Police Digital Forensics: Storing and Using an Overflow of Video Data 

When police departments object to installing cameras in cruisers and on uniforms, it can undermine trust in the police, feeding an assumption that they want to conceal their activities from public view. But some police resistance to always-on cameras is technology-based, and given the scale, complexity and cost of storing and retrieving police video data, it’s hard not to sympathize with law enforcement IT departments.

For each eight-hour shift, a police officer’s body camera generates around 18 gigabytes of video data. Three shifts means 50+ Gb per day. In 14 days, 12 officers generate 1 Tb. Multiply that by, say, the 1,500 officers in the Calgary (Alberta) Police Department, and you’re talking about 1 petabyte of video data produced per year.

Beyond recording video, police must retain it for extended periods of time. How long? It varies by municipality, state and country. In Calgary, all video data must be held for 13 months; video used in court must be held for seven years; video associated with a serious crime: 20 years; with a terrorist incident: 40 years.

Then there’s retrieval of video data on demand. In Seattle (and many other cities), citizens and lawyers can request any amount of video data covering any period of time, and the police are required to find and deliver it. Failure to produce all relevant video files can result in fines being levied against an already budget-stressed police department.

Criminal investigators also need searchable video data spanning the life cycle of prosecution. Digital forensics is a crucial aspect of crime fighting. And there are many sources of it. There’s the video produced by cameras on uniforms and cruisers, cameras in the receiving bays where suspects arrive at police stations, cameras in police interrogation rooms and in the cells of the arrested. There’s video from non-police surveillance cameras inside and outside of buildings that must be integrated and examined by investigators. And they want a system that they can use themselves, without the help of the IT department, to compile cases efficiently.

All of this is expensive. According to one study, the average cost of primary storage per terabyte is between $1000-1500 per year; storage of police video data can run into the millions.

Former Seattle Police Chief John Diaz

“These are real-world problems we’re trying to deal with,” former Seattle Police Chief John Diaz told EnterpriseTech, “and it’s coming at us at lightning speed with this massive amount of data, particularly video data. We’re going to need different solutions for how to try and fix this. If you have enough money there’s always a way to do it. The trick is figuring how to do it efficiently, effectively and securely at the lowest possible cost. It’s been an incredibly difficult problem to try to deal with.”

The Calgary Police Department (1,500 officers, 200-plus cruisers) took on these problems when the city decided to install cameras on uniforms and in cruisers. The police department looked ahead at the avalanche of data and turned to Quantum Data Storage, the San Jose-based scale-out storage, archive and data protection company with roots in military/intelligence markets. Quantum offers a tiered storage approach designed to lower costs by integrating data across multiple storage media and maximizing use of the least expensive storage.

In contrast to the growing embrace, in some IT circles, of going all flash, or flash and disk, Calgary and Quantums’ video data storage strategy demonstrates the enduring, cost-containment value of tape when used in its proper role. In the case of Calgary Police – and any other police department, for that matter – as video data gets older there’s less likely to be an urgent need for it. The idea behind Quantum’s StorNext data management system is to migrate data, in accordance with end-user policies, to less expensive tape as soon as possible and overlay it with a file system and user interface that extends across all data, regardless of how it is stored, allowing police end users to find the data they need.

For the Calgary Police, the solution fits both its performance requirements and its budget constraints.
“A quick calculation showed that we could expect to gather nearly a petabyte of video data in the first year,” said Corey Dunn, technical services manager. “And we knew it could easily be more if we shifted to higher-resolution video formats or had to lengthen the retention. The scale-out NAS disk we had been using for dash cams was simply too expensive to even consider.”

Using tiered storage, the department is able to manage nearly a petabyte of data with only 240TB of live disk space cutting its costs by about half compared with a disk-only approach.

“StorNext’s ability to let us use a small amount of disk while the balance of the data is on tape was just what we needed to keep this project’s costs under control,” said Dunn. “It also gives us protection and long-term retention, something that was a real headache with disk-only systems.”

According to Quantum, the cost structure of a multi-tier approach looks like this: if storing a given quantity of data in high-performance primary disk costs $1, the same data in object storage costs $.35, in file-based tape costs $.18, and in the cloud between 8 and 16 cents.

With the Quantum architecture, body-camera data is ingested directly into a StorNext environment, landing on a Quantum high-performance disk. The data is retained there for 30 days, and StorNext automatically creates two copies of the files on tape. One is held in a Quantum Scalar tape library as an active archive, available to users needing to view the videos. The second copy is moved off-site for longer-term retention and disaster recovery protection.

The StorNext archive management system allows users to view any of the files directly through a single, file-system interface, whether the files are stored on disk or tape—no need for IT support.

“The only way we know whether data is being read from disk or tape is that it takes a little longer to access the data stored on tape—the interface and applications are identical,” Dunn said.

Former Seattle Chief Diaz can testify to the effectiveness of digital forensics in investigating crime, citing the case of a Seattle police officer named Timothy Brenton, who was killed in the line of duty on Halloween night, 2009. Officer Brenton, accompanied by another officer just out of the police academy, were called to the scene of a disturbance where they were ambushed by a gunman. Brenton was fatally shot, the other officer was wounded. The surviving officer managed to call police headquarters and report on the location of the crime.

As the suspect drove away, police from the surrounding area rushed to the scene, their “dash cams” (cameras on the dashboard of police cruisers) in operation producing video that investigators later went over in detail.

“It was slow process but it was 1000 times better than what we had in the homicide division 10 years earlier,” Diaz said.
Examination of multiple enhanced videos showed that the driver of a particular car appeared to be trying to conceal his vehicle, parking it in different driveways and so forth. The car turned out to be an older model, a Datsun (pre-Nissan). From there, investigators matched the car model to license plate and tracked down any data about the vehicle that would lead to the whereabouts of the suspect. Eventually, he was located and approached by members of a Seattle Police SWAT unit, a gunfight ensued and the suspect was wounded, apprehended and, later, convicted.
“With today’s tools,” Diaz said, “it would have been solved even quicker.”

Quantum’s Wayne Arvidson, VP of surveillance and security solutions, told EnterpriseTech that police video data storage systems should “make the technology support the way the officer needs to work.”

“This technology has got to help people catalogue the data in real time so that they can find every instance – not just for responding to Freedom of Information public disclosure purposes, but also to help the officer when it comes to solving a case,” Arvidson said. “There may be something (evidence) that appeared that didn’t seem related at the time, but by being able to search through the video data it may provide clues to a current case.”

For police to effectively use the volumes of data, the system also needs to be a practical tool for the non-technical user.

“One of the things officers and investigators have stated,” he said, “is that there’s a learning curve involved. They’re police officers, not IT experts, so what they’re looking for is a solution that helps them find it themselves, that works with them the way a detective would think and the way a detective would uncover information. But to do that you’ve got to be able to search things that are there and retain things for long periods of time, because it may be years before you get back to certain case information.”