Are they spying on you?

Wednesday 14 January 2026

Monitoring by international intelligence agencies is, by design, difficult to observe. Modern signals intelligence aims to be quiet, legally insulated and plausibly deniable. Yet there are circumstances in which a journalist, humanitarian worker, diplomat or business figure may reasonably ask whether his or her mobile phone or computer is being observed. Here we set out the principal indicators, emphasising limits and false positives, and explains how intelligence monitoring differs from ordinary criminal hacking.

The nature of intelligence monitoring

State intelligence services prioritise persistence over disruption. Unlike ransomware or fraud, their objective is not to announce themselves but to collect information over time. That usually means lawful interception through telecommunications providers, covert access to cloud accounts, or the use of sophisticated spyware that avoids obvious system damage. Agencies such as National Security Agency (United States), Government Communications Headquarters (United Kingdom) and their counterparts operate within national legal frameworks, often with judicial warrants, but may cooperate internationally where interests align.

As a result there is rarely a single decisive sign of monitoring. What exists instead is a pattern of anomalies that, taken together and assessed in context, may justify concern.

Unusual behaviour of devices

One commonly cited indicator is abnormal device behaviour. Mobile phones that overheat when idle, lose battery charge rapidly or show unexpected data usage can prompt suspicion. On computers, unexplained background network activity or system processes that reappear after removal may appear troubling.

These signs must be treated cautiously. Software updates, corrupted applications and poor network conditions can produce identical effects. Intelligence-grade spyware is engineered specifically to minimise such signals. When devices behave conspicuously badly, it is more often due to ordinary malware than state surveillance.

Network anomalies and interception

Persistent anomalies at the network level are more suggestive, although still inconclusive. Repeated certificate warnings, unexplained redirection of encrypted traffic or connections to infrastructure known to be associated with state-linked operators can indicate interception. Journalists and researchers sometimes discover that their traffic is routed through unusual nodes or subjected to man-in-the-middle techniques.

However, many intelligence agencies no longer need to tamper visibly with traffic. Access to telecommunications backbones or cloud providers allows collection without altering the user’s experience at all. In such cases, the absence of anomalies does not imply safety.

Behavioural and social indicators

A more subtle class of indicators lies outside the device itself. When confidential information discussed only on encrypted channels appears to influence diplomatic positions, legal actions or media narratives, it raises questions. Individuals may notice that officials demonstrate foreknowledge of private meetings, unpublished articles or travel plans that were not shared publicly.

Such correlations can arise through human sources rather than technical monitoring. Intelligence services routinely combine signals intelligence with human intelligence, open-source analysis and diplomatic reporting. Nonetheless repeated alignment between private communications and external responses is often what first alerts experienced observers.

Account access and cloud pressure points

Modern surveillance frequently targets accounts rather than hardware. Unauthorised login alerts, password reset attempts or security notifications from email and messaging providers can be meaningful, particularly if they occur across multiple services simultaneously. Intelligence agencies may lawfully compel providers to grant access, in which case the user sees nothing at all. In some jurisdictions, some kinds of lawful hidden access can subsequently be used in legal proceedings, whereas others kinds cannot.

Cloud dependence increases exposure. Documents, photographs and contact lists synchronised across devices create a rich intelligence picture even if the endpoint device remains uncompromised. This is why monitoring today often leaves fewer traces on the phone or computer than it did a decade ago.

The problem of false positives

Perhaps the most important caution is psychological. Awareness of surveillance risks can easily slide into assumption. Confirmation bias encourages the interpretation of ordinary technical glitches as hostile acts. For journalists working on sensitive topics, stress and fatigue can magnify this tendency.

Professional counter-intelligence practice relies on corroboration. A single indicator is meaningless. Multiple indicators, across different technical and social domains, persisting over time and consistent with a plausible intelligence interest, begin to matter.

What monitoring usually does not look like

It is rarely cinematic. Screens do not flicker ominously. Microphones do not audibly click on. Pop-up messages do not announce interception. Intelligence agencies avoid anything that would alert the subject. When overt pressure is applied, it is usually through legal, diplomatic or reputational channels rather than technical theatrics.

A measured conclusion

The uncomfortable reality is that effective intelligence monitoring is often invisible. Most people who are monitored will never know. Conversely, most people who suspect they are monitored are not. The sensible position lies between complacency and paranoia.

For those operating in sensitive environments, disciplined digital hygiene, an understanding of threat models and a clear-eyed assessment of one’s actual intelligence value are more useful than searching for definitive signs. Surveillance is a structural feature of modern geopolitics, not an exception. Recognising its quiet, procedural nature is the first step to understanding both its limits and its power.