This access control case involves the failure to properly install a home security and visual surveillance system, which led to two burglaries. The family who owned the home had a security system installed as the house was built. The system included motion sensor devices, window security devices and all around doorway security. The system was installed by the contractor and was then monitored by a local security management systems company.

The first burglary took place as the family was moving into the home. The thieves cut the phone line to the home and then used the realtor’s key box (a combination lock beneath the door handle containing the door key, to allow the realtor entry to the home). The burglars entered the home and ripped the security system from the wall and took a number of valuables including multiple pieces of antique family memorabilia, computers, televisions, and audio equipment.

After the first burglary, the security company assessed the house and installed a wireless notification device in the same location as the first control panel. A few months after the first burglary, the house was robbed again. The thieves again cut the phone lines, but this time they entered the house by breaking a window. The system tried alerting the security company by dialing out through the hard line about eight times, but eventually the thieves ripped that alarm system from the wall as well, which prevented the wireless alert system from sending a signal. The thieves took more than $400,000 in jewelry and gemstones, and have not yet been apprehended.

1. Phone lines cannot be completely buried. The phone lines are laid by the phone company. One could put conduit around the wires going into the home but that would not guarantee they could not eventually cut the wires. 2. Since they entered with a key and knew where the alarm panel was, it is likely they had enough time to damage it without the alarm actually sending a signal. My question would have to do with the configuration of the system. All alarm systems provide a 30-45 second delay before sending the signal to the central station. Obviously, this is intended to allow the home owner enough time to enter the home and deactivate the alarm. There is no detection of the phone line being cut so they really did not have to hurry to destroy the panel. 3. This is a strong maybe. The purpose of the cell backup is to provide covert redundancy to an alarm system. I would question the training received by the installer regarding high risk locations (especially having had a prior burglary where the system was ripped from the wall). 4. This is a self-contained transmitter. For this to work properly the cell system must have its own power either battery or hardwired. It should not be getting power from the main alarm panel for the very reason that happened here. Absent any structural hurdles, they could have placed the unit elsewhere. I’ve worked five specific cases just like this one that settled prior to deposition. All involved commercial warehouses and the losses were several million dollars in each case. There are no standards as to how or where an alarm panel is to be installed or how/where the detection devices are to be located. It is mostly a collaborative effort between the client and the alarm company. Also, cut phone lines have been an identified vulnerability for a very long time. I am curious as to why the cell backup was not recommended or requested for the initial installation.

1. After the first burglary, should the security company have buried the phone line? 2. Should the security company have changed the number of emergency alert attempts to have the system dial out through the wireless uplink? 3. Should the security company have placed the system in a different location? 4. Should the security company have placed the control panel and the wireless up link in separate locations after the first break in?

Location: Texas Board Certified in Security Management, American Society of Industrial Security Certified, Protection Professional Certified, Security Consultant Member, International Association of Professional Security Consultants Former S******* S****** I********* C**** S******* Former P****** M****** K**** S***** & A********* Former D************** A*********** E******* C*** T*********** Current P*************** C********* i********** s******* c********* f***

This expert has 30 years of experience in the security industry. He is knowledgable in all facets of security from risk assessment to system installation to system design and engineering. A Certified Protection Professional as well as a Certified Security Consultant, this expert currently serves as the President of his own independent security consulting firm.

Improper installation of home security system leads to two burglaries

This case involves allegations of evidence tampering in relation to a wrongful death action. A patron at the defendant bar consumed approximately 4 drinks or more prior to leaving the establishment. She was allegedly visibly intoxicated and impaired while continuing to order and consume drinks. While driving, the patron blacked out and struck a pedestrian in a crosswalk, killing him. A breathalyzer revealed that the impaired driver had a BAC of .14 at the time of the accident. The plaintiff alleged that the accident was a result of the patron being over-served and allowed to leave the bar when she was visibly impaired. To this end, the defense retained an expert in video forensics and visual surveillance to recover and review footage of her drinking at the bar before the accident.

I am a certified forensic examiner with almost 15 years of digital forensic and over 20 years of IT experience. I am regularly tendered as an expert witness, and my firm handles family law, criminal, business and employee misconduct cases, as well as wrongful death cases. I travel around the country examining mobile devices for accident cases as well. This is something I can assist with; my firm does a lot of work with DVRs. I have not testified in a case exactly like this case, but I have testified about video evidence and DVRs in a criminal case before. I testify regularly and typically find myself in court about once a week. Depending upon the type of DVR, the size of the HD and the retention policy our chances of recovering the data may be slim, unless steps were taken to preserve the DVR or it was taken out of service. Sometimes if we can't get the video, we can at least extract log files that can tell us when the system was accessed and what may have been done. Actual conscious tampering is rare; losing data from inaction or upgrades is more common.

1. Please discuss your background in digital video forensics. How long have you been practicing in this capacity? 2. Are you able to review the case and/or inspect the video system, to determine if there has been any tampering of evidence? 3. Are you able to recover deleted footage?

Location: NC Graduate, Behavioral Science, Erskine College Certified, Forensic Examiner, GIAC, AccessData Member, Information Systems Audit and Control Association Presenter, 30+ Speaking Engagements Former E********** T********* & I*********** R** E******** Former P******** & C********* E******** I* & F******** Current P******** & C********* A D****** F******** B******* i* t** R************* A***

This digital forensics expert has been providing litigation support and e-discovery services for nearly 20 years. He graduated from Erskine College in South Carolina, where he studied behavioral science, law, and computers. Since the mid-1990s, he has been operating consulting businesses focused on forensic data acquisition and investigations. The expert is a Certified Forensic Examiner and a Member of the Information Systems Audit and Control Association. He has experience consulting in criminal cases, business disputes, employee misconduct, family law, and wrongful death investigations.

Video Forensics Expert Discusses Security Camera Footage Recovery in Criminal Trial

This case involves a man who was severely injured on a mall escalator. The man was descending to the first floor of the mall when several rowdy children began running down the escalator. The children had just come from a sporting equipment store and had purchased a basketball. As the children were running down the escalator, they began throwing the ball to one another. The basketball hit the man in the back causing him to slip and fall on the escalator. The man suffered lower back and neck injuries from the incident. It was alleged that the mall had insufficient security measures and was negligent in monitoring the children in question. An expert in mall security with experience in escalator safety was sought to discuss the protocols that exist to prevent such incidents.

I have 30+ years of experience in retail loss prevention and I spent 20 years as a director of security for various retailers located in malls. Measures to prevent incidences such as this should include visible roaming security officers on mobile foot patrol and strategic camera placement in main stairways, exits and entryways, escalators, common pathways, food courts, and balconies. There should be around-the-clock staff monitoring the live feeds. In addition, mall security should inform retailers how to best report incidences to them that they feel are unsafe.

1. Please describe your experience in mall security. 2. What protocols exist, if any, to prevent this kind of accident? 3. What standards exist regarding regular surveillance of all parts of the mall?

Allegedly Insufficient Mall Security Blamed For Escalator Accident

This case involves the alleged secretive filming of female students at a large university. A female student first noticed what appeared to be an additional clothing hook in the shower of the shared bathroom of her dorm building. She thought that it was odd, but did not report it. The following week, the hook was gone, and it appeared in the room of another female student on the floor. The student opened the hook and found a covert, motion-activated recording device. The plaintiffs tried to view the footage on the camera but could not access any. They believed the footage had already been downloaded by the perpetrator by the time they discovered the device. The plaintiffs informed the university of this invasion of privacy expecting swift corrective action but the university did not undertake any efforts to perform a thorough search to identify the source of this covert device. The plaintiffs repeatedly went back to the university to request an investigation. However, the university contended that because there were no security cameras near the plaintiff’s sleeping quarters, there was no evidence of illegal recording. An expert familiar with forensic data recovery was sought to speak to the potential capability of recovering this data and opine on the theoretical ability to view this downloaded video and to test if it had been downloaded on campus.

I routinely work on cases where forensic data recovery based upon file signature analysis and "file carving" is necessary to help prove or disprove a claim. Video and/or picture files are generally stored in one of several common formats, which is defined by file headers and other file metadata accompanying the particular files. Generally speaking, unless the digital media storage device on which the images were stored has been wiped (not deleted), the images would be recoverable. Downloading or uploading of the data would require two basic components: hardware and an internet connection. The hardware which was used to upload the images would likely contain trace evidence of the storage media on which the images were stored. The hardware may also contain evidence of the internet connection (IP address) that was in use at the time of the upload. There may also be trace evidence of the specific image files, either deleted or undeleted, on the memory storage of whatever device was used to upload the images. Time is a crucial component in recovery of this data. The more time that has passed since the incident without a forensic image (copy) being made of the original hardware devices suspected to be used, the greater the likelihood that some or all of this data will not be available. I am familiar with open source investigation and intelligence techniques that would help monitor the potential appearance of this video on the open internet.

1. Please briefly describe your familiarity with forensic data recovery as it relates to a case like this. 2. Can you speak to the potential downloading and uploading of this data? 3. Are you familiar with tactics to monitor the potential appearance of this video on the internet?

University Fails To Investigate Claims Of Illegal Video Surveillance

Electrical Devices and Electronic Systems

Licensed Professional Engineer Thirty years in Defense industry Communication, Navigation, Countermeasures Analysis of audio and video surveillance Tracking systems including GPS Mobile phone localization Electrical and electronic failures Qualified many times as expert in radio and electronics

Reviewed Cases: over 300 Been Deposed: 60 Trial: 30 Split: 50-50

Visual Surveillance Expert Witnesses

Find an expert witness near you

Visual Surveillance Expert Witness Case Studies

Improper installation of home security system leads to two burglaries

Video Forensics Expert Discusses Security Camera Footage Recovery in Criminal Trial

Allegedly Insufficient Mall Security Blamed For Escalator Accident

University Fails To Investigate Claims Of Illegal Video Surveillance

Connect with the Visual Surveillance expert witness you need to win your case