What to do, and what NOT to do, when you suspect or find a device
Instinct is almost always wrong. The right reaction in the first minutes decides whether you solve the problem or destroy your chance to solve it.
The mistake of touching first and thinking later
Finding something suspicious triggers an immediate reaction: rip it out, switch it off, open it up, show everyone. It is understandable and it is almost always the worst path. Handling the device can destroy evidence, alert whoever is on the other end and eliminate any chance of understanding the true extent of the threat.
A found object is, potentially, evidence. And mishandled evidence loses technical and legal value. Before acting, it is worth containing the impulse and thinking in terms of preservation.
What NOT to do
Do not touch, do not remove and do not switch off the device. Do not take it apart to see what it is. Do not comment out loud in the environment, which may be monitored in real time. Do not discuss the finding through the very channels that may be compromised, such as the phone or the messaging in that location.
And, perhaps most important, do not alert people who may be involved. A hasty reaction often hands the adversary exactly the information that you have discovered them, giving them time to protect themselves and erase traces.
What to do
Maintain apparent normality. Step out of the environment to address the matter and communicate through a secure, external channel, preferably from another location and another device. Record what you can discreetly, without handling the object, and engage professional support as soon as possible.
The ideal conduct preserves the scene, the chain of custody and the possibility of a complete technical analysis. Often, the value lies not only in removing the device, but in understanding who placed it, since when and what it captured, information that a rushed reaction erases forever.
Why professional support changes the game
A specialized team treats the finding as part of an investigation, not as a scare. It performs a full sweep of the environment, because where there is one device there may be others, documents everything in a technical or forensic assessment, and guides the next steps, including legal follow-up under the LGPD.
At BlackSweep, we respond to this kind of situation with total discretion and method. If you suspect something now, the wisest move is not to improvise: preserve the environment and seek confidential guidance. Service by appointment, in Brazil and abroad, with no names and no traces.
You may be under surveillance right now.
Talk to BlackSweep through a private channel. Service by appointment across Brazil and abroad.
Request a private sweep