LAPD body cams: Cloud storage raises concern

Los Angeles Mayor Eric Garcetti will present this month his proposed city budget for the coming year. It’s expected to include money for body cameras for all Los Angeles Police Department officers. But some security analysts argue the LAPD’s plan to store body camera video in the cloud could make the images more vulnerable to attack than if the department placed them on its local servers.

The LAPD plans to deploy cameras on 7,000 officers, beginning this summer. Officers wearing cameras are expected to create tens of thousands of hours of video and upload them at docking stations at the department’s 21 divisions after each shift.

“The inherent nature of the cloud is to allow easier access remotely from multiple places,” said Hanni Fakhoury, senior staff attorney for the Electronic Frontiers Foundation. “That creates weaknesses in terms of where an attacker can come from.”

The department is still working on a policy for what’s kept and for how long. But the video will include everything from innocuous traffic stops to gruesome crime scenes.

“Police data about citizens is highly sensitive,” said Paul Rosenzweig, a former official with the Department of Homeland Security, who now works as a security analyst with The Chertoff Group.

“Imagine the interview with a woman who has just been beaten by her husband.”

But both analysts said the jury's out on whether storing in the cloud is more vulnerable than storing on local department servers.

“In some ways, cloud storage may be better because the providers have more resources to devote to security,” Rosenzweig said.

“This is not easy to do well,” said Wolfgang Kandek, chief technical officer for Qualys, a company that provides security-scanning technology. “You need significant resources and cyber security specialists. And there are not a lot of people out there who know how to do it.”

LAPD body camera video will be cloud-stored at Amazon World Service under a contract the department has with Taser International. Taser is providing cameras (including two replacement cameras), docking stations and unlimited storage for $85 per month, per officer under a five year contract, according to the department. The contract covers 860 cameras.

In a report to the Police Commission, the LAPD’s IT department called the plan, “secure and reliable.”

“We meet or exceed the standards set by the Criminal Justice Information Services Division of the FBI,” said Taser spokesman Steve Tuttle.

Numerous big companies that handle sensitive information like credit card numbers and government agencies use the cloud to store information now. It’s cheaper and in many cases easier to manage, said Kandek.

Taser and the LAPD did not answer questions about whether the video would be housed on separate servers at Amazon, nor whether the data would be encrypted. 

Given the amount of data expected to be collected by the LAPD, Rosenzweig said it may make more sense to store it in the cloud rather than “stuff the LAPD basement with more servers.”