Members-Only Club Bug Sweeps

Who this service is for

• Established members’ clubs and governing committees where confidential business is transacted
• Heritage social clubs rooted in Toronto’s founding Italian, European, and old-world communities
• Executive dining rooms and private banquet halls used for closed conversation
• Trade associations, professional bodies, and industry councils with sensitive boardrooms
• Registered charities and foundation boards whose donors expect verifiable confidentiality
• Any institution whose members are named on a document that is not meant to leave the room

Fob Experts is the only NASTF-registered TSCM practice retained on referral by Toronto’s private-club community, and the only Ontario firm whose reports are accepted under privilege by counsel to those institutions.

Why clubs sweep

• A new member has been introduced whose provenance the committee wishes to verify without confrontation
• A member is preparing to close a transaction and prefers negotiations occur in a room known to be clean
• Renovations, catering staff turnover, or A/V refresh may have introduced unknown devices
• Media, legal, or regulatory interest in a member has raised the possibility of adversarial surveillance
• Annual security-hygiene sweep as part of the club’s governance discipline

How the engagement is conducted

The engagement is initiated by written referral from a committee member, a club secretary, or an existing counsel to the club. The technician is briefed on the club’s dress code and access protocols, arrives outside operating hours, and conducts the sweep with a single unmarked case that never leaves his hand. No signage, no vehicle branding, no billing that would appear on a members’ financial statement, no reference on any external record. A written report is hand-delivered to a nominated club officer within 72 hours in an unmarked envelope.

The privacy that members pay dues to preserve is the privacy the sweep is designed to verify. Nothing about the visit ever crosses the threshold twice.

Our privacy protocol

• The engagement is filed under no client name — a numeric case reference only
• Communication moves through counsel, secretary, or referring member — never the general club address
• Invoices are issued to a private nominated party, not the club itself, if the committee prefers
• The written report is delivered by hand in an unmarked envelope — no email attachment, no cloud copy
• No component of the engagement — client identity, case number, room list, findings — is retained beyond the retention period agreed with the referring party
• Every technician on site has signed a private-engagement non-disclosure specific to the club, in addition to the firm’s standing PIPEDA-compliant privacy protocol

Privacy is not an add-on. Privacy is the reason the firm exists.

How the sweep is performed

Every engagement runs the same ten-pass instrument sequence. Each pass is documented, timestamped, and included in the written report so the client — or their counsel — can see exactly what was inspected and what was measured.

• Full-spectrum RF analysis, 10 kHz – 24 GHz — a continuous sweep of the licensed and unlicensed radio bands using the REI OSCOR Green and Aaronia Spectran V6. Every transmitter in the environment is captured, classified, and matched against a known device list. Anything that does not belong is flagged.
• Wi-Fi survey — 2.4 GHz, 5 GHz, 6 GHz, and 7 GHz Wi-Fi 6E / Wi-Fi 7 bands — visible and hidden SSIDs enumerated, rogue access points identified, evil-twin networks impersonating the client’s SSID exposed, deauthentication-attack fingerprints logged.
• Bluetooth Classic and BLE mesh scan — 2.402 – 2.480 GHz — enumerates every paired and unpaired device, beacon, and mesh node within range, including Airtag-class trackers hidden inside upholstery or vehicle trim.
• Cellular baseband monitoring — LTE B4 / B7 / B13, 5G n41 / n71 — powered by Ettus USRP. Detects covert cellular listening devices, unauthorized modems, and IMSI-catcher activity attempting to impersonate the carrier.
• Sub-GHz and mesh IoT scan — Zigbee, Z-Wave, LoRa, 433 MHz, 868 MHz, 915 MHz — used to catch consumer bug hardware sold on retail markets that operates below the standard Wi-Fi bands.
• Non-linear junction detection (ORION 2.4 HX) — best-in-class NLJD, the same unit used by federal counterintelligence services. Locates dormant, powered-off, or physically hidden semiconductor devices even when they are not transmitting. Finds devices behind drywall, inside furniture, sewn into upholstery, and embedded in vehicle trim.
• Thermal imaging — FLIR E86 — the heat signature of any active electronic component reads through drywall, plaster, and wood. Identifies hidden cameras, transmitters, and modified outlets that emit no RF at the time of the sweep.
• Wired network audit — VLAN and switch-port inspection, ARP-table analysis, unauthorized DHCP detection, port-mirroring evidence, unauthorized VPN endpoints. Applies to boardroom Ethernet, executive-office switches, private-club conference bridges, and residential router configurations.
• Physical inspection — every A/V fixture, wall outlet, HVAC vent, ceiling tile, smoke detector, thermostat, teleconference camera, and switched device is opened, examined, and either cleared or seized under chain of custody.
• Written report with evidence exhibits — spectrum plots, thermal captures, network audit logs, chain-of-custody documentation, and a plain-language summary for principals. Prepared to Ontario Bar Association standards, admissible in civil and criminal proceedings.

No pass is skipped. No pass is delegated to a technician who was not on site. The report reflects exactly what the instruments saw at the moment they saw it.