Procedure for Safety & Security Cameras and Video Equipment 1026
Effective Date: 11/4/2026
Purpose: These procedures implement the University of Montana Cameras Safety & Security Cameras and Video Equipment Policy and establish the operational processes for requesting, approving, installing, operating, accessing, retaining, and reviewing University security camera systems.
1. Definitions
Security Camera System. A camera or network of cameras and associated technology used to capture, transmit, monitor, record, store, or review video for campus safety or security purposes.
Public Area. An area in which there is generally no reasonable expectation of privacy, such as campus grounds, academic corridors, common areas, parking areas, walkways, stadiums, arenas, and similar public spaces.
Private Area. An area where individuals have a reasonable expectation of privacy, including restrooms, locker rooms, showers, occupied residence-hall rooms, and similar private spaces.
Authorized Personnel. Individuals authorized under these procedures to access or manage live or recorded security camera information.
Person of Interest (POI). An individual designated by authorized personnel for a documented safety or investigative purpose, limited to locating or correlating appearances in available video and not involving automated biometric identification.
2. Safety & Security Technology Oversight Group (SSTOG)
SSTOG reviews and approves or denies proposals for University security camera equipment and provides oversight of camera technology and practices. SSTOG may recommend changes to these procedures and the related policy.
SSTOG consists of:
- Chief of Police, Chair;
- Associate Vice President of Campus Preparedness and Response;
- Executive Director of Cyberinfrastructure, or designee;
- Facilities Project Manager II/IT;
- Director of Office of Risk Management, or designee; and
- Member of University Legal Counsel, ex officio.
3. Requesting a New Camera or System
Any University unit seeking to install, expand, relocate, replace, or materially modify a security camera system must submit a Work Order request.
The request should identify:
- The proposed location(s);
- The safety, security, property-protection, event-management, or investigative need;
- The proposed camera coverage and intended use;
- Alternative solutions considered, where appropriate;
- Any anticipated privacy considerations;
- The proposed owner/operator and responsible unit;
- The proposed data-storage and retention arrangements; and
- Funding, installation, maintenance, and lifecycle responsibilities.
The Chief of Police, in coordination with SSTOG and the appropriate University offices, will evaluate the request for consistency with this policy, applicable law, privacy considerations, technical standards, and operational need. No new system may be installed, activated, or materially modified before required approval is documented.
4. Procurement, Installation, and Technical Standards
- Security camera equipment must be procured through the University’s established procurement and technology processes.
- Cyberinfrastructure will establish or approve applicable technical, cybersecurity, interoperability, scalability, and data-storage standards.
- Facilities will coordinate installation and address physical, architectural, electrical, and maintenance considerations as appropriate.
- Installations in shared facilities should include consultation with affected stakeholders.
- Cameras should be visible and positioned to minimize unnecessary capture of private areas.
- Architecturally significant spaces should be evaluated for visual impact.
- Audio recording must be disabled unless specifically authorized.
5. Existing and Legacy Systems
Existing security camera systems must be identified and evaluated for compliance with the policy and these procedures. Units responsible for legacy systems may be required to provide the system location, purpose, ownership, maintenance arrangements, storage location, retention period, and authorized users.
Where feasible, legacy systems should be brought into the University’s approved technical and security environment. Future upgrades or material modifications must comply with the policy and these procedures.
6. Camera Placement and Operation
- Cameras may be installed only in public or otherwise authorized areas.
- Cameras may not be installed in private areas or positioned in a manner that unreasonably intrudes on privacy.
- Technical masking, redaction, or comparable controls should be used when necessary to avoid unnecessary capture.
- Cameras are not continuously monitored. Live monitoring occurs only when there is a legitimate operational need, such as an emergency, active incident, investigation, special event, alert, or public-safety concern.
- Monitoring must be purpose-driven, limited in scope, professional, and lawful.
- During events, monitoring may support crowd safety, operational awareness, and incident response, but should not be used for generalized tracking of individuals absent a specific safety or investigative need.
7. Access to Live and Recorded Video
The Chief of Police or designee determines access levels based on operational need. Access is limited to authorized personnel.
- Users must complete required training before receiving access.
- Users must comply with confidentiality requirements and information-security protocols.
- Each access to recorded video should be logged, including the requester, date, time period accessed, purpose, and person fulfilling the request.
- Access may be suspended or revoked when no longer required or when misuse is suspected.
8. Review and Use of Recorded Video
Recorded video may be reviewed for:
- Safety or security purposes;
- Investigation of reported incidents or suspected violations;
- Emergency response;
- Legal proceedings or preservation of evidence; or
- Other purposes specifically authorized under the policy.
Review must be limited to the footage reasonably necessary for the authorized purpose. Personnel may not use video systems for generalized monitoring of individuals or groups engaged in lawful activity.
9. Person of Interest (POI) Designations
- A POI designation must be supported by a documented and articulable safety or investigative purpose.
- POI use must be limited in scope and reviewed periodically.
- A POI designation must be removed when the documented purpose no longer exists.
- POI procedures do not authorize facial recognition, biometric identification, or automated comparison against identity databases.
10. Storage, Retention, and Deletion
- Video data must be stored securely and protected from unauthorized access, modification, disclosure, or destruction.
- The standard retention period for ordinary security camera video is 30 days unless a different period is established under University records-retention requirements.
- Footage must be preserved beyond the standard period when necessary for an investigation, legal proceeding, administrative review, litigation hold, public-records request, or other legal obligation.
- When retention is no longer required, video must be securely deleted or overwritten in accordance with applicable University requirements.
11. Requests for Access, Disclosure, or Preservation
- Requests from law enforcement or other external entities must be referred to UMPD and, when appropriate, University Legal Counsel for review.
- Requests for records under applicable public-records laws must be handled through the University office responsible for public-records compliance.
- Personnel must not delete, alter, conceal, or withhold video that is subject to a lawful preservation or records request.
- Video may be shared externally when required by law, subpoena, court order, or other lawful authority, or when otherwise authorized by University policy.
12. Signage and Transparency
The University will provide reasonable notice of security camera use through clearly visible signage or other appropriate notice. Signage should communicate that cameras may be in use without suggesting that individuals are subject to continuous monitoring.
13. Security, Auditing, and Oversight
- System activity must be logged to the extent supported by the technology.
- At least annually, the University should review user access, system use, data-handling practices, and compliance with these procedures.
- Audits should be documented and reviewed by the appropriate oversight authority.
- Suspected misuse or unauthorized access must be reported promptly to the Chief of Police and handled under applicable University procedures.
14. Exceptions
Exceptions should be rare and must be documented. An exception request must identify the operational or contractual need, the provision from which an exception is requested, the proposed duration, and measures that will mitigate privacy, security, or legal risk. The Chief of Police will coordinate review with SSTOG, University Legal Counsel, Cyberinfrastructure, and other appropriate University officials.
15. Complaints and Violations
Questions or complaints about University security camera systems may be directed to UMPD or SSTOG. Reported misuse will be reviewed and, when appropriate, investigated. Violations may result in suspension or revocation of access, corrective action, or discipline consistent with applicable University policies and agreements.
16. Review and Maintenance
These procedures should be reviewed at least every three years, and sooner when necessary because of changes in law, technology, University operations, or the related policy.