Subscriber Discussion

Marijuana Dispensaries And Their Absurd Storage Requirements

UI
Undisclosed Integrator #1
Feb 13, 2017

I do quite a few marijuana dispensaries in states where medical marijuana is legal and heavily regulated, including the security of those buildings. In my experience, these regulations are being written by people who don't have a clue as to what is going on. Check out this requirement one of my clients has,

(4) Ability to record all images captured by each surveillance camera for a minimum of 4 years in a format that may easily be accessed for investigative purposes.

I calculated 30 cameras would require at least 768TB to meet this requirement. My calculation is based on normal use in other marijuana dispensaries I have done.

In the past when I have approached these regulatory agencies and requested they make realistic changes to their regulations I have been met with typical government bureaucracy. I am hoping I can get somewhere with this one.

Has anyone else seen a requirement like this? What did you do?

(1)
JH
John Honovich
Feb 13, 2017
IPVM

Ability to record all images captured by each surveillance camera for a minimum of 4 years in a format that may easily be accessed for investigative purposes.

Are you allowed to lower frame rate or resolution? E.g., use multistreaming, 1st month full frame rate, full resolution, secondary stream for the next 47 months at full frame rate, 5fps or half resolution, 2fps, etc.?

(1)
UI
Undisclosed Integrator #1
Feb 13, 2017

I'm waiting to hear back on this, this was the first question I asked. The initial response was that the regulatory agency wanted full frame for the four years.

Avatar
Brian Karas
Feb 13, 2017
IPVM

The concerns, as I have heard it, are that there are no legal precedents for a dispensary defending themselves from either federal or local lawsuits. Nothing to draw from in terms of statutes of limitations, what kinds of evidence/data will be sufficient to defend themselves, or even what kinds of lawsuits are likely to come up.

This is resulting in the "We need to see everything, record everything, and keep it 'forever'" mentality behind a lot of the systems customers are requiring.

For these kinds of systems, I sometimes wonder if the tape-offload approach of companies like Quantum would make sense.

(2)
(5)
UI
Undisclosed Integrator #1
Feb 13, 2017

Brian, you make an interesting point. I'll check out Quantum and see if that's an option I can recommend. 

Avatar
Hans Kahler
Feb 13, 2017
Eagle Eye Networks

Full Disclosure - I work for Eagle Eye Networks.  

I have not specifically seen 4 years of storage requirements for the marajuana industry, typically we see 90 days.  (However, we have a few customers, outside of that industry, with 1-5 years of storage.)  Some states also require that video storage is off site, which honestly works great for us. 

I think that 4 years is probably company policy, not a regulation.  My advice is to give them the price of complying with the policy/regulation and then let them make a business decision.

With regards to impacting the regulations, I heard (but can't confirm) that Washington state recently reduced their requirements from 90 days to 30 days due to the negative feedback they received.  

(2)
(3)
(1)
UI
Undisclosed Integrator #1
Feb 13, 2017

Hans this is regulation by the State and not company policy, we do other facilities for this particular client in other states, and typically we're recording 45 days of storage which I think is reasonable. Recordings must be locally stored in a room with an independent intrusion alarm (separate from the dispensary facility), access control system and fire alarm system (fire alarm doesn't need to be independent).

(1)
Avatar
Josh Hendricks
Feb 13, 2017
Milestone Systems

This may be too simplistic a view of the situation but it seems like the legislation is designed by people who are anti-legalization to make it as difficult and expensive as possible to comply. If that's the case, then it is probably going to be extremely difficult to get those requirements dropped without replacing politicians.

(7)
RS
Robert Shih
Feb 13, 2017
Independent

I'm guessing we're going to run RAID with this setup as well? So with 10TB drives, we're looking at a minimum of about 104 drives...fun. We can get close with a Dahua EVS7048D-R and ESS3148D-JR, but we're still short about 8 drives.

UE
Undisclosed End User #2
Feb 13, 2017

Look into Amazon Glacier.  It is .004 cents a month per gigabyte, now that will add up to a lot depending how much and for how long they decide to keep the video.  768TB is a lot of video.  I also do a lot of Marijuana based business, and I love those guys.  They just have no worries about budget or spending money.  I also do LARGE outdoor gardens in Northern California, and all these guys are worried about is privacy, and you not running your mouth about what you saw.  I don't have to do ANY advertising, they call me now that my name is out there. The guys I deal with don't have any state agency's setting standards, this is a big "Grey" area and market, to sometimes a complete "Black" market.  Now that California has passed a recreational use law, these guys who get state licensed may have to start complying with the state regulations.

(1)
(3)
UE
Undisclosed End User #3
Feb 14, 2017

Archiving to western digital my cloud drives, there's nothing saying it needs to be on the live array, today an 8TB is less than $300. I started doing this year's ago when dvds were a feasible option. By the end of year 2 a larger drive will come out at the same cost, fully automate it with a robocopy script and the option to email on storage check is full set as a scheduled task. 

 Do put a label with durations and and drive id, and a simple list for easy access.

(1)
UI
Undisclosed Integrator #1
Feb 14, 2017

Thanks for the idea, add storage as you need it. Each year bigger less expensive drives are released that could make this possible.

(1)
Avatar
Armando Perez
Feb 14, 2017
Hoosier Security and Security Owners Group • IPVMU Certified

I had good luck in criticising Washington State publicly enough theough their firat draft of rules to get some movement on the regulations there, but even after all of that they were pretty asinine. 

 

I've not run into a 4 year requirement, but we don't do much in cali. Could be a local ordinance. Many of the rules are written to impose NIMBY. It's all fine and dandy, just don't do it here, so they will impose additional requirements that practically make it impossible to comply without outright making it impossible. Those are the fun ones. The only thing you can do is read the regs carefully and interpret them with as much flexibility as you are willing to risk. For me it's not much, so we go with a strict interpretain and get creative on hardware and settings.

RS
Robert Shih
Jul 12, 2017
Independent

Yeah, the settings are pretty rudimentary. Basically, doesn't allow for much clarity, but that's what you get when storage is prioritized over real coverage.

UE
Undisclosed End User #3
Feb 14, 2017

i didn't see anything in there saying 30 fps either, just it must "record all images captured", you might be able to record at 5, 10, 15, or even 20 fps, also it doesn't say 24/7 recording, might be able to just do motion recording with even a frame every 1-60 minutes. that would be a huge reduction in storage for both live and archives. data aging on the live storage as long as it kept a week should be sufficient as well, expectantly if you schedule the archive to get the full frame at the end of each day.

AM
Alastair McLeod
Feb 20, 2017

Actually, long-term video retention is quite common nowadays and there are surveillance storage systems specifically designed for this kind of application.

(Note: My company, Veracity, manufactures just such a system: COLDSTORE).

Long term retention is common in the Middle East (60 days to 6 months typically).  It is also common for correctional facilities in the USA and Canada, although in the US this varies from state to state.  There are a number of other verticals, such as utilities, stadia, hospitals and university campuses, in which video retention times are generally increasing.  Another driver in some verticals is insurance requirements. We have many customers keeping 6 months to 3 years of video data purely because of insurance requirements.

There are a couple of ways of tackling the problem, depending on whether the customer wishes (or can afford) to have all the data online or whether their needs would be satisfied with an offline archiving system.

I would be happy to discuss this further with you outside of this forum if you are interested. 

 

(2)
DO
David O'Neil
Jul 03, 2017

 

Alastair. I have used Veracity Network POE products in the past and am very happy with your product.

I did see your company at the Toronto Ontario CANASA Security convention where I first heard of your Coldstore product.

I am the owner of a company here in Ontario called Eternal Security and we are dealing with the longterm storage requirements (2 Year) done right with appropriate redundant measures. I would like to chat more about your Coldstorage and longterm storage options and how it may fit into the projects we are working on.

Thankyou

Dave O'Neil

President & CTO

ETERNAL SECURITY

 

AM
Alastair McLeod
Jul 03, 2017

Hi David,

I'd be delighted to talk to you about long retention storage with COLDSTORE and will contact you directly outside of this forum.

Thanks,

Alastair McLeod

 

Avatar
Carter Maslan
Feb 20, 2017
Camio

FD, I'm CEO of Camio, which has passed Oregon state inspections for continuous 24x7 off-site video history with the use of Camio's accelerated timelapse video during periods of no-motion to reduce storage costs.

For reference, the legislation is described here.

If your state requires 4-year tamper-proof video history, you might be able to show your state regulators that smart timelapse ensures 24x7 history without excessive bandwidth and storage burdens on dispensaries. Also, for video history longer than 90 days, Camio uses Google's Coldline Storage at $0.007/GB/month.

 

 

(4)
JH
John Honovich
Feb 20, 2017
IPVM

for video history longer than 90 days, Camio uses Google's Coldline Storage at $0.007/GB/month

How does that impact retrieval / playback times using the Camio interface?

Avatar
Carter Maslan
Feb 20, 2017
Camio

That's the amazing thing about Google's Coldline Storage - there's very little impact on response times because retrieval is still in the order of milliseconds.

(2)
U
Undisclosed #4
Jul 04, 2017

They have the money. Build it. Watching people walk in with $400,000 cash stuff in gym bags is gross.

 

(1)
UM
Undisclosed Manufacturer #7
Jul 13, 2017

if by "is gross" you mean "makes me think I'm in the wrong industry" then I agree...

(1)
(4)
UM
Undisclosed Manufacturer #5
Jul 11, 2017

I've quoted one of these in Canada before, they had a 2 year storage requirement for most cameras, and 4 cameras per room in most places. For about 200 cameras, they ended up requiring almost 2PB of storage.

(1)
JD
Justin Dale
Aug 28, 2017

That's the situation i am in here. We are waiting for health Canada to start processing this application so we can actually ask them questions. 

Some that I have are: 

What FPS, resolution and PPF are required?

They say all areas where cannabis is present must have video coverage. Is that 100% or just exits or just overviews with low PPF?

Can we keep 6 months video and stash the rest on Glacier or similar?

 

Hopefully I will be in contact with them in the next few weeks and get these questions answered. It really holds up planning just about all aspects of cameras without knowing these requirements

UM
Undisclosed Manufacturer #6
Jul 11, 2017

Iron mountain ends up being cheaper than cloud, especially if you have to retrieve a large amount of data. Plus your data isn't on someone else's server....

BM
Bob McCarvill
Jul 13, 2017

Massachusetts Laws specify that you need 90 days of retention with 24/7 recording. we got away with doing it for 20 FPS on motion, and 1 FPS continuous. Most cases we've seen with these settings all we need is a 48TB server at most 84TB on larger cases. 

(2)
JE
Jim Elder
Jul 13, 2017
IPVMU Certified

Read the fine print for offsite storage. For certain jobs (such as legal), the law requires the owner of the data to have control and specific knowledge of  where  data is stored. Contracts with storage houses may not commit to this by saying that they have the right to store outside the US... particularly now when this offsite storage industry is beginning to boom. 

I'm curious, what does the law say (or imply) about off-site storage?

U
Undisclosed
Feb 01, 2018

iron mountain at least sometimes has terribly fine print.  "you pay us money, we probably don't leave your cardboard boxes in a flooded part of the warehouse" seems to be one option.

UE
Undisclosed End User #3
Jul 13, 2017

the topic was for Pennsylvania, here is a Q&A link

 

http://www.health.pa.gov/My%20Health/Diseases%20and%20Conditions/M-P/MedicalMarijuana/Documents/PA%20DOH%20Medical%20Marijuana%20Permit%20Application%20-%20Q-A%20%20624-746(v2).pdf

 

page 11 section 676 

Question:

1151.26(a)4(i) & (ii) 1161(a)(4)(1) & (ii) requires the applicant to record all images and keep them at the facility for a minium of 4 years or at a location other than the facility if approved by the Department. Does a "location other than the facility" include off-site secure cloud storage? 

Answer:

Secure cloud stroage is permissible

 

the certification of the amendments,

http://www.health.pa.gov/My%20Health/Diseases%20and%20Conditions/M-P/MedicalMarijuana/Documents/Chapter%201151%20Growers-Processors%201-26-17.pdf

 

on page 4 list maintaining a log of whom entered the facility.

 

http://www.pacode.com/secure/data/028/chapter1161/s1161.31.html

listing the following

 

(4)  Ability to record all images captured by each surveillance camera for a minimum of 4 years in a format that may be easily accessed for investigative purposes. The recordings must be kept:

     (i)   At the facility:

       (A)   In a locked cabinet, closet or other secure place to protect it from tampering or theft.

       (B)   In a limited access area or other room to which access is limited to authorized individuals.

     (ii)   At a secure location other than the location of the facility if approved by the Department.

(2)
DO
David O'Neil
Aug 25, 2017
I have seen one solution where the previous designer approached recording from an appliance based approach where the ENTIRE 2 years was a live archive that was switched between CONTINUOUS Low Frame (1FPS) to MOTION/ALARM Higher frame (15FPS). This solution for storage totals is dependant on percent motion per day per camera. It resulted in an average of 8 Hour per day of motion or 1/3rd day or 1/3 of 2 year or about 8 months of High quality High frame rate recording over 2 years. A solution I am working on involves setting up the cameras with DUAL recording licences in order to have 2 VRM Pools of data. Pool 1: Would be a dedicated pool of storage that switches between HIGH & LOW frame rate on motion providing up to 90 days (3 month) quality video. Pool 2: Provides a place to dump Stream 2 at LOWER frame Rate for continual archive purposes (giving at least some redundancy for the entirety of POOL 1's 90 day storage) as well as providing the required system health archive showing the cameras were up and recording for the full required time. Then with proper SOP's in place any incident response to events that require responding to in the 90 day time frame can be pulled from the live archive and pushed to an incident archive. This design frees up about 5 months of high frame rate high quality video storage overhead. This freed up storage can be put to use as a means to save $, to increase the frame rate and quality of the 90 day pool, and also can be put to use increasing the frame rate and quality of video on pool 2 ( so perhaps even raising the entire 2 year archive from 1FPS to say 4 FPS or customised so specific cameras can be even higher) Any other thoughts on the different ways to approach the often difficult balance of managing storage compliance for video storage while balancing budget and performance with adequate redundancy?
DO
David O'Neil
Aug 25, 2017

Not sure what happened to my line feeds in the above post? I apologise.

U
Undisclosed #8
Aug 25, 2017
IPVMU Certified

Undisclosed #3 depleted the quota :)

(1)
Avatar
Patrick Bailey
Jan 31, 2018

I'm currently working with a manufacturing firm in the Cannabis Industry here in California and the regulations are vague at best.  Basically the state laws says you must provide video coverage throughout the facility wherever product is stored, transported, created, kitted, tested, etc.  The video captured must provide identification quality resolution throughout the areas mentioned and the complete perimeter of the building on the exterior.  The state regulations require the capture rate to be 15FPS continuous for a minimum of 90 days.  The local city that this business is located in has a requirement of 6 months of video to be retained at full resolution, 15FPS and continuous and not based on motion.  The video equipment (NVR or storage server or array) must also be protected with video coverage and the room housing this equipment to be controlled access.

I am sure we will see these requirements go thru some modifications as things settle down.  I hope they consider recording on motion with pre and post buffering because the storage costs are quite high for these operations.  I was shocked at the permit costs alone.  Permits to operate the business ranged from $25,000 to over $250,000 just to obtain a permit.  That's crazy. 

Avatar
Michael Fleming
Jan 31, 2018

When talking state regs please tell us what state we are talking about. I am familiar with the Oregon laws regarding video - 10fps at 1.2mp for most of the video. 

90 day retention. 

Who is calling for 4 year retention?

 

Mike

 

UE
Undisclosed End User #3
Jan 31, 2018

Pennsylvania, they call for 4 years. Their regs I listed above.

(1)
MM
Michael Miller
Jan 31, 2018

Yup, PA needs 4 years and all the video needs to be full resolution @ 10FPS. 

New discussion

Ask questions and get answers to your physical security questions from IPVM team members and fellow subscribers.

Newest discussions