CCTV footage - how do you protect it?

[fiza]

I don't look after the CCTV system but I have been asked to provide USB drives so footage can be transferred onto them to hand over to 3rd parties when required ie Police.

 

I cant encrypt the USB drives as the CCTV system won't recognise Bitlocker. The staff who look after CCTV don't have the ability to enable bitlocker after transferring the files so it would have to come back to me to encrypt.

 

How do other Schools deal with CCTV footage that needs to be handed over?

[ADMaster]

I don't look after the CCTV system but I have been asked to provide USB drives so footage can be transferred onto them to hand over to 3rd parties when required ie Police.

 

I cant encrypt the USB drives as the CCTV system won't recognise Bitlocker. The staff who look after CCTV don't have the ability to enable bitlocker after transferring the files so it would have to come back to me to encrypt.

 

How do other Schools deal with CCTV footage that needs to be handed over?

The last footage I pulled I put on Google drive and shared it with the police.

[Arthur]

How do other schools deal with CCTV footage that needs to be handed over?

We zip up and password protect the exported video (.mp4) and then burn it to DVD.

[6Foot2]

After downloading clips for the last request I uploaded them to my OneDrive and forwarded them to the member of staff who made the request while making sure to adjust the properties of the message included 'do not forward' (from this point onward)

[dhicks]

I don't look after the CCTV system but I have been asked to provide USB drives so footage can be transferred onto them to hand over to 3rd parties when required ie Police.

 

If you're handing over evidence to a police officer, they have a whole chain-of-evidence process which should keep the item safe / private - you can hand them an un-encrypted USB stick or DVD, they have a process in place to keep that evidence safe. If the police officer in question is able to deal with a shared Google Drive folder we share footage with them like that, it varies from officer to officer as to what they'll handle.

[christhetech]

I don't look after the CCTV system but I have been asked to provide USB drives so footage can be transferred onto them to hand over to 3rd parties when required ie Police.

 

I cant encrypt the USB drives as the CCTV system won't recognise Bitlocker. The staff who look after CCTV don't have the ability to enable bitlocker after transferring the files so it would have to come back to me to encrypt.

 

How do other Schools deal with CCTV footage that needs to be handed over?

Can you not use a hardware encrypted stick instead, such as Ironkey or Datatraveler DTVP. I've used the Datatravelers for a few years now & I'm yet to find any device that doesn't recognise or work with them. Realistically, you would only need to purchase a couple at the most, as once you have handed it over and they have extracted whatever data they need, they can return the stick to be reformatted and a new password applied for re-use.

[enjay]

The times we've handed footage to the Police, we've done it in person on an unencrypted stick - as others have said, the Police have their own chain-of-custody which protects it. Actually, the most recent time, the officer filmed it on their mobile phone directly from the CCTV console!

[christhetech]

The times we've handed footage to the Police, we've done it in person on an unencrypted stick - as others have said, the Police have their own chain-of-custody which protects it. Actually, the most recent time, the officer filmed it on their mobile phone directly from the CCTV console!

 

I prefer to err on the side of caution tbh. If I've passed the data on to the relevant person in encrypted format, what they do with that data and how they protect it is entirely their call. The main thing is that I have done everything that could be reasonably expected of me to ensure that the data was not exposed to any potential risk whilst I was the custodian. If I've handed it over to the police in an encrypted format & they decrypt and then subsequently leak/lose that data, that's their problem. As long as I can demonstrate that I have taken all reasonable action to secure that data whilst in my care, I've done my job.

[enjay]

If I've handed it over to the police in an encrypted format & they decrypt and then subsequently leak/lose that data, that's their problem. As long as I can demonstrate that I have taken all reasonable action to secure that data whilst in my care, I've done my job.

 

Personally I think putting it in the hands of a uniformed officer would also constitute "reasonable action", but each to their own. Plus, the footage they filmed on their phone wouldn't have been encrypted - should I have told them they couldn't record it like that?

[christhetech]

Personally I think putting it in the hands of a uniformed officer would also constitute "reasonable action", but each to their own. Plus, the footage they filmed on their phone wouldn't have been encrypted - should I have told them they couldn't record it like that?

 

Just my own personal opinion on Data Protection, and perhaps I am a little anal when it comes to data security, but I would not have been entirely comfortable with anybody (uniformed officer or not) extracting data to a mobile phone. By making a concerted effort to ensure that everything that leaves the building is encrypted, I feel that I am doing everything within my power to cover both myself and the school from falling foul of any potential data breach fall-out, should that data subsequently be lost or leaked after it has left my custody.

[enjay]

Just my own personal opinion on Data Protection, and perhaps I am a little anal when it comes to data security, but I would not have been entirely comfortable with anybody (uniformed officer or not) extracting data to a mobile phone.

 

You may well be right. Possibly I was just too trusting of a police officer, and I should have told them no (or rather, expressed my concern to the HT who would probably have told me to do it but at least that would clear my responsibility). Thoughts from anyone else?

[elsiegee40]

You may well be right. Possibly I was just too trusting of a police officer, and I should have told them no (or rather, expressed my concern to the HT who would probably have told me to do it but at least that would clear my responsibility). Thoughts from anyone else?

It fls all wrong using a mobile. It may be that it was a police issued device and that is how things are done today, but there's a little niggle that this was the officer's own phone

[enjay]

It fls all wrong using a mobile. It may be that it was a police issued device and that is how things are done today, but there's a little niggle that this was the officer's own phone

 

It was a police-issue phone (or so the officer claimed), and they started the recording by stating their name, the case number the footage related to, and a bit of other preamble too.

[Edutech98]

I wouldn't have a problem with the police officer doing that.

 

The law enforcement directive sets out how the police are required to handle this type of data including the security of it. I think its reasonable of the school to presume that they are handling data in line with the directive without needing to confirm this.

 

Although... the first school I worked at a teacher started and a few weeks later went AWOL. There was a bit of a rumour it was drugs related and one day two non-uniformed police officers turned up as I was fixing one of the reception computers. The receptionist called the head and he came down. The police officers introduced themselves as GMP and told them they were investigating this teacher and believed the school employed him. The head confirmed this and the police asked if they had an address for him. The head happily obliged and asked the receptionist to print his address. Off they went and at that point the head asked who confirmed there ID - everyone looked at everyone else and all shrugged there shoulders. I've never seen someone change from white to red so fast

 

His only comment was "oh sh1t"

[Achandler]

Police are issued phones nowadays that are encrypted. They get 3 chances at their pins normally before it locks and needs unlocking centrally normally, or they do atleast around here.

 

Also recording on their own phone means if the evidence is needed in court, their personal phones can be seized until after a trial, so it's in their personal interest to not use it. I'm not fully sure if a recording of footage is good enough for a court case though, probably enough for an interview or confirm a crime though.

 

Obivously you would still check their credentials unlike the above...

[enjay]

The law enforcement directive sets out how the police are required to handle this type of data including the security of it. I think its reasonable of the school to presume that they are handling data in line with the directive without needing to confirm this.

 

That's my thinking too. Let's be honest - what certainties do we have any of our ed tech suppliers are doing what they say? They have Ts&Cs which say "we will do X, we won't do Y" and they may have even signed a data processing agreement with us stating this, but do we actually KNOW they are adhering to it? So - do you have more confidence in the data handling of the police or Bob's IT Ltd?

[localzuk]

Unencrypted on a CD/DVD - handed directly to the police officer who needs it. They are law enforcement, and have their own chain of custody stuff - they don't need us confusing matters by handing them randomly encrypted stuff.

[christhetech]

That's my thinking too. Let's be honest - what certainties do we have any of our ed tech suppliers are doing what they say? They have Ts&Cs which say "we will do X, we won't do Y" and they may have even signed a data processing agreement with us stating this, but do we actually KNOW they are adhering to it? So - do you have more confidence in the data handling of the police or Bob's IT Ltd?

 

True, but by publishing T&Cs and signing data processing agreements, they are effectively accepting responsibility for any data which falls within the scope of the contract. Whilst in practice, you don't necessarily have any way of proving that they do adhere strictly to any agreement, by signing an agreement, they are effectively absolving you of responsibility once the data is in their hands as they have now agreed under contract to take full responsibility for how the data is handled whilst in their custody. A guy turning up in a Police uniform and recording some CCTV on his phone is not entering into a written contract agreeing to hold the data securely.