CCTV: security system or system security?

Pretty much all of us are now chasing modern technology. Some organisations and individuals are at the forefront of that dash while, almost inevitably, others are trying to catch up.

Do you remember when a desktop was a word processor, or when a mobile phone was used simply to call people?

Can you recall when tablet was a lovely, sickly sweet frowned upon by dentists and not a multi-communication device, or when CCTV was Closed Circuit Television? When a CCTV system was used solely for security?

Like everything in this wonderful world of ours, things move on. New uses are found for what were once basic system tools.

Through time, these basic tools are added to, remodelled, sometimes even totally replaced by newer tools that can do lots more than even you originally thought they were capable of from inception.

CCTV: is it still a security system?

Set against that backdrop, let me pose an initial question to you: is CCTV still a security system?

CCTV was primarily introduced within the public and private sector arenas to render properties secure: to try to stop break-ins and thefts (and vandalism, too). It was new and it was innovative. It was a tool designed for a specific purpose.

First there were fixed cameras overlooking designated areas, then there were moveable cameras. All of them reported back to a central communications point.

What is it used for now, though? Well, yes, security is somewhere in the mix. Indeed, the question surrounding CCTV’s role in the detection and prevention of criminality is one that very often encourages a healthy debate.

Purposes of the surveillance system

Take, for instance, a modern town centre public space CCTV system typical of those in operation today. Is it used for security, and just security? No, I don’t think so.

Part of the initial exercise in any CameraWatch assessment is to ask surveillance system managers what the CCTV system is used for (what the Information Commissioner would term the ‘purposes of the system’).

It’s very interesting to prise out of those CCTV managers what they use the system for on a daily basis. There’s nothing sinister involved. Indeed, it’s all about good things which, to be honest, the CCTV industry needs to ‘advertise’ and shout about much, much more than is presently the case.

Some examples of the use of CCTV in today’s world? Well, the main word is ‘safety’. Yes, I said ‘safety’… “These cameras in the town help to keep people safe” is the stock answer… “The system keeps an eye on people and ensures that we reduce the chance of a threat to them” is another… “We help to let people go about their business in a safe environment”… “We keep the streets of our city safe”… These quotes say it all really.

Whether you’re out shopping (a real ‘nose bleeder’ for people like me, I’m afraid!) and might be accosted by someone intent on committing an act of anti-social behaviour, or if you are on a night out and someone is keeping watch to ensure you aren’t accosted by ‘nuisance factors’ through the ingestion of too much drink… CCTV is going to see you, and it’s all about your safety.

Safety and well-being of those being watched

No, the CCTV operator doesn’t follow you around the town centre just to see how many boozers you visited, or who you met up with or what kind of fashionable/seedy (delete as appropriate) nightclub you ended up in.

Rather, the CCTV system is designed to employ the skill of those operating and managing it to keep an eye out for your safety and well-being. It maintains a watching brief, much like your big brother or sister used to do for you when you were wee (as they say in Scotland).

Digressing for a moment (and, hey, here’s a novel idea), why does the phrase ‘Big Brother’ seem to conjure derogatory notions among so many when used alongside CCTV?

What could have been better when you were little and may have felt vulnerable – or, in fact, when perhaps you didn’t even think of being vulnerable but others could see a bigger picture – than to have someone in the background keeping a watchful eye on you? Sound familiar?

And if a situation arose and your own big brother became a bit concerned, well he would become involved. Again, does this sound familiar?

Accentuate the positives, please

Why does the CCTV industry not look at the positives to be derived from surveillance and shout about them from the rooftops? Why?

How many public space CCTV operators have spotted someone in the street looking ‘out of sorts’? Perhaps an elderly person appearing anxious or lost, or maybe dishevelled? Or a child on their own looking around with trepidation?

How many times has CCTV stepped in and helped out? We don’t know. Why don’t we know? Let’s tell people about it!

In real terms, we’ve merely scraped the surface on the use of CCTV, and we have only very briefly looked at public space CCTV.

Most CCTV in the UK is not used to monitor public space. Most isn’t within the jurisdiction of local authorities or police authorities. Most of it isn’t even publicly owned. The majority of CCTV is private CCTV.

Again, a momentary digression here… Why, then, is the current Home Office consultation on a Code of Practice relating to surveillance cameras focused solely on local authorities and police authorities (never mind the fact its scope only covers England and Wales)?

Why is that consultation not addressing the majority of CCTV systems in the land (ie those that are privately owned and funded)?

I hope that you managed to achieve the deadline date for submissions to this consultation (which just happened to be on Wednesday of this week). I for one very much look forward to being involved on an ongoing basis.

Smaller-scale surveillance systems in the private sector

Back to the security question and a couple of examples focused around smaller systems in the private sector…

Take an office block with cameras located in the car park. Is the CCTV there for the security of the cars or indeed the car park (company property), or is it checking to see who might approach the building through that car park?

It could easily be all of the above, some of the above or none of them.

Suppose that you are an employee… You bring your car in during the winter (you are good on the CSR front and cycle to work during the summer, though). You park your car in the car park. Since it’s winter, by the time you finish work it’s dark, dank and rainy: absolutely dreich (again, as they say in Scotland!) You see the CCTV cameras. You know they are there…

Do you think of the previous reasons for these cameras being there while you try to hold your coat fronts together and battle against the wind and rain, fumbling for your keys and not looking around you?

Or do you have a feeling of safety, one of comfort? Of someone keeping an eye on you and preventing or lessening a threat that may be posed to you? A ‘Big Brother’ watching over your well-being and your safety?

And no – you don’t need to e-mail the answer to me.

Considering the patrolling security officer

Take another example, this time of a shopping mall (but it could be a factory or an airport or any other large building)… It’s the nightshift. The security officer begins his patrol. The officer’s on his own. Yes, radio communication with the Control Room is available and activated, but he’s on his own… or is he?

That officer maintains his regular patrol within eye-shot of the cameras. Why? His colleague is his ‘Big Brother’ for the night, that’s why. The CCTV system is keeping an eye on him and on his safety. If anything untoward happens then the CCTV system is used to its full capability in keeping that security officer as safe as possible.

Yet on the other side of the coin the surveillance system is also being used for the general safety of staff and of lone workers. Employers have an obligation here, by the way. They must factor-in the Health and Safety of lone workers.

What rears it’s head here? Yes indeed: the Corporate Manslaughter Act.

If your CCTV isn’t/wasn’t fulfilling it’s expectations in relation to the safety of your lone working staff then who would bear responsibility for that in today’s business landscape?

Again, no e-mail answers are required.

CCTV and the 2012 Olympic Games

Just to finish off on the expanding use of CCTV, allow me to mention a unique surveillance system. A system to be used, in fact, at one of the London 2012 Olympic Games venues.

This system has been in use since the venue in question was realised. When I went through the ‘purposes’ exercise with those running it a few years ago now, they were actually astounded when they sat down and listed all of the different uses that they had for the system.

Put simply, they just didn’t realise how much they relied upon the CCTV system. How much it supported what they were doing, and how many things that they would find very difficult to progress if they didn’t have CCTV.

Areas of actual use included: access control, perimeter security, traffic management, on land security, on land safety, on water safety, water boat monitoring, boat management, staff monitoring, public footfall, the management of races, weather monitoring, boat storage and usage and much, much more besides.

You know what? All those areas of use are areas in which the management depended (and continues to depend) on CCTV.

Look at it from the other side of the equation and think of how many people captured by the cameras also depended/depend on those cameras… Do we always think of that? The answer is ‘No’.

Now I should point out here that there were questions raised about the various everyday uses of the system and what was actually registered in terms of ‘purposes of use’ with the Information Commissioner’s Office.

So many uses of CCTV: security, prevention and detection of crime… and the rest. Is CCTV used for monitoring staff? For monitoring crowds? To monitor the direction of customers entering a store? For footfall or the number of cars entering an area?

In hotels, is it used to keep a watchful eye on lone workers? Or smokers? Or deliveries? Perhaps traffic management at the loading bay?

Maybe in the car park? Perhaps in children’s nurseries for parents monitoring their youngsters playing over the Internet (and more than a few questions are raised here)?

Is the use of CCTV in a given context actually legal?

There are so many different uses for CCTV, then, but are they all justified? Are they allowable? Are they registered? Most important of all, are they legal?

This, in turn, promotes so many different areas for discussion, and it would not do the subject justice to even attempt to cover them all in one article.

Hopefully, though, what I’ve said here has raised a bit of a thought process concerning not just the different ways that the use of CCTV has increased dramatically since it was first brought in, but also in terms of why we must make sure that, even though it seemed a good idea at the time, the main issue is to make sure that CCTV’s usage is open and transparent (and that it can be fully justified).

CCTV is a brilliant tool and we have shown that it can be used for many and various purposes, but we absolutely do need to make sure that it’s operated and managed correctly and legally to ensure public confidences are maintained at their highest possible level.

Security of the CCTV system

Now on to my second fundamental question. What about the security of the CCTV system itself?

Well, I can only touch on some of the areas of the security of a CCTV system in one article. Let’s look at some of the very simple ones:

• are the cameras secure on their fixings?
• are the cameras too low to the point where someone could interfere with them?
• how secure is the access to live images?
• are those images shown on a monitor open to people who are not fully trained?
• if a third party company is exposed to these images, what training and written agreements are in place (even for a third party destruction company)?
• are the images – either live or post-event – shared with other parties and, if so, what agreements and procedures are in place for this?
• do the persons whose images are being captured know that their personal data may then be shared with other parties?
• how secure are the stored images, and are there restrictions (and written procedures in place) on who gains access to them?
• are the stored images under lock and key, and are those keys under restricted access (and their usage logged appropriately on every occasion)?
• where appropriate, how secure is the Internet connectivity?
• what about the actual recording and storage equipment: is it too easily accessible, fully restricted or fully secure in a secured area?

Remember that whatever images are on these devices, those images stand as peoples’ personal data.

If you need to review images from an incident then what restrictions do you have in place? How well are your members of staff trained in Data Protection Act requirements for CCTV?

Can staff recognise a request to prevent the processing of images? How often is your CCTV system assessed and/or audited?

Is the system audited independently by an organisation with appropriate expertise in CCTV Data Protection Act compliance? Do you have correct procedures in place for all aspects of the management of the CCTV data?

Importantly, do you have appropriate and correct documentation to hand on all aspects of the management of the CCTV data?

That’s just a flavour of some of the things to be identified and looked at, but this list is by no means comprehensive.

Safety and security of captured data

CameraWatch has often commented on the awareness that needs to be shown when we are talking about ‘the cloud’.

Security is paramount for those people whose images are captured, and for those responsible for the safe management of those images. Why? Simple. It’s all about personal data.

In the future, we will go into a bit more depth and highlight some examples of everyday issues concerning security.

In the meantime, all data as it’s being viewed and recorded needs to be kept safe and secure. That’s equally true when and where the data is being transferred to a third party medium (eg CD/DVD/tape, etc).

The actual machine used for recording and playback, the viewing of recorded images and the authoritative ‘signing over’ of the images to other parties where required: all are equally important as part of the CCTV mix.

What’s the easiest way to ensure that you’re doing everything in accordance with the law? Well, the first thing is to have the system assessed by experts in CCTV and compliance with the Data Protection Act legislation. At the very least, this will tell you the current situation and what needs to be done.

By the way, when was the last time you had your CCTV system assessed? You do know that it should be done regularly, don’t you, and at the very least on an annual basis?

Have a look at the Information Commissioner’s CCTV Code of Practice. That’ll tell you all you need to know

Paul Mackie is the compliance director at CameraWatch

Mackie boasts a 30-plus year background in IT working with both international blue chip companies and also national Government, during which time he dealt with compliance and legalisation of industry software

Further information on CameraWatch

CameraWatch is a group aimed at promoting awareness and compliance of the Data Protection Act for camera surveillance in both the private and public sectors. The organisation has the support of the industry regulator, namely the Information Commissioner’s Office.

A need has been identified for a central information point for the industry. CameraWatch is an independent, not-for-profit, self-funding advisory body* that supports the understanding of CCTV and compliance with current policy and legislation, removing risks relating to data protection and other legal non-compliance.

CameraWatch represents the interests of members through liaison with legislative, prosecution and Government organisations throughout the UK and the EU.

In consultation with the Information Commissioner’s Office, the organisation facilitates the implementation of the ICO’s CCTV Code of Practice and builds up and disseminates Best Practice guidelines designed to support compliance in the use of CCTV systems, their operation and procedures and (where appropriate) prosecutions using CCTV evidence.

CameraWatch offers support tailored to meet the needs of specific organisations, as well as the general public. To these ends, the organisation undertakes R&D project work and market research.

Promotion of data-sharing forums

CameraWatch also promotes regular meetings/seminars and data-sharing forums with the police and law enforcement agencies, the ICO and other security working groups, suppliers/manufacturers and installers and CCTV applications users from all affected sectors (such as retail, transport, finance, insurance, property management and construction, the licensed trade, industry consultants, the security industry, the legal profession, local authorities and other related bodies).

CameraWatch’s activities are currently funded by industry sponsorship and membership fees. The organisation celebrated its Fifth Anniversary in March this year.

CameraWatch’s CEO Gordon Ferrie is a recognised expert in banking security. He was the director of the Fraud Squad and deputy head of CID operations at Strathclyde Police, and is a former worldwide head of security for the Royal Bank of Scotland Group.

Currently a director of ComSec, Ferrie is the CEO of CameraWatch in a volunteer capacity.

Along with Ferrie and Paul Mackie, five other directors make up the Board of CameraWatch.

*CameraWatch is a company limited by guarantee and recognised by HMRC as a not-for-profit organisation

Access more detail on the CameraWatch website (a dedicated link is provided at the foot of this page)