Using It in an Investigation

Retrospective review after an incident is the application with the clearest value and the fewest objections. It also has specific pitfalls.

Preserve first

Before automatic retention deletes it, which is a real risk with short periods.

Widely, then narrow. Export the relevant cameras for a generous window; reconstructing later is impossible.

Include adjacent cameras, which frequently show what the obvious one does not.

Include the detection records and the system logs, not just the video.

Record what was preserved, by whom, when, which is the beginning of the evidential trail.

Scope the access

The investigation opens access that is normally restricted. That is the point and it is also the risk.

Define the period and the cameras, enforced technically rather than by instruction.

Authorise it, by someone named.

Log the retrieval and review the log afterwards.

Revoke at the end, verified. Investigation access retained afterwards is the most common route by which a narrow permission becomes standing.

Do not browse. Looking at unrelated periods because access is open is the misuse this whole arrangement exists to prevent.

Reading the footage carefully

A detection is not a fact. It is a classification with a confidence and a threshold behind it.

State the threshold and the measured error rate when a detection is used as evidence of anything.

Timestamps need checking against other systems; clock drift between a recorder and an access control system produces confident and wrong sequences.

Frame rate matters. A gap between frames is not evidence that nothing happened in it.

Field of view matters. What is outside the frame is unknown, not absent.

The trap

The footage shows an action immediately preceding the harm.

Stopping there produces a finding of human error, which is not a cause and prevents nothing.

Keep asking: why was that action reasonable at the time, what made the safe method slower, what else was happening, how often does this happen without harm.

The useful findings are conditions — layout, pace, lighting, equipment, procedure — and an investigation that ends at the individual has ended early.

Ask the people involved. The footage shows what; only they can say why, and their account frequently explains something the video makes look inexplicable.

Sharing it

Footage of an incident contains other people, who are not the subject and have their own rights.

Redact or blur those who are incidental.

Share the minimum: the relevant clip, not the day.

Log every share.

Be careful with internal circulation. A clip shown in a meeting is a clip that will be forwarded, and the people in it did not agree to that.

Afterwards

Delete the working copies and retain the investigation record.

Feed the finding back: if the system missed the event, that is an evaluation finding; if it detected it and nobody acted, that is an alerting finding.

Check whether the conditions exist elsewhere, which is where the preventive value is and which is the step most often skipped.

The clock check

A step that prevents confidently wrong sequences and takes minutes.

Compare the recorder clock against the access control system, the machine log and a reference.

Drift of minutes between systems is common and produces narratives that are plausible and false.

Record the offsets at the time of preservation.

Correct in the analysis rather than the source, and state the correction.

Do this before building any timeline, because an incident report built on unsynchronised clocks is worse than none.

Sharing footage of an incident

The clip contains people who are not the subject and did not agree to be in it.

Redact or blur those who are incidental.

Share the minimum: the relevant clip, not the day.

Log every share.

Be careful with internal circulation. A clip shown in a meeting will be forwarded.

Delete the working copies afterwards, retaining the investigation record rather than the video.

This is the point at which a well-governed system most often leaks, because the urgency of an incident overrides the habits.