The security week that was: 02/26/10

Video system alerts

Today, the AP reported that cameras at Newark Liberty International Airport will now have alarms tied in to let security personnel know when the cameras aren't working.

This alarming of the cameras follows the incident in January where a man went through a security exit for Terminal C the wrong way, prompting the grounding of planes and the rescreening of passengers. The issue at the time was that only when investigating that incident did security personnel realize that the cameras weren't recording and that the TSA officer in charge of manning that exit lane was off post at the time. The TSA ended up relying on cameras not managed by them or the port authority (thank goodness that other units inside the airport had invested in video surveillance ) and the incident was later found to be a simple case of a guy wanting to say goodbye to his girlfriend, and not a case of someone with terroristic or drug smuggling intentions.

So now Newark has made the smart move to identify when cameras aren't recording. To people outside of our industry, this sounds like a no-brainer. They must be asking, how on earth would an organization as security centric as the TSA not know when their security systems aren't working? As we know inside the industry, it's more often the case that security users don't know that cameras have failed than that they do know when cameras have failed. To be fair, if you're an integrator who has sold and installed camera surveillance systems, I'd bet that a number of your customers are experiencing failures (or simple non-recording) of their surveillance systems right now. And you don't know, and worse, they don't know they have a problem.

Of course, technology has changed a lot in the last years, and any equipment that's been a reasonably recent purchase probably has some sort of support for sending alerts upon failure. Ok, maybe not that off-brand DVR installed at the convenience store, but at least the nicer equipment has some function to alert an end-user. For example, if you take a Bosch Divar XF "hybrid" video recorder, the unit prompts an on-monitor alarm to indicate video loss. Some more high-end machines (and I do hope that the airports are using some of the nicest equipment) and video management systems can send an email or sometimes even a text message when they lose video. At the very least, part of the daily security personnel or security technology manager’s duties should be to ensure equipment is operating and to get someone on task if it's not.

As we know, security is designed to concentric. At the first layer of an exit lane, you have signage that alerts people not to enter. This is basic security by trying to encourage the public to do the right thing. At the second layer of the onion, you have a TSA officer (sometimes two) in charge of monitoring exiting passengers to ensure that no one is violating the rule that you can't go in through the "out" door. At a third layer, you have video surveillance as a set of back-up eyes to the TSA officer on post. As a fourth layer, we've even heard of video analytics being used to trigger alarms if someone does try to go the wrong way through an exit lane into the secure side of an airport (admittedly, this is not very common, though I suspect we will see more of this as the technology matures and becomes more and more accurate and proven). But just because you have a concentric approach doesn't mean you can forget to check that those rings are in place and assume that the next most "inward" ring is going to do its job. That would be like having a fence around a building with a hole cut in it, and not worrying about that hole because you have an alarm system on the building at night anyway.

So, in conclusion, it's great to hear that Newark has added an extra layer of concentric security by setting alarms for when camera video feeds go down. Let's hope their move becomes a standard installation procedure for any high-security installations. Otherwise, we'll never know whether that black box with the hard drive and the camera inputs is an overpriced paperweight or an asset to security.

It seems like there are some obvious security tips to be learned from this Newark incident:

  • Make sure officers don't go off post.
  • Don't trust your video surveillance system 100%.
  • Remember that even if video surveillance is working, it can't reach out and grab a guy who is going the wrong way.
  • Make sure video loss alerts are set up on your video recorders.
  • Make sure you have alerts in place to signal failure to record.
  • If you're in a high-security scenario, make sure to do daily checks of your equipment.
  • Compare the cost of a breach to the cost of replacing old, bad technology.

So, what else happened in the last week? As it turns out, quite a bit. Here's what was on our radars from this week:

First body scanners planned for U.S. airports to be installed in Boston. The story here is that these machines have been used in test instances, especially in Europe, but our squeamish, protestant culture in the U.S. was too afraid of our private parts showing up in grainy images to the numbed head of a security staffer who's looking for weapons, not for giggles. I'm glad this technology is in use, and I had no problem being scanned when flying in Europe a year ago.

Teacher tackles gunman suspected in school shooting. My take on this is that doctors and teachers usually rate as two of the highest respected professions. Sometimes teachers go crazy and become school shooters themselves, but other times they are the heros and take down a gunman unarmed, like this story out of Littleton, Colo. I suppose there's a reason teachers still get high ranks in terms of most-respected professions.

Memo: Coast Guard nominee wants to cut funding for counterterrorism programs. Obama has nominated Vice Admiral Robert J. Papp Jr. to head up the Coast Guard, and the word today is that Papp has proposed cuts to counter-terrorism funding in the Coast Guard. Before you think the Coast Guard could care less about terrorism (they are part of DHS), realize that this may be more about shifting counter-terror responsibilities to the most effect organization. After all, it can present a problem if you have an agency with two divergent responsibilities. In the Coast Guard's case, that would mean search-and-rescue and counter-terror. It makes sense, though I'm not fully convinced, and probably won't be until I better understand what DHS unit is going to pick up the slack on coastal counter-terror.