware.

What Canadian law governs covert surveillance devices

The legal framework for covert surveillance in Canada spans four federal statutes, each addressing a distinct type of interception threat.

Section 184(1) of the Criminal Code is the primary offence provision: it is a federal crime to knowingly intercept a private communication “by means of any electro-magnetic, acoustic, mechanical or other device,” punishable by up to five years on indictment. Section 184(2) sets the lawful exceptions — interception with the originator’s or recipient’s consent (s.184(2)(a)), under judicial authorization (s.184(2)(b)), or by a communication-service provider in the course of service delivery (s.184(2)(c)).

Section 184.5(1) addresses radio-based telephone communications separately. It makes it a federal offence to intercept such communications “maliciously or for gain” when the originator or intended recipient is in Canada, also punishable by up to five years. This distinction matters for TSCM practitioners: passive RF scanning to detect a transmitting bug — without listening to or recording any signal content — does not constitute malicious or for-gain interception under s.184.5.

Section 191(1) of the Criminal Code creates a separate offence for possessing, selling, or purchasing any device “knowing that its design renders it primarily useful for surreptitious interception of private communications,” punishable by up to two years on indictment. The exemptions in s.191(2) are narrow: they cover police officers in the course of employment, persons acting under a judicial authorization, persons assisting police under police direction, federal and Crown personnel in the course of duty, and (under s.191(2)(d)) any person holding a licence issued by the Minister of Public Safety and Emergency Preparedness. A provincial PSISA licence does not appear in s.191. TSCM firms therefore operate detection and scanning equipment — spectrum analyzers, non-linear junction detectors, camera lens detectors — which are not designed primarily for surreptitious interception and do not fall within the s.191(1) offence definition.

The Radiocommunication Act, RSC 1985, c R-2 adds a parallel layer. Section 9(2) prohibits any person from intercepting and making use of, or intercepting and divulging, any radiocommunication except with the originator’s or recipient’s permission. Section 4(4) of the same Act prohibits the possession, use, or manufacture of a jammer — a device that disrupts RF communications. A TSCM sweep uses passive RF detection to identify transmitting devices without actively jamming or intercepting any signal, keeping the work within the lawful limits of the Act.

Where a surveillance device targets computer data (keystroke loggers, USB exfiltration implants, or rogue network devices), Section 342.1(1) of the Criminal Code applies. It criminalizes fraudulently obtaining computer services and intercepting computer functions using electromagnetic or other devices. Section 430(1.1) creates a related mischief offence for willfully destroying or altering computer data, punishable by up to ten years on indictment. These provisions extend the statutory framework beyond audio and RF surveillance to cover the full range of data-exfiltration threats a TSCM sweep addresses.

What a professional bug sweep physically detects

The scope of a professional TSCM sweep maps directly to the device categories defined as criminal under the Criminal Code. A sweep conducted under the s.183 framework targets:

• Audio recording and transmitting devices (“acoustic” devices under s.183): hardwired microphones, GSM-networked audio bugs, and recording modules concealed in fixtures, picture frames, or common office equipment
• Video surveillance devices (“electromagnetic” devices): IP cameras, pinhole lens units, and camera apertures concealed in clocks, chargers, or smoke detectors, transmitting wirelessly or storing locally
• RF-transmitting bugs: devices broadcasting in VHF, UHF, GSM/LTE, or ISM frequency bands, identified by spectrum analysis of the sweep space
• Telephone line intercept devices: hardware physically tapped onto copper or digital telephony infrastructure, detectable by impedance testing of the line
• Data-exfiltration devices: hardware keyloggers, USB exfiltration implants, and rogue network devices that intercept computer data within the meaning of s.342.1(1)
• Optical surveillance vulnerabilities: laser microphone attack surfaces on glass surfaces, which allow audio reconstruction from vibration without any device in the room

Each category has a corresponding Criminal Code offence if the device is operating without the knowledge or consent of the communicating parties.

How a TSCM sweep is conducted: the step-by-step workflow

A professional TSCM sweep follows a structured multi-phase workflow. The sequence ensures that no category of device is missed and that findings — positive or negative — are documented in a form that supports any subsequent legal use.

1. Pre-sweep threat assessment: establish the purpose of the sweep, identify who has had physical access to the space and over what period, and document the known communication infrastructure (telephony, Wi-Fi networks, AV systems, networked devices) present in the environment
2. Physical inspection: systematic room-by-room examination of surfaces, fixtures, furnishings, electrical outlets, ventilation grilles, and ceiling voids for concealed devices; inspection of telephones, power strips, extension cords, and networking hardware for anomalies or unauthorized modifications
3. Non-linear junction detector (NLJD) sweep: the NLJD transmits a signal that provokes a response from semiconductor components, revealing electronic devices in walls, furnishings, or fixtures even when the device is powered off or not broadcasting any RF signal; this is the only technique capable of detecting dormant or timer-activated listening devices
4. RF spectrum analysis: a spectrum analyzer scans the radio frequency environment across VHF through microwave bands; a transmitting bug, Wi-Fi-enabled camera, or Bluetooth exfiltrator will produce an emission signature distinguishable from authorized signals; anomalous emissions are logged and investigated
5. Telephone and data-line analysis: telephone lines and low-voltage wiring are tested with time-domain reflectometer (TDR) equipment and audio amplifiers; a TDR measures impedance along the line to locate bridge-taps, contact microphones, or other physical intercept devices on the wire
6. Video and optical inspection: IR illuminators and camera lens detectors scan the space for lens apertures or reflections invisible to the naked eye; thermal imaging may identify devices generating heat in concealed locations, such as a continuously recording unit behind a wall plate
7. Documentation and reporting: all findings, including negative findings, are documented in a written report that records devices found, RF emissions identified, equipment used, inspection methodology, and the investigator’s conclusions; the written record supports any criminal complaint, insurance claim, or civil proceeding arising from the sweep

What equipment does a licensed PI use during a sweep

The equipment used in a standard TSCM sweep corresponds to the categories of private communications protected by the Criminal Code. Core tools in professional TSCM practice include:

• Non-linear junction detector (NLJD): detects semiconductor components in walls and furnishings even when the target device is powered off and not transmitting; the only tool capable of finding dormant or timer-activated devices that produce no RF signature
• Spectrum analyzer / RF sweep receiver: scans the radio frequency spectrum (typically 10 kHz to 6 GHz and above) to identify any transmitting device in VHF, UHF, GSM, 3G/LTE, Wi-Fi, or Bluetooth bands; anomalous emissions are logged against known environmental baselines
• Time-domain reflectometer (TDR): measures impedance on telephone and data lines to locate bridge-taps, contact microphones, or other physical intercept devices on the wire; deviations from the expected impedance curve indicate unauthorized hardware
• Telephone line analyzer: tests for voltage anomalies, impedance deviations, and carrier-current devices on both POTS and digital telephone circuits
• Near-field communication / carrier-current detector: identifies devices that use building electrical wiring as a transmission medium rather than broadcasting in open RF bands
• Optical and infrared camera lens detector: illuminates and detects camera apertures or lens reflections invisible to the naked eye; effective against pinhole cameras built into fixtures or consumer objects
• Thermal / IR imaging camera: identifies concealed devices generating heat in hidden locations, including units behind wall plates, inside ceiling voids, or within permanently mounted fixtures

Each tool addresses a specific detection gap. The NLJD finds what the spectrum analyzer cannot (unpowered devices); the TDR finds what neither can (wired line taps). A professional sweep uses all categories.

What happens when a device is found: evidence handling and legal obligations

When a TSCM sweep locates a surveillance device, three parallel obligations govern the investigator’s response.

Criminal Code obligations. The device is physical evidence of a potential offence under s.184(1) (intercepting private communications) or s.191(1) (possessing a device primarily useful for surreptitious interception). The investigator must photograph and document the device in situ before any disturbance to the scene. Premature removal or destruction can compromise both a police investigation and any civil proceeding that relies on the finding.

PIPEDA data-handling obligations. The Office of the Privacy Commissioner of Canada’s Guidance on Covert Video Surveillance in the Private Sector establishes that any recordings captured by the discovered device before it was found may constitute personal information. The building’s occupant may now hold a PIPEDA obligation to retain that material securely and ultimately delete or depersonalize any third-party information that is not relevant to a stated surveillance purpose. Two OPC enforcement decisions reinforce this proportionality requirement: PIPEDA Case Summary #2008-392 (2008) found that personal information must be limited to “that which is required for purposes identified by the firm in advance,” and a related 2009 decision held that personal information captured incidentally about parties who were not the surveillance subject “must be removed or depersonalized as soon as practicable.”

Notice and legal counsel. The party that planted the device has committed a federal criminal offence. Whether to report to police is the client’s decision. The PI firm’s obligation is to document the finding, preserve the scene, and advise the client to seek independent legal counsel before the device is disturbed. The written report is structured to be reviewed by the client’s criminal defence or civil litigation counsel.

What this means for you: when to engage a PSISA-licensed TSCM investigator

The CSIS Public Report 2024 states that Canada “was a frequent target of pernicious PRC activities that threatened Canada’s economic prosperity in 2024,” with the People’s Republic of China willing to use “clandestine and deceptive means to acquire intellectual property and emerging technologies” in artificial intelligence, quantum computing, biotechnology, and aerospace. CSIS’s mandate addresses digital and human-intelligence channels, not physical eavesdropping. The same espionage pressure on corporate information environments (boardrooms, executive offices, sensitive meeting spaces) drives demand for physical counter-surveillance work. A TSCM sweep addresses the physical layer of information security that network defences cannot reach: covertly planted audio and RF devices operating entirely outside the corporate network.

Residential and personal engagements follow the same legal framework. A device found in a home, vehicle, or personal office triggers the same Criminal Code obligations and the same PIPEDA data-handling requirements as a corporate sweep.

Under Section 2(2) of the PSISA, a private investigator is any person who performs work “for remuneration, that consists primarily of conducting investigations in order to provide information.” TSCM sweeps conducted on a commercial basis fall within that definition. For the client, engaging an unlicensed operator means findings may be disputed and the firm’s integrity cannot be established through the provincial licensing record.

At Discreet Investigations, our investigators conduct TSCM sweeps for corporate, legal, and personal clients across the Greater Toronto Area under Ontario’s Private Security and Investigative Services Act, 2005. Every sweep produces a written report documenting devices found, devices ruled out, RF emissions identified, and the inspection methodology — a record formatted for review by criminal defence or civil litigation counsel. When a device is located, we preserve the scene, advise the client to engage independent legal counsel before any disturbance, and provide full chain-of-custody documentation. To discuss whether a TSCM sweep is appropriate for your situation, call +1 (888) 680-0036 or visit our espionage and bug sweep service page.

Licensed · Insured · Bonded.

For background on James Glanville, the licensed investigator who leads every TSCM engagement, including credentials and case-type experience, visit the about page.