SIA CCTV Incident Management 2 — Questions and Answers
Question 1: What does 'NIM' stand for in a UK policing context, and how is it relevant to CCTV operations?
- National Incident Monitor - a CCTV database shared by UK police forces
- National Intelligence Model - a framework for gathering and using intelligence that CCTV intelligence contributes to (Correct answer)
- Night Infrared Monitoring - a technical standard for night-vision CCTV cameras
- Non-Invasive Monitoring - the ethical standard for public space CCTV
Correct answer: National Intelligence Model - a framework for gathering and using intelligence that CCTV intelligence contributes to
The National Intelligence Model (NIM) is the framework used by UK police to collect, analyse, and act on intelligence. CCTV observations and footage are a key source of intelligence that contributes to NIM processes.
The National Intelligence Model (NIM) is the standard process used by UK police forces to manage intelligence. It operates at three levels: Level 1 (local crime), Level 2 (cross-border crime), and Level 3 (serious organised crime). Intelligence gathered by CCTV operators, including observations of suspicious behaviour, vehicle movements, known offenders, or patterns of activity, feeds into NIM as raw intelligence that can be developed, analysed, and acted upon. CCTV operators in partnership schemes such as town centre BIDs or police CCTV suites are often trained to produce intelligence reports that are submitted into the NIM intelligence cycle.
Question 2: An operator spots two individuals acting suspiciously near an ATM, repeatedly walking past and looking around nervously. What is the most appropriate initial response?
- Call the police immediately as this is likely a robbery in progress
- Continue to monitor and record the behaviour, note descriptions, and alert on-site security or police if behaviour escalates or confirms suspicion (Correct answer)
- Activate the public address system to warn the individuals they are being watched
- Dispatch a security officer to question the individuals immediately
Correct answer: Continue to monitor and record the behaviour, note descriptions, and alert on-site security or police if behaviour escalates or confirms suspicion
Suspicious behaviour should be monitored, documented, and assessed before escalating. Premature intervention may alert suspects and compromise any investigation; continued monitoring builds an evidential picture and allows a more informed response.
At the initial stage, the operator is observing suspicious behaviour but has not witnessed an offence. The proportionate and professional response is to: maintain and improve camera coverage of the subjects; document their descriptions, times, and movements; note any associated vehicles; and contact the police control room or on-site security to report the suspicious activity, allowing them to decide on a response. Calling 999 immediately may be premature if no offence is imminent; using the PA system alerts suspects prematurely; and dispatching security to confront the individuals may compromise evidence gathering. Good intelligence reporting enables an appropriate, proportionate response.
Question 3: During a public event, a large crowd surge occurs near a barrier. What is the primary concern for the CCTV operator and what immediate actions should be taken?
- Preserving high-quality footage of the event for future media review
- Public safety - immediately alert event control, security, and emergency services, and use cameras to identify the most dangerous pressure points (Correct answer)
- Recording the incident to assess whether the venue layout contributed to the crush
- Identifying any individuals who may have deliberately caused the surge
Correct answer: Public safety - immediately alert event control, security, and emergency services, and use cameras to identify the most dangerous pressure points
Crowd crushes can be fatal within minutes. The CCTV operator's immediate priority is life safety, alerting control, redirecting crowds, and guiding emergency responders using real-time camera intelligence.
Crowd crushes (compressive asphyxia events) can become fatal very rapidly as pressure on the crowd prevents people from breathing. The CCTV operator plays a critical life-safety role in these events. Immediate actions should include: activating the major incident or crowd emergency protocol; alerting event control, security supervisors, and emergency services simultaneously; using camera coverage to identify the highest-pressure zones and areas where crowd flow can be redirected; providing real-time guidance to security staff on the ground via radio; and maintaining continuous recording. Speed is critical and operators must overcome any hesitation and use the direct emergency channels available to them.
Question 4: After a security incident, a journalist arrives at the control room requesting to view CCTV footage for a news story. What should the CCTV operator do?
- Show the journalist the footage as it is in the public interest
- Decline to allow access and direct the journalist to the organisation's press office or communications manager (Correct answer)
- Allow the journalist to view but not copy the footage
- Check whether the journalist holds an SIA licence before allowing access
Correct answer: Decline to allow access and direct the journalist to the organisation's press office or communications manager
CCTV footage is personal data that may also be part of an active police investigation. Unauthorised disclosure to journalists would breach UK GDPR and could compromise any legal proceedings.
Journalists do not have automatic right of access to CCTV footage, and a CCTV operator has no authority to disclose footage to the press. Disclosing footage to a journalist could breach UK GDPR (unauthorised disclosure of personal data), interfere with an ongoing police investigation, and expose the organisation to significant legal liability. The operator should politely but firmly decline and direct the journalist to the organisation's press office, communications manager, or designated spokesperson. Any media request should be logged. If the journalist persists, security staff should be notified to assist in managing the situation.
Question 5: What is the significance of a CCTV operator's log entry being described as 'contemporaneous'?
- It means the entry has been reviewed and countersigned by a supervisor on the same day
- It means the entry was made at or very close to the time of the events recorded, making it more reliable as evidence (Correct answer)
- It means the entry was typed rather than handwritten to ensure accuracy
- It means the entry has been formally submitted to the police within the required timeframe
Correct answer: It means the entry was made at or very close to the time of the events recorded, making it more reliable as evidence
A contemporaneous record is one made at or close to the time of the events it describes. Such records are considered more reliable evidence because memory is freshest immediately after an event, reducing the risk of inaccuracy, distortion, or fabrication.
The legal and evidential value of a log entry depends significantly on when it was made. A contemporaneous entry, made during or immediately after the events described, is considered more reliable because the operator's recall is at its most accurate, there has been little time for memory to fade or be influenced by subsequent information, and it is harder to later claim the entry was fabricated. In court, a witness may refer to contemporaneous notes to refresh their memory of events. For this reason, CCTV operators should complete log entries as events unfold or immediately after, never retrospectively reconstructing logs from memory hours or days later.
Question 6: A CCTV operator receives a bomb threat call on the control room phone. What is the correct immediate procedure?
- Immediately evacuate the control room and leave the building
- Keep the caller talking as long as possible, complete the bomb threat checklist, call 999, and alert management (Correct answer)
- Hang up and call the police to report the call
- Make an announcement over the PA system to evacuate the building immediately
Correct answer: Keep the caller talking as long as possible, complete the bomb threat checklist, call 999, and alert management
Keeping the caller talking allows the operator to gather crucial information (description of device, location, detonation time, caller's identity clues, background sounds) using the bomb threat checklist, which is essential for the police response.
A bomb threat call is a major incident requiring a specific and trained response. The operator should: keep the caller talking by asking questions (Where is the bomb? When will it go off? What does it look like? Why are you doing this?); simultaneously complete the organisation's bomb threat checklist, noting the exact words used, the caller's voice characteristics, background sounds, time of call, and call duration; signal to a colleague to call 999 without interrupting the call; not hang up until the caller does; alert management via the incident protocol; and not initiate a PA evacuation unilaterally as that decision rests with management or police, who will assess the threat.
SIA CCTV Incident Management 2
What does 'NIM' stand for in a UK policing context, and how is it relevant to CCTV operations?