Spy games

Central London has at least 500,000 CCTV cameras and on a typical day an individual can expect to have their image captured 300 times. But what if those cameras remembered exactly where you'd been that day, or during the past weeks or months? And what if it weren't just the streets that were being watched, but your office too?

Questions of whether such surveillance is an infringement on privacy or simply benign protection aside, the reality is such systems are already emerging. Some vendors are pushing to make corporate physical security systems as pervasive and as easy to operate as Google. 3VR is one of the companies that believes in the benign power of surveillance and specialises in video analytic software that can, among other things, remember individual faces and pull up any video they've appeared in. "This will be of interest to anyone who wants to stop bad things from happening," says Tim Ross, the company's co-founder.

While critics say the spread of this kind of technology could be part of a Big Brother nightmare, Ross says it will actually be better for individual privacy in the long run. He argues that if the authorities can pinpoint exactly the video they need, they'll end up spending less time watching the rest of what goes on. "The trend towards more camera coverage is somewhat inevitable — in a post 9/11 world, there's too much need or demand for that," says Ross. "We think search is the key to privacy, not something that infringes."

Booming market
Corporate interest in physical security systems goes back, inevitably, to the terrorist attacks of 11 September, 2001. "9/11 increased the emphasis on all forms of risk management related to the potential for hostile human activity — both cyberdefence and physical defence," says Jay Heiser, research vice-president with analyst group Gartner.

As well as paying more attention to things like off-site backup systems, companies have started investing in ways of better locking down who can do what on their premises. The two main ways of doing this are video surveillance and access-control systems like key cards, which can be tied into IT authentication systems and feature biometric identification technology.

If 9/11made companies start to think they should be investing in systems like those seen on the TV series 24, five years on a host of start-ups have sprung up to take advantage of that demand. "The turning point was 9/11. It drove a lot of interest in homeland security, a lot of government spending and increased spending from large, Fortune 500 corporations," says 3VR's Ross.

On a basic level, companies have started digitising their video surveillance systems, which today are overwhelmingly analogue. That trend was in evidence when Cisco's acquired digital migration tools maker SyPixx. "Video is a good way to use up network bandwidth, and anything that does that fills Cisco's pockets, so why wouldn't they at least dabble in it?" says Gartner's Heiser.

Cameras that remember you
3VR has been drawing attention in recent months, partly because a successful funding round in January included investment from In-Q-Tel, a CIA-funded private venture firm. 3VR says it is also the first company of its kind to gain momentum in the mainstream business world, with customers including large companies like Morgan Stanley, GlaxoSmithKline, Lehman Bros and several large hotel chains.

3VR's system is designed to cut through the hours of undifferentiated video typically generated by surveillance systems and pick out the most relevant bits. At the heart of is the search engine, which Ross compares to Google, which indexes all the video as it is recorded, extracting all the data it can — including things like particular types of motion and face recognition — and putting it into a searchable database. The data is then used to trigger alerts around defined conditions, so that a feed will be brought to attention on the monitor when certain types of activity are detected. It also makes vast video archives easily searchable, Ross says.

One of the key data types is face recognition. Every time the system encounters what it thinks is a new face, it assigns an ID tag to the face, which it continues...

For more, click here...

...to track. If the same face is viewed from a different angle, or under different lighting conditions, the system can recognise the similarity, even if it doesn't get an exact match. When the operator searches for appearances of a particular individual, the system also displays close matches, which can be easily sorted through by hand.

That might not be as sexy as automatically getting an exact ID of everyone attending a World Cup match, but the difference is that it actually works, says Ross. "Face recognition is not perfect, but in the past, people have tried to employ it as though it were," he says. "We use it like Google, it lists the matches in order of confidence level. If the correct match turns out to be the sixth on the list, that's still a good result."

Hotels are using the system to monitor access to the building, for example displaying a mug shot of any person walking around, which makes it easier for security guards to spot known criminals. Similarly, banks are using it to help identify fraudsters against a watch list. In offices, the system can keep an eye on employees, which could come in handy when something goes wrong, Ross says.

"If you find out somebody is stealing data from the server room, you don't just want a picture of the guy who took the box, you want to be able to look back at who he's been talking to, and find out who his confederates were," he says.

Video systems can prove useful in criminal and corporate investigations, as was shown after the 7 July attacks in London, points out Heiser. But so far the lack of workable analytic technology has held them back. "Knowledge is just data until it's searchable and retrievable," he says. "Whether or not this technology actually works, it's the sort of thing you need to be able to do for surveillance to reach its full potential."

Other start-ups are adding further cleverness into the system. Vidient Systems, for instance, uses technology originally developed by NEC for use in broadcast video to recognise particular behaviours, such as multiple vehicles piggy-backing through a check point. "When you integrate video with your access card reader system or biometric signature, and fuse that identity with behaviour, you end up with a richer sense of what's going on," says Vidient president and chief executive Brooks McChesney.

Imprivata's OneSign adds another layer of information from a company's physical authentication system. This can be tied to network access, helping companies to enforce their badging-in policies, for instance, or locking former employees out of the network as soon as their key-card privileges are revoked. It also lets companies track exactly who accessed what or used which applications, when and from where, which can be important for auditing purposes as well as investigations, Imprivata says.

Goodbye privacy?
If all this sounds like a security guard's wet dream, there are critics who say it is likely to do more harm than good. As a tool for stopping crime, surveillance cameras are overrated, says security expert Bruce Schneier. "I think 9/11 has scared people, and they think that cameras will somehow magically save them. Cameras are cheaper than policemen, so it's perceived to be security on the cheap," he says. In fact, however, all they do is move crime around, Schneier says, citing research from Privacy International.

Face recognition might be useful for tracking members of the general public, but criminals can easily outwit it, Schneier says. "It'll be a whole bunch of years before the software (for automatic face recognition) gets that good, and even more before it recognises people who don't want to be recognised," he says.

In the meantime, a culture of universal surveillance is creating serious psychological side-effects, Schneier argues. The corporate interest in surveillance adds a new dimension to the problem, since the private sector has more of a free hand than government where it comes to collecting data.

"Companies can collect data that it is illegal for the government to collect, and then the government can use it," Schneier says. "Data has value. The rise in private sector surveillance mirrors the rise in data buying and selling. Companies will continue to eavesdrop on us because it is profitable to do so."