Safety does not start with a bodyguard. It starts with the routine we reveal about ourselves every day

Most people only start thinking about security once something has happened. Professional protection works the other way round: it looks for the conditions that give a problem the chance to arise, and removes them before anyone can exploit them. And the first of those conditions is rarely a weak lock or a missing camera. More often, it is our own predictability.

7.20 in the morning: the same café, the same table by the window, the same double espresso. At 8.15 you drop the children off outside school, at the same gate as always. At half past eight you park in your usual space by the office. On Tuesday and Thursday evenings, tennis, court number three. On Friday, dinner at the restaurant you like, and a photo online before the main course has even arrived. On Saturday morning, a run along the same route, and the app tells you that you were twelve seconds faster than last time.

None of this is a mistake. This is how most of us live, and it is a good way to live. But try, for a moment, to look at that week through a stranger’s eyes. Not as a life, but as a set of information. Where this person tends to be. When they are there. With whom. How they get there. When they are not at home. One day will not tell you much. Five weeks in a row will.

In close protection, this is one of the first things we look at. Not the locks, not the cameras, not the cars. The pattern.

Routine is not the enemy

Routine is one of the most useful things we have. It saves attention. You do not have to decide every morning which way to drive to work or where to have your coffee, and you can put the energy you save into the things that matter. Children need regularity even more than adults do. Businesses are built on repeated procedures. Anyone who advises you to abandon your routine understands neither people nor security.

The science is clear on this. When a team led by the physicist Albert-László Barabási analysed anonymised mobile network records of the movements of fifty thousand people in 2010, they used them to calculate a theoretical upper limit of predictability: 93 per cent. That does not mean anyone could say with such accuracy where you will be at ten o’clock tomorrow. It means there is so little randomness in our routes that, in principle, it could be done. And that this limit is almost the same for people who move within a few kilometres as for those who regularly travel long distances. We are not unpredictable. We are creatures of habit, and that is perfectly fine.

Routine is not the problem. The problem is when a routine becomes public and when it comes with too much other information. Criminology described this as far back as the late 1970s: for something to happen, three things must come together in one place at one moment — a person who wants to do it, a suitable target, and the absence of anyone who would stop them. Protection in the narrowest sense means nothing other than breaking up that meeting. And the cheapest place to break it up is the middle item: how easy a target we make ourselves.

Routine, or unnecessary predictability?

I distinguish between two things. Routine is going to the same café. Unnecessary predictability is when anyone who takes the trouble to look you up knows about it, including the time and the table. Routine is your children going to the same school. Unnecessary predictability is when a public profile shows the school logo on their hoodie, the name of their after-school club and the fact that their grandmother collects them on Tuesdays because you have a meeting.

The difference is not in what you do. It is in how much of what you do can be found out by someone who has no reason to wish you well. And how little effort it costs them.

Routine is not the problem. The problem is when routine becomes public.

Bílý kruh bezpečí, which helps victims of crime in the Czech Republic, gives people who are being stalked this advice, among other things: choose different routes, times and habits from the ones the stalker knows. That is advice for when things have already gone wrong. Most of us have the advantage of being able to do the same thing in a much milder form, and sooner. We do not need to change our lives. We just need to stop broadcasting them.

The digital and physical worlds are no longer two worlds

For a long time, we thought about security in two boxes. In one: locks, alarms and whoever is standing at the door. In the other: passwords, phishing and hackers. Those boxes no longer exist. Most physical risks today begin with information, and most information today is created on a phone.

The Czech Police have been saying it for years in their advice before the summer: do not share the fact that you are going away, or your holiday photos, on social media. It sounds trivial, but it is precisely the point at which a digital footprint turns into a physical opportunity. Research into how burglars make decisions, such as the work of Claire Nee at the University of Portsmouth, ranks signs that people are at home among the main criteria by which an offender chooses a target. Burglary is not about who has the best lock. It is about who is definitely not at home.

In December 2024, the FBI sent professional sports leagues in the United States a warning that organised groups were deliberately targeting athletes’ homes for burglary. According to CBS News, which described the contents of the document, at least nine players were affected between September and November 2024. The AP news agency quoted the warning as saying that the offenders use publicly available information and social media to learn athletes’ habits and to track when they leave and when they return. The fixture list is public. Travel to away games is public. Hotel photos are public. Nobody had to hack anything. And the FBI’s advice to athletes was simple: do not publish photos of valuables or of the inside of your home, and do not post from holiday in real time.

And then there is the best-known case of recent years. In October 2016, Kim Kardashian was attacked in a rented flat in Paris and robbed of jewellery worth millions of dollars. When a Paris court convicted eight of the perpetrators in May 2025, she summed it up, according to ABC News, in a single sentence: people were watching and knew where she was. She had previously shown the ring she lost to her followers on Instagram. Since then, according to the same source, she has not posted her location in real time. You do not have to be a celebrity for the lesson to apply. It is enough to have anything someone else wants, and a schedule that can be seen.

How innocent information builds a picture

Almost no single piece of information about you is dangerous. A photo from a restaurant is not. A running route is not. A mention of a conference is not. The name of a school is not. What is dangerous is what emerges when someone puts them side by side.

In 2013, researchers from MIT and the Catholic University of Louvain examined anonymised data on the movements of one and a half million people over fifteen months. They found that four randomly chosen spatio-temporal points — four pieces of data about roughly where and when a phone was — were enough to make the movement trace of 95 per cent of the people in the data unique. That will not tell anyone your name. But it will tell them that it is you again. Our movements are so distinctive that they cannot be mistaken for anyone else’s, and so regular that they can be predicted in advance.

In security analysis, this is known as the mosaic effect. In 2013, the US government even wrote it into its rules on publishing data: a piece of information that on its own endangers no one can, when combined with other publicly available information, put both privacy and security at risk. What such a mosaic adds up to about one person is known in protective practice as their pattern of life: where they tend to be, when they are there, with whom, how they get there and when they are not at home. I am not describing here how it is pieced together, and I will not. What matters is the principle: the information you publish about yourself is not added together. It is multiplied. And the person putting the mosaic together need not be a criminal out of a film. It could be an ex-partner, a disgruntled business associate, someone you dismissed, or someone who noticed you and cannot stop.

The information you publish about yourself is not added together. It is multiplied.

Family and children: the most regular routine in the household

Most of the information people publish is not about themselves but about their children. A study by Palacký University Olomouc, in which almost 2,500 Czech parents took part between March and July 2022, found that 69 per cent of them share information about their children online. Almost two thirds regularly post photos in which the child’s face is clearly recognisable. Around a third of parents also share photos of other people’s children without asking their parents. That is why the Czech Police run an awareness project with the telling name “Don’t build your child a digital footprint”.

I do not want to frighten anyone with talk of kidnapping, and I will not. The risk I am talking about is more mundane and more common. Of all the routines in a family, a child’s schedule is the most regular. School always starts at the same time. The club is always on a Wednesday. Pick-up is always at the same time and by the same person. Add a parent’s public profile that reveals the school, the club and who collects the child, and you have a picture that none of us would willingly draw for a stranger.

The good news is that there is a simple safeguard against the most common kind of misuse: verification. Under the Czech decree on pre-school education, a nursery school may hand a child over to someone other than their legal guardian only on the basis of a written authorisation issued by that guardian. The rule was not born of bureaucracy but of the simple experience that an unexpected change is the best cover. “Uncle’s picking him up today, Mum can’t make it.” “The coach has cancelled training, come earlier.” “Hi Mum, I’ve got a new number, message me on WhatsApp.” The police know that last sentence so well that in September 2025 they put it in the headline of their warning. Since the start of the 2025 summer holidays alone, officers in the Kladno area had counted eighteen similar cases, and for some people the losses ran into hundreds of thousands of crowns. The advice is still the same: call the original number and verify the change another way. At home and at school, it is a good idea to agree in advance that any non-standard instruction is always confirmed, even if it means that once a year you will feel awkward for ten minutes.

Executives, entrepreneurs and people in the news

For people who run companies or are publicly known, there is another layer on top of their personal routine: their professional one. Conferences are announced months in advance. General meetings have fixed dates. Public appearances come with a programme that includes the time of arrival. Business trips are mirrored in assistants’ calendars, in LinkedIn posts and in photos from the airport.

The most instructive story on this subject in recent years came not from an attack but from journalists. In October 2024, the newspaper Le Monde tracked down, on the fitness app Strava, the public profiles of 26 US Secret Service agents, 12 members of the French presidential security detail and 6 officers of Russia’s Federal Protective Service. That much is documented. From the runs they had published, the newsroom then worked out the movements of the people they protected: a private weekend Emmanuel Macron spent in Honfleur in 2021 that was not in his official schedule, or the hotel in San Francisco where Joe Biden stayed in 2023 during talks with the Chinese president — several hours before he arrived, because one of the agents had gone for a run from the hotel. The US Secret Service told the newspaper that, in its view, protection had not been compromised; the Élysée Palace spoke of a very limited impact. Even so, people whose profession is protection gave their client away through their own routine. If it can happen to them, it can happen to anyone with a team, a family and a phone around them.

The history of the profession has seen worse endings, too. Alfred Herrhausen, head of Deutsche Bank, was killed on 30 November 1989 in a bomb attack near his home in Bad Homburg, on his way to work. The charge had been placed beside the road he used. The attack required no secret knowledge, only the route. And a public appearance always has the same weak point: an announced place, an announced time and the moment when the protected person comes close to the public. That is exactly where most of the work that no one sees from the outside is concentrated.

And then there is a dimension that does not involve a physical attack but is far more common. In its report on the state of cyber security in the Czech Republic for 2025, the National Cyber and Information Security Agency states that, from the point of view of organisations, the most widespread threat was phishing: nine out of ten organisations that responded to the agency’s questionnaire survey had encountered it. According to the same report, the most common forms of cybercrime included fraud relying on social engineering and the manipulation of victims. For 2025, the Czech Police recorded more than a third more frauds against individuals than in the previous year. According to both Europol and the Czech Police, the scam in which someone poses as a company’s boss has the same core: pressure to act urgently and a request for absolute confidentiality. And it succeeds where an employee does not check the instruction with their actual manager, perhaps because the manager happens to be out of the office. How does the fraudster know when they are out of the office? Often from wherever the boss posted it themselves.

The man in a suit a metre from the client is only the last and least frequent part of the job. If everything else worked, he would have nothing to do.
— Robert Václavík

What close protection actually does

In films, close protection looks like a big man in a black suit a metre from the client. In practice, that man a metre from the client is only the last and least frequent part of the job. If everything else worked, he would have nothing to do.

From a professional protection point of view, the order is reversed. First, information: what is publicly known about the client, and what their family, company, calendar, car and sport give away about them. Then planning: which way, when, where there will be waiting and where not, where the alternative is. Then preparing places and people. Only then, presence. And throughout, situational awareness — the ability to notice that something is not right before it shows — and the willingness to change the plan when the situation does not match it. Good protection is discreet not because it is elegant, but because attention is a risk in itself.

In the 1990s, the US Secret Service studied all 83 people who, between 1949 and 1996, had attacked or come close to attacking a prominent public figure in the United States. Three of the study’s conclusions are worth knowing even outside the profession. There is no reliable profile of an attacker. Fewer than one in ten of them had directly threatened their target or the police beforehand. And at the same time, two thirds had mentioned their thoughts about an attack to someone else beforehand — family, friends, colleagues — or had written them down. According to the study, attacks are not sudden outbursts but the result of an understandable and discernible process of thinking and behaviour. That is what the study says. What follows from it for personal security is my own reading: you cannot wait for a threat before you start. But you can take away from an attacker what that process needs most: information and a predictable moment.

Six things that make sense for everyone

I do not want to give you a list for the paranoid. These are a few sensible things you can do this week that will not change your life.

1. Share your location later. Do not publish your exact current location unless you have a reason to. The restaurant photo can wait until tomorrow. Sports apps can hide the start and end of a route, or the whole map.
2. Check the whole family. Every so often, look at what can be found out about your family from public sources. Not about you — about the whole family. The weakest point is often a profile you have forgotten about, or a relative who shares on your behalf.
3. Keep your children’s routine at home. Do not publish your children’s regular schedule. The school, the club, the pick-up time and the person who does the pick-up add up to more than the sum of their parts.
4. Always verify a change. Agree at home and at school that any unexpected change of plan is always verified. Calling a known number takes a minute.
5. The event, yes; the logistics, no. Keep the public information that you will be somewhere separate from the logistics. That you are speaking at a conference is fine. Your hotel, your arrival time and who is driving you do not belong anywhere.
6. Do not deal with threats in public. If someone threatens you, do not argue with them online. Keep the evidence, cut off contact and turn to the police or to an organisation that helps victims. A public argument gives the perpetrator exactly what they want: attention and information about how you react.

Security as freedom, not a list of prohibitions

The worst way to protect yourself is to start being afraid. A frightened person either locks themselves and their family into a set of prohibitions, or gives up after two weeks and goes back to how things were. Neither works.

The point of security is not a life full of restrictions. The point is to remove the risks that are unnecessary — the ones we create ourselves and that cost us nothing to remove. Anyone who knows what they give away about themselves can freely decide what they want to give away. That is the whole difference between a person who is easy to find and a person who has decided who gets to find them.

Keep going to your café. Run your route. Send your children to the school you like. Just broadcast less and notice more. A bodyguard comes into the picture only when this is not enough. For most people, it is enough.

The point of security is not a life full of prohibitions. It is the freedom to decide who finds you.

Robert Václavík Founder of Bodyguard Group^®. This piece opens his Perspectives series on personal security in everyday life.

Would you like to find out what an ordinary week reveals about you and your family?

If you are dealing with your own security, or that of your family or company, and would like a discreet assessment of what is publicly available about you, Bodyguard Group^® will review it and propose a proportionate solution — without panic and without unnecessary prohibitions.