DIY Counter-Surveillance: A Passive Field Guide (2026)

How do I sweep a space for surveillance devices?

The short answer

By signal type: Wi‑Fi/Bluetooth makers (cameras, ALPR, trackers) → our signature lookup and a MAC vendor lookup; Bluetooth tags → tracker detection; drones → Remote ID; ALPR locations → DeFlock; phones → phone checks.

What it can’t do: a radio match is a lead, not proof, and gear that is wired, analog or switched off won’t show up. Combine signals with a careful look by eye.

Golden rule: detect, don’t attack. Receiving public broadcasts is passive; jamming, deauthing or breaking in is not — and not legal.

Hidden cameras

Five independent methods, strongest when they agree:

Wi‑Fi / Bluetooth. Most modern cameras are on a network. Scan for devices and check the maker prefix and network name against our surveillance‑signature lookup; a Reolink, Wyze, Hikvision or Axis radio in a room that shouldn’t have one is a lead.
Broadband RF. Analog wireless cameras (1.2/2.4/5.8 GHz) emit no decodable Wi‑Fi. A broadband RF power detector (the RFHunter approach) finds “hot” spots. Our Scout RF‑sweep spec covers this.
Lens glint. A bright light (phone torch) swept slowly across a room throws back a small, sharp reflection from a lens. Cheap and surprisingly effective at close range.
Time‑of‑flight. Research like LAPD (SenSys 2021) uses a phone’s ToF sensor to spot the tell‑tale reflection of a camera sensor — promising, still mostly a lab technique.
Infrared & physical. Many cameras show IR LEDs in the dark through a phone camera without an IR filter. And check the obvious: smoke detectors, vents, mirrors, USB chargers.

Our exposed‑cameras guide covers the opposite problem — cameras open to the whole internet.

Licence-plate readers (Flock and others)

Where they are: DeFlock maps 100,000+ ALPR cameras on OpenStreetMap; check your street before you assume. EFF: Street-Level Surveillance

In the field: Flock cameras and similar announce themselves by maker radio and, sometimes, a network name — the Flock SSID pattern and ALPR OUIs are in our signature lookup, and a MaxIntel Scout’s SPY mode flags them live. Our Flock guide and misuse cases cover the bigger picture.

Bluetooth trackers on you or your car

AirTags, Tiles and SmartTags are the most common personal‑stalking tool. Your phone now alerts you to an unknown tracker moving with you, and the free AirGuard (seemoo-lab) app scans on demand. Full method, including how to make one sound and disable it safely, is in our tracker detection guide; Apple Personal Safety has the official steps. Any Bluetooth ID you capture can be read in our signature lookup.

Audio bugs and other RF transmitters

A live transmitter radiates power whether or not it speaks a protocol you can decode. A broadband RF sweep (RFHunter‑style, or a Scout with the RF‑sweep add‑on) finds the hot spot; move the detector slowly and watch for a peak that tracks a specific object. Honest limits: it also lights up on phones, routers and microwaves, says nothing about what the device is, and misses anything that records locally and transmits in bursts or not at all. Treat it as a sweep aid, best in a quiet room with your own radios off.

Drones overhead

Most drones that must be registered broadcast Remote ID — an open beacon with the aircraft’s ID, position and the operator’s location. Decode a captured ID in our Remote ID decoder (OpenDroneID is the reference), see live traffic on the aircraft‑overhead radar, and read our Drone as First Responder and Remote ID OSINT guides for context.

Your own phone

The device most likely to be watching you is the one in your pocket. For Android, our Phone Stalkerware Check scans over USB and the package lookup checks an app name against the IOC list. For iPhone, the usual threat is iCloud access, not an app — our iPhone spyware guide walks the checks, and Amnesty MVT is the forensic tool for targeted threats.

The rules that keep this legal and honest

Passive, not active. Receiving broadcasts anyone can receive is lawful almost everywhere. Jamming, deauthing, spoofing or breaking into a device is not — and defeats the point.
Leads, not proof. A maker prefix, an SSID or an RF spike points you somewhere to look. Confirm by eye before you conclude, and never name or accuse a person on a radio hit alone.
Your own space. Sweep places and things you have the right to — your home, car, hotel room, rental. Searching others’ property or networks is a different matter.
Safety first. If you may be targeted by an abuser, acting on a find can escalate danger. Talk to a domestic‑violence advocate, and involve police when a device is evidence.

This is general information, not legal advice. See Is OSINT legal?

Sources

Read on 25 October 2026. Passive detection only; this is general information, not legal advice.

Frequently Asked Questions

Can I really detect hidden cameras myself?

Often, yes, if you combine methods. Scan for the camera on Wi-Fi or Bluetooth and check the maker, sweep for broadband RF, look for a lens glint with a bright light, and check for infrared LEDs in the dark through a phone camera. No single method is certain, and a wired or switched-off camera may show nothing, so treat every hit as a lead to confirm by eye.

Is it legal to scan for surveillance devices?

Receiving signals that devices broadcast publicly is passive and legal almost everywhere, and that is all this guide describes. What is not legal is jamming, deauthing, spoofing, or breaking into a device or network. Sweep places and things you have the right to, such as your own home, car or hotel room.

What is the single most useful tool?

For personal stalking, your phone plus the free AirGuard app catches the most common threat, Bluetooth trackers. For a room or vehicle sweep, a device that scans Wi-Fi and Bluetooth and flags surveillance makers, such as a MaxIntel Scout, covers the most ground. A broadband RF detector adds the analog devices those miss.

Why do you keep saying a hit is not proof?

A radio match tells you a device from a certain maker, or with a certain network name or Bluetooth ID, is nearby. It does not prove the device is a camera, that it is recording you, or who owns it. Makers sell non-surveillance gear too, MACs can be cloned, and names can be faked. Confirm visually before you conclude.

What about devices that do not transmit?

Those are the blind spot. A camera that records to a local card and never goes online, a wired microphone, or a tracker that is powered off will not show on a radio scan. That is why physical inspection, lens-glint checks and broadband RF sweeps matter alongside Wi-Fi and Bluetooth scanning.

I found something and I feel unsafe. What should I do?

Do not necessarily remove it right away, especially if an abuser may be watching, because acting can signal that you know and can escalate danger. Screenshot and preserve evidence, contact a domestic-violence advocate to plan, and involve local law enforcement, who can work with the device and its serial number.

Next step

Start with the signal you can read. Scan Wi-Fi/Bluetooth and check makers in the signature lookup, install AirGuard for trackers, and check your street on DeFlock.