Leadership

Video surveillance: Four ways to protect privacy and achieve business outcomes

Video surveillance is easy to deploy. An increasing number of employers are exploring implementation of inexpensive video systems to protect employees and the business. Before writing the check, however, there are several regulatory and employee relation safeguards to consider.

Video surveillance in the workplace is easy to deploy and often not covered by specific local, state, or federal laws. An increasing number of employers, including many of their security managers, are looking at implementation of inexpensive video systems to ostensibly protect employees from parking lot confrontations and the business from insider theft. Before writing the check, however, there are several regulatory and employee relation safeguards to consider.

Common justifications for video surveillance

Video surveillance is often a good way to protect employees, customers, and patients. For example, businesses have always looked for ways to protect employees as they enter or exit the workplace. Use of monitored cameras is a good way to ensure employees are not bothered by outsiders or other employees. This is almost an expected safeguard if employees work shifts, causing them to traverse parking areas after dark.

Another reason given for video surveillance is prevention of office asset theft, including cash, computers, copiers, intellectual property, national defense materials, etc. In health care facilities, stolen items can also include drugs intended for residents or patients.

A third justification is monitoring patients in long term care or Alzheimer’s facilities to make sure they are safe.

Of course, there are other reasons sometimes given. One is ensuring employees actually work while at the office. However, I’ll focus on the three reasons given above. My personal opinion about employee productivity video monitoring is that it is taking the place of good management controls. Managers should manage. They should set expectations and ensure appropriate outcomes. If outcomes are consistently missed, video surveillance should not be necessary to terminate employment.

Although whether to implement video surveillance is often a subjective decision, based on unique conditions at a specific location, the following are four general guidelines which might help:

  1. Identify specific business outcomes
  2. Objectively document how video surveillance helps achieve the outcomes
  3. Discuss with legal counsel and HR if the loss of employee or patient privacy exceeds the business benefits gained
  4. Attempt to identify alternatives with less risk

Risk, as listed in item 4 above, arises from several sources when video surveillance technology is implemented.

Sources of risk and recommended safeguards

Although regulatory and union-related risk varies from location to location, four sources of elevated business risk must be addressed.

  1. Employee and customer relations issues. Most managers today agree that our employees are our most valuable asset. Turnover due to job dissatisfaction has a direct negative impact on the bottom line and affect our ability to deliver products and services. If employees believe video cameras are used to “spy” on them, overall job satisfaction levels will most likely fall. Additionally, notify employees at time of employment that the company may monitor certain areas in the facility. Similar issues arise when patients or their families are recorded in long term care facilities or hospitals. Ensure clearly visible notices of surveillance with cameras placed in plain view.
  2. Regulatory concerns. In the U.S., the Health Insurance Portability and Accountability Act (HIPAA) contains very clear standards governing patient privacy. Placement of cameras and how collected data is stored and accessed should be governed by what is considered reasonable and appropriate in the HIPAA and other similar privacy laws. Further, the U.S. courts have made it clear that it’s reasonable for employees to expect privacy in areas such as locker rooms, rest rooms, and lounges. Avoid placing cameras or other surveillance technology in these areas. Another regulatory issue arises if audio is included with video. Make sure audio recording solutions don’t violate federal, state, or local wiretap laws.
  3. Retention and e-discovery. A general e-discovery principle is that if it exists, it’s potentially discoverable. Output from cameras stored on tape, disk, or other media is subject to discovery during litigation. Develop and enforce strict retention policies controlling how long video files are kept and in what format. IT and Legal personnel should also consider how these videos would be searched pursuant to a discovery order.
  4. Restricted access. Classify video files as confidential, accessible under strict need-to-know guidelines. In most cases, only investigators or legal counsel need to view them. Similarly, real-time monitoring of cameras should be limited to a select and carefully vetted team. Finally, consider isolating camera networks—physically or logically--from the business network and from the Internet.

The final word

Video surveillance is a great business tool when used intelligently to meet specific business challenges. Understanding these challenges and why video is the best solution is only the first step. Employees, customers, and patients must also understand the reason for surveillance and be provided notice of monitoring activities. Don’t avoid video surveillance if it’s the best solution for a security or safety issue. Just do it right.

About

Tom is a security researcher for the InfoSec Institute and an IT professional with over 30 years of experience. He has written three books, Just Enough Security, Microsoft Virtualization, and Enterprise Security: A Practitioner's Guide (to be publish...

9 comments
Photogenic Memory
Photogenic Memory

I worked for the post office years ago. They played games by putting a penny, nickel, or dime on the floor in a busy hallway and put cameras on them. Theft was common especially during the holidays. The protocol was to call a manager to remove it. Funny stuff! I guess it's used to evaluate honest employees? Okay, whatever. It's too bad there aren't better methods. I now work for someone else. A much smaller organization. Management does the same thing but small conversations even at the end of your shift are evaluated. Quiet weird and annoying. Protecting a business is one thing but it's kinda of moral killer. Ya get me? Anyone ever have similar experiences? I know there's a reason and serious situations for this type strictness but sometimes technology enables the paranoid into overdrive. It makes for a sore experience.

Geno'sAtTheDoor
Geno'sAtTheDoor

Timely article as I'm seeing more and more of this in businesses including the company I work for. I read all the posts and some great points are being made but I can think of one more. There is a safety issue here as well that wasn't pointed out. Nowadays there is also the potential some employee might get really pissed off if they find out they are being spied on. If they get fired because of something seen on surveillance or of being overheard complaining about some manager, somebody might get their head blown off. I particularily liked the post on CEO's opinons on employees worth. I work for a large company and I recall a few yrs. back, while we were going through so downsizing, all employees received an email notice that basically said only 1% of positions (people) are considered irreplaceable or safe. That note did wonders for moral. And get this...the main reason the downsizing was necessary was mainly because the then CEO. I still wonder how he managed to get to that position,he was the worst I had ever seen. He was allowed to retire though, and with a multi million dollar golden parachute.

joshuaviktor
joshuaviktor

I did video surveillance for some time, and have designed, built, installed, and certified many systems for casinos, military bases, businesses, you name it. There are far more items to consider than the ones listed above. (Don't get me wrong, it's a short article, lots of things HAD to be left out.) One of the most important is regulatory. There was a law considered in California not long ago that if a business was using video surveillance, they would be required to keep the video for a year. Do you know how much hard drive space that takes? Depending on the resolution, it could be terabytes, many terabytes. Also, if you have video, your liability rises. "How could you not be aware of the spill in the hallway? There's a camera pointing right at it!" And remember, Video is a deterrent, and an evidence collection system. Unless you start getting into video analytics, it is not a detection system, or a system to tripwire other resources with. And video analytics is not cheap. Like I said, there are a lot of points to consider. IF you want to do video surveillance, great, as it is a wonderful tool. Plan it right, with an expert, and do it right, with a project plan, solid business budgets, deliverables, schedules, and expectations. Good luck. Joshua joshua@datadevastation.com

pgit
pgit

While you say most managers consider employees 'the greatest asset,' most CEOs and other high officials view employees entirely as a liability. If you can replace them with Chinese slaves or machinery, they will do so at the drop of a hat. And they despise the fact one cent has to be "wasted" paying the peons, grunts and even certain managers. One of the CEOs I used to work with had penned a very famous doctoral thesis while at Cornell University, back in the early 1950s. His point was precisely that from the company's perspective it is est to consider "human resources" as liabilities rather than assets. Furniture doesn't need a day off, a rack of servers doesn't want a vacation. A warehouse doesn't have any feelings to be considered. A copier doesn't sue for sexual harassment or whatever the union flavor of the day...

tdh2112
tdh2112

The caveat that you run into with audio is that, while it is legal for a business owner to listen in on a conversation involving that business, it is not legal to listen in on a private conversation between two people. When reviewing video, you won't know which conversation it is until you listen to it. If you have customers visiting your place of business, some states require you to practically hand each customer a pamphlet notifying them that you are recording audio. Bottom line, before implementing any video system, especially with audio, consult your legal counsel first.

dirtylaundry
dirtylaundry

I left a seasonal office job a few years ago and video surveillance was one of the reasons. As soon as I walked in I noticed the domes in the ceiling and asked a full-timer "When did they install the cameras?" She replied, "What cameras?" This is a business where the employees own stock in so needless to say she was shocked they hadn't been told. They were situated every few rows and privacy of any kind was gone (the cubicles were low-walled so not much privacy was there to begin with). I stayed the season and never returned due to the micro-managing that went on in addition to the new video system. This was a small holiday card company with many loyal and invested employees - it didn't nurture a feeling of trust and security, it felt more like Big Brother watching.

fatman65535
fatman65535

I will take your point one step further. Many CEO's look at the wages and benefits paid out to employees as deductions from the CEO's year end bonus check. And then they complain about employee morale. Lusers.

clendanielc
clendanielc

Yes, too bad that these CEO's are walking away with $250,000+ as bonuses a year. I have mixed feelings on video surveillance. I do believe that yes safety and security is a huge thing. That is fine if the cameras are pointed at entry points and exit points. When cameras are above employees desks I find that a little disturbing. To me that right there is close to crossing many lines. Like the article said weighing the benefits with the actual outcome is a big thing. I have seen many people quit because they felt like they were in prison with small businesses that had many cameras. As well as where they were positioned. I know things have changed after certain events in the past 8 years. As the article pointed out benefits and actual outcome ~ all depends on the CEO's point of view of benefits and outcome.

bmtsa2003
bmtsa2003

The notion that CEO?s are monitoring their employees for reasons of greed is plainly silly. Besides that there are other businesses in the world beside big corporations. How would any of you like to own a small business (like 20 employees) and loose 10 to 15% of your gross income, not net profit, to theft? There are types of businesses that are all cash and it is impossible to safeguard the business without cameras etc... I have installed cameras years against heavy objections of some employees. Some of them got caught and lost their job. Now, nobody is even remembering that we have cameras, they are just part of the job. I would have objected as an emploee to cameras as well, but now I got to see the other side of the coin.

Editor's Picks