In brief
A camera is a window somebody has fitted in your house and pointed inwards, so the first question is not about resolution or how much you can see at night, but about where that picture goes, who has access to it and how long it stays there. In the most popular model today the answer is: to the manufacturer’s server, on the terms of a service agreement nobody has read. I write about the opposite model, in which the footage stays on the plot – about local recording, about cameras with no route of their own to the internet, and about a variant in which the only thing that goes outside is a signal that something is happening. I design, choose and supply CCTV like any other part of a house’s security, and I start not with the equipment but with the space, the cable routes, the power and the room, which have to be in the design before the plastering. I describe principles here and do not show publicly how the system looks in any particular house; I explain why in the text on residence security in layers.
Where the footage goes
A conversation about cameras usually starts with resolution and night range, and the question of where the footage goes comes up at the end, or not at all. In my view it is the first question, because the answer to it decides all the others.
The default model on the market works like this: the camera connects to the manufacturer’s server, and you watch the picture in an app on your phone. It works well, it is set up in a quarter of an hour, and for the first few months there is no reason to think about it. In practice the arrangement means that recordings from inside your house sit physically on the server of a company you do not know, under the law of a country you did not choose. You have access to them on the terms that company has written into its service agreement – terms it can change – and for as long as it exists and keeps the service running. In some systems everything passes through somebody else’s server; in others only the live view and the notifications, while the recording itself stays at home. Which functions travel which way is a question you put to the seller directly, because you cannot see it from the box.
This follows from the way the service itself is built. A recording that sits with whoever stores it is available to whoever stores it; it is available to anybody who successfully breaks in; and it is sometimes handed over at the request of the competent authorities, addressed to whoever stores it – not necessarily to you. All of that is decided by the terms of service nobody reads, not by the settings in the app everybody clicks through.
Security researchers have described the case of a manufacturer that assured its customers that the recordings did not leave the home, while its cameras were sending material to company servers even with the cloud switched off; deleting the recordings in the app did not remove them from the servers. There is one conclusion from that story, and a practical one: the promise on the box and the actual traffic on the network are two different things, and only the second can be checked. Then there is something sellers mention least of all: a constant stream of video from several cameras takes up the house’s upload capacity around the clock.
Footage that stays on the plot
The local model is older than the cloud and simpler than it sounds. In the arrangement I regard as the benchmark, the camera gets a single cable – a twisted-pair network cable that carries power and picture at the same time. The cable ends at a recorder in your equipment room, and the recorder writes the footage to its own disks. The picture has nowhere to go, on one condition I will come back to in a moment: that the cameras have not been given a side route of their own to the internet. The picture’s route ends at a device you can touch.
What for years was the main argument for the cloud – recognising what is actually in the frame – now works on site. Telling a person from a deer, noticing that somebody has crossed the line of the fence, spotting a car at the gate: a decent camera or recorder can do that without asking the internet for its opinion. The cloud does have a real advantage in two things: matching faces against very large databases, and linking many sites together at once. Neither is needed to keep watch over one house.
There is one more decision that determines your independence for years: whether the system supports an open standard. There are widely adopted standards through which cameras and recorders from different manufacturers talk to each other, and a camera that supports them will work with a new recorder when the old one has had its day, and the other way round. A camera from a closed ecosystem talks only to its own manufacturer’s devices and server; sometimes local access to the picture is deliberately blocked, and when the manufacturer closes the service or ends support, the functions that went through that server disappear. Then, years on, you replace the whole system rather than one component.
The camera that phones home
Now something surprisingly few buyers know: a camera is a computer. It has a processor, an operating system and its own opinion about whom it wants to talk to. The fact that it records to your local recorder does not yet mean it is not holding conversations of its own with the internet at the same time – with the manufacturer’s servers, with remote-access intermediaries, with update servers. The recorder does not switch those connections off, because it does not even know about them.
That is why I treat local operation as something you require and then verify, not as a promise in the specification. At the handover of the installation I put it simply: the cameras and the recorder are to have no route of their own to the internet, and the whole system is to keep recording with the connection cut completely. That is shown on the spot, and it either works or it does not. On top of that there is one question you have to ask directly: what does this equipment do when the internet disappears for a week? Some devices designed around the cloud cope badly with simply being cut off and lose functions nobody would have suspected; that does not have to be assumed either, because it is checked before the handover, not after a break-in.
The radical variant: a contact instead of a link
For those who want certainty about the electronic route, there is an even simpler arrangement, and I like it because its boundary can be seen with the naked eye. The system records and analyses the picture by itself, with no connection to any network, and the only thing that leaves the system is a contact – two wires that are either connected or disconnected. There are just two states, and nothing apart from them leaves the house. When the system decides that something significant is happening, it closes the contact, and that is all the world learns; the alarm system receives the signal that something is happening and carries on according to its own procedures, because the camera records and responding is the alarm’s job.
A picture cannot be sent down that route, so it cannot be stolen down that route either. No security product deserves the credit for that; it is physics, because not a single frame will fit through a switch that knows two states. You do not have to trust software settings or a manufacturer’s declarations – it is enough to look at two wires.
This does not buy you absolute security, though. It buys the removal of one route, the remote one, and the physical route remains: somebody who walks into the room and takes the recorder, or just the disks. That is why the second layer of this variant concerns the disks. The recorder’s password protects its menu, but from a disk taken out of the unit the recordings can be recovered on another computer, unless they are stored encrypted. Encryption of the recordings is a feature you ask about directly when buying, so that the theft of the recorder means the loss of hardware, not a leak of private footage. It has its price: the strongest variants can need a person at every start-up, because after a power cut the system will not come back on its own. That is settled when the equipment is chosen.
The price of this choice
You will not see a live view from the airport, at least not in the variant cut off from the network, and the whole inconvenience of this model lies in that sentence. Checking what happened in the night means walking up to the device. For some people that is too much, and I understand it without any irony, because the convenience of a live view is real, and so is the unease on a longer trip.
Choosing a route does not settle the question of security, either, because every route can be attacked, just in its own way. I can show you what you give up in this exchange, but the decision is yours.
You can also settle deliberately on a middle ground. You point a few cameras from a convenient ecosystem with an app at the places where the picture is half-public anyway – the drive, the pedestrian gate, the entrance gate – and treat them as if their footage were public, because in practice it is. What those cameras see still has to stay within your plot, because the limits in the section below apply to them in exactly the same way. The rest of the house stays separate, with the interiors recorded locally only, or not at all. That is a decision, not a technical compromise: you choose how much convenience you buy for how much privacy, and you know what you are giving up.
Who has access to the recordings
In a house where people work – cleaning, care, gardening, servicing – the archive of recordings becomes a collection of information about everybody who spends time there. A system in which everybody knows the same code and viewing the archive leaves no trace is not a system but a box of recordings.
The rule I described with the alarm applies here just the same: everybody gets access to what they need for their work. With CCTV that means separate accounts instead of a shared code, different permissions for different roles, and a trace of who has looked through the archive; the live view and the archive should be treated as two separate permissions. The service engineer needs access to the settings, not to your recordings from last week.
You should be able to do the everyday things in the system yourself, and with CCTV that matters all the more, because it is about access to recordings from your home. If after a year you cannot add an account for somebody or check who has looked through the recordings, the system works for the installer, not for you.
That leaves the question you ask before the installation is handed over, not after: what is left behind when the service engineer goes. Once the house has been handed over, only you have access to the recordings and the settings, until you give it to somebody yourself. Remote access left in place after commissioning, just in case, is a back door into the system, even if nobody had bad intentions – and most of the time nobody did. Good companies raise this themselves; the others have to be asked.
Where your private matter ends
Here I slow down, because this stops being a purely technical question. As long as the cameras cover only your house and your plot, and only the household spends time there, CCTV is, as a rule, a private matter. That status can be lost, and it is usually lost without anybody knowing.
The first boundary is the frame. A camera that captures the street or the neighbour’s garden is no longer a purely private matter, and what decides that is what appears in the frame, not what you intended. The second boundary is the people who work in your house. From the moment the house becomes somebody’s workplace, rules come in: what the monitoring is for, which rooms it must not cover, how long the recordings may be kept, and what people have to be told before the system goes live. The third is sound, because recording conversations is a different category from recording pictures and the bar is set much higher; in practice the microphones are left off until there is a good reason for them not to be.
When we are talking about security, what matters most is that it is effective and done properly, for my client. We do not film the neighbours and we do not break the law. There is one practical remark: the camera layout is discussed while it is still on paper, because moving a camera on a drawing costs one pencil line.
Where it physically stands
The recordings have to sit somewhere, and in the local model they sit on disks in your house, on one particular device. One camera recording continuously produces, depending on the picture quality, anything from a few to several dozen gigabytes a day, and several cameras over a month add up to a few terabytes. The recorder runs day and night all year round; disks built for that kind of work are different from the ones in a laptop, and they wear out like any working part, so at some point they will have to be replaced. The unit gets warm, hums and needs room to breathe, which is why a tight, closed cupboard with no airflow shortens the disks’ lives faster than anybody assumes. And when the space runs out, the recorder overwrites the oldest recordings, so a disk that is too small means the footage from the one day that happens to matter may no longer exist.
That is why the recorder has its own place in the design: an equipment room, power with back-up, ventilation and a locked door. Whoever has the key to that room is part of the system, because physical access to the device everything sits on is the weakest point of the whole local arrangement. For the same reason I treat CCTV as one of the layers of a house’s security, not as a separate gadget.
When to decide
Everything I have written about above is decided before the plastering, together with the electrical installation, and that is the only moment when these decisions are cheap. With cameras it is definitely worth preparing the cabling – as long as you are considering installing them at all. The cables are run together with the electrics, more routes are provided than the first list of cameras calls for, and the equipment room is planned with space to spare.
The positions of the outdoor cameras are fixed even earlier than most people assume, because their cable routes run in a wall that is about to be covered by insulation and the facade finish. (A masonry wall here is insulated on the outside, and the facade goes over the insulation.) If the layout of the cameras and the lighting on the facade was not settled when the electrics went in, now is the last moment to do it. The same decision comes back at the soffits and at the fence, because routes run there too.
Then there are surges: telecoms lines – internet cables, television cables, camera cables – should be protected against them too. Almost nobody does it, and it is not for me to judge whether that is right or not. The cable from a camera on a post by the fence comes into your house and ends at the device your recordings sit on, so the conversation with the electrician about it belongs to the same stage as the routes themselves.
Finally there is the documentation, because it decides whether in a year anybody will know where all of this runs. The routes are photographed before they disappear into the wall, because when, years later, you lose touch with the electrician who ran the installation, the photographs are the only trace of them left.
When CCTV is theatre – and what I do not promise
A camera stops nothing; it records. If stopping is what you care about, we talk about other layers, and at the end of that ladder stands the panic room, which I have written about separately. CCTV answers the question of what happened and who it was, and that is a lot, as long as you do not confuse it with preventing the event.
There is also CCTV that is pure theatre: cameras bought because one ought to have them, hung wherever the cable was easiest to run, with recordings nobody has ever watched or ever will. The question of what we are defending against works here too, and sometimes the answer is: against nothing, it just seemed the thing to do.
And there is a boundary talked about least of all, because it is not technical. A house under constant observation cannot be unseen. A camera in the living room pointed at the sofa changes the way people sit on that sofa, adults and children alike, and that is a cost paid by the family, not by bank transfer. Interiors are covered with restraint or not at all, because a home is meant to stay a home.
So I do not start with the number of cameras. I start with the question of what you really want to see: the gate, the approach to the house, the interiors – or simply to have a recording in case something happens.
That leaves the list of things I do not promise. I do not promise that a local system will stop somebody who came with intent, because stopping is the job of other layers, nor that cutting off the network settles the question of security, because it only removes the remote route. And one last thing, which concerns not your house but my work: I do not talk about my clients and I show nothing publicly – no photographs, no locations, no names – and your house will be protected in exactly the same way.
What I ask before such a system goes into the design
- Where does the footage from the cameras go, and can it be shown that it goes no further?
- Do recording and picture analysis work with the internet cut off completely, and will I see that at the handover?
- Do the cameras support an open standard, and if so, what exactly works over it and what only in the manufacturer’s app?
- What exactly leaves the system: pictures, event notifications, or just a signal from a contact?
- Who has which account, who can see the archive, and where is the trace that somebody has looked through it?
- What is left behind when the service engineer goes, and who knows about it?
- Are the recordings on the disks encrypted, and what happens to the system after a power cut?
- Where does the recorder stand, who has the key to that room, and when do we plan to replace the disks?
- Where do the outdoor cable routes run, and are the camera positions agreed before the facade and the fence are finished?
Frequently asked questions
Can CCTV without the cloud be watched on a phone?
At home, yes, over the home network, with no outside server involved. Away from home it can be done too, only every remote view opens some route into the system, and the difference is whether that route was built deliberately and who controls it. If viewing while you are away matters to you, say so at the start, because a route that is designed and described in the documentation is something different from a factory route through the manufacturer’s server that nobody told you about.
Which cameras without the cloud should I choose, and what should I require?
I do not recommend brands, but there are four requirements, and all of them can be checked. Recording is to be local, on a device in your house. The cameras and the recorder are to have no route of their own to the internet. The system is to support an open standard, so that a component can be replaced rather than the whole. And the last one: recording with the connection cut is to be shown at the handover, not promised in the offer.
Can cameras be added after the build?
They can, and it is done often – only then you can see that somebody was late: trunking, chased walls, or a compromise in a spot the cable could no longer reach. Cameras need cables more than an alarm does, since an alarm can be wireless. It costs least when the cables go in together with the electrical installation, even if the decision about the cameras comes two years later. The hardest thing to add after the fact is the room in which all of it is to stand.
How much does CCTV without the cloud cost?
The price does not come from the number of cameras but from what goes with them: the cable routes, the equipment room, the disks and their replacement every few years, encryption if you want it, and how completely the system is to be cut off from the network. The cloud model moves part of the cost into a subscription – less at the start, a fee every month for years, and terms set by the provider. The local model works the other way round: more at the start, then mostly electricity and disks. The conversation about specifics starts once it is decided which model is in play at all.
I have collected answers to common questions about privacy and discretion in the Questions section.
If you are thinking about a house where privacy is part of the design, this conversation should take place before the installation is designed. Let’s talk about your project.