How a University Created Its Surveillance Policy

Some are bad, some are good, some are nonexistent, but what considerations go into crafting a surveillance policy? We talked to University Police Chief Peter Carey about how they developed their surveillance policy and why they made the decisions they did.

First Step: The Legal Department

Buffalo State College is part of the State University of New York system which is comprised of 28 different campuses. The SUNY legal department sent out a memo and a model policy for campuses to use as a framework to build their individual surveillance policies.

Carey says using that template, which included things like places where people have an expectation of privacy, and examining policies from other universities, they built Buffalo College’s.

“Some of the policies we looked at were light. Some were confusing and were missing things that should be included,” he said.

Rounding Up the Stakeholders

The next step was to find out what things should be addressed in the policy. Representatives from different groups, including police, maintenance, and university faculty, around campus were assembled to give input.

“The biggest thing was being inclusive and including anyone who would be using the system or maintaining the system,” he said. “When you create policies like this they shouldn’t be overly long, shouldn’t be overly complicated and you should include the people the policy is talking about in the process.”

The Policy

Buffalo College’s one-page policy [link no longer available] says the school can put cameras anywhere on campus “necessary and appropriate,” but "takes pains to balance that privacy against safety needs on campus.” To that end, the policy prohibits use of the cameras to monitor or track behaviors or monitor individual students or staff.

It also prohibits dummy cameras on campus, cameras in private areas (“bathrooms, shower areas, locker and changing rooms, areas where a reasonable person might change clothing, or private offices”), using cameras for parking enforcement or minor violations, or using cameras to look at information on computer screens. This is because at a university, sensitive information or confidential data is sometimes on screens: student ID numbers, Social Security Numbers and home addresses. 

The policy requires signage to indicate recording is in progress and images be kept for a minimum of 30 days. All of the residence halls have cameras on the first floor lobbies, entrances and exits and in the elevators.

Not Big Brother

The college doesn’t use the cameras for cracking down on minor violations or parking enforcement because it does not want to give the community the impression that Big Brother is watching, Carey said.

“Another reason we have them is deterrence and to hopefully make people feel safer. When we do see a violation we do handle it. Or when we get calls that something has taken place in a location our dispatcher will look at that location and relay information to the responding officer. So we do use it for some minor incidents, but that’s not the main purpose,” he said.

Carey says it would not be cost effective to have people monitoring 24/7 and trying to enforce parking regulations. The college does not have as many exterior cameras as it would like, but most are in the courtyards and walkways. There are none in the parking lots, however, they plan to add more exterior cameras in the future.

Retention Debate

Carey said most of the stakeholder debate centered around retention time. Images are stored both on DVRs and campus servers.

They agreed that the minimum storage time would be 30 days, but records that documented any incidents would be stored for a minimum of three years to correspond with the statue of limitations for personal injury litigation and criminal prosecution for misdemeanors.

“If we don’t know about something within 30 days, it’s probably not going to trigger a need for use to look at video,” he said. When creating that part of the policy, Carey says they also took into consideration how long cell phone providers and universities keep data. They found that a year was average.

Operation, Training and Maintenance

There is no one person dedicated to watching the cameras but all of the police in the department are trained on operating the system, exporting video and basic maintenance. A limited number of people have access to the DVRs and all access to the system is tracked on paper and electronically.

The college takes care of routine maintenance - mostly the IT department and the deputy chief - but will contact local integrators for replacing and installing new cameras.

The college is currently looking to hire a person with access control and surveillance experience to bring those tasks in-house.