Handbook of Operating Procedures 8-1120
Video and CCTV Security Systems
I. Policy Statement
It is the policy of The University of Texas at Austin ("University") to manage the use of video recording and closed circuit television ("CCTV") security systems so that safety and security is enhanced while respecting the privacy rights of the University community and the public and maintaining compliance with all applicable laws and policies.
II. Reason for Policy
To define campus goals for the use of video and CCTV security systems and outline the responsibilities and procedures when deploying technology.
III. Scope & Audience
- This policy applies to all employees and students with respect to the installation and use of video security and CCTV cameras, except as noted below, in facilities owned or controlled by the University.
- All references to video security and CCTV systems throughout this policy are for those systems which were designed and installed with the intent and ability to record video and/or to be monitored for purposes of enhancing campus safety and physical facility security.
- This policy governs all new departmental video/CCTV monitoring systems with planned installation following the policy's effective date. Existing installations and written procedures for the use of those existing video monitoring and recording systems shall be brought into compliance with this policy by August 31, 2012.
This policy does not apply to:
- Use of video recording and CCTV technology covered by University policies governing research with human subjects or animals.
- Use of video recording and CCTV technology for video conferencing.
- Use of class lecture recordings and/or archiving for the purpose of content sharing.
- Use of mobile video/audio recording systems used by the University Police Department ("UTPD"). The UTPD must comply with existing Police Department Operations policy for use of these systems.
Use of cameras in the UTPD Temporary Detention and Interview Rooms.
IV. Definitions (specific to this policy)
This is the Information Technology (IT) Architecture and Infrastructure Committee. The AIC oversees data and voice networks, data storage, administrative computing infrastructure, applications, and security issues. The University's shared IT architecture and infrastructure is governed by representatives on this committee assembled from across campus in order to share the responsibility and accountability for the seamless delivery of IT services to campus.
- Camera Control Operator:
The person(s) designated by a department who is responsible for a department's Video Security and CCTV systems, including recording, review and recovery of recordings, and related duties.
Closed-Circuit television is the use of video cameras to transmit a signal to a specific place, on a limited set of monitors. CCTV systems may operate continuously or only as required to monitor a particular event. CCTV video used for security purposes pursuant to this policy must always be restricted to a secure private network or Virtual Private Network (VPN) which may only be accessed by authorized persons.
- Forensic video retrieval/review:
Security video retrieval involving UTPD and departments utilizing UTPD chain of custody procedures to protect the forensic integrity of video.
- IP Cameras:
Internet protocol (IP) cameras which use the protocol used most by Local Area Networks (LANs) to transmit video across data networks in digital form. IP video used for security purposes pursuant to this policy must always be restricted to a secure private network or VPN which may only be accessed by authorized persons.
- Position of Special Trust:
A designation provided to certain positions at the University that entitles the designated employee elevated information systems privileges and access to Category I University data.
- Preliminary Video Screening:
Department level preliminary review of security video by authorized staff in compliance with departmental procedures in order to isolate relevant parts of video in preparation for forensic video retrieval.
- Responsible System Manager:
The individual who is responsible for the management of a University video recording and/or CCTV system governed by this policy.
- Video Monitoring:
Real time monitoring of security video of an event that is in progress to enhance the safety and security of the event.
- Video Security System:
Video recording systems installed for the purpose of prevention against assault, damage, theft, unlawful entry, and other such occurrences caused by deliberate actions.
- Video Surveillance:
Ongoing close observation and collection of data or evidence for a specified purpose or confined to a narrow sector. This can include real time video monitoring or automated recording.
- Video Security and CCTV Exception and Review Committee:
A committee comprised of staff from departments that participated in the drafting of this policy who may be called upon for periodic review of the policy with regard to operational implementation and technical specification advisement to the Campus Safety and Security Committee ("CSSC") and/or Strategic IT Accountability Board ("SITAB").
V. Website (for policy)
|IT Security Operations||Phone:512-471-6878||Email:Video_security_help@utlists.utexas.edu|
|University of Texas Police Department - Crime Prevention Unit||Phone:512-471-4441||Email:firstname.lastname@example.org|
VII. Responsibilities & Procedures
When deploying CCTV and/or video security systems on campus, the Responsible System Manager and all individuals granted access to those systems are required to abide by the responsibilities and procedures set forth in this policy.
- Purpose for Use of Monitoring Systems
The purpose of video and CCTV monitoring governed by this policy is for enhanced safety and security. Any interception, duplication, transmission, or other diversion of video and CCTV technologies for purposes other than the safety and security contemplated by this policy is prohibited.
Safety and security purposes include, but are not limited to:
- protection of individuals, including students, faculty, staff, and visitors.
- protection of University owned and/or operated property and buildings, including building perimeters, entrances and exits, lobbies and corridors, receiving docks, special storage areas, laboratories, and cashier locations.
- monitoring of common areas and areas accessible to the public, including transit stops, parking lots, public streets, and pedestrian walks.
- investigation of criminal activity.
- protection against an act of terrorism or related criminal activity.
- protection of Critical Infrastructure as defined under the Texas Homeland Security Act, the USA Patriot Act, or the United States Department of Homeland Security.
- Monitoring System Protocol
- Video and CCTV monitoring and recording are required to be conducted in accordance with all existing University policies, including the Non-Discrimination Policy, the Sexual Harassment Policy, and other relevant policies. Monitoring based solely on the characteristics and classifications contained in the Non-Discrimination Policy (e.g., race, gender, sexual orientation, national origin, disability, etc.) is prohibited.
- Monitoring or recording of audio is strictly prohibited. The interception of oral communications without court authority is a violation of United States Code, Title 18, Section 2511 ("Interception and Disclosure of Wire, Oral, or Electronic Communications Prohibited").
Monitoring shall be limited to uses that do not violate a reasonable expectation to privacy.
- Cameras may be monitored in real time, but cameras may also be unmonitored while recording.
Violations of the responsibilities and procedures set forth under Section VII of this policy may result in disciplinary action consistent with the rules and regulations governing employees of the University.
- Monitoring System Usage Requirements
- Signage for video and CCTV locations is required at main entrances to areas with video security, such as building entrances and elevator landing areas. The signage language should say: "This Area Subject To Video Surveillance".
- All new departmental video/CCTV monitoring systems governed by this policy with planned installation following the effective date of this policy shall comply with this policy including technical specifications for both IP and CCTV cameras.
All existing uses of video monitoring and recording shall be brought into compliance with this policy as specified in Section III.C of this policy.
- The Campus Safety and Security Committee is authorized to oversee the use of CCTV monitoring for safety and security purposes at the University.
- Temporary installation of video/CCTV monitoring systems:
The Chief of Police, in consultation with an Institutional Representative (as defined by The University of Texas System Rules and Regulations of the Board of Regents, Rule 80101, Section 3.3.1, 3.3.2, and 3.3.3), has the responsibility to authorize any temporary installation as deemed necessary in connection with a criminal investigation, for enhanced security for special events or as otherwise deemed necessary to enhance safety and security at the University.
Departments may continue to deploy temporary cameras to investigate operational and administrative issues pursuant to the existing operating policy for Conducting Administrative Investigations Involving University Employees and Information Resources. Temporary cameras must be removed once investigations are concluded. (https://security.utexas.edu/specialtrust/).
- Departments must provide stored video upon request by UTPD as needed in connection with any ongoing criminal investigation, unless prohibited by law, including but not limited to the Health Insurance Portability and Accountability Act ("HIPAA") and the Family Educational Rights and Privacy Act ("FERPA"). UTPD will continue to have access to stored video per currently established procedures.
- Departments are required to maintain their video security systems in compliance with this policy.
- The Information Security Office ("ISO") may audit any department's video/CCTV surveillance operations for policy compliance, including recording storage and retention.
- Departments are required to retain records of all new video security components location, costs, camera descriptions, camera capabilities, make and model number in order to provide those to the Office of the Vice President and Chief Financial Officer in response to open records requests. Departments must make the best effort to assemble this information for all existing video security currently deployed.
- If a camera is proposed or is installed in a research space, an authorized representative from the Office of Sponsored Projects ("OSP") must approve the location and ensure a "Technology Control Plan" has been established, if applicable. Installation of video and CCTV equipment is prohibited in restricted areas where Department of Defense classified information is discussed, stored or otherwise processed without the approval from the Vice President of Research, or his/her designee, and in consultation with the Office of the Vice President for Legal Affairs.
- All operators and supervisors involved in video surveillance are required to perform their duties in accordance with this policy.
- All departments responsible for a video/CCTV monitoring system governed by this policy shall develop and maintain written policies and processes in place to prevent camera operators tampering with, intercepting or duplicating recorded information. Written departmental policies shall be no less stringent than this policy. To maintain the integrity of the process, Camera Control Operators who retrieve video must do so in the presence of at least one other employee according to established procedures. A UTPD officer can also serve as the second person present when video is retrieved. Individuals authorized to oversee video security viewing must be listed in the department's written video recording policy.
- Personnel involved in monitoring and recording must be trained and supervised by their department in the responsible use of the technology and the requirements of this policy.
All Camera Control Operators:
- must be trained by their departments in the technical, legal, and ethical parameters of appropriate camera use. Training shall cover the proper operation and maintenance of department's equipment and infrastructure.
- must acknowledge they are in a Position of Special Trust per the University's Information Resources Use and Security Policy (https://security.utexas.edu/specialtrust/).
- must not monitor individuals based on characteristics of race, gender, ethnicity, sexual orientation, disability, or other classifications protected by the University's Non-Discrimination Policy.
- must not view places where people have a right to privacy, including but not limited to bathrooms, dressing rooms, locker rooms, private rooms or areas through windows.
- Installation of cameras with audio recording capability is prohibited.
- A Video Security and CCTV Exception and Review Committee is required to review the policy, implementation guidelines, and equipment specifications as necessary to comply with the policy and must make recommendations for changes to the appropriate governance group.
- All devices on the departmental list required in Section VII, C.9 above that are connected to the campus network must adhere to the Minimum Security Standards for Systems. (http://security.utexas.edu/policies/standards_systems.html).
- No video security or CCTV system may be accessible from the public internet.
- All video and CCTV systems and locations are required to be registered using the Information Technology Services ("ITS") Video and CCTV System Registration Tool and that information must be reviewed and updated by the system's owner to ITS at least semiannually, on June 1st and December 1st.
- All systems are subject to random audits for compliance with security and retention policies.
- Video and DVR devices are required to be included with all life safety and/or property protection systems and may only be used for crime solving. Exceptions may be requested from UTPD.
- A department deploying video or CCTV security systems must obtain the services of a qualified ISP/OSP cable crew from ITS to ensure cabling installations of life safety systems conform to University standards found at https://www.utexas.edu/its/cabling/ Alternatively, the department may employ contractors specifically trained and certified in video security and CCTV systems installation. These contractors must adhere to these same University standards.
- Records Retention
- Recordings must be retained for a period not to exceed 31 days, or for periods not to exceed 60 days for certain lab areas as stipulated by Environmental Health and Safety authorized staff. After those time periods, recordings are required to be erased, or recorded over, unless retained as part of a criminal investigation or court proceeding (either civil or criminal) or other authorized use as approved by the Office of the Vice President for Legal Affairs.
- Recordings must be retained in a secure location with access by authorized personnel only.
Departments must provide, and ITS must store, information (for open records requests) of deployed video security and CCTV on campus consisting of:
- Department ownership
- Authorized contacts for the system
- Purpose of cameras
- Video retention periods
- Requests for Information Obtained from Monitoring Systems
- Information relating to ongoing criminal investigations and anti-terrorism must only be released when approved by the Chief of Police of UTPD, in consultation with the Office of the Vice President for Legal Affairs.
- Open Records Requests for recorded video must be forwarded to the Office of the Vice President and Chief Financial Officer.
- Lawful requests (e.g., subpoenas, search warrants) for recorded video must be forwarded to the Office of the Vice President for Legal Affairs.
- The Office of the Vice President for Legal Affairs is responsible for reviewing and responding to all subpoenas from law enforcement to release recordings obtained through Video and CCTV monitoring.
VIII. Form & Tools
ITS Video and CCTV System Registration Form (requires authorized access via UT Austin WIKI)
(approved by AIC, 12/1/10)
Issue date: December 12, 2011
Next scheduled review date: December 12, 2013