Reflections on the World Cup Doha

Covert Munkey

Credit to EP wired for this article:

Earlier I wrote a short article on my team’s preparations for taking our client to the World Cup in Doha. So I thought I would follow up on some reflections and lessons learned.


One of the big things we went into Doha with was the need to protect our cyber footprint and our client’s. So cyber threats were at the top of the list given to us by our protective intelligence team.

We had procured burner cell phones for our team and the principal’s entourage. Our cyber team was concerned about the safety of the Qatari government and FIFA applications required to enter the stadiums and FIFA venues.

The Qatari COVID app, the FIFA app, and the FIFA Hayya card apps contained permission to examine and look at our emails, bank, text messages, and other apps on our cell phones. However, we opted to use burner cell phones with only these applications on them set up through a dead-end email account and an iTunes account.

The Qatari COVID app Ehteraz, which had been required on our initial visit in September, was no longer required. But the Hayya card and the FIFA apps were still needed. We felt we contained the third-party snooping to the burner phones only but still needed to carry a different cell phone to do our EP business and run WhatsApp on.

One thing you could not avoid was the amount of biometric data collected in the stadiums and FIFA venues. Cameras and cyber monitoring were everywhere.

We attempted to mask our cyber footprint as much as possible. To that effect, we used the following:

  • FARADAY bags for cell phones when not in use,
  • MiFi WiFi hotspots we brought along with VPNs to protect mobile cell phones and laptops when conducting email of internet traffic.
When not in use, laptops went into FARADAY bags.


The Qatari government dropped all COVID requirements to enter the country and suspended the monitoring via their own COVID app during the World Cup.

We did hear about numerous people we were in contact with other in-country corporate security teams coming down with Covid while we were there. No COVID reporting was done while we were in the country.


As we suspected, traffic at the World Cup would be tough and packed during game times. This was further complicated by restricted parking access to parking lots close to the venue and random road closures by Qatari security during movements by fans to the games.

We had transportation to many games through our sponsor, US Soccer, via buses and bus parking lots. For the games our clients didn’t have parking for, we had to get creative. This required us to borrow passes from other corporate security teams for games they weren’t attending to use to get close to the venue.

Security perimeters for all stadiums had been pushed out significantly for this event giving each stadium maximum standoff from any VBIEDs (Vehicle Borne Improvised Explosive Devices).

We would send the advance EP agent out early to scout the parking lot and then the gate entry the clients would use. Fortunately, our clients didn’t mind a short hike from the parking lot to the stadium we had to make on several occasions.

Venues #1​

All the stadiums had various dedicated lanes for VIP/VVIP drop-offs and for hospitality-level ticket holders. Lanes directing you to other parking lots surrounding the stadiums were subject to random road closures or redirection of traffic to not well-marked roads that had been built and weren’t on maps yet.

We solved this by having the advance agent drop a pin on maps or WhatsApp to allow our local drivers the ability to find them.

Security at the venues included drones flying overhead, remote cameras, and uniformed security forces on the perimeter. Entry points were manned by uniformed security officers hired from various countries, like:

  • Pakistan,
  • Turkey,
  • Morocco,
  • Africa,
  • Sri Lanka.
They had basic instructions about what was allowed into the venue and what was not. And minimal leeway to make decisions about making exceptions. The level of expertise and professionalism varied from stadium to stadium. We found large discrepancies between what was looked at in your bag and what was not.

Venues #2​

Stadium entry had metal detectors and X-ray machines. Once past those, you were randomly wanded with a handheld metal detector and sometimes patted down. X-ray machine operators had various levels of expertise. My bag was always opened in most stadiums because the X-ray operator was unsure what they were looking at.

My team carried a bag with a basic medical kit, including:

  • Gloves,
  • Chest seals,
  • Blood stoppers,
  • Tourniquets,
  • U-shaped cutting tool by Variant, the one called the HUK,
  • EpiPen,
  • Battery charger,
  • Cords,
  • Small tracking device,
  • Flashlight, and
  • Chemlights.
I also carried two flashlights and two cell phones.

I only had one stadium security team really attempt to take items from me at entry or really search my bag thoroughly without me having control of the bag. Most of the time, I was able to physically control my bag and control their access to the contents.

Ninety-nine percent of the time, the security staff was polite, gracious, and genuinely lovely people. Of course, we ran into some who were having a bad day or were not up to par. But they were the exception.


We received various reports and information about what would happen in a medical emergency, all of which were conflicting. Therefore, we made sure to have sourced a local doctor and hospital we could go to for any issues or emergencies.

We carried two full trauma kits in our vehicles with oxygen and trauma supplies. We had problems sourcing some items we could not fly into the country with, like certain IV supplies and common trauma supplies. But our local sources had connections that finally helped us get what we needed.


We operated on WhatsApp most of the time, with text and cell phone calls. Secondly, we supplemented our drivers with handheld radios obtained in the country from our local sources for inter-vehicle communication. Thirdly, we carried SAT phones in the limo and follow vehicles for emergency communications.

We utilized small tracking devices in each vehicle and on the person of the EP personnel. That way, we could locate our cars in parking lots and track our personnel.

At the World Cup, we utilized our GSOC to track our daily movements and set up GEO fences around the living quarter and stadiums that alerted the GSOC when we left the residential area and entered certain stadiums’ parking.

The general idea was if we had an emergency where our team needed to be extracted from the country due to a major event, our extraction team would be able to locate us with the tracking devices we had.


We were fortunate to have secured four local driverswho knew the area very well and had local resources they could contact for hard-to-find items and information.

This proved invaluable on multiple occasions as the drivers navigated around and through the stadium traffic jams to quickly get us back to the residential location. The bad thing was these guys were used to being limo drivers, and it took some time to get them used to how to follow and block for the lead driver.

Most bus drivers used by our host group contact had been hired out of Saudi Arabia, didn’t know the area and often got lost. We found ourselves having to help with directions and having them follow pins our advance person dropped to get to locations. We had our vehicles shadow the buses when the clients took the buses to the games.

The State Department OSAC group created a WhatsApp chat for all corporate entities to share information, road conditions, event statuses, real-time feeds to venues and daily threat levels. It was a big help because you could also reach out for assistance for issues that popped up and usually get it from other corporate or government entities.

Last edited by a moderator:
Excellent post, a lot of angles covered here that are crucial in modern ops, specifically the COVID apps scooping up data and the need for a strong cyber strategy when on assignment.

Prior Planning Prevents P*ss Poor Performance