On CCTV Cameras

Actually, I'm a fan of Schneier and I'm agree almost with every his idea. He mastered the art of speaking simply about difficult things in Applied Cryptography (Russian translation to my mind is very good) and The Psychology of Security is one of the most interesting security publication I've ever seen. But I let myself to disagree with this. Before explaining my thoughts I'd like to confess that I work in field of information security and physical security is not where I'm professional, but I think that Shon Harris' physical security domain is enough to have an opinion on this topic, also CCTV is not difficult to understand - that's why I'm writing this post.

To my mind saying that CCTV cameras are ineffective is the same as saying that IDS is dead. Well, I was disagree with this declaration in 2003 and haven't changed my mind now. Every technology in amateur's hands is ineffective and it's not the matter of goodness or badness of technology. But let's go further and look on some quotations.

"Most CCTV footage is never looked at until well after a crime is committed". Yes, that's right, but why in this case nobody challenge the idea of collecting systems logs? Of course it's better when every camera picture is analyzed by operator in real time and in most cases known to me when one wants to use cameras more effectively it's done in that way: operator can remotely operate camera to clarify image of interesting object or subject. I predict your objections about bad comparison camera footage with system logs because by system logs in most cases you can exactly say what had happened and video is not able to provide you with the same rate of assurance because "Lighting is bad and images are grainy, and criminals tend not to stare helpfully at the lens". But this is still better than nothing because: this deter huge per cent of "kids", this still can help in postmortem analysis in case of the same "kids". Stored somewhere CCTV recordings is not a weapon against "professional criminals". It's all about the same costs of threats and costs of countermeasures: professionals can be caught only by professions with comprehensive tools and methods. The same idea with IDS - for example, you can simply evade scanning detection by increasing timeouts.

"The solution isn't for police to watch the cameras". Again this is the matter of costs. Let's assume one policeman can watch 5 cameras operating in 5 different places. It's obvious that one man and 5 cameras cost less than 5 men communicating with each other. If policeman can operate cameras: turn it around, change look-up angle, change focal distance, etc. and perform this professionally, to my mind, the effect will be the same as five different policemen walking around.

"Criminals know this, and can easily adapt by moving their crimes to someplace not watched by a camera" . Let's cameras change their look-up angle randomly or use fish-eye, or both, use remotely operated cameras.

"The funds spent on CCTV cameras would be far better spent on hiring experienced police officers" Nobody says that if we use CCTV we can allow ourselves to hire unexperienced officers. Moreover, the more complicated systems we use, the more professional staff we need. Amateur will not see crime and it doesn't matter whether he or she looks "by eyes" or through camera. We should always educate security personnel because attacking techniques, tools, aims, etc. are changing.

"But the question really isn't whether cameras reduce crime; the question is whether they're worth it." Completely agree! As I said earlier it depends on threat and possible impact. Before choosing countermeasure/control it's always good idea to perform Risk Assessment and be sure that cost of countermeasure is less then possible damage. In one situation just dumb cameras will be enough, in others - advanced remotely controlled cameras is OK, and in case of high probability of professional criminals attack you need to use professionals to withstand i.e. only highly educated police officers can help you.