Bug Sweep Before a Board Meeting, AGM or Deal Room: A Protocol

A bug sweep before a board meeting, AGM or deal room is a scoped technical and physical inspection of the room and its adjacencies, timed to finish shortly before the session and followed by sealed access until the meeting starts. The protocol below runs from seven days out to the debrief afterwards. It is written for company secretaries, general counsel, security leads and the people who organise sensitive sessions in Ghana and across West Africa, and it works for a hotel venue as well as for your own boardroom.

Why are the 48 hours before a sensitive session the highest-risk window?

Three things are true in the two days before a board meeting, an annual general meeting or a deal closing. The room is known. The agenda is known, at least to everyone who received the papers. And the room is being prepared, cleaned, set up and tested by people who will not be in it when the sensitive words are said.

That combination is what an adversary needs. A device placed a month early risks discovery, battery exhaustion or a change of venue. A device placed the evening before, by someone whose presence in the room is entirely ordinary, arrives fresh, hears everything and can be retrieved with the flowers afterwards. The window in which access is easiest is the window in which the room is worth the most, which is why the timing of a sweep matters as much as the sweep itself. The wider picture of who targets these sessions and why is in our article on corporate espionage in Ghana.

Choosing and controlling the room

The decision that most shapes the risk is made before any equipment is switched on.

Your own boardroom. The strongest starting position. You know who has keys, what equipment is installed, and when the room was last swept. Its weakness is familiarity: nobody questions a technician in their own building, and the room is often left open between sessions.

A hotel or hired venue. Convenient for AGMs and multi-party negotiations, and the weakest starting position. Staff, prior occupants and whoever booked the adjoining suite have all had access. The venue’s own conferencing gear is an attack surface you did not build. A hotel room can be made safe, but it needs a pre-meeting sweep and live monitoring rather than a hope that a good hotel is a secure one.

A law firm’s office. Common for deal rooms and often assumed to be safe because of the firm’s confidentiality duty. That duty does not extend to the building’s cleaners, the shared floor above or the video-conferencing unit installed by a contractor. Treat it as a controlled third-party venue: better than a hotel, still not yours.

Whichever you choose, think about the space around the room, not only the room. Shared walls, ceiling voids, the suite next door, the corridor and the window all carry sound or line of sight. Then think about what is already in the room. Speakerphones, video-conferencing bars, wireless presentation dongles, smart displays and the credenza’s power strip are all places a device can be added or a legitimate device can be turned against you. Anything with a microphone or a network connection is part of the scope.

The timeline protocol

T-7 days: scope and non-disclosure

Confirm the venue and the adjacencies to be covered. Agree the scope in writing with the sweep team under a non-disclosure agreement. Decide who inside the organisation needs to know that a sweep is happening; that list should be shorter than the attendee list. Arrange this from outside the room in question, on a personal device. Our note on how a professional bug sweep works explains what the survey stage settles at this point.

T-48 hours: access freeze and contractor log

From this point, nobody enters the room without a name, a reason and an escort. Cancel or defer non-essential maintenance, cleaning and AV testing, or bring it forward so it is complete before the freeze. Start a written log of every entry: who, when, why, escorted by whom. If the room is at a venue, agree the freeze with the venue in writing and ask for the same log from their side.

T-24 hours to T-2 hours: sweep and seal

The sweep takes place in the last practical window before the session. The team surveys the room and adjacencies, baselines the RF environment, inspects the room technically and physically, and examines the AV and conferencing equipment in place. Anything found is documented where it is and handled according to the agreed plan, never announced in the room.

When the sweep is complete the room is sealed: doors closed, access limited to the sweep team and a named controller, and a note made of the time and the state of the room. If catering or set-up must happen after the seal, it happens under escort and the room is re-checked before the doors open.

During the session: monitoring and the electronics policy

For the highest-stakes sessions, a technician monitors the RF environment live for the duration, so a device introduced by an attendee or a mid-session visitor does not go unnoticed. The electronics policy below is applied at the door. Breaks are controlled: if attendees leave and others enter, the controller keeps the log running.

After: debrief and document

The team confirms the room was clear throughout, or reports what was observed. The findings report is finalised and retained with the meeting papers. Any lessons, such as a contractor who arrived unannounced or a venue that could not provide a log, feed into the next session’s planning.

The electronics policy

Every attendee carries at least one microphone. Phones, smart watches, wireless earbuds and laptops can record, transmit and pair with other devices, and none of them needs to be compromised to do so. The policy does not assume bad faith; it removes the most common capture device from the room regardless of intent.

• Phones and smart watches go into a locker outside the room for the sensitive items, applied to everyone including the chair and any advisers. If a phone must be in the room for a dial-in, it is the one phone, controlled by the secretary, and it is known to the technician.
• Laptops and tablets are permitted only where the agenda needs them, with wireless disabled where practical, and are named on the log.
• Wireless presentation and conferencing gear is either part of the swept and documented equipment or it is switched off and unplugged.
• Hearing aids and other medical devices are exempt and are handled discreetly, one to one, by the controller before the session. Nobody is asked to declare a medical device in front of the room.
• Recording of the session, where the constitution or the deal requires it, is done by one declared device, controlled by the secretary, and noted in the report.

What if the room cannot be swept in time?

Sometimes the venue changes, the sweep team cannot reach Kumasi or Takoradi in the window, or the freeze was broken by an unlogged visit. Proceeding and hoping is the one option to rule out. The alternatives, in order of preference:

1. Move the session to a room that has already been swept and sealed, even if it is smaller or less convenient.
2. Reduce the agenda to what can safely be said in an unverified room, and take the sensitive items at a later, controlled session or in a cleared room afterwards.
3. Postpone the sensitive items entirely rather than discuss them in a room whose state is unknown.

A board that moves its most sensitive item to next week because the room could not be verified has made a defensible governance decision. A board that discussed it anyway has made a different kind of decision.

The findings report as governance evidence

The report is not a formality that follows the sweep; it is the reason the sweep can be relied on later. It records what was searched, when, by whom and how; the RF baseline; every anomaly examined and how it was resolved; any device found, its location and capability; and the time and state of the room when it was sealed. It is dated and retained with the minutes.

Should a decision taken in that room ever be questioned, whether by a regulator, a shareholder, a counterparty or a court, the report is the evidence that the directors verified the room before they spoke. Alongside a standing quarterly programme of corporate bug sweeps, pre-meeting reports build a record that the duty of care over the company’s spoken information was actively discharged rather than assumed.

Pre-meeting sweep checklist

A printable PDF version of this checklist is on our resources page.

1. Venue, room and adjacencies confirmed; the space around the room included in scope.
2. Sweep scope agreed in writing under NDA, arranged from outside the room.
3. Internal need-to-know list fixed and shorter than the attendee list.
4. Non-essential maintenance, cleaning and AV work completed before T-48h or deferred.
5. Access freeze in force from T-48h; contractor and visitor log started.
6. Venue’s own access log requested in writing, where applicable.
7. AV, conferencing and wireless presentation equipment inventoried and included in the sweep.
8. Sweep completed between T-24h and T-2h; anomalies resolved and documented.
9. Room sealed; time and state recorded; a named controller holds access.
10. Post-seal catering or set-up escorted and the room re-checked before doors open.
11. Phone lockers in place outside the door; electronics policy briefed to attendees in advance.
12. Medical-device exceptions handled privately by the controller before the session.
13. Live RF monitoring in place for the duration of high-stakes sessions.
14. Breaks controlled; entries and exits logged throughout.
15. Fallback agreed in advance: which cleared room, which agenda items can move, who decides.
16. Debrief held; findings report finalised, dated and filed with the meeting papers.

Arrange a pre-meeting sweep

If you have a board meeting, AGM, closing or negotiation coming up and would like the room verified before it starts, we are glad to scope it with you. Please contact us from outside the room in question. A confidential consultation is handled in strict confidence, with no obligation.