Fears PIN-pointed

Chip AND PIN technology has gained tremendous support and momentum in the UK. Stores, banks and consumers alike seem to have welcomed the retail revolution, which is being heralded as the biggest change to the way Britain shops since decimalisation.

With its roll-out completed earlier this year, most people will have already experienced Chip and PIN first hand, It is estimated that Chip and PIN will touch more than 42 million people in total in the UK, including 850,000 retailer terminals, 120 million cards, 40,000 cash machines and 2.7 million retail staff.

But the rise of the Personal Identification Number has brought with it some security and privacy concerns that installers of CCTV should be aware of.

Greater surveillance opportunity

The fact that you now need to key your PIN number into machines in a multitude of leisure, retail and banking premises means that your code is potentially open to a greater number of surveillance opportunities from criminals – and also security cameras.

A key concern for the public is that CCTV cameras that have been installed to protect people and property from theft and vandalism, could potentially be used as a tool to facilitate fraud. In larger retail stores, for example, there are often several cameras used to cover the majority of the premises. It is likely that one or more of the cameras will cover the till area, and could therefore potentially capture customers' PIN details as they are tapped in.

The fear is that criminals who have obtained PIN numbers, either by 'shoulder surfing' or by accessing the CCTV security footage, could engineer for a card to be stolen and then use the card at any retail store or cash machine.

From January 2005 Chip and PIN has also heralded a change in the relationship between retailers and the credit and debit card issuers in the UK. Prior to then, the card issuers bore the liability for all card transactions, however, now the financial liability has shifted to the retailer unless they have adopted Chip and PIN, or unless they can demonstrate that they have taken adequate precautions to prevent fraud. This increases the value to the retailer of good CCTV recordings.

There are ways for CCTV installers to overcome these issues. Firstly, it is sometimes possible to position the cameras so that they face away from the area where people input their number. This may, or may not, be viable depending upon the layout of the store and its security requirements. ATM machines are often overlooked by external CCTV cameras that are immovable.

The most effective way to address these issues where movable cameras are concerned, however, is to use advanced video control technology that obscures sensitive information, such as the area where PIN codes are entered.

To prevent fraud it’s sometimes possible to position the cameras so they face away from the area where people input their PIN numbers ...

Masking private areas

Advanced dome cameras, (such as Bewator's Solaris dome camera, for example) have the capacity to set up privacy masks so that any sensitive area within the range of the camera can be obscured.

This means that security staff are able to monitor activity, whilst also protecting customer/members of the public's privacy. (Bewator's Solaris, for example, has twenty-four privacy masks that can be programmed via the on-screen display, but these masks are automatically repositioned and re-sized to compensate for the camera being moved and zoomed.)

The risk of criminals or retail staff collaborating with criminals gaining access to the security recordings in an attempt to obtain PINs or to delete incriminating footage will result in even more emphasis being placed on the security of the CCTV recordings.

Modern technology provides a solution in the form of digital video management systems (DVMS), that record, monitor and log the images captured by CCTV cameras.

Compliance with data protection

Bewator's DVMS, Eventys, for example, is a digital video and audio recorder/server that replaces analogue VCR, multiplexer, motion detector, and video transmission systems used in traditional analogue systems.

Access is password protected and an electronic audit trail of who did what can be kept. Importantly, it can be set up to automatically delete images after a pre-determined amount of time – for example, security managers can programme it to delete images from a retail store after 30 days, or a bank ATM machine after six months, ensuring automatic compliance with the current data protection laws.

• Dr Mark Wherrett is General Manager for Video Control at access security specialist, Bewator.