Surveillance Log Checklist: What a PI Should Record

A surveillance log that stands up to cross-examination records six things: when you went on station and when you came off, where you were with the error on that GPS fix, one timed line for each event, the gaps where you saw nothing, every correction left readable, and a fingerprint for each photo. The reason sits in Federal Rule of Evidence 612. If you glance at your log to refresh your memory on the stand, the lawyer on the other side is entitled to have it produced, read it and cross-examine you on it. So the log has a second reader from day one.

Everything below is written for that reader.

Who reads the log after you

Most investigators write the log for themselves and the report for the client. That’s backwards for the log. Under Federal Rule of Evidence 612, an adverse party can have a writing produced, inspect it, cross-examine you about it and put into evidence any part that relates to your testimony. The rule covers notes used while testifying, and the court can stretch it to notes you read beforehand if it decides justice requires it.

Insurance work adds a wrinkle. Federal Rule of Civil Procedure 26(b)(3) shields material prepared in anticipation of litigation by a party’s agent or insurer, but only ordinarily. The other side can still get it by showing substantial need and that it can’t get the equivalent another way. Surveillance of a claimant on one particular afternoon is hard to reproduce, which is exactly the argument.

In England and Wales the logic runs the same way. Section 139 of the Criminal Justice Act 2003 lets a witness refresh memory from a document made earlier if their recollection was likely to have been significantly better at that time. A log written up days afterwards struggles with that test.

Before the first entry: the header

Police Scotland’s Surveillance Operations Log Keeping procedure puts the name of the operation, the subject, the date and the authority number on page 1, before a single observation. Your version of that is the case header.

• Client, and your own matter number
• The subject as the instruction names them, in the instruction’s words
• The date the file was opened
• The scope: what you were asked to establish, in a sentence or two

The scope line is the one people skip. It’s also the one that answers “why were you outside my client’s house?” without you having to reconstruct it from old emails. If you want a field-by-field layout, the surveillance log template page walks through each one, from the case header to the observation line.

Start and stop, from one clock

Mix your watch, the car clock and a camera body nobody changed back from daylight saving time (an illustrative mix, but an easy one to fall into), and a log can end up with an observation timed before the session began. Take both times, on station and off, from one device.

If you leave without writing a stop time, say so. A session marked “not stopped” is better than a stop time guessed at on the drive home, because a guess is a fact you can’t defend.

Your own position, with its error bar

A location stamp in the log places you, the observer. It documents where you were standing or parked when you made the entries, which supports what you could see from there.

Record the accuracy alongside the coordinates. According to GPS.gov’s page on GPS accuracy, GPS-enabled smartphones are typically accurate to within a 4.9 m (16 ft) radius under open sky, and that accuracy worsens near buildings, bridges and trees. On a street of terraced houses, a fix with, say, a 30 m error circle (an illustrative figure) could put you on the wrong side of the road. Write the address or area in words too: coordinates say where precisely, the words say where recognisably.

Keep a clear line between that stamp and tracking the subject. California Penal Code section 637.7 says that “no person or entity in this state shall use an electronic tracking device to determine the location or movement of a person.” It defines the device as one attached to a vehicle or other movable thing, makes a violation a misdemeanor, and makes it grounds for revoking a licence issued under Division 3 of the Business and Professions Code. The Private Investigator Act sits in Division 3. Exceptions exist for a vehicle’s registered owner, lessor or lessee who consents, and for law enforcement. Your log should never contain a position you could only have known from a device on someone else’s car.

ProofPI stamps the phone’s own position only when you tap to stamp a session’s start or stop, and never runs location in the background.

One event per line, in the present tense

Police Scotland’s procedure is blunt about the language: the log is written in the present tense, as if providing live commentary, in plain English with no glossary terms and no abbreviations. It bars words such as possibly, may and believed to be, because they record what the officer thought instead of what happened.

Compare two lines, both made up for illustration:

“10:26 Subject probably heading to work.”

“10:26 Grey estate car leaves the driveway northbound. Driver is a man in a dark jacket.”

The first is a conclusion with a time attached. The second is something you can be asked about and answer. If you couldn’t see the driver’s face, the line says a man in a dark jacket, not the subject.

When an entry is late, record two times

You will not always write at the moment. You’re driving, or the subject is close enough that a phone in your hand is the wrong look. The fix is to keep two times on any late entry: when the event happened and when you wrote it down.

The rules of evidence care about the gap. Federal Rule of Evidence 803 admits a recorded recollection made or adopted when the matter was fresh in the witness’s memory, and a business record made at or near the time. A late entry that admits it’s late is defensible. A late entry dressed up as a live one, then exposed under questioning, damages every other line in the log.

ProofPI keeps both times on each observation. The observed time can be edited, the recorded time is set once and an edit never overwrites it, and the case-file PDF prints the recorded time beside any line where the two differ by a minute or more.

Gaps are entries too

“Lost sight of subject”, with its time, is one of the most useful lines in a log, and one of the least written. Without it, a reader assumes continuous coverage you didn’t have, and the first time a lawyer finds the gap, it looks like you hid it.

Police Scotland’s paper rules point the same way: no blank spaces, and incomplete lines crossed through, so nothing can be slipped in later. On a phone, the equivalent is to log the loss, log the reacquisition, and close a session with an outcome that says what happened. ProofPI’s five outcomes are Subject located, No activity, Lost, Terminated and Completed. A session that ends in No activity is still a result, and it belongs in the log. The client paid for that time.

Corrections that leave the original readable

Police Scotland’s procedure sets the paper standard: words written in error are crossed through so that the error remains readable, initialled, and followed by the correct entry. Nothing is erased so that it becomes unreadable.

Two habits carry over to a phone. Don’t delete a wrong entry and retype it; correct it and keep the record of when you first wrote it. And keep your original notes after the report is typed. A report that disagrees with notes you destroyed is a bad afternoon in a deposition.

The same procedure allows further detail and descriptions to be added later, at the debrief. That is a fair reading of contemporaneous: the core line at the time, the colour afterwards, marked as afterwards.

Photos and video: a fingerprint in the log

Every photo gets a line in the log at the time it was taken, with a caption that says what it shows. The harder question comes later: is the file you hand over the same file you took?

The federal rules’ answer is a hash. The 2017 committee note to Federal Rule of Evidence 902 says data copied from electronic devices and files are ordinarily authenticated by hash value, and that identical hash values for the original and copy reliably attest that they are exact duplicates. Rule 902(14) lets that data be self-authenticated through a certification by a qualified person. The NIST standard behind SHA-256, FIPS 180-4, puts the property plainly: any change to the message will, with a very high probability, produce a different digest.

NIST Special Publication 800-86 describes the custody side: a log of every person who had custody of the evidence, what they did to it and at what time. It adds a rule I’d tape inside the glovebox: if it is unclear whether evidence needs to be preserved, by default it generally should be.

In ProofPI each photo gets a SHA-256 fingerprint when it is added, and a camera JPEG is kept byte for byte so the hash belongs to the file the camera produced. Opening a photo later can check it against that fingerprint and report unchanged since added, or that the file differs. Videos stay where they are; the record keeps the file’s name, size and fingerprint. A photo added from the gallery is marked as such, because its capture time is when it was added, not when the shutter fired.

The paid tier adds the step for handing over. For the client or the attorney, the evidence package builds one zip holding the case-file PDF, the evidence photos numbered in capture order, receipts, the case spreadsheets, an evidence index that compares the hash taken when each photo was added with the hash of the copy in the package, and a manifest listing the SHA-256 of every file. That is what a private investigator log that hands over evidence with a hash manifest looks like in practice.

Keep the narrative out of the log

The log is the record. The narrative is your account of what the record means, in order, in sentences. Mixing them is where opinion leaks into the timed lines.

Write the narrative once the session is over, in plain words, and keep it in its own section. ProofPI keeps a separate narrative field on each session, which the case file prints with that session, just above its timed observations, so the two are read together without being confused for each other.

How long to keep it

Retention is set by your state, and the numbers vary. Kansas is a clear example: under K.S.A. 75-7b15, each private detective or agency must keep a complete record of its business transactions and retain those records for at least three years. Whether field notes count as those records is a question for the board. Other states set their own periods. Read your board’s rules, then keep the log at least as long as any case it supports could come back.

The checklist on one page

Check	What it looks like in the log	Why
Header	Client, matter number, subject as instructed, date opened, scope	Answers why you were there
Start and stop	Both times from one clock; “not stopped” if you left without one	Time on station is billed and questioned
Position	Your own GPS fix with its accuracy, plus the address in words	Phone GPS drifts near buildings
One line per event	Time, then what happened, present tense, no hedging words	Opinion invites cross-examination
Late entries	Event time and the time written	Rules 803(5) and 803(6) ask about timing
Gaps	Lost sight, regained, outcome at the end	A hidden gap discredits the rest
Corrections	Original readable, correction beside it	An erased line looks like a hidden one
Photos and video	Logged when taken, hashed when saved	Matching hashes show an exact duplicate
Narrative	Written after the session, kept separate	Keeps conclusions out of the record
Retention	Originals kept for your state’s period or longer	Set by state

This is general information about record keeping, not legal advice. Rules of evidence, tracking laws and retention periods differ by jurisdiction, so check them with your licensing board or a lawyer before relying on any of it.

The next time you go on station, start from the header and the clock, and log the gaps as they happen. If you’d rather keep that on the phone you already carry, ProofPI’s case file and surveillance log holds the sessions, the timed observations and the hashed photos together for each case.