Security

Balancing Physical Security and Privacy in Higher Education: A Practical Guide

Cutting-edge physical security comes with benefits and risks. Colleges and universities must balance them carefully.

Oliver Garcia Hernandez is a Senior Field Solution Architect for CDW.

Video surveillance, face recognition and artificial intelligence have become common in physical security. For colleges and universities, that raises some serious questions about privacy.

Benefits to the safety and well-being of students range from being able to more quickly identify an on-campus intruder to improving access control for staff and faculty. But the potential risks include new administrative burdens, spiraling costs and running afoul of local privacy laws.

The key to using cutting-edge physical security technology responsibly is striking a balance among protecting people, property and premises and respecting local privacy regulations.

Click the banner below for deeper insight into enhancing campus safety.

The Current State of On-Campus Physical Security

Higher education institutions typically use three main categories of physical security technology: video surveillance systems, access control and badging systems, and environmental sensors for more specialized use cases.

Environmental sensors present minimal privacy concerns. For example, temperature sensors, air quality monitors and occupancy counters collect data without capturing personally identifiable information. Even occupancy counters used in stadiums, auditoriums and other campus settings will only tell you how many people are in a space, not who those people are.

Access control systems with biometric authentication, such as fingerprint readers or face recognition for building entry, also carry a relatively low privacy risk when used for employees and staff. Biometric authentication is best deployed as a multifactor authentication method for high-security areas such as laboratories handling pharmaceuticals, chemicals or hazardous materials, and it is typically done with the knowledge, consent and participation of campus staff.

The greatest complexity emerges with video surveillance and face recognition technology deployed in public-facing areas, such as city campuses and colleges that contain hospitals, healthcare and other public services onsite. This is where institutions must tread carefully.

WATCH: Bowie State University modernizes its physical security system.

Privacy Challenges for Higher Education

Video surveillance on campus creates several distinct privacy risks. First, there’s the issue of collecting and retaining biometric data such as faces, identifiable information and, in the case of medical facilities, HIPAA-protected data. Second, as public or quasi-public entities, universities are subject to Freedom of Information Act (FOIA)requests. If you’re recording street corners and public thoroughfares around campus, you may find yourself legally obligated to provide footage for incidents that didn’t even occur on your property.

Perhaps most timely and significantly for higher education, campuses have historically been centers of political activism and debate. Demonstrations, sit-ins and marches are part of campus life. When law enforcement requests video evidence that could identify participants in these activities, institutions face difficult decisions that may conflict with their community values and governance structures.

The patchwork of regulations across the U.S. adds another layer of complexity. Many cities, such as San Francisco, Boston, Minneapolis and Portland, Ore., have banned face recognition technology. Meanwhile, Illinois, Washington and Maryland have restrictions around biometric data collection and use.

SUBSCRIBE: Sign up to get the latest EdTech content delivered to your inbox weekly.

Strategies for Responsible Deployment of Physical Security

First and foremost, be judicious about where you deploy face recognition. Private companies have some latitude when it comes to collecting employee data, but public institutions must closely adhere to rules about what data they collect on constituents. Identify very specific use cases and locations where face recognition provides clear security benefits rather than deploying it campuswide — provided your jurisdiction allows for its use.

Second, you can minimize your exposure to FOIA requests by limiting what your cameras capture. This can be as simple as angling cameras downward to focus on your building entrance, with minimal sidewalk or street coverage. Some institutions use technology to blur or mask certain areas from recording entirely.

Third, establish clear retention policies. Rather than keeping video data indefinitely based on available storage, set specific retention periods. Thirty days typically makes the most sense for most higher education applications. This policy-driven approach provides legal protection when requests come in months after an incident. If your documented policy is for a 30-day retention, and someone requests footage from six months ago, you can’t be expected to have that data anymore.

Video redaction technology, commonly required in K–12 environments, is also available for higher education. While less critical when dealing with adults, this technology allows institutions to blur faces before sharing footage with law enforcement or other entities.

Finally, traditional face recognition isn’t the only use for AI and pattern-recognition technologies. Similarity search technology analyzes physical characteristics such as height, apparel and even gait without storing biometric data. It can therefore identify individuals with a degree of probability but without the typical biometric privacy implications.

The Benefits for Higher Education Are Real

Despite the challenges, there are legitimate security benefits to these technologies. Face recognition excels in incident investigation. If someone breaks into a building, you can quickly determine where else they’ve been on campus. You can also use face recognition or other forms of pattern-recognition to set up proactive alerts when banned individuals attempt to return to campus. Similarly, biometric access control ensures that only certain authorized personnel can enter restricted areas.

The key to deploying these tools thoughtfully is to develop clear policies around their use that include appropriate safeguards based on local regulations and desired outcomes. Higher learning institutions must work with technology partners who understand the nuances of the region or municipality, as well as exactly what the college is trying to achieve. Everything from storage expenses to the specific technology used, the risks tied to it, the type of campus (urban vs. suburban) and regulatory constraints will determine the most sensible setup. You shouldn’t have to navigate that alone.

AI, biometric data, pattern recognition and other cutting-edge technologies are unquestionably ingrained in physical security. Meanwhile, state and local legislation are still playing catch-up. Higher ed institutions that have thoughtfully addressed the benefits and risks from the start will be well positioned to protect their communities while respecting individual privacy rights.

This article is part of EdTech: Focus on Higher Education’s UniversITy blog series featuring analysis and recommendations from CDW experts.