I walked into a Marriott hotel last week – probably the millionth time I’ve done that in my life – and I felt perfectly anonymous. I always feel that way when I enter a public place. Unless I’m wearing a name tag for some company or conference, I feel like an undercover agent slipping around in “stealth mode.” I feel private.

But then I read the story of a Chicago hotel that uses facial recognition in conjunction with a series of surveillance cameras. OK, what’s so surprising about that? The hotel management wants to be able to find troublemakers as they move through the hotel. The recognition software and cameras help them do that quickly. Response is quicker and everyone is safer. What’s not to like?

And I look at all the cameras going up around my home city of Chicago – on the street corners, in the subways, at building entrances.

Suddenly I feel a lot less private.

Over the years I never really had a “big brother” feeling about the security recommendations I was making. Think of all the security directors and chief operations officers over the years who followed my counsel and deployed various surveillance technologies. It seemed alright because the security personnel were a fairly limited group of folks with access to the video, and tapes wore out or were re-used so video images had a short life.

Bits and Bytes

But now everything is digital. Data. And data never dies. Video images are stored flash memory, moved to hard drives and then archived to huge storage arrays. The bits and bytes of my face moving through hotel lobbies are safely ensconced in these computers – for now. But what about a year from now, or many years from now. With storage becoming cheaper, maybe we’ll never erase those disks. And with the Google mindset that I wrote about in this column two months ago getting more pervasive, maybe we’ll be able to Google any video image of any person at any time. Suddenly feeling private seems impossible.

I just know that someday I’ll be able to use analytical software and search engines to find any senator, any business manager, any neighbor as they walk through city streets, entering health clinics or hotels, banks or peep shows. Not this year, but someday. And even if the person has done nothing wrong, a group of cleverly assembled “casual” video images can look pretty scandalous. I know because the same thing happens to companies with loose e-mail retention policies.

People write e-mail in a casual way, with typos and subtleties of meaning meant for the intended recipient. But an auditor or prosecutor searching e-mails can find plenty of damaging evidence in day to day messages about sales forecasts, comments about fellow employees, and practical jokes. Deleting e-mail from your Outlook is no guarantee that it is gone. It was probably already mirrored on the server in the data center. In fact, if a bit of time has gone by, it was already backed up onto a tape and driven to some storage facility for posterity.

Video captures facial expressions, specific actions and behaviors that may be useful to archive for awhile, but which will surely get into the wrong hands someday if not properly managed. And when it does, it is going to look very bad for the company that originally captured the video – before it was leaked to the public domain, or before the freedom of information act made it available.

So now I make another recommendation to my clients. I suggest setting policies and procedures to limit archive periods, and to cleanly wipe all disks with expired video images. Normal policies for retention of images is just over two weeks in some companies, stretching to 6 months in others. The policy should ensure that administrators do not have rights to make unauthorized copies of video, and that backups are precisely recorded. Disks should routinely be wiped or even degaussed, and retired disks should be completely destroyed by competent disk destruction services.

Video retention policies are a low cost way to avoid an obvious and frightening risk in the future. Plus it allows us to have a little bit of the secret agent fun of walking around in stealth mode.