Who Can Look

The question after any misuse is who had access and why. It is answerable only if it was designed for.

Roles, not people

Live view: watching current footage.

Retrospective search: reviewing recorded material.

Export: producing a copy that leaves the system.

Configuration: cameras, zones, thresholds, exclusions.

Administration: managing users and permissions.

These are different capabilities and they are routinely bundled into one login. Separating them is the single most effective control available here.

Least privilege in practice

Most operators need alerts and live view of their own area, not retrospective search of the whole site.

Retrospective search across all cameras is a powerful capability and should be held by few.

Export should require a reason recorded at the time.

Configuration should be separate from operation, because a threshold change alters what the system does and should not be available to everyone watching it.

Review the assignments quarterly, and expect to find people who changed role and kept access.

Logging

Every live view session, search, playback and export: who, when, which camera, which period.

With a stated reason for retrospective access, which is a field people fill in badly and which still deters casual browsing.

Immutable enough that the people using the system cannot alter it, which usually means shipping it elsewhere.

Retained for a defined period, and it is personal data about staff, so it has its own basis and retention.

Reviewing the log

The control that makes logging worth doing.

Sample periodically: does each access map to a stated purpose?

Look for patterns: repeated searches on one camera, one time of day, one area.

Look for out-of-hours access.

Look for access without a recorded reason.

Report the review, including a clean result, which is what makes the control visible to the staff it protects.

The misuse that happens

Worth naming, because it is predictable and because naming it in advance makes prevention easier.

Watching individual colleagues.

Checking on a specific person's timekeeping, which is purpose drift with a friendly face.

Searching for someone out of curiosity after an unrelated event.

Sharing clips informally, which is the export problem.

Using safety footage in a disciplinary matter without the purpose limitation being addressed.

Each is prevented by role separation, reason capture and a visible review, none of which is expensive.

The operators' own position

The people watching are also being logged, and they should know that and know why.

It protects them: a demonstrable record that a search did not happen is worth a great deal when an accusation is made.

Say so when the logging is introduced, which converts it from surveillance of operators into a control that works in both directions.

Investigation access

Widen access for a specific investigation, temporarily, with authorisation.

Scoped to the period and cameras concerned, enforced technically rather than by instruction.

Logged and reviewed afterwards.

Revoked at the end, verified rather than assumed. Investigation access retained after the investigation is the most common way a narrow permission becomes a standing one.

The quarterly permission review

Twenty minutes that reliably finds something.

List everyone with each capability: live view, search, export, configuration, administration.

Check each against their current role.

Expect to find people who changed job and kept access, contractors whose engagement ended, and accounts from a project that closed.

Remove rather than deactivate, and record the review.

Report the result, including a clean one, which is what makes the control visible to the people it protects.

Logging protects the operators too

An argument worth making when access logging is introduced.

The people watching are also being recorded, and they should know that and why.

A demonstrable record that a search did not happen is worth a great deal when an accusation is made.

Say this at introduction, which converts the logging from surveillance of operators into a control working in both directions.

Share the review results with them, including clean ones.

Operators who understand the logging protects them cooperate with it; operators who experience it as suspicion do not.