Audit of Procurement and Use of In-Car Video

Final Report

March 2015

This report has been reviewed in consideration of the Access to Information and Privacy Acts. An asterisk [*] appears where information has been removed; published information is UNCLASSIFIED.

Table of Contents

Acronyms and Abbreviations

CAP
Contract and Aboriginal Policing
CIO
Chief Information Officer
D/COMMR
Deputy Commissioner
ICVS
In-car video system
IM/IT
Information Management and Information Technology
NISO
National individual standing offer
PWGSC
Public Works and Government Services Canada
RCMP
Royal Canadian Mounted Police

Executive Summary

In-car video systems (ICVS) have been in use within the Royal Canadian Mounted Police (RCMP) since at least the 1990s, and they are recognized as an important policing tool. Both the capabilities of the technology and expectations around the capture of this type of policing evidence have evolved significantly during the time period since their introduction.

In late 2013, the RCMP issued a National Individual Standing Offer (NISO) for the purchase of new ICVS to fulfil its current needs. The needs assessment, completed prior to issuing the NISO, focussed on the video equipment to be placed in police vehicles and did not put adequate attention on the end-to-end system requirements, in particular data storage and related information management. Moreover, while many stakeholders were involved in the needs assessment, no single group assumed responsibility for ensuring all aspects of the purchased systems were properly considered, and that appropriate on-going management of the asset and resulting data was put in place.

At the time of the audit the majority of recently purchased ICVS systems were not in use. Divisions indicated that they were awaiting further Headquarters direction and assistance prior to fully implementing the new ICVS. In addition to further technical direction on how to efficiently transfer and store the resulting data, Divisions indicated that additional policy direction regarding when to capture this evidence and the required retention period is warranted.

The RCMP is currently developing a national digital asset management strategy which will apply to all types of video evidence, including ICVS. However, implementation of this strategy is not expected for some time and will not provide short-term resolution to the issues identified in the audit report. Rather, an interim solution specific to ICVS, which includes both policy and guidance on data capture, storage and retention, as well as technical assistance in the use of ICVS, is recommended to ensure efficient and standardized implementation.

The management response included in this report demonstrates the commitment from senior management to address the audit findings and recommendations. A detailed management action plan has been developed and actions are underway to amend policy to improve clarity and better ensure consistent use of the new ICVS. As well, a video storage solution aligned with the long-term digital asset management strategy is currently being piloted. RCMP Internal Audit will monitor the implementation of the management action plan and undertake a follow-up audit if warranted.

As ICVS is only one of several emerging technologies for gathering policing evidence, the lessons learned in the successful implementation of ICVS could serve to streamline the acquisition and implementation of other related policing equipment.

Management's Response to the Audit

The audit of Procurement and Use of In-Car Video Systems (ICVS) has highlighted risk areas and opportunities for improvement in the planning, procurement, use and replacement of this important technology.

Responsibilities related to management of ICVS are shared between a number of RCMP program areas and there is no champion with overall accountability for the replacement of ICVS. CAP, the policy holder for ICVS use, relies on internal resources to take on a proactive role to promote the successful implementation and use of ICVS. That said, moving forward, CAP will assume the role of project lead for ICVS.

Additional work will be undertaken to enhance the interim solution and to ensure that ICVS policy is updated to provide appropriate direction to the Divisions. A long-term solution for the collection, transfer and storage of digital data that meets Departmental Security and Information Management requirements remains unresolved and therefore must remain a priority for the organization. Shared Services Canada also has a large part to play.

In summary, the audit has raised awareness of the risks that can occur relative to the life-cycle management of all policing tools, particularly those that rely on quickly evolving technology. The scrutiny provided by the review process and resulting recommendations are of value to the organization and will invariably improve strategies to manage these tools and to prevent similar issues from occurring in the future.

D/Commr. Janice Armstrong
Contract and Aboriginal Policing

1. Background

In-car video systems (ICVS) have been in use in the Royal Canadian Mounted Police (RCMP) since at least the 1990s. Research papers document the numerous advantages of using ICVS, including contributing to officer safety, reducing the number of violent encounters with clients, lessening the cost related to formal public complaints by lowering their numbers, and providing easily accessible video evidence for investigative purposesFootnote 1. They are an important tool to improve accountability and transparency in policing. Increasingly, there is an expectation that video evidence will be available to support policing activities. ICVS technology has evolved rapidly. Newer versions allow greater flexibility in terms of data storage and retrieval.

The majority of ICVS in use within RCMP are older models that are nearing the end of their useful life. Accordingly, the objectives of this audit included examining the mechanisms in place to evergreen these systems and to assess whether management of the asset and the associated data could be improved.

To replace the existing ICVS, both a national individual standing offerFootnote 2 (NISO) and a one-time contract were established in November 2013 under the contracting authority of Public Works and Government Services Canada (PWGSC). The combined financial limitation of the two contracting vehicles is $21.5 million. During the 13-month period ending December 31, 2014, [*] new ICVS units were purchased across eight (8) Divisions totaling approximately $3.4 million in equipment and ancillary costs.

Responsibilities related to the management of ICVS are divided between various RCMP groups. Procurement and overall asset management are the responsibility of branches under the Chief Financial and Administrative Officer. The Contract and Aboriginal Policing Services Directorate, specifically National Traffic Services in consultation with Specialized Policing Services' Technical Operations Branch, is responsible for the requirement and specification definitions for ICVS as a policing tool. In addition, National Traffic Services is responsible to develop policy for the use of ICVS. The Departmental Security Officer plays a role by defining security requirements relating to the classification of data. The Information Management Branch under the Chief Information Officer (CIO) is responsible for establishing policy and a framework for the management of data obtained by ICVS. Also, the IM/IT Policy Centre under the CIO is accountable for the disciplines associated with the management of IM/IT, including ICVS.

Commanding Officers are accountable for their acquisition decisions and responsible for the stewardship of assets under their control.

In April 2014, the Commissioner approved an audit of the procurement and use of ICVS as part of the 2014-17 Risk-Based Audit Plan. While the objective and scope were specific to ICVS, the audit was intended to provide lessons learned and best practices which may more broadly apply to other policing tools, specifically those involving digital technology.

2. Objective, Scope, Methodology and Statement of Conformance

2.1 Objective

The objective of this audit engagement was to determine whether ICVS are appropriately managed and if associated data is collected, retained, accessed and disposed of in an efficient, effective and compliant manner.

2.2 Scope

The audit consisted of an assessment of the current practices at National Headquarters and in the Divisions, with a focus on recently purchased ICVS.

2.3 Methodology

Planning for the audit was completed in October 2014. In this phase, the audit team conducted interviews and examined relevant legislation, policies, directives, procedures and related management practices. Research and best practices from other policing services were also reviewed to identify common issues and concerns related to the procurement and use of ICVS.

Sources used to develop audit criteria include Treasury Board and RCMP policies, procedures and directives on procurement, information technology and information management. The audit objective and criteria are available in Appendix A.

The examination phase, which concluded in January 2015, employed various auditing techniques including teleconferences with three (3) Divisions, documentation review and analysis of the information obtained from National Headquarters and the sampled Divisions. Upon completion of the examination phase, the audit team held meetings to validate findings with personnel and debriefed senior management of the relevant findings.

2.4 Statement of Conformance

The audit engagement conforms with the Internal Auditing Standards for the Government of Canada, as supported by the results of the quality assurance and improvement program.

3. Audit Findings

3.1 Life-cycle Management of In-Car Video Systems

A more integrated approach to procurement and management of ICVS, which considers the end-to-end solution, would optimize the benefits of this asset.

Proper life-cycle management for the ICVS, similar to other assets, should include: timely, requirements-based acquisition; astute in-service management, including installation and maintenance; and an evergreening process for replacement and disposal. While various groups are involved in providing the full spectrum of life-cycle management activities, overarching responsibility needs to be assigned to one group in order to ensure coordination and that all stakeholder requirements are met.

Roles and responsibilities for ICVS

The roles and responsibilities for managing ICVS as a digital asset have not been clearly identified. A briefing by the Chief Information Officer to the Senior Management Team in October 2013 highlighted the requirement for improved governance and a less fragmented management model for video systems in general, including ICVSFootnote 3. This is in light of concerns that new video systems are currently being used without an overarching digital asset information management plan.

Many business lines are involved at the national level; however none have taken overall responsibility for the complete life-cycle management of ICVS. As a result, divisional counterparts are making local decisions about its procurement, implementation and use.

Replacing the ICVS equipment was not included in the 2012-13 to 2016-17 RCMP Investment Plan. This may have contributed to the absence of a clearly defined champion for ICVS replacement. As well, while a National Vehicle Equipment Committee exists to provide guidance for all installed equipment in RCMP vehicles, there is no evidence that they were actively involved in discussions regarding the replacement ICVS. This may be partly because the ICVS are not included in the minimum standard of equipment for RCMP vehicles, and their installation is up to divisional discretion.

Contract and Aboriginal Policing is responsible for identifying the needs for policing tools and for establishing policies regarding their use. However, they have not taken a proactive role in ensuring all components are in place to promote a consistent implementation and use of ICVS.

Requirements planning and establishment of the NISO

In 2009, PWGSC reminded the RCMP that the existing NISO for ICVS would expire in January 2010. A working group was established, with Protective Technical Services Branch taking the lead in determining the technical requirements and serving as the Project Authority for the new NISO. The working group included representation from Asset Management, the CIO Sector, Contract and Aboriginal Policing, Legal Services, Protective Technical Services Branch, and Procurement. A fulsome assessment of ICVS needs was completed which included input from the Divisions.

The NISO was issued in November 2013 which resulted in a period of over three (3) years whereby a national contractual agreement was not in place for the procurement of ICVS. To meet their needs in the interim, one (1) Division established an independent contract in order to make a one-time bulk purchase for ICVS. While intended to expedite the purchase and meet their needs in a timelier basis, in actuality the NISO and the independent contract both became effective in November 2013. [*]. The individual price of the units under the independent contract was higher than the units purchased using the NISO. However, when full costs are considered including data storage, the cost difference is reduced.

In both cases, the process focussed on acquiring the video equipment to be placed in police vehicles. It did not take an end-to-end view of the system requirements, in particular data storage and the related information management issues. Our audit research identified that multiple policing organizations experienced difficulties in relation to the quantity of data generated and the associated cost and logistics involved in managing ICVS data obtained. Many policing organizations have reported that this aspect was not thoroughly researched nor proactively forecasted with resulting costs above anything that was anticipatedFootnote 4. While many ICVS have been purchased using the NISO and independent contract, the long-term data management implications and related costs remain unresolved.

Divisional procurement of ICVS

Divisions determined the number of units to procure based on Divisional budgets and local operational priorities.

Using call-ups against the NISO, seven (7) Divisions purchased [*]. An additional [*] units were purchased through the independent contract that was established by one (1) Division [*]. The majority of these purchases (95%) were made in the final quarter of fiscal year 2013-2014.Footnote 5

The only consolidated information with respect to ICVS purchases is produced by the vendor. National Headquarters does not hold information on how many units and of which configuration various Divisions possess. While some information regarding installed ICVS units is available through various fleet management systems or other local spreadsheets, collecting national information regarding ICVS would be beneficial for life-cycle management and planning future ICVS procurement.

Installation and maintenance

ICVS are installed and maintained by Divisional Post Garage and/or the Radio Workshop. For the sampled Divisions, the majority of ICVS that were purchased were uninstalled and/or unused at the time of the audit, as follows:

  • In one (1) sampled Division, [*] ICVS were purchased in February 2014, yet only 12 have been installed as of January 2015. The Division informed that full implementation has been delayed while awaiting a storage solution to house all of the data obtained from the installed ICVS. In the interim, a few units have been installed in new vehicles as part of a pilot project.
  • In another sampled Division, of the [*] ICVS that were purchased in January 2014, 72 were installed as of December 2014. However, all of these units were disabled at the time of the audit due to data storage considerations. Older versions of ICVS remain in use.
  • Lastly, the Division that purchased [*] ICVS using an independent contract had installed 38 as of January 2015. Making police vehicles available for the installation process has been problematic. As well, the group doing the installations has had other equipment installations to complete on a priority basis. As these ICVS include a one-year warranty beginning upon deliveryFootnote 6, in many cases the warranty will have expired before the units have been installed.

Divisional Post Garage and/or Radio Workshop facilities have applied ad-hoc solutions to resolve installation issues (for example issues related to cabling and mounting devices) which resulted in minor additional costs, absorbed locally. We were advised that warranties are reviewed prior to performing repair work on ICVS units. However, there is no mechanism in place to centrally collect and bring forward repetitive issues with ICVS so that a collective corrective action can be determined. Such an approach would promote collaboration and efficiencies across the organization.

3.2 Information Management

While ICVS have been in use for an extended period of time, there is not sufficient policy or guidance regarding the gathering, storage and retention of resulting data.

Steps are being taken to develop a national information management strategy which would involve all types of digital evidence. However, waiting for such an all-encompassing solution has caused inconsistencies in the use of ICVS. Providing interim solutions specific to ICVS information would benefit Divisional users.

Policy on in-car video systems

ICVS policy was last amended in October 2009. To a large degree, this policy has been developed around the functionality of the equipment in use at the time. It contains detailed operating instructions as opposed to broad-based policy guidance on the use of ICVS. As a result, this policy requires updating in order to provide sufficient direction regarding the appropriate operational use of ICVS. Other related policies require updates to address the IM/IT elements, such as the security level of the resulting information and its appropriate storage and retention mechanisms. Most interviewees indicated that there is a need for further policy clarification, increased communication and related guidance in regards to the capture, storage and retention of ICVS data.

According to current ICVS policy, Detachment Commanders are responsible for the management of the ICVS and applicable proceduresFootnote 7. However, little guidance has been provided to them to fulfill this task. Consequently, varying approaches to storage and retention are in place among Divisions.

As previously mentioned, one (1) sampled Division indicated that it had disabled newly installed ICVS due to lack of clarity regarding data storage.

Storage and accessibility

The eventual goal is to allow video evidence to be seamlessly integrated with operational files. To facilitate this and for ease of data transfer, purchasers of new ICVS were encouraged to buy wireless configurations at an additional cost. The wireless capability is not currently approved for use, however, the eventual national digital asset management strategy should allow for the use of this technologyFootnote 8.

As different generations of ICVS equipment are in use, current storage and filing methods vary. Interviewees indicated that the current approaches allow required information to be accessed when needed for court disclosure, addressing public complaints and general review. However, the process is time consuming.

There is no specific policy guidance regarding the security classification for ICVS data, however general information and communications technology security principles apply. A Threat and Risk Assessment has been drafted relating to the new generation of ICVS, however it has yet to be finalized. In the sampled Divisions, while ICVS data is not labelled with the security level of the information contained, it is for the most part being stored in secure exhibit rooms. At the moment, ICVS data that relates to specific case files is copied and stored with the appropriate files. For all other ICVS data, only a single copy of this information exists and there is no backup or recovery plan in place for most ICVS data.

Currently ICVS information is stored locally at each Detachment and there is no method to share the information on an organization-wide basis as part of case files. While a national digital asset management strategy has been drafted which should address this issue, it is in its infancy and full implementation will take considerable time. In the interim, a national approach for managing ICVS data, which considers users' immediate needs and is consistent with the eventual digital asset management strategy, is warranted.

Retention

The required retention period for ICVS data varies depending on the significance and applicability of the data recorded. This cannot always be immediately determined. For example, information which may seem insignificant at the time of recording may subsequently play an evidentiary role in an investigation. ICVS data captured that relates to a specific case file (such as public complaints, investigations, or Access to Information Act or Privacy Act requests) is kept in accordance with that file's retention and disposal requirements.

Policy guidance is not clear regarding the retention requirements for the remaining ICVS data. In particular, there is no clarity around whether some of the recorded data should be considered transitoryFootnote 9. While transitory data must be kept for a minimum of seven (7) daysFootnote 10, ICVS policy indicates that all recorded data is to be retained for at least two (2) yearsFootnote 11. A maximum retention period is not stipulated in either case. In the sampled Divisions, there was no clear standard for retention, with most retaining the data for extended periods of time. While currently not problematic, as the magnitude of data increases and the storage approaches change, a more standardized approach is needed.

4. Conclusion

ICVS is only one of several policing tools designed to gather digital evidence. The purchase of new ICVS equipment focussed on obtaining the in-car equipment, but did not give adequate consideration to the resulting data management requirements. Using a more project-based approach to procuring an asset of this type, which considers the full life-cycle of the equipment to be purchased, could lead to more efficient implementation and ensure the full benefits of the new equipment are optimized.

While a national digital asset management strategy is needed to ensure efficient integration of all types of video evidence, this is unlikely to result in timely resolution of current issues associated with implementation of the new generation of ICVS. Consequently, enhanced policy and guidance, which is developed in consideration of this eventual strategy, is warranted.

It is important to note the critical role the IM/IT Policy Centre must play to establish a standard operating model for the IM and IT systems across the country. For video systems to be used successfully, the action plan should address this gap.

5. Recommendations

1) The D/Commr. of Contract and Aboriginal Policing should:

Communicate to Divisions directives on the use of ICVS including capture, storage and retention of digital video data. These directives are to be aligned with the Chief Information Officer's strategy for the long-term management of digital video data.

2) The Chief Information Officer should:

Continue to develop the current and long-term methods of retention and storage of digital video data and, along with the Departmental Security Branch, provide Divisions technical and policy support for the storage of digital data including data retention periods, when using the current systems.

Appendix A – Audit Objectives and Criteria

Objective: The objective of this audit engagement is to determine whether ICVS are appropriately managed and if associated data is collected, retained, accessed and disposed of in an efficient, effective and compliant manner.

  • Criterion 1:
    The needs and requirements for ICVS have been fully identified and are met by the standing offer.
  • Criterion 2:
    The product life-cycle of the ICVS is effectively and efficiently managed.
  • Criterion 3:
    Data obtained by the ICVS is collected, maintained, accessed and disposed of in a consistent, compliant and secure manner.
Date modified: