Eye Spy: Understanding Your Video Surveillance Technology Risks

Before you set up that CCTV, the key thing to remember is that, while the fact of video surveillance alone doesn’t violate privacy, unauthorized access to it does.

But let’s say you did sign up with your friend’s cousin, without checking with Legal, or HR. Take a look at those surveillance files from last night. You may discover more than you bargained for: Illegal, illicit, or unsavory activity. You do know that if you become aware of a crime, you become part of that crime if you don’t report it, right? Yet who has access to the tape? You? The service provider? What if you turn over the data, but there’s other activity on the file that compromises someone’s privacy or damages their reputation?

This is not the time to call Legal and HR.

Instead, your VS technology program deserves the same proactive, interdisciplinary approach you’ve applied to your cyber resilience program, outlined in CIO Review’s June 2015 Cyber Security Issue. Bring in your team of Security, IT, HR, Legal, and Finance officers (and maybe others as appropriate), for a 360-degree perspective including answers to these questions:

• Does your VS procurement process account for Compliance, Legal and Financial Risks incurred when VS is implemented?
• Where does the VS Data go? How is it stored and managed? Who has access?
• What’s your VS disposal policy and process?

And, how secure is the VS software? The question of whether the software code has been compromised in a way that leaves it open to tampering is a real concern, say experts.

“Absolutely, it’s a problem, there are no guarantees on who will control the data and how well they control it,” says James Ryan, founder and principal of cyber security firm Litmus Logic. “The more advanced cyber attacks become, the more assurances firms should demand from their suppliers to verify that software and cloud systems are resilient to hacks, and that suppliers manage data and infrastructure with prudence and transparency,” Ryan said. Litmus Logic performs independent assurance services for software and services that have passed the most stringent tests, i.e. those of the Department of Defense and its suppliers.

While burgeoning technologies like VS provide us with more information than we’ve ever had, there’s still a lot to learn. Caveat Emptor: To the extent that we are poor consumers of technology, there will be unintended consequences.