Locate 'Active Shooter' During Code Red Lockdown

This past week, an integrator posed this scenario to me:

Their customer (a school campus with 'hundreds' of cameras) wanted to know if there was some way for their VMS to display only cameras with motion if they press a button during a Code Red lockdown.

Their theory being, while students and staff are 'locked down' during the emergency situation, they want to be able to automatically locate the active shooter via motion on their cameras.

This reminded me of that old Star Trek episode where someone was loose on the Enterprise and the ships computer isolated all the heartbeats to eliminate the crew and show there was one heartbeat unaccounted for - someone else was on board on a lower deck... :)

My initial response was that I am not aware of any VMS that can do this (all by itself anyway). But after thinking about how the customers proposed solution could be accomplished, I think I've got at least something that could work.

However, I'm interested in hearing how other IPVM members (who have to devise one-off solutions all the time) might propose to do what this customer wants.

Any ideas?

Technically, this would not be hard. VMSes already track and know which cameras have motion (presuming they have motion detection set up server side or are getting the metadata from the camera's side).

It's mostly a UI issue. How do you display the cameras? What happens when a camera not being displayed has motion? How and where do you add it? And the opposite side, what happens when a camera stops have motion?

I could imagine it would have a little pinball effect and get disorienting to see cameras pop in and out continuously.

That said, it could be interesting for a VMS to offer this option and it might be real useful if the motion detection was somewhat accurate and there was not a ton of activity going on in a facility.

The operating theory that the school is floating is that they want a separate capability they can employ only during a Code Red that will show any camera that is motioning. They are assuming (at least how I'm taking it) that during the Code Red, no cameras should have motion - except for the ones the shooter is moving past.

So, the UI should actual help them follow the shooter.... they expect only the cameras he/she is passing to be displayed.

Clearly, active shooter scenes are not the most serene and predictable environments. The schools assumptions that they are basing this wanted solution on are most likely operationally flawed. But lets assume that they can accomplish what they are thinking - that only the cameras the perp is running past will be displayed.

If this was the only thing you had to make the system do - and only during a Code Red - how would you do it?

Geutebruck, who is the primary VMS we deal in as an integrator, has rules that can be activated by the built in I/0 ports. Those rule can be used to activate a preconfigured scene in the client. The scense can contain those cameras currently in alarm mode, which is activated by activity. The scenes are not very easy to setup, but can be done.

I can see them wanting such a feature, but don't most VMS's have views that can show cameras with activity in them?


I was thinking something similar to what you propose in the first paragraph - and I agree it would probably require much preconfiguring in any VMS. :)

For your second paragraph, how can you preconfigure a view (or individual cameras) to only show up when they are motioning - but only during a Code Red situation (designated by pressing a button, presumably by a school administrator)? i.e. you can't rely on simple camera motion to trigger the pop up alert - the solution should only do this when the Code Red button is pressed.

I'm not sure about other VMSes, but with Geutebruck you can tie scenes to an event, and the event can be triggered by something like say the I/O input. So someone hits a button connected to the I/O, or the I/O is tied to some other system that is activated during a CodeRed. That activates the event in the VMS which has scenes tied to it, so those scenes are activated. Those scenes are configured however you need them to be and based on say motion events.

That is similar to the idea I had. In Ocularis ES (and the new LS) we can use rules to do pretty much anything - exactly as you described in your initial reply regarding Geutebruck. But in our 'lower' levels (CS, IS and PS), though we can still tie alerts to camera I/Os - we don't have the same robust rules capabilities as in the higher levels of our platform (which I was pretty sure this customer didn't have).

So, I thought of setting up a series of PIRs in the hallways - but powered off. Once the admin hits the Code Red button, it turns on the PIRs which have been configured in Ocularis to be the event source(s). Since they are normally powered off, the events never fire until the PIRs are turned on by the Code Red button. We would also have to preconfigure a 'Manual Event' for each PIR so we could then tie a close-by camera (or cameras) to pop up on an Alert monitor as the sensor triggers.

Also, after each PIR is set up as an individual Manual Event, we can tie them directly to something we literally call 'Triggers' in Ocularis Client's Live mode. So, not only can an admin push the Code Red button, but based on assigned rights an operator/user could also fire off a Code Red right within Ocularis Client if they wanted to allow that function.

I'm curious how integrators using other VMS's would approach this situation. Like John, I think it could be a cool feature to offer/promote - as long as you could do it and it would actually add value in active shooter situations.

I think you are asking for help from a knowledgeable integrator for approaches that can be implemented in the field, and sorry, I'm of no help there. This is also an exciting thread for "the rest of us" end users, because it points to the sorts of functionality we would like to see but that seem to be lacking in the professional offerings.

The basic functionality requested seems widely relevant to any business during unoccupied periods such as after hours, when the assumption that motion equals trouble would be most relevant.

Although lacking specificity, IPVM's recent vms_mapping_shootout article provided a good high-level feature summary. The report indicated that most VMSs can support map alerts. Camera fields-of-view associated with alerts can be highlighted in most VMS' map views. One would expect that motion alerts traversing a geographic display could support global situational awareness and improve incident responses. However, it's unclear from the high-level overview whether this mapped alert capability can even be limited to display only the video motion detection events and not other alerts which would otherwise detract from a clear unambiguous view of unfolding events.

That same vms_mapping_shootout also briefly addressed suspect tracking options, which seemed quite limited (only two VMSs appeared to have meaningful capability). Would I be out of line to suggest that the sparsity of capability in this area is a reflection of complacency and lack of innovation in the field, considering that suspect tracking seems to be one of the core uses of video surveillance? Similarly, video motion detection is actually getting quite reliable for many indoor and some outdoor applications, so a VMS probably has the information needed to meet your customer's desires. Unfortunately, it's not that accessible or configurable, or I'm sure you would not be considering a PIR work-around, which agains suggests that the developers haven't "got it right" even to support standard industry use cases.

Businesses need tools for active suspect tracking in both bustling and inactive facilities. These may be two different but overlapping sets of tools. Even if the human is likely to be needed in any busy environment, hopefully the inactive case can reasonably be automated.

Given the sparsity of options, this might be a good area for industry growth and differentiation. My sense is, while facility motion mapping can be helpful, the customer also wants automated selection and display of corresponding video views. Since the inactive facility is the most benign and achievable case, automated suspect tracking tools for this environment should be (but aren't?) readily achievable.

To a layman, the field of video surveillance is non-trivial, complex, and confusing, similar in some ways to personal computers of the Apple II and Commodore 64 time frame. Once a business makes a VMS choice, in many ways they are now locked into that vendor technology set. The complexity even puts many integrators into the same category, since it takes time to achieve competence across the complexity of a manufacturer's capabilities. Yet what is needed is a wider view of the field, integrating core capabilities that are bigger than video. IPVM is already expanding into access control. I think by the time IPVM is done, it will look across the holistic fields of video, alarms, and access and perhaps provide valuable insight and ideas across these industries.

There is a decent breadth of capabilities available from a wide range of IP cameras, including motion detection, line crossing, area penetration, "leave behind" object detection, loitering, license plate readers, face detection, etc.

Even achieving an industry standard for digital video transfer and PTZ control has taken time, and many proprietary detectable events have no open standard to communicate such detections.

Similarly there appears to be no standard for integration and control across other related fields such as access control and physical security, yet we can envision ways in which integrated approaches can provide a signifcant payoff. For example, ADT had installed and charged us for monthly monitoring of both video and access control at one of our facilities, yet whenever there's an alarm, why aren't they rousing us out of bed with a description of both the alarm and whatever is seen on the video? It's like these very related fields are in separate divisions and never the twain shall meet. So now I climb out of bed, boot the computer, ... ... ... eventually make a decision based on information which was already accessible within the company to whom I've outsourced those functions. While so far no crime has been in progress, response time would be MOST critical when something IS happening. 10 minutes later, I am finally reviewing and notifying the authorities?

The complexity of these fields argues against some magical standards for integration and scalability, yet ultimately that is where these related fields should go to provide best customer value. I wonder who might ultimately have the knowledge, interest, and clout to move things in this direction?

Bringing this back around to the subject, yes, it seems very reasonable to expect that every major VMS of consequence should be capable of supporting automated motion trajectory tracking, by map and by dynamic video feeds, at the push of a button, on those occasions when a facility is unoccupied or quiet. Why don't they?

Great post and great responses – especially from Horace.

First I would like to set the stage – go to YouTube and search ‘Columbine Surveillance Video.’ Watch the videos from start to finish.

“Everyone has a plan until they get punched in the mouth.” – Mike Tyson

What is missing thus far is additional detail on how the feature would respond to these motion activated cameras. Would there be a dedicated monitor? If not, where would the video be pushed to? Would the dedicated monitor limit the viewing matrix to a 2X2 or 3X3 or 4X4 or would that be custom definable? Would the rules dictate that there is to be a 10 sec pre/post buffer for the motion events or would it follow the motion exactly as it is activated/deactivated? How would you identify priority in the event 75% of the cameras have motion? Consider the chaos involved in an active shooter event. Would the solution involve analytics (only follow the guy in the red shirt?), how would the feature be activated in a multi-site campus (100+ school buildings) – would there be an individual button for each school providing more granularity? Who would use this feature – school admin, school police or responders (swat) and would all entities benefit equally from this feature? Would swat actually need this or would they prefer a different method?

Personally, if I were tasked with monitoring the video live, I would want multiple viewing panels (4X4 pref) displaying the video without interruption. I would not want cameras switching based on movement and complicating my viewing perspective. I would want a large HD spot monitor that I could call up just a few select views. Once I am on my subject, I would want the means for quickly grabbing nearby cameras without the trouble of looking through a menu tree for the next camera – I would want it built into the camera interface – fetch me the next nearest camera - single click.

I think that there is a disconnect between what is technically possible and what is practical in terms of real usability and functionality. In the given circumstance of an ‘active shooter,’ and given the likely chaotic scene, I don’t think the described feature would be of any real value (in an active shooter event) if it even it worked as advertised. Conditions would have to be perfect.

My .02.