Art sector observers are disturbed by the risks inherent in what currently seem to be frenetic levels of activity
With every technological advance that can
museum management comes another
that may 
assist thieves 

When protecting art treasures, the first instinct for many security professionals may well be to look at recent advances in technology. Hasn’t the advent of IP-addressable devices provided sufficient tools to protect art exhibits from theft in a discreet manner? Apparently not, and entrenched attitudes abound among curators. Consultants who so much as mention RFID tagging in a museum environment often receive sarcastic responses reminding them that they have been asked to secure works of art – not pets or livestock.

There has, however, been a gradual acceptance of RFID in the art world, particularly if the tag is small enough to occupy only the head portion of the frame of a painting and not extend to the back. But it’s unusual for museum RFID tags to have GPS tracking, and they are rarely monitored beyond a distance of 70 yards. There is no downloadable “Where’s My Painting?” app on Android or iOS. Furthermore, RFID tagging of a frame provides no protection against thieves who are willing to take a blade to the canvas.

An application where RFID tagging and GPS come into their own is when items are sent on loan to other galleries and a travelling case is placed around the regular frame. The Kröller-Müller Museum in the Netherlands (known for its van Gogh collection) has recently adopted this technique. But even with such technology in place, art sector observers are disturbed by the risks inherent in what currently seem to be frenetic levels of activity, with galleries lending each other works as part of “inter-museum horse-trading.”

Motion detection

The video analytics lobby might point to the increasing reliability of intelligent scene analysis, but a confident thief placing a small painting in a shopping bag is not an easy scenario for an algorithm, and many types of legitimate behaviour near a painting can cause nuisance alarms. By contrast (even as a small source of comfort) it should be noted that removing an oil painting from its frame is not an easy matter and in this context “canvas” in the sense of cloth is a misnomer. Centuries-old lacquer makes many canvases as stiff as a board, and simple motion detection within a CCTV camera let alone analytics is likely to expose the hacking and sawing movements needed to cut away a painting.

Simple motion detection within a CCTV camera let alone analytics is likely to expose the hacking and sawing movements needed to cut away a painting

Passive infrared sensor advantages

Passive infrared sensors (PIRs) have been the mainstay of protection at galleries since the 1950s and continue to be a vital tool, although ceiling height can be a limiting factor. The usual technique is to create a 4-inch deep “wall” in front of the painting by projecting downward from a ceiling-mounted detector. It was after leaning in to one of these “curtains” once too often at my favourite portrait gallery that I was finally persuaded to buy a pair of bi-focal glasses. I had been performing an elaborate ritual whereby I would come within inches of a work in order to read the information panel and then back off in order to view the whole painting. By this time an alarm had sounded or a visual alert unseen by me had attracted a guard. This odd to-ing and fro-ing among the middle-aged has been practiced by and named after one of Britain’s foremost playwrights; it’s known as “the Alan Bennett minuet.”

Steven Keller of Florida-based Architect’s Security Group is a consultant whose expertise includes museum protection. He argues that, ideally, an infrared curtain should be combined with a low railing in front of pictures projecting out some three feet. This will allow responsible visitors to lean over if necessary for a better view or perhaps to indicate a detail to a companion or student without setting off an alert. The infrared field can then be tight to the picture and nuisance alarms from legitimate visitor activity will be minimised.

A veteran of numerous gallery and museum installation projects, Keller makes the point that unless the wall being protected by an infrared alarm is very long – longer than the range of the detector – then the field of coverage will project into walkways or other areas where surveillance is not required. This difficulty can be solved by using two opposing detectors and wiring the devices so they must both trip before an alarm is generated, or terminating the detector into the wall before it extends beyond the desired area.

Galleries are beginning to adopt a technology that in no way compromises the safety of exhibits or visitor experience
Passive infrared sensors (PIRs) have been
mainstay of protection at galleries since the
and continue to be a vital tool 

Analytics better than infrared?

If a museum has suitable cameras then video analytics can become a viable alternative to projecting infrared beams in front of pictures. Areas that are prone to nuisance alarms can be masked off, and adaptive learning analytics can be “taught” that certain types of stimuli are not an attempt to steal the item but part of legitimate ambient activity.

Analytics can benefit museum curators more than infrared in so far as it may be possible to sound an alarm as soon as a sterile zone is compromised and prevent an incident whereas infrared will always be after the fact.

Access control for museum security

Access control has much to offer museums and, far from ignoring developments in this sector, galleries are beginning to adopt a technology that in no way compromises the safety of exhibits or visitor experience. It should be remembered that many of the access challenges presented to museum managers are in areas not seen by the public. MIFARE cards that can be deactivated at will must have solved many headaches for security directors worried that a former member of staff may pose a threat. Similarly, electronic key management (often using RFID) where traditional keys are issued on a hierarchical “right-to-have” basis creates accountability and protects paintings when they are in vulnerable locations such as a restoration studio. (Stringent access control for staff may have prevented many incidents: the FBI currently estimates that 80 percent of art crime is committed with the aid of an insider.)

Passive infrared is primarily useful in protecting exhibits from the clumsy or over-curious but it also deters thieves. A strategy intended specifically to defeat the art thief is a small wireless transmitter placed at the back of a painting and connected to an impact sensor. Unless they are exceptionally dexterous, anybody removing the painting from the wall will send a signal to an alarm panel in a control room, an off-site alarm receiving centre (ARC) or even to a smartphone app. These devices are of course reliant on a power supply in the control room and it would be interesting to know how many major art galleries have a back-up generator and how many take precautions against the possibility of thieves with electrical knowledge disabling entire power systems.

Saturation motion detection is
preferable to perfect perimeter
protection since museum thefts
can more easily occur by staying
behind than by breaking in

Sadly, with every technological advance that can benefit museum management comes another that may assist thieves. (I can hardly be the first person to have looked at the roofs and perimeters of London’s art galleries on Google Earth.) The sheer volume of current security innovations must however be favouring the good guys; video management systems (VMS) companies are not only allowing motion sensors or video analytics to trigger recording but they can also programme their software to send clips (playable on a tablet or smartphone) to staff who are either off-site or elsewhere in a large building.

Understanding perimeter protection and motion detection

Perimeter protection manufacturers have much to offer the art sector. Nobody wants a museum to look like a fortress and many of the buildings are listed architecture whose façades cannot be compromised, but buried volumetric intruder detection is contributing to the security of numerous galleries. However, Steven Keller notes that perimeter protection provides no safeguard against the “stay behind” or against perhaps the most potent threat of all, the disaffected current or recent employee lurking in the building as was the case when ‘The Mona Lisa’ was stolen from the Louvre in 1911.

Keller says: “So many security designers, faced with a moderate budget, saturate galleries with motion detection rather than alarming every air intake vent in the room. While the intruder might not be immediately detected, he would eventually be apparent upon arrival in the collection-bearing area. Saturation motion detection is preferable to perfect perimeter protection since museum thefts can more easily occur by staying behind than by breaking in.” Keller is also at pains to stress that guards must also remain vigilant out of hours, and any security installation should be walk-tested every day at closing time in order to check functionality and flush out a “stay behind,” however remote this possibility may seem.

Download PDF version Download PDF version

Author profile

Jeremy Malies European Correspondent,

Jeremy Malies is a veteran marketeer and writer specialising in the physical security sector which he has covered for 20 years. He has specific interests in video analytics, video management, perimeter intrusion and access control.

In case you missed it

The physical side of data protection
The physical side of data protection

The impact of the COVID-19 pandemic has accentuated our digital dependency, on a global scale. Data centres have become even more critical to modern society. The processing and storage of information underpin the economy, characterised by a consistent increase in the volume of data and applications, and reliance upon the internet and IT services. Data centres classed as CNI As such, they are now classed as Critical National Infrastructure (CNI) and sit under the protection of the National Cyber Security Centre (NCSC), and the Centre for the Protection of National Infrastructure (CPNI). As land continues to surge in value, data centre operators are often limited for choice, on where they place their sites and are increasingly forced to consider developed areas, close to other infrastructures, such as housing or industrial sites. Complex security needs One misconception when it comes to data centres is that physical security is straightforward One misconception when it comes to data centres is that physical security is straightforward. However, in practice, things are far more complex. On top of protecting the external perimeter, thought must also be given to factors, such as access control, hostile vehicle mitigation (HVM), protecting power infrastructure, as well as standby generators and localising security devices to operate independently of the main data centre. Face value How a site looks is more important than you may think. Specify security that appears too hostile risks blatantly advertising that you’re protecting a valuable target, ironically making it more interesting to opportunistic intruders. The heightened security that we recommend to clients for these types of sites, include 4 m high-security fences, coils of razor wire, CCTV, and floodlighting. When used together in an integrated approach, it’s easy to see how they make the site appear hostile against its surroundings. However, it must appear secure enough to give the client peace of mind that the site is adequately protected. Getting the balance right is crucial. So, how do you balance security, acoustics and aesthetics harmoniously? Security comes first These are essential facilities and as a result, they require appropriate security investment. Cutting corners leads to a greater long-term expense and increases the likelihood of highly disruptive attacks. Checkpoints Fortunately, guidance is available through independent accreditations and certifications, such as the Loss Prevention Certification Board’s (LPCB) LPS 1175 ratings, the PAS 68 HVM rating, CPNI approval, and the police initiative - Secured by Design (SBD). Thorough technical evaluation and quality audit These bodies employ thorough technical evaluation work and rigorous quality audit processes to ensure products deliver proven levels of protection. With untested security measures, you will not know whether a product works until an attack occurs. Specifying products accredited by established bodies removes this concern. High maintenance Simply installing security measures and hoping for the best will not guarantee 24/7 protection. Just as you would keep computer software and hardware updated, to provide the best level of protection for the data, physical security also needs to be well-maintained, in order to ensure it is providing optimum performance. Importance of testing physical security parameters Inspecting the fence line may seem obvious and straightforward, but it needs to be done regularly. From our experience, this is something that is frequently overlooked. The research we conducted revealed that 63% of companies never test their physical security. They should check the perimeter on both sides and look for any attempted breaches. Foliage, weather conditions or topography changes can also affect security integrity. Companies should also check all fixtures and fittings, looking for damage and corrosion, and clear any litter and debris away. Accessibility When considering access control, speed gates offer an excellent solution for data centres. How quickly a gate can open and close is essential, especially when access to the site is restricted. The consequences of access control equipment failing can be extremely serious, far over a minor irritation or inconvenience. Vehicle and pedestrian barriers, especially if automated, require special attention to maintain effective security and efficiency. Volume control Data centres don’t generally make the best neighbours. The noise created from their 24-hour operation can be considerable. HVAC systems, event-triggered security and fire alarms, HV substations, and vehicle traffic can quickly become unbearable for residents. Secure and soundproof perimeter As well as having excellent noise-reducing properties, timber is also a robust material for security fencing So, how do you create a secure and soundproof perimeter? Fortunately, through LPS 1175 certification and CPNI approval, it is possible to combine high-security performance and up to 28dB of noise reduction capabilities. As well as having excellent noise-reducing properties, timber is also a robust material for security fencing. Seamlessly locking thick timber boards create a flat face, making climbing difficult and the solid boards prevent lines of sight into the facility. For extra protection, steel mesh can either be added to one side of the fence or sandwiched between the timber boards, making it extremely difficult to break through. A fair façade A high-security timber fence can be both, aesthetically pleasing and disguise its security credentials. Its pleasant natural façade provides a foil to the stern steel bars and mesh, often seen with other high-security solutions. Of course, it’s still important that fencing serves its primary purposes, so make sure you refer to certifications, to establish a product’s security and acoustic performance. Better protected The value of data cannot be overstated. A breach can have severe consequences for public safety and the economy, leading to serious national security implications. Countering varied security threats Data centres are faced with an incredibly diverse range of threats, including activism, sabotage, trespass, and terrorism on a daily basis. It’s no wonder the government has taken an active role in assisting with their protection through the medium of the CPNI and NCSC. By working with government bodies such as the CPNI and certification boards like the LPCB, specifiers can access a vault of useful knowledge and advice. This will guide them to effective and quality products that are appropriate for their specific site in question, ensuring it’s kept safe and secure.

Data explosion: Futureproofing your video surveillance infrastructure
Data explosion: Futureproofing your video surveillance infrastructure

Video surveillance systems are producing more unstructured data than ever before. A dramatic decrease in camera costs in recent years has led many businesses to invest in comprehensive surveillance coverage, with more cameras generating more data. Plus, advances in technology mean that the newest (8K) cameras are generating approximately 800% more data than their predecessors (standard definition). Traditional entry-level solutions like network video recorders (NVRs) simply aren’t built to handle massive amounts of data in an efficient, resilient and cost-effective manner. This has left many security pioneers grappling with a data storage conundrum. Should they continue adding more NVR boxes? Or is there another, better, route? Retaining video data In short, yes. To future proof their video surveillance infrastructure, an increasing number of businesses are adopting an end-to-end surveillance architecture with well-integrated, purpose-built platforms for handling video data through its lifecycle. This presents significant advantages in terms of security, compliance and scalability, as well as unlocking new possibilities for data enrichment. All of this with a lower total cost of ownership than traditional solutions. Security teams would typically delete recorded surveillance footage after a few days or weeks Previously, security teams would typically delete recorded surveillance footage after a few days or weeks. However, thanks to increasingly stringent legal and compliance demands, many are now required to retain video data for months or even years. There’s no doubt that this can potentially benefit investigations and increase prosecutions, but it also puts significant pressure on businesses’ storage infrastructure. Data lifecycle management This necessitates a more intelligent approach to data lifecycle management. Rather than simply storing video data in a single location until it’s wiped, an end-to-end video surveillance solution can intelligently migrate data to different storage platforms and media as it ages. So, how does this work? Video is recorded and analysed on a combination of NVR, hyperconverged infrastructure (HCI) and application servers. Then, it’s moved to resilient file storage for a pre-determined period, where it can be immediately retrieved and accessed for review. Finally, based on policies set by heads of security, data is moved from file storage to highly secure, low-cost archive storage such as an object, tape or cloud. Data is moved from file storage to highly secure, low-cost archive storage Long-term storage This process is known as tiering. It allows businesses to use reliable, inexpensive long-term storage for most of their data, whilst still enabling security pioneers to retrieve video data when the need arises, such as during a compliance audit, or to review footage following a security breach. In a nutshell, it offers them the best of both worlds. Scaling your video surveillance infrastructure can be a headache. Businesses that rely on NVRs – even high-end units with 64 or even 96 hard drives – are finding themselves running out of capacity increasingly quickly. In order to scale, security pioneers then have to procure new boxes. With NVRs, this inevitably involves a degree of guesswork. Should they go for the largest possible option, and risk over provisioning? Or perhaps a smaller option, and risk running out of capacity again? Common management console Security pioneers can easily add or remove storage capacity or compute resources – separately or together As businesses add new cameras or replace existing ones, many end up with inadequate surveillance infrastructure made up of multiple NVR boxes along with several application servers for running other surveillance functions such as access control, security photo databases, analytics, etc. This patchwork approach leaves security pioneers scrambling for capacity, maintaining various hardware footprints, repeating updates and checks across multiple systems, and taking up valuable time that could be better spent elsewhere. By contrast, flexible HCI surveillance platforms aggregate the storage and ecosystem applications to run on the same infrastructure and combine viewing under a common management console, avoiding ‘swivel chair’ management workflows. Plus, they offer seamless scalability. Security pioneers can easily add or remove storage capacity or compute resources – separately or together. Data storage solutions Over time, this ensures a lower total cost of ownership. First and foremost, it removes the risk of over provisioning and helps to control hardware sprawl. This in turn leads to hardware maintenance savings and lower power use. Many security pioneers are now looking beyond simple data storage solutions for their video surveillance footage. Meta tags can provide context around data, making it easier to find and access when needed Instead, they’re asking themselves how analysing this data can enable their teams to work faster, more efficiently and productively. Implementing an end-to-end video surveillance architecture enables users to take advantage of AI and machine learning applications which can tag and enrich video surveillance data. These have several key benefits. Firstly, meta tags can provide context around data, making it easier to find and access when needed. Object storage platform For instance, if security teams are notified of a suspicious red truck, they can quickly find data with this tag, rather than manually searching through hours of data, which can feel like looking for a needle in a haystack. Plus, meta tags can be used to mark data for future analysis. This means that as algorithms are run over time, policies can be set to automatically store data in the right location. For example, if a video is determined to contain cars driving in and out of your premises, it would be moved to long-term archiving such as an object storage platform for compliance purposes. If, on the other hand, it contained 24 hours of an empty parking lot, it could be wiped. These same meta tags may be used to eventually expire the compliance data in the archive after it is no longer needed based on policy. Video surveillance architecture Continuing to rely on traditional systems like NVRs will fast become unsustainable for businesses Even if your organisation isn’t using machine learning or artificial intelligence-powered applications to enhance your data today, it probably will be one, three, or even five years down the line. Implementing a flexible end-to-end video surveillance solution prepares you for this possibility. With new advances in technology, the quantity of data captured by video surveillance systems will continue rising throughout the coming decade. As such, continuing to rely on traditional systems like NVRs will fast become unsustainable for businesses. Looking forward, when moving to an end-to-end video surveillance architecture, security pioneers should make sure to evaluate options from different vendors. For true futureproofing, it’s a good idea to opt for a flexible, modular solution, which allow different elements to be upgraded to more advanced technologies when they become available.

How can the security industry provide affordable and cost-effective solutions?
How can the security industry provide affordable and cost-effective solutions?

Cost is a reality to be managed. No matter how powerful or desirable a technology may be to a customer, the sale often comes down to the basic question: Can I afford it? And affordability extends not just to the purchase price, but to the cost of technology over its lifespan. In addition to advances in technology capabilities, the security industry has also achieved inroads to make its offerings more worth the cost. We asked this week’s Expert Panel Roundtable: What is the physical security industry doing to make more affordable and cost-effective technology solutions for end users?