Location: Aberdeen
Sector: Energy Services
Reason for Surveillance: Executive Protection
Background
A senior executive at an Aberdeen-based oil and gas services company approached Bond Rees corporate investigators, via the company’s head of corporate security, after receiving a series of increasingly specific and unsettling messages through professional networking platforms and, on one occasion, a handwritten note left at a public event, apparently from an individual aggrieved by a redundancy process the executive had overseen at a previous employer some years earlier. While none of the messages contained an explicit threat of violence, the pattern — increasing specificity about the executive’s movements, a level of personal detail that suggested some degree of physical surveillance of the executive themselves, and clear evidence of grievance — was assessed by the company’s security team as warranting a proper protective risk assessment.
The head of corporate security who instructed us had, sensibly, already advised the executive not to engage with any of the messages directly, and had begun a basic internal log of the contact received before bringing Bond Rees in. That early discipline made a real difference to the quality of the assessment we were able to produce — a clear, contemporaneous record of dates, platforms, and message content gave us a far more reliable foundation to build on than trying to reconstruct a timeline retrospectively from memory once the situation had already been escalated.
The Brief
We were instructed to conduct a threat assessment of the individual believed responsible for the messages, assess the credibility and escalation risk of the situation, and provide recommendations for proportionate protective measures for the executive, including advice on their public engagements and travel patterns over the following months.
The Investigation
We began with a careful, structured threat assessment, reviewing the content and pattern of the messages received to date against established behavioural threat assessment frameworks used in protective security work, which focus on indicators such as escalation, specificity, and grievance fixation rather than simply the presence or absence of an explicit threat.
Working from identifying details in the messages and the earlier redundancy context, we conducted lawful open-source research to establish the probable identity of the individual responsible, corroborating this through writing style analysis comparing the received messages to publicly available social media posts from the identified individual, which showed consistent phrasing and grievance themes.
We then conducted a discreet review of the individual’s public online activity for indicators of capability and intent beyond the messages themselves — such as references to weapons, detailed knowledge of the executive’s home address, or statements suggesting imminent action — finding no such indicators, which was an important and reassuring negative finding for the overall risk assessment, even though the underlying pattern of fixation and apparent surveillance remained genuinely concerning.
Alongside the threat assessment, we conducted a protective security review of the executive’s forthcoming public engagements, identifying two events with insufficiently controlled public access given the circumstances, and worked with the company’s security team to arrange enhanced venue liaison and discreet close protection coverage for those specific events.
Throughout this engagement, I was conscious of the need to balance genuine protective caution against the risk of unnecessarily disrupting the executive’s professional and personal life — a risk that is easy to underestimate in protective security work, where erring toward maximum caution can itself impose a real cost on the person being protected. I discussed the assessment directly with the executive, explaining both the basis for the concern and the reasoning behind each recommended measure, since an executive who understands and buys into their own protective arrangements is, in my experience, considerably more likely to actually follow them consistently than one who experiences the measures as being imposed without explanation.
I also liaised early with the company’s head of corporate security to establish a clear escalation pathway should the pattern of contact intensify, including pre-agreed criteria for when the situation would warrant formal police referral rather than continued internal monitoring — criteria that, in the event, we did reach, prompting the police liaison described below.
Findings
Our assessment concluded that the situation represented a genuine, if moderate, level of concern warranting protective measures, driven primarily by the apparent physical surveillance of the executive and the escalating specificity of contact, rather than by any direct threat of violence or identified capability for one. We assessed the risk as requiring active management rather than emergency intervention, and provided a structured set of recommendations calibrated accordingly.
Outcome
The company implemented our recommendations, including discreet close protection for the two identified high-exposure public engagements, revised travel and diary-sharing protocols for the executive going forward, and a direct liaison with local police to formally log the pattern of behaviour, ensuring a documented record existed should the situation escalate. The individual responsible for the messages was, following the police liaison, made aware that the pattern of contact had been identified and logged, after which the behaviour ceased entirely.
Lessons for Other Businesses
Executive protection work is fundamentally about calibrated, evidence-based risk assessment rather than blanket, high-visibility security theatre, which can be counterproductive both in cost and in the message it sends. A structured threat assessment — distinguishing genuine escalation indicators from ordinary, if uncomfortable, grievance expression — allows a business to apply protective resources proportionately, to the specific engagements and periods where risk is genuinely elevated, rather than spreading resource thinly and less effectively across every public appearance.
Investigator’s Reflection
I place a lot of value on the conversation with the executive themselves in cases like this, and I would encourage any business commissioning protective work to make space for it rather than treating the executive purely as the subject of a security plan devised around them. People manage genuine, if moderate, personal risk far better when they understand it clearly, and the willingness of this particular executive to adjust their own diary-sharing habits, once the reasoning was explained rather than simply instructed, made a real practical difference to how effectively the recommended measures could actually be implemented. The eventual outcome — the behaviour ceasing once formally logged with police — is also a useful reminder that a documented paper trail can, on its own, sometimes achieve what more visible protective measures cannot.
