We present in this paper a method for de-identi cation of persons in a CCTV environment which uses di erent levels of ltering depending on the privacy sensitivity of the region of interest. The proposed method tries to tackle the problem of re-identifying (de- ltering) a person which has committed a crime. Validation of the method shows low results in privacy as a result of the identity of the subjects not being concealed at all times.
Police and security forces around the world deploy great
amounts of CCTV in an e ort to ght crime and preserve
peace. This at a cost of regular citizens' privacy, as their
daily whereabouts are being recorded as well. For the
MediaEval 2014 Visual Privacy task[
The de-identi cation method applies di erent lters depending on the privacy sensitivity of the region of interest. All the types of regions of interest were categorised in three possible levels, each carrying more sensitive information than the previous one.
But before going into details of the de-identi cation method and each of the levels, it is important to note that an important feature of this lter is the ability to re-identify suspects of criminal activities. This allows CCTV operators to perform the surveillance activity in a more e ective way. As soon as one actor is known to be committing a suspicious activity, the lter is switched o only for that actor performing the illicit activity but keeping the privacy of the other actors intact. The current actions for which the lter is deactivated are \ ghting", \stealing", and \bad drop". This allows to e ectively re-identify the criminals in the scene. This is an important feature of de-identi cation lters: the ability to reverse the lter if it is required by the users of the system.
As stated previously, the lter applies 3 di erent process depending on the privacy sensitivity of the region of interest. The sensitivity is given to the lter and it decides which process to apply.
The rst level of privacy is the one with the less sensitivity and the lightest lter is applied here. In this case it was decided to use a Gaussian Blur with a kernel size of 21 pixels. The second level might carry some additional personal information which might harm the privacy of the subjects. For this level, a pixelisation lter with a new pixel size of 10 is applied.
The third and nal level carries the most personal information (such as faces and skin tone) and has to be ltered the most. For this level the pixelisation lter was also selected, but with a new pixel size of 20 pixels. In addition to this, the colour of the region of interested is removed, leaving a pixelated grey-scale region. 2.1
The rst thing we want to achieve is to provide privacy to law-abiding citizens. The second goal of the lter is to allow the re-identi cation of suspects of crimes. With this in mind, and since the meta-data of the actions of the actors in the scene was available, it was decided that the lter would be deactivated to allow the surveillance task to be carried away with much more information than if it was ltered. This lter has thus two parts: the de-identi cation of innocent people and the re-identi cation of suspects of crimes.
In the de-identi cation part of the lter, for the top
levels of privacy sensitivity, the pixelisation lter has been
selected because it has shown to have a very good balance
of privacy and intelligibility[
Evaluation was performed in with the DataSet and
methodology presented in [
(a) Stream 1 (b) Stream 2 (c) Stream 3 the results. It includes the results for Stream 1 (nave subjects - sub gure 2a), Stream 2 (video surveillance sta sub gure 2b), and Stream 3 (online subjective evaluations sub gure 2c).
It can be seen that the results in Intelligibility and Pleasantness are right around the median of the other results (except for pleasantness in Stream 1, where it is actually higher). But in all of the Streams, it is evident that the privacy score is signi cantly lower than the other approaches. This is a result of the lter not concealing the identity of the subjects (thus, NOT protecting their privacy) in the case where they are engaging in potentially illicit activity as speci ed by the meta-data. 4.
We have developed a de-identi cation method for the MediaEval 2014 Visual Privacy Task, which applies di erent lters to di erent regions of interest according to it's privacy sensitivity. Most importantly, the lter allows the reidenti cation of a suspect by removing all relevant lters when a crime is detected. This allows us to keep the privacy of innocent citizens' intact, while exposing the full identity of crime suspects, facilitating the labour of law enforcement to the authorities.
Because of the nature of this lter, a low privacy score was actually achieved. We hope that this development leads to a wider discussion about the adequate way to address citizens' privacy concerns while still generating useful data for law enforcement. We think the best solution is a multi-tiered approach where there are di erent levels of de-identi cation depending on the relevance of the person. This discussion must include the fact that it would be a machine determining the \guilt" of a subject and thus revealing it's identity. Among other ethical issues, what would happen for example with false negatives or false positives?
In the future we expect to adjust the de-identi cation lter to get better results in Intelligibility and Pleasantness. The usefulness of removing the lter in case of suspicious activities has to be further evaluated as well. 5.
The research presented in this paper was supported by the European Commission under contract FP7-SEC 261743 VideoSense and FP7-SEC 285024 Advise.