Police can store body-cam video in secure Azure cloud

The Boston Marathon bombings of 2013 and the Ferguson, Mo., police shooting case have made clear the important role of video in law enforcement. What’s muddier, however, is how police departments can store exponentially growing terabytes of data and how they can do so according to federal security policies.

A new partnership between Microsoft and VIEVU, a body-wearable camera maker, aims to solve that problem. Now, at the end of their shifts, officers remove their cameras and transfer the video they took wirelessly or via a direct connection to VIEVU’s Veripatrol software. Veripatrol sends the information to Microsoft’s soon-to-be-released Azure Government Cloud, where it is stored in compliance with policy approved by the FBI’s Criminal Justice Information Services (CJIS) Division.

“It’s not enough to tell a police department that you reserved a corner of your consumer cloud just for them,” said Richard Zak, Microsoft’s director of justice and public safety solutions. “Their regulatory environment is completely different. To support law enforcement, we have to deliver a completely separate cloud platform, separated in every way: different data centers, different network infrastructures, different everything.”

And that’s been the missing link for VIEVU, said Steve Lovell, the company’s president. It had been using Amazon Web Services to store raw video, while programming Veripatrol to send sensitive metadata to departments’ local storage devices. But departments still couldn’t be sure who was accessing the files, he said. And even with sensitive data removed, the videos need protection.

“All too often, police officers see people at their worst time, or maybe you have the camera on but you’re moving into a trauma center or emergency, so now we have HIPAA laws that apply to the video that’s now being recorded,” Lovell said.

One officer can generate a terabyte of files in a year, according to Lovell. In 2013, the 4,000 law enforcement customers using VIEVU’s cameras generated about 7 million hours of police video – a number he expects will grow this year.

“People are deploying many more cameras than they ever have before,” Zak said, adding that they’re also recording more frequently in high-definition formats, which create larger files. But police departments don’t always have the information technology infrastructure or staff to handle so much data.

The cloud is “particularly useful and provides very powerful capabilities for midsize and small agencies,” he said. “The power of the cloud is to take a lot of the administration and management of infrastructure that normally would be done by a technology team on-site…all of that gets delivered by Microsoft.”

The cloud’s scalability is another perk for organizations of all sizes but especially smaller ones, Zak said. Departments can’t always buy local storage fast enough to store video. Other considerations include the cost associated with such procurements and what a department would do with additional storage when it doesn’t need it anymore – say, after the end of a large event such as the Super Bowl.

“They are doing something that didn’t exist before,” Lovell said of Microsoft. “Our customers have been asking us for years about remote data storage and if it would comply with federal guidelines. The Microsoft Government Azure cloud does just that. It’s on U.S. soil, it’s operated by background-checked U.S. citizens, it’s got heavy security requirements.”

To work with Azure, VIEVU had to adapt its software; the hardware didn’t undergo any technical changes.

When officers need to access stored data, they can log in and see only their video. Administrators and others with broader views are also subject to restrictions, thanks to a lockdown feature in Veripatrol that makes files viewable only by particular users.

CJIS requires, among other things, that cloud vendors conduct fingerprint-based background checks on the system, database, security and network administrators who can access and recompile criminal justice information. The policy also prohibits remote maintenance from outside the United States.

Microsoft lets law enforcement entities audit Azure to be sure it’s CJIS-compliant, said Rochelle Eichner, director of risk and compliance for the company’s worldwide productivity team. “That process needs to be well defined to still meet policy,” she said. “We developed a process working with the state CJIS officers to be able to accommodate that.”

Overall, cloud has been gaining traction in the law enforcement community as a storage mechanism.

“A year ago, if you talked to a police chief, the likely answer you’d get was, ‘I’m not going to pursue the cloud,’ or ‘The cloud’s not going to be part of our strategy,’” Zak said. “Fast forward a year to today, that same police chief would shift the question to how: ‘How are we going to use the cloud?’”

Azure will be a major enabler, Lovell said. “Now people can actually utilize this type of technology, get off the heavy infrastructure that they’re currently supporting with staff and hardware, and they can now manage these files with a peace of mind,” he said.