CCTV Retention, Alarm Fatigue and Evidence Handling at a Shopping Mall
A shopping mall has 96 cameras. Twelve are older analogue units covering the loading bay, two stairwells and the rear service corridor; at night their footage is too grainy to identify faces or number plates. The network video recorder is set to overwrite after 14 days, although the mall's written policy promises 30 days. Two operators monitor 96 camera views on three monitors and also answer the security phone. The alarm system generates 38 to 45 alerts per day; roughly 80 percent come from one passive infrared sensor near the escalator that is triggered by shoppers. Police requested footage of a bag theft 19 days after the incident; the operator could not find it. The centre manager has approved a modest budget for this quarter and wants to know what to fix first. You are the security supervisor responsible for the system.
1. Given the limited budget, set out a prioritised remediation plan for the CCTV and alarm system. Explain the reasoning behind the order, including what you would deliberately not spend money on yet.
Read the worked answer
I would prioritise by evidential and operational impact, not by camera count. The system currently fails at three points: it cannot identify at the critical back-of-house locations, it does not keep footage for the promised period, and the alarm stream is so noisy that operators cannot respond meaningfully.
First spend: storage and retention. If the policy promises 30 days, the system must deliver 30 days for the cameras that matter. This may be as simple as increasing disk capacity, adjusting frame rate or resolution on low-risk cameras, or moving to a recorder that supports the load. This is first because it is cheap relative to new cameras and because every day of the 14-day gap is a day when evidence disappears. The police request at 19 days is exactly the failure this fixes.
Second: replace or upgrade the 12 analogue cameras at the loading bay, stairwells and rear corridor. These are the highest-risk locations for theft, assault and unauthorised access, and grainy footage there has little evidential value. I would replace them with units that give identifiable images at the actual distances involved, and test at night rather than trusting the specification sheet.
Third: fix the escalator PIR. This is a nuisance alarm, not a detection problem. Re-aiming, masking, changing the sensor type or moving it to a zone with a short delay could remove most of the 80 percent noise. That is a low-cost action that improves operator attention immediately; I would do it in parallel with the storage work.
I would not spend the budget on adding more cameras or a video wall yet. More views on the same three monitors would worsen attention, and the evidential and alarm foundations are not in place.
2. Redesign the operators' monitoring and alarm-response workflow for two people covering 96 cameras. Show how you would reduce alarm fatigue and improve the chance that a real incident is detected.
Read the worked answer
Two operators cannot watch 96 live views continuously, so a design that pretends they can is the root problem. I would change the work from 'watching screens' to 'responding to prioritised events with a structured patrol of views'.
Alarm triage: classify alarms by zone and consequence. Loading bay door forced, rear corridor motion after hours and stairwell door held open are high priority; the escalator PIR is nuisance until fixed. High-priority alarms should produce a distinct sound and a camera pop-up on one dedicated monitor. Lower-priority events should log for review rather than demand immediate attention. This is how the 38-45 daily alerts become a manageable list instead of background noise.
View discipline: build camera groups or tours so that each operator has a defined set of critical views and a timed tour of secondary views. The three monitors should have fixed roles, for example one for alarms and pop-ups, one for the main entrance and high-value areas, one for review and playback. That reduces the random scanning that leads to misses.
Task separation: answering the security phone and monitoring should not be simultaneous at peak. If staffing cannot change, the phone should go to a reception or control-room colleague during peak periods, or be answered in a defined sequence with a radio check.
Response scripts: for each high-priority alarm, the operator has a short script: verify on camera, radio the nearest guard, record time and outcome, preserve clip. That makes response consistent across shifts and gives supervisors something to audit.
I would also introduce a handover log and a short daily review of alarms and misses, so the workflow is tuned from evidence rather than assumption.
3. What would you change about evidence handling so that a police request 19 days after an incident can be met reliably? Include the practical controls, not just a policy statement.
Read the worked answer
The 19-day failure was predictable: 14-day retention plus no export routine equals lost evidence. The fix has technical, procedural and human parts.
Technical: retention must match policy for evidential cameras, and the recorder clock must be synchronised to a reliable time source. A clip with the wrong timestamp is weakened evidence. I would check time drift monthly and record the check.
Procedural: define what counts as an evidential incident, who can declare it, and a preservation step. When an incident is reported, the operator should export the relevant footage promptly to a secure folder or write-once media, record the camera, time range, export time, operator name and a hash or system-generated checksum if available, and store it separately from the recorder. This 'preserve first, investigate later' rule is what protects against overwrite.
Chain of custody: a simple evidence log with an entry for each export, who handled it, where it is stored, who accessed it and for what purpose. Access should be limited to nominated staff. Copies should be labelled and kept in a locked location or access-controlled folder. If footage is released to police, record the officer's details, the reference, what was released and the date.
Human: train both operators on export and log completion, and test the process with a quarterly exercise, for example 'find and preserve the clip from this morning's incident'. A policy that has never been exercised is not a control.
I would also review the case of the missed bag theft and tell the centre manager plainly that the evidence was lost because of retention and process, not operator indifference, and that the changes are designed to prevent recurrence.