Eye Spy: Understanding Your Video Surveillance Technology Risks

By Keith Burkhardt, Vice President, Kraus-Anderson Insurance

Reprinted with permission from CIO Review.

George Orwell almost had it right: You are being watched. But it is not just Big Brother. It may be a home-security vendor, an employer monitoring a lobby, a security camera in a parking ramp, a church nursery, a work computer or a phone.

A video surveillance technology program deserves the same proactive, interdisciplinary approach as a cyber resilience program.

From fetal 4D ultrasounds to gravesite mapping, American lives are being recorded in more ways than ever before. Government entities, schools and colleges, public and private corporations, and nonprofit organizations routinely rely on video surveillance for safety and security. Uses may include deterring crime, protecting proprietary methods and materials, and identifying potential wrongdoing.

Yet, despite its benefits, video surveillance technology can create significant risks. As the Internet of Things continues to expand, surveillance technology may outpace an organization’s ability to understand the full implications of its use and misuse, both for individual privacy and society at large.

News of cyberattacks continues to grow, alongside incidents involving actual or perceived privacy and human-rights violations tied to surveillance. Consider the concerns raised by Samsung’s smart TV privacy controversy or public requests for police video following officer-involved shootings.

Is a Low-Cost Camera System a Simple Solution?

Suppose a business owner wants to address theft in a supply room. A low-cost closed-circuit television, or CCTV, system may seem like an easy answer.

Not so fast.

Video surveillance does not automatically violate privacy. However, unauthorized access to surveillance data can create serious privacy, legal and reputational concerns.

If a business installs a system without involving legal or human resources professionals, it may discover more than expected in recorded footage, including illegal, illicit or otherwise sensitive activity. Questions quickly follow:

• Who has access to the recordings?
• Does the service provider have access to the data?
• What happens if footage is shared as evidence but also contains private information about other individuals?
• How will the organization protect people’s privacy and reputation?

Those questions should be addressed before the system is installed, not after a concern arises.

What Should a Video Surveillance Program Address?

A video surveillance technology program should receive the same proactive, interdisciplinary attention as a cyber resilience program. Organizations should involve security, information technology, human resources, legal and finance leaders, along with other stakeholders as needed.

Key considerations include:

• Does the video surveillance procurement process account for compliance, legal and financial risks?
• Where does surveillance data go?
• How is the data stored, managed and protected?
• Who can access the recordings?
• What is the organization’s data-retention and disposal policy?
• How secure is the video surveillance software?

The integrity of surveillance software is also a critical concern. Organizations need to understand whether software code could be compromised in ways that permit tampering or unauthorized access.

“Absolutely, it’s a problem, there are no guarantees on who will control the data and how well they control it,” says James Ryan, founder and principal of cybersecurity firm Litmus Logic. “The more advanced cyber attacks become, the more assurances firms should demand from their suppliers to verify that software and cloud systems are resilient to hacks, and that suppliers manage data and infrastructure with prudence and transparency.”

Litmus Logic performs independent assurance services for software and services that have passed stringent testing, including testing for the Department of Defense and its suppliers.

A Proactive Approach to Surveillance Risk

As surveillance technologies provide more information than ever before, organizations have more to consider. Technology procurement, data governance, privacy, cybersecurity and risk management should be evaluated together.

Caveat emptor: When organizations do not fully assess technology risks, unintended consequences can follow.

For related perspectives, read about cyber resilience and the human element, improving cybersecurity maturity for general contractors and risk management leadership.

For current guidance on cybersecurity risk management, visit the National Institute of Standards and Technology Cybersecurity Framework.