​

BY THE TIME A TRASHCAN FIRE WAS DISCOVERED in a restroom at the Dallastown Area Senior High School, the culprit had made a clean getaway—or so he thought. In fact, the York County, Pennsylvania school district had a new IP (Internet Protocol)-based surveillance system, and IT Network Manager Brian Arnold was able to log onto the school’s system, pull up the camera in front of the restroom where the fire had started, and watch video of everyone who entered and left that restroom minutes before the alarms went off. Arnold presented the information to the superintendent, and about 15 minutes after meeting with the students in the surveillance video, the school had a confession.

The high school, along with a connected middle school and administration building making up the same campus, is part of the Dallastown Area School District. Also in the district are five elementary schools.

The area’s limited security staff consists of a single school resource officer responsible for the entire district and a part-time employee who is charged with some security-guard type duties. The small staff size translated into limited security capability before the surveillance system was upgraded. At that point, the district had only a small system of analog cameras that were mainly used for viewing, not recording. On the occasions when the footage was recorded, it went straight to videocassette recorders.

Cameras were originally used for monitoring students when they were taking standardized tests at the school—a requirement of the test sponsors. For security purposes, the cameras were also set up at the school entrances so that the school’s administrative staff could see who was at the door before buzzing visitors in.

David Barley, the school resource officer who is also an officer with the York Area Regional Police Department, realized that a state-of-the-art surveillance system could act as a force multiplier and a potential bad behavior deterrent for the students.

There had not been any incident to spur the move toward better surveillance, but the district believed in being proactive. That attitude may stem in part from its proximity to some major incidents of violence. For example, Arnold says a neighboring district experienced two deaths a few years ago when a student shot a principal in the chest and then shot himself. A parent wielding a machete attacked teachers and students in an earlier incident in that same district. In addition, the Dallastown school district is about a half-hour away from Lancaster, Pennsylvania, site of the 2006 deadly Amish schoolhouse shooting.

Barley began lobbying the school district for a new system about five years ago. “I’m one police officer in a middle school and a high school with 3,500 to 3,600 students. So, the more eyes I have, whether it be faculty or cameras, the easier it makes my job,” he explains.

Initially, Barley was told that the district would need grant funds to implement such a system. He later gained the support of the school principals. Thanks in part to his efforts, the middle school, the high school, and the district’s buildings and grounds department each donated $50,000 of their budgets to the project for the last fiscal year, for an initial budget of $150,000. When other projects came in under budget, the surveillance system received an extra $75,000 in funds, according to Arnold.

The first phase of the project was the installation at the high school; it was completed in the fall of 2007. Among the issues facing the district in undertaking this project were the choice to go with IP, which manufacturer to use, and whether to seek outside help from an integrator.

Choosing IP

The IT department took the lead on the project because the network implications required the technical expertise of that department. Shortly after the district made the decision to go ahead with the surveillance system, a team that included the director of IT (Don Robbins), Barley, and some additional school administrators visited a local school district to take a look at its analog security system. Robbins immediately spotted the limitations of that system, including the lack of centralized management and the need to run coaxial cable throughout the buildings. Robbins never considered anything other than IP after that.

There were other reasons IP made sense for Dallastown, according to Arnold. To begin with, the badging and security access systems were already managed by the IT department. Thus, IT was already involved in maintaining the district’s security systems, and while CCTV was completely foreign, IP technology was definitely not.

“When we came across a new concept involving the IP system, our vendor was able to easily explain it to us, since we already understood all our networking concepts,” Arnold says. IP was much more in the realm of the department’s comfort level than an analog system would have been.

Additionally, the IP technology meant that the video would be accessible remotely via the Internet from any PC as long as the user had the proper password and Web address. That would be a great benefit since no one was going to be dedicated to viewing the footage throughout the day.

Another major reason that IP was chosen was for a capability the school district hopes to be able to install in the not-too-distant future. They want to extend their network to the edges of the physical campus, such as the outer edges of the parking lots, by using wireless Ethernet bridging. Arnold describes it as an extension of the network through an access point that might be placed on a rooftop or light pole, for example.

With an Ethernet access point at the edge of the campus, a police officer in the school’s parking lot could log in to the school’s surveillance system and remotely view any camera’s feed. That way, an officer could, for example, view what was happening inside the school before entering the building in an emergency.

Design

After the initial budget allocation, the key players got together to outline their needs for the system in November 2006. The school administration and Barley definitely wanted remote access capability as well as the ability to store data for at least 14 days. They wanted cameras to be installed at school entrances and wherever large groups of people gather, such as in cafeterias and lobbies. Also important were the outsides of the bathrooms. “That’s where we tend to have issues of vandalism, things like that, because the kids are really in there by themselves,” says Arnold.

Wiring was another issue. In implementing IP systems, companies and schools often have to make the choice between installing a separate network for the security system (which can be expensive) or running it on the existing network, which might bring up storage and bandwidth issues. For Dallastown, this choice was easy, because the district already had several strands of unused fiber wiring in each of its wiring closets from an earlier networking project. That extra fiber enabled the IT department to create a separate network for surveillance.

This choice had multiple advantages. “We don’t have to share bandwidth with our existing network traffic, and there’s an additional layer of security, since it’s an additional network,” Arnold says. The Dallastown networks have a very large bandwidth to begin with; there is a one-gigabyte connection to every desktop and server in the district.

The IT department members now knew what they wanted to do, they just weren’t sure what equipment to do it with. They had to decide whether the district should use one manufacturer or pull pieces from various different manufacturers. Since the IT department wanted to handle the whole project, staff decided that it would be more seamless to buy all of the equipment from the same company.

“In IP, you spend a lot of time trying to get products from different manufacturers to play nice together,” Arnold says. Instead of wasting that time or having to hire an integrator to make the parts work together, the department opted to go with a large manufacturer that would have everything the district needed.

“Various research we’d done about IP systems kept leading us back to Bosch,” says Arnold. He adds that he was already familiar with Bosch Security Systems because his brother, who is a security director with the Charlotte Convention Center, also uses a Bosch system. Additionally, the district knew Bosch had the capabilities they were looking for, including the IP cameras and the ability to facilitate future upgrades. Bosch was one of the companies that had a state contract to sell to schools in Pennsylvania, and the school did not have to enter an independent bidding process when it chose to buy from a state-contracted Bosch vendor.

A Rocky Beginning

Not involving an integrator to provide advice and guidance was one of the biggest missteps Dallastown made, Arnold notes. His department figured that because of their knowledge of IP and networking, they would be able to choose cameras and put the system together almost entirely on their own. “Our main plan up front was really just to run this entire plan ourselves,” Arnold says.

He’s wiser now. “It really seems rather foolish in hindsight,” he admits.

“We developed our budget and purchased some of the equipment before we even contacted an integrator. And as a result, we had to adjust the scope of the project after the integrator got involved, because there are some things we didn’t necessarily understand that we thought we did,” says Arnold.

Before he involved an integrator who had knowledge of the cameras and other system components, such as software and storage, Arnold says, his department was making some uninformed choices. While they understood networking, they knew nothing about camera features and functionality.

For example, they incorrectly estimated how many cameras they could afford based on their inexperience in working with cameras and reading the product catalogs. Another mistake was that the district was ordering too many telephoto lens cameras, when often what they really needed were wide-angle lens cameras in situations such as hallways where they wanted to cover more space.

The team at Dallastown finally brought on the integrator company, which was Bosch manufacturing representative Midlantic Marketing, LLC, in April 2007 when they were finalizing the system plans. “It was at that point where we realized we were just completely in over our heads as far as handling the project ourselves,” says Arnold, who adds that the state-contracted vendor recommended that Dallastown work with Midlantic.

With the integrator’s advice, the IT department realized that the project had to be scaled back, because the IP cameras cost more than they had anticipated. It went from aiming at installing 132 cameras initially to about 90. That meant that the middle school would not receive as many cameras at first, and the district would concentrate on the high school. The middle school’s cameras would initially be limited to entrances.

Arnold says the integrator, Matt Golueke of Midlantic, “rescued the project” by helping the school district figure out which cameras they actually should be ordering, what the initial scope of the project should be, and how to set up the storage mechanism and software.

Although they needed some help in ordering the equipment and modifying the design, the IT department’s plan to run the system once it was installed was a reasonable goal. “They are IT savvy and can easily and proficiently manage or even expand the system,” says Golueke.

Implementation

Setting up the cabling infrastructure for the IP-video system was not difficult. As noted, the district’s buildings already had several strands of unused fiber wiring in each wiring closet from an earlier networking project. That extra fiber enabled the district to create a separate network for surveillance fairly easily.

By contrast, the actual running of the cables and installation of the cameras posed one of the project’s biggest challenges, because of scheduling difficulties. The school district wanted to have control over the project and was relying on its buildings and grounds department to put the cameras up. But neither that department nor any other in the school works on nights or weekends. Therefore, the work had to be done during the day when students would be in the buildings.

The district decided that it should install the cameras while students were in class. If they were between classes and flooding the halls while work was ongoing, that would pose a safety risk to workers and students. However, that plan gave the workers only a small window of time to complete each installation.

“For a standard company, you would just have somebody come in one or two days, run all the cable, throw your cameras up, and that’d be the end of it,” explains Arnold. “It took us a couple of months, because they had to work around all those students,” he says.

It was not just the need to work around student schedules that caused delays, however. Arnold notes that his department did not set a hard deadline by which the work should have been completed, and he now believes that was a mistake. He suggests setting up deadlines for any project like this, even if it is being completed in-house.

Switches. The schools already had normal network switches that could have been used for the project, but they decided to go with Power over Ethernet instead and purchased ProCurve switches from HP. The switches allow both power and data to be run over the Ethernet connection to network devices.

It simplified the wiring, according to Golueke, because the school did not have to hire an electrician to put in a power line to each camera location in addition to the Ethernet line. The need for extra power would have restricted the locations of the cameras and driven up the cost for the project.

A drawback to Power over Ethernet, according to Arnold, is the need for a power brick in the wiring closet for each device. The alternative would be to buy a more expensive Power over Ethernet switch that actually provides the power itself.

Firmware. Aside from the physical installation, there were technical duties that the IT staff handled, such as setting the cameras up with IP addresses and upgrading firmware, which is software that is embedded on a hardware device. The firmware allows the users to connect to the cameras over their Web browsers.

Arnold and the IT department completed the firmware installation and set up the cameras on the network without much trouble. After the infrastructure was laid down and the network was prepared, Midlantic came in for a one-day back-end installation to get the system up and running. This consisted of mainly setting up and configuring the storage system.

Storage. Dallastown opted to store its data in Internet small computer system interface (iSCSI) disk arrays that would be managed by Bosch’s Video Recording Manager (VRM) software.

The use of the VRM is described by Golueke as a “halfway point” between pure iSCSI and a network video recorder (NVR). Normally iSCSI requires that you set up logical unit numbers (LUN), or little “storage buckets,” on the disk array for each camera. The VRM does the calculations of space needed on its own, and it reallocates space on the disk array if, for example, one camera needs more space than another. Golueke refers to it as a “behind-the-scenes traffic cop.”

One of the major reasons Dallastown chose iSCSI was because it is scalable, and they could add more cameras and more arrays at any point. The arrays currently hold 14 terabytes of data.

Although iSCSI seems to just be catching on in the surveillance world, the Dallastown IT department had already been using that technology for network storage because it was more cost effective for them than leasing a fiber channel storage area network (SAN), a separate network that maintains storage between servers. They had been using a SAN prior to switching to iSCSI.

It made sense to use iSCSI, rather than trying to learn all about NVRs or other similar technology with which the IT department was unfamiliar. “Because we’re coming into this brand new, we’ve never even heard of an NVR,” Arnold says.

Additionally, a fiber channel would have called for more fiber network cable running to each device, whereas the iSCSI is a fiber channel done virtually; it runs on a standard network card that is installed in a computer.

Camera installation. As of last fall, the Dallastown Area School District had installed about 60 of the 90 planned-for cameras. They were put in the high school in the first phase of the project, and the remaining cameras were to be installed at the middle school. Cameras have been placed at every entrance to the high school. In high traffic areas, such as a lobby or a cafeteria, there are up to six cameras to cover all angles.

The locations of the cameras are something the district is still trying to get down. “We’re revisiting some of the locations and changing some locations and tweaking the angle of the cameras, and I’m sure that’s going to be an ongoing process pretty much forever,” Arnold says.

The cameras, all of which are Bosch color IP Flexidomes, are set to send data through the VRM to the iSCSI continuously at 2 CIF and 30 frames per second (fps) during the day hours, and at 2 CIF and 5 fps after 6 p.m., kicking up to 30 fps when motion detection is activated. Feeds are stored in the array for at least 14 days.

Another feature of the cameras that Arnold likes is that their Web servers are password protected and different users can be granted different levels of access. In that sense, Arnold says, it’s very much like other network and physical security systems: “You don’t want to give anybody a greater privilege than they need to do anything.”

Arnold is hoping to get additional funds that can be used to expand the project to include cameras at the entrances of the elementary schools and in a new intermediate school that is under construction. Additionally, the district has purchased pan-tilt-zoom IP cameras for the parking lots, but because those cameras aren’t capable of Power over Ethernet, the district must wait for the opportunity to have an electrician run a power supply to the location on the outside of the building where the cameras will be installed.

“We have problems once in a while with student cars being broken into, CDs, players, things like that being taken…. To have that ability to be able to go back and look at what’s occurring in our parking lot is my biggest projected hope in the future,” Barley says.

The school district is also interested in perhaps adding megapixel cameras for the parking lots to enhance the ability to see details, such as license plates, says Arnold. But given that they require more storage and bandwidth capacity, they would use them sparingly. For example, Arnold says, an option might be to set the cameras up at license plate level at the front entrance where parents drop off and pick up children, and have the cameras set to record only on motion at that location.

Arnold recently tested the motion detection alert and he was happy with the results. The schools might use the alerts during the evening hours when no one is on the campuses, he says.

Web interface. Arnold decided to set up a Web interface on the school intranet so that it would be easier for users to access cameras. The Web site allows people to look up cameras by location, rather than by IP address. Arnold has found that the training on how to use the system has been very smooth.

“I’m really shocked at how quickly everybody’s taken to the new system,” he says. He attributes that to the fact that the district was very enthusiastic about the project once the planning began.

Results

The IP surveillance system has already proved helpful in various incidents in Dallastown, ranging from scuffles to vandalism. The system has also assisted the district in rooting out bullying behavior.

“It’s really subtle little things that bullies do that can’t be proved, there are no physical marks. And then typically their buddies all stand up and say, ‘I was right there, and he didn’t do anything,’” says Arnold.

The cameras now allow the school to prove that bullying took place, because images of actions like taunting and shoving are captured. With that evidence, the school then has grounds to discipline the bully.

Another example of how the system is helping is that the schools can now identify students who are leaving the building without permission and people who should not be coming into the building at all, says Barley.

Dallastown hadn’t experienced any major school violence situations that served as the catalyst for the new surveillance system. The district just likes to be proactive, Barley says. He adds that now if a crime occurs, they “have the video, which is difficult to fight.”

Laura Spadanuta is an assistant editor at Security Management.