Handbook of Operating Procedures 8-1120

Video and CCTV Security Systems

Effective November 6, 2023
Executive Sponsor: Senior Vice President and Chief Financial Officer
Policy Owner: Director – Data Centers & Electronic Physical Security Systems University

1. Policy Statement

It is the policy of The University of Texas at Austin ("University") to manage the use of video recording and closed-circuit television ("CCTV") security systems so that safety and security is enhanced while respecting the privacy rights of the University community and the public and maintaining compliance with all applicable laws and policies.
 

2. Reason for Policy

To define campus goals for the use of video and CCTV security systems and outline the responsibilities and procedures when deploying technology.
 

3. Scope & Audience
   1. This policy applies to all employees and students with respect to the installation and use of video security and CCTV cameras, except as noted below, in facilities owned or controlled by the University.

2. All references to video security and CCTV systems throughout this policy are for those systems which were designed and installed with the intent and ability to record video and/or to be monitored for purposes of enhancing campus safety and physical facility security.

3. This policy governs all video/CCTV monitoring systems on campus except as provided in section D below.

4. Exclusions

This policy does not apply to:

1. Use of video recording and CCTV technology covered by University policies governing research with human subjects or animals.

2. Use of video recording and CCTV technology for video conferencing.

3. Use of class lecture recordings and/or archiving for the purpose of content sharing.

4. Use of mobile video/audio recording systems used by the University Police Department ("UTPD"). The UTPD must comply with existing Police Department Operations policy for use of these systems.

5. Use of cameras in the UTPD Temporary Detention and Interview Rooms.

4. Definitions (specific to this policy)

Authorized Representative:

An Authorized Representative is any member of the Board of Regents, executive or administrative officers of the U.T. System Administration or U.T. System institutions, public safety officers, and secondary delegates as determined by the rules promulgated by U.T. System or UT Austin.

Camera Control Operator:

The person(s) designated by a department who is responsible for a department's Video Security and CCTV systems, including recording, review and recovery of recordings, and related duties.

CSU:

College, School, or Unit

CCTV:

Closed-Circuit television is the use of video cameras to transmit a signal to a specific place, on a limited set of monitors. CCTV systems may operate continuously or only as required to monitor a particular event. CCTV video used for security purposes pursuant to this policy must always be restricted to a secure private network or Virtual Private Network (VPN) which may only be accessed by authorized persons.

Forensic Video Retrieval/Review:

Security video retrieval involving UTPD and departments utilizing UTPD chain of custody procedures to protect the forensic integrity of video.

IP Cameras:

Internet protocol (IP) cameras which use the protocol used most by Local Area Networks (LANs) to transmit video across data networks in digital form. IP video used for security purposes pursuant to this policy must always be restricted to a secure private network or VPN which may only be accessed by authorized persons.

Position of Special Trust:

A designation provided to certain positions at the University that entitles the designated employee elevated information systems privileges and access to Category I University data.

Preliminary Video Screening:

Department level preliminary review of security video by authorized staff in compliance with departmental procedures in order to isolate relevant parts of video in preparation for Forensic Video Retrieval.

Responsible System Manager:

The individual who is responsible for the management of a University video recording and/or CCTV system governed by this policy.

Video Monitoring:

Real time monitoring of security video of an event that is in progress to enhance the safety and security of the event.

Video Security System:

Video recording systems installed for the purpose of prevention against assault, damage, theft, unlawful entry, and other such occurrences caused by deliberate actions.

Video Surveillance:

Ongoing close observation and collection of data or evidence for a specified purpose or confined to a narrow sector. This can include real time Video Monitoring or automated recording.

Video Security and CCTV Exception and Review Committee:

A committee comprised of staff from departments that participated in the drafting of this policy who may be called upon for periodic review of the policy with regard to operational implementation and technical specification advisement to the Campus Safety and Security Committee ("CSSC").
 

5. Website (for policy)

https://secure4.compliancebridge.com/utexas/public/getdoc.ph?file=8-1120
 

6. Contacts

7. Responsibilities & Procedures

When deploying CCTV and/or Video Security Systems on campus, the Responsible System Manager and all individuals granted access to those systems are required to abide by the responsibilities and procedures set forth in this policy.

1. CCTV Installation and Administration

2. Purpose for Use of Monitoring Systems

The purpose of video and CCTV monitoring governed by this policy is for enhanced safety and security. Any interception, duplication, transmission, or other diversion of video and CCTV technologies for purposes other than the safety and security contemplated by this policy is prohibited.

Safety and security purposes include, but are not limited to:

• protection of individuals, including students, faculty, staff, and visitors.
• protection of University owned and/or operated property and buildings, including building perimeters, entrances and exits, lobbies and corridors, receiving docks, special storage areas, laboratories, and cashier locations.
• monitoring of common areas and areas accessible to the public, including transit stops, parking lots, public streets, and pedestrian walks.
• investigation of criminal activity.
• protection against an act of terrorism or related criminal activity.
• protection of Critical Infrastructure as defined under the Texas Homeland Security Act, the USA Patriot Act, or the United States Department of Homeland Security.

3. Monitoring System Protocol

1. Video and CCTV monitoring and recording are required to be conducted in accordance with all existing University policies, including the Non-Discrimination Policy, the Sexual Harassment Policy, and other relevant policies. Monitoring based solely on the characteristics and classifications contained in the Non-Discrimination Policy (e.g., race, gender, sexual orientation, national origin, disability, etc.) is prohibited.

2. Monitoring or recording of audio is strictly prohibited. The interception of oral communications without court authority is a violation of United States Code, Title 18, Section 2511 ("Interception and Disclosure of Wire, Oral, or Electronic Communications Prohibited").

3. Monitoring shall be limited to uses that do not violate a reasonable expectation to privacy.

4. Cameras may be monitored in real time, but cameras may also be unmonitored while recording.

5. Violations of the responsibilities and procedures set forth under Section VII of this policy may result in disciplinary action consistent with the rules and regulations governing employees of the University.

4. Monitoring System Usage Requirements

1. Signage for video and CCTV locations is required at main entrances to areas with video security, such as building entrances and elevator landing areas. The signage language should say: "This Area Subject to Video Surveillance." Signage is the responsibility of the CSU or building manager.

2. All video/CCTV monitoring systems governed by this policy shall comply with this policy including technical specifications for both IP and CCTV cameras.

3. The Campus Safety and Security Committee is authorized to oversee the use of CCTV monitoring for safety and security purposes at the University.

4. Temporary installation of video/CCTV monitoring systems:

1. The Chief of Police, in consultation with an Authorized Representative, has the responsibility to authorize any temporary installation as deemed necessary in connection with a criminal investigation, for enhanced security for special events or as otherwise deemed necessary to enhance safety and security at the   University.

2. Temporary cameras may be deployed to investigate operational and administrative issues pursuant to the existing operating policy for Conducting Administrative Investigations Involving University Employees and Information Resources. Temporary cameras must be removed once investigations are concluded. (https://forms.security.utexas.edu/acceptable_use/).

5. The Information Security Office ("ISO") may audit CCTV surveillance operations for policy compliance, including recording storage and retention.

6. The EPSS group must retain records of all new video security components location, costs, camera descriptions, camera capabilities, make and model number in order to provide those to the Office of the Vice President and Chief Financial Officer in response to open records requests. The EPSS group will undertake best efforts to assemble this information for all existing video security currently deployed.

7. If a camera is proposed or is installed in a research space, an authorized representative from the Office of Sponsored Projects ("OSP") must approve the location and ensure a "Technology Control Plan" has been established, if applicable. Installation of video and CCTV equipment is prohibited in restricted areas where Department of Defense classified information is discussed, stored or otherwise processed, unless approved by the Vice President of Research, or his/her designee, in consultation with the Office of the Vice President for Legal Affairs.

8. All operators and supervisors involved in Video Surveillance are required to perform their duties in accordance with this Policy.

9. All departments responsible for a video/CCTV monitoring system governed by this policy shall develop and maintain written policies and processes in place to prevent camera operators tampering with, intercepting or duplicating recorded information. Written departmental policies  shall be no less stringent than this policy. To maintain the integrity of the process, Camera Control Operators who retrieve video must do so in the presence of at least one other employee according to established procedures. A UTPD officer can also serve as the second person present when video is retrieved. Individuals authorized to oversee video security viewing must be listed in the department's written video recording policy.

10. Personnel involved in monitoring and recording must be trained and supervised by their department in the responsible use of the technology and the requirements of this policy.

11. All Camera Control Operators:

• must be trained by their departments in the technical, legal, and ethical parameters of appropriate camera use. Training shall cover the proper operation and maintenance of department's equipment and infrastructure.
• must acknowledge they are in a Position of Special Trust per the University's Information Resources Use and Security Policy (https://forms.security.utexas.edu/acceptable_use/).
• must not monitor individuals based on characteristics of race, gender, ethnicity, sexual orientation, disability, or other classifications protected by the University's Non- Discrimination Policy.
• must not view places where people have a right to privacy, including but not limited to bathrooms, dressing rooms, locker rooms, private rooms or areas through windows.

12. Installation of cameras with audio recording capability is prohibited.

13. All devices on the departmental list required in Section VII, C.9 above that are connected to the campus network must adhere to the Minimum Security Standards for Systems. (http://security.utexas.edu/policies/standards_systems.html).

14. No video security or CCTV system may be accessible from the public internet.

15. All video and CCTV systems and locations are required to be registered using the Information Technology Services ("ITS") Video and CCTV System Registration Tool and that information must be reviewed and updated by the system's owner to ITS at least semiannually, on June 1st and December 1st.

16. All systems are subject to random audits for compliance with security and retention policies.

5. Records Retention

1. Recordings must be retained for a period not to exceed 31 days, or for periods not to exceed 60 days for certain lab areas as stipulated by Environmental Health and Safety authorized staff. After those time periods, recordings are required to be erased, or recorded over, unless retained as part of a criminal investigation or court proceeding (either civil or criminal) or other authorized use as approved by the Office of the Vice President for Legal Affairs.

2. Recordings must be retained in a secure location with access by authorized personnel only.

3. Departments must provide, and ITS must store, information (for open records requests) of deployed video security and CCTV on campus consisting of:

• Department ownership
• Authorized contacts for the system
• Purpose of cameras
• Location
• Video retention periods

6. Requests for CCTV Video

1. Law Enforcement Requests

2. Building Security or Video Administrator Requests

1. Administrators are not authorized to submit requests for information intended to be used for internal investigations. Such requests must be submitted to the Information Security Office (security@utexas.edu).
2. Administrators are not authorized to submit requests for information to be used in relation to law enforcement investigations. Such requests must be submitted via a subpoena to the Office of the Vice President of Legal Affairs as referenced above.
3. Administrators are not authorized to submit requests for information intended to be used for attendance or time-keeping records. Such requests must adhere to the following procedure: Conducting Administrative Investigations Involving University Employees and Information Resources.
4. Administrators are not authorized to share any information collected from the BACS or UT- Video systems without previous permission from Legal Affairs.

3. Exceptions

1. Real-time monitoring as part of routine law enforcement activities

2. Official information requests made by the Information Security Office

3. Exigent circumstances

4. Other circumstances as approved by the Vice President for Legal Affairs.

4. Logging  and Retention of Requests for Information

7. Policy Exceptions

1. During times of emergency the president or designee has the ability to implement exceptions to this policy, as necessary.

2. Any other requests for exception to this policy must be approved by the EPSS Executive Operations Committee. Requests can be made via the EPSS Service Catalog.

8. Forms & Tools

ITS Acceptable Use Policy Acknowledgement Form

9. Frequently Asked Questions

None
 

10. Related Information

United States Code, Title 18, Section 2511

Board of Regents' Rule 80101 - Category of Facilities and Authorized Users

 Open Records Requests

 Handling of Legal Papers Related to the University

 Administrative Investigations:

Departments wanting to utilize video recording technology for use in administrative investigations must refer to the existing operating policy.

 UTPD Mobile video/audio systems:

Mobile video/audio recording systems used by the University's police department must comply with existing Police Department Operations Policy.
 

11. History

Origination Date: December 12, 2011

Modified: November 6, 2023

     Next scheduled review: November, 2026