How to secure a contractor yard without turning the cameras into the breach

A contractor yard is an easy place to lose money. Tools walk out in a backpack. Copper leaves in a pickup after dark. A skid steer rolls onto a trailer that was never booked. Most yards already have cameras. What they usually do not have is a plan: what the system is supposed to prove, how long the footage lasts, who can reach the recorders, and whether an insurer would even accept the export.

This is a practical walk-through. It is written for owners and superintendents in Alberta and B.C. who run equipment, not a security department. It is not legal advice and it is not a product pitch. If a step needs a lawyer or a licensed alarm partner, it says so.

Walk the yard before you buy another camera

Start on foot, at the time theft actually happens. That is usually last light, Sunday morning, or the first quiet hour after the last truck leaves. Bring a notebook. Do not start with a sales sketch.

Write down four things:

• What is worth stealing, and how it leaves. Tools, copper, fuel, batteries, GPS units, and compact machines on trailers are the usual list. If it fits in a half-ton, assume someone will try.
• How a stranger gets in. The gate that is left on the latch. The fence that is short behind the laydown. The shop man-door that props open for airflow. The neighbour's lot that shares a dark corner.
• Where people actually walk and park, not where the site plan says they should. Cameras pointed at empty geometry miss the cut in the fence.
• What you can already prove. If last month's theft produced no usable clip, no time stamp you trust, and no export anyone kept, the current system is decoration.

Physical controls still do more work than another 4K dome. Lock the fuel. Put copper and small tools in a crib or a locked conex, not on an open pallet. Park machines away from the fence so a trailer cannot back up to the bucket. Hitch pins and battery disconnects are boring and they work. One controlled gate after hours beats three decorative ones.

Inventory matters more than people admit. Photograph high-value machines with serial plates. Keep a simple list: unit number, serial, last known hour meter, who has keys. If a machine leaves, you want a record that existed before the claim, not a memory.

Habits that stop the easy thefts

Most yard losses are not cinematic. They are a habit gap.

• Close the loop at quitting time. One person walks the gate, the fuel, the crib, and the machines that sit near the street. Write the time. If nobody owns that walk, it does not happen on Fridays.
• Keys are a system. Shop keys on a nail and ignition keys in the cup holder are how a thief finishes in four minutes. Night storage for keys, a sign-out for extra sets, and a rule that machines are not left with the key in them.
• Do not advertise the pile. Photos of new iron on a public page, with the yard in the background, tell people what sits unattended on weekends. Share wins without a map.
• Lighting on the approaches. A bright office and a dark apron is the wrong pattern. Light the gate, the fence line people actually use, and the gap between the shop and the laydown. Motion lights help if they are aimed and maintained.
• Neighbours and after-hours traffic. A yard on a dead-end industrial street has fewer witnesses. Ask the neighbouring shop who is usually there late. A shared after-hours number is cheap.
• Mark what walks. Etch or stamp company marks on tools and copper-prone fittings. It does not stop a determined crew. It makes resale harder and it helps police and insurers identify property.

None of that needs a cloud login. Do it first. Then decide what the cameras have to prove.

Decide what the cameras have to prove

A useful camera plan answers specific questions after a loss:

• How did they get in?
• What did they take, and how did it leave?
• Can we identify a vehicle, a plate, or a person well enough to hand to police or an adjuster?
• When did it start and end, in a time zone you can defend?

That usually means a small set of jobs, not a camera on every pole:

• Gate and approach. Who entered. Plates if the geometry allows. Enough light and angle that a trailer hitch is visible.
• Shop apron and man-doors. Tools and copper leave through doors more often than over the fence.
• Laydown and high-value machines. Wide enough to see a trailer pad, close enough that a skid steer leaving is not a blur.
• Fuel and crib. These are repeat targets. One dedicated view beats a distant overview.

Write the zones down. Note blind spots and power or network limits in the same note. A coverage plan you can hand to an installer (or to us) is worth more than a brochure with a camera count.

Do not point cameras into washrooms, change rooms, or a lunch table unless counsel has a specific, written reason. Do not treat the yard system as a performance-management tool. In Alberta and B.C. that is where privacy complaints start.

Edge-recorded kits that do not become the breach

Every camera is a computer on a network. Consumer kits are famous for default passwords, UPnP, and inbound ports that show up on Shodan before the first weekend. A yard that opened a hole to "check cameras from the phone" has traded a theft problem for a remote-access problem.

The pattern that holds up on contractor sites is simple: record on the property, reach it without opening the firewall.

• Record at the edge. An NVR or a locked recorder on site, or cameras that write to local storage you control. Cloud viewing can sit on top of that. Cloud-only recording with a vendor password you cannot audit is a different product. Know which one you bought.
• No inbound ports for cameras. Do not forward 80, 443, 554, 8000, 37777, or "whatever the app asked for." If someone needs to see a live view from home, use a VPN into a small management network, or a vendor path that only makes outbound connections. If the installer cannot explain how they avoided inbound ports, get a second opinion.
• Put cameras off the office LAN. A separate VLAN or a dedicated switch is enough for most yards. The recorder should not sit on the same flat network as payroll shares and the shop PC. If a camera is compromised, it should not be a step into QuickBooks.
• Change every default. Unique admin password on the recorder and on each camera if they have one. Disable unused accounts and P2P features you do not use. Turn off UPnP on the router. If the kit emailed you a password in plain text, change it.
• Keep firmware current. Camera bugs get weaponized the same way server bugs do. Put a calendar reminder on the recorder model. If the vendor has gone silent, that is a finding, not a reason to leave it forever.
• Lock the recorder. A thief who wants footage gone will take the NVR. Bolt it, lock the closet, and keep a second copy of the last export window if you have had a live claim.
• Remote apps are optional. A superintendent who wants a phone view is fine. An entire crew with the same shared login is how footage leaks and how accounts get reused on other sites. Named logins, or at least a login you can revoke.

We review camera fleets the same way we review servers: exposure, credentials, segmentation, and whether anyone can wipe the evidence. A site-security assessment is not a requirement to buy hardware from us.

Evidence packages insurers will actually use

Adjusters and brokers do not want a Dropbox of 40 unnamed MP4s. They want a short package that answers the claim questions and shows you did not invent the clip after the fact.

Build the habit before the theft:

• Time you can defend. Recorders drift. Point the NVR at a known NTP source or set it from a trusted clock and write down the offset if you cannot. A clip that is 17 minutes off is an argument, not evidence.
• A camera map. One page: camera name, what it sees, what it does not see. "CAM3 shop south" means nothing six months later if the dome was moved.
• Retention you chose on purpose. Thirty days is a common starting point for yards. Longer is a storage and privacy decision, not a default. Write the number down. If the disk fills and overwrites on day nine, your policy is fiction.
• A clean export path. Original file, not a screen recording of the live view. Include the camera ID and the time window in the filename. Compute a SHA-256 hash of the file and put that hash in the cover note. Keep a copy you do not email around.
• A cover note. Who exported, when, from which recorder, what the clip shows, and what it does not show. "No camera on the north fence" belongs in that note. Honesty here is what makes the rest believable.
• Chain of custody for a live claim. One person handles the export. They do not edit it. They log who received copies (insurer, police, counsel). If you trim a clip for email size, keep the original and say you trimmed.

Stills help. A plate, a hitch, a face at the gate, the machine leaving. Pair them with the clip, do not replace it.

None of this guarantees a payout. It makes the conversation shorter. Carriers ask whether you had a system, whether it ran, and whether the export is trustworthy. A hashed file and a one-page note beat a login you cannot find on Monday morning.

Alberta and B.C. privacy, in plain language

Contractor yards record staff, contractors, delivery drivers, and sometimes the street. That is personal information. In the private sector, Alberta and British Columbia both use a Personal Information Protection Act (PIPA). Public bodies sit under different statutes. This section is a field guide, not an opinion letter. If you have a union, a live complaint, or cameras indoors on people all day, talk to counsel.

Write a purpose that is actually true. Safety, site security, and loss prevention are the purposes that hold up. Using the same cameras to grade who takes the longest smoke break is how employers get into trouble. An Alberta OIPC investigation into workplace cameras (Hoffman Holdings, 2005) treated security and safety as reasonable in that case and treated general performance monitoring as not reasonable. Do not put "productivity" on the sign if you cannot defend it.

Give notice before people walk into the frame. Signs at the gate and at shop entries. Plain language: cameras are in use for security and loss prevention, who to call with questions. Put the same point in orientation papers for employees. OIPC Alberta's private-sector video guidance expects noticeable signage and a contact. B.C.'s commissioner has the same expectation under B.C. PIPA: people should know they are being recorded before they have to choose whether to enter.

Minimize. Cover the gate, the apron, the laydown, the fuel, and the crib. Do not cover toilets, change rooms, or a lunch table. Avoid grabbing more of the public sidewalk or the neighbour's lot than the job requires. If a camera can do the job from a higher, wider angle that does not stare at faces all day, prefer that.

Have a short written policy. Purpose, where cameras sit, how long you keep footage, who can watch live or export, how someone asks for their own images, and what you do if footage is requested by police or an insurer. Name a person who owns the policy. Alberta PIPA expects an organization to have policies and someone accountable. B.C. is in the same family of rules.

Protect the recordings. Access control on the recorder, no shared "admin/admin," no inbound ports, and a rule that exports leave with a hash and a log. A camera system that is open to the internet is both a cyber finding and a privacy finding. If identifiable footage leaks and there is a real risk of significant harm, Alberta PIPA has breach-notification duties. Do not wait to invent a process after the leak.

Access requests are real. Staff and other individuals can ask for their personal information, which can include images of them. Know how you would find a clip and what you would withhold (other people's faces, security methods). You do not need a law firm on retainer to write a one-page intake for those requests. You do need to know who answers the phone.

Covert cameras are a high bar. Hidden indoor recording of staff is a different legal problem than an obvious dome on a pole at the gate. Do not "just add one in the shop" without advice.

Facial recognition and biometrics are not a default. That is a separate review. A yard does not need it to prove a trailer left at 1:14 a.m.

A thirty-day version you can actually run

Week 1. Night walk. Photo inventory of machines and high-value tools. List keys. Write what last year's thefts actually cost. Note what the current cameras can and cannot show.

Week 2. Physical fixes: gate habit, fuel, crib, machine parking, lighting on the approaches. Assign the quitting-time walk to a named person.

Week 3. Camera hygiene: defaults, inbound ports, separate network, firmware, lock the recorder. Add or move views only where the walk showed a hole. Write the camera map.

Week 4. Retention number, NTP, one practice export with a hash and a cover note. Signs at the gate. One-page policy and a named contact. Tell staff what the system is for and what it is not for.

If you want a second set of eyes after that, a scoped site walk is the next step. You get a written coverage plan and a review of the system you already have. Buying hardware is optional and separate.

Bottom line

Yards lose equipment because the easy path is open and because the footage, when it exists, cannot be used. Close the physical path first. Record at the edge without opening the network. Keep a package an adjuster can read. Treat staff and visitors as people with privacy rights, not as scenery.

Forensic Five is in St. Albert, Alberta. We review contractor and industrial yards the same way we review websites: scope in writing, findings you can hand to a broker or a board, no requirement to buy the kit from us. If you want that walk, say so on the contact form under site security.