The contractor yard field guide after this month's recorder and switch news

We published a yard walk in mid-September. The last week changed the shopping list, not the method. Digital Watchdog recorders got a federal ICS note. Zyxel GS1900 switches landed on CISA's exploited list, with a Thursday clock. Someone pulled a Flock camera off a pole and the encryption key was sitting on the device. Consumer Tapo kits still fail on the same LAN they are sold for. Alberta yards are being offered solar trailers and month-to-month monitored response. This is the field version: what to do with your feet, what to ask before you rent a trailer, how to keep the kit from becoming the breach, what to hand an adjuster, and how to stay on the right side of Alberta and B.C. PIPA. It is not legal advice and it is not a product pitch. If a step needs a lawyer or a licensed alarm partner, it says so.

Start with feet, fuel, and keys

Theft still wins on habit, not on missing megapixels. Walk at last light or Sunday morning. Write four lines you can read in a claims meeting:

• What leaves, and how. Tools and copper in a half-ton. Fuel in a jerry can. A compact machine on a trailer that was never booked. GPS bricks and batteries that fit in a backpack.
• How a stranger gets in. Latch-only gates. Short fence behind the laydown. Shop man-door on a brick. The neighbour's dark corner.
• Where people actually park and cut through, not the site plan.
• What you can already prove. If last year's loss produced no clip, no trusted time, and no export anyone kept, the current system is decoration.

Physical work still beats another dome. Lock the fuel. Put copper and small tools in a crib or a locked conex. Park iron away from the fence so a trailer cannot back up to the bucket. Hitch pins and battery disconnects are boring and they work. One controlled gate after hours beats three decorative ones. Photograph serial plates now. Keep a one-page list: unit number, serial, last hour meter, who has keys. That list has to exist before the claim.

Quitting time needs an owner. One named person walks the gate, the fuel, the crib, and the machines near the street, and writes the time. Keys off the nail and out of the cup holder. Do not post a yard photo of new iron on a public page. Light the approaches, not only the office. Etch a company mark on tools that walk. Ask the neighbouring shop who is usually there late. None of that needs a cloud login.

If a solar trailer shows up, ask these before you sign

Thermal cameras on a trailer with a generator and a month-to-month response desk can be the right next step. They are not a coverage plan. They are not evidence until you have seen an export. Before you rent or buy, get answers in writing:

• Where does the video live. On the trailer, in a vendor cloud, or both. Who holds the admin password. Can you export an original file without calling sales.
• How does the trailer talk home. Outbound only, or did someone punch a hole in your yard firewall to make the app work.
• What happens when cellular drops. Alberta industrial parks still have dead corners. If the trailer goes silent, do you still have local recording.
• Who answers at 1:14 a.m. A licensed monitoring shop is a different product from a camera vendor's phone tree. We do not sell licensed 24/7 monitoring. If you need that, hire it as its own contract and keep our walk independent of it.
• What the trailer does not see. The side of the conex, the man-door, the fuel that sits behind the shop. A trailer at the gate is not a plan for the crib.

Write those answers on one page and keep them with the rental. If the salesperson cannot explain recording, export, and the network path, get a second opinion before the trailer arrives.

Treat the recorder and the switch as computers

CISA's mid-September note on Digital Watchdog VMAX (ICSA-26-258-01) is the sentence we already write on a walk: full admin on the recorder means live video, old video, config, and a path into the rest of the LAN. Hard-coded FTP and missing web auth are not exotic. They are what you find when the NVR sat on the office VLAN because that was easier than a camera switch.

This week's Zyxel GS1900 row is the same class of device with a different logo. CVE-2026-7273 is a LAN user with no login turning the management page into a command. GreyNoise counted 996 boxes. Firmware is the June 2.90(...2)C0 line. Federal clock is Thursday. The eight-port PoE brick under reception, or the 24-port in the conex, is often the camera switch. If guest Wi-Fi or a contractor laptop shares that LAN, "LAN only" in the advisory is not a comfort.

Flock's lesson from the stolen-pole dump is older than Flock. On-device encryption that keeps the key on the device is a locked filing cabinet with the key taped to the lid. Lock the recorder. Do not store the only copy of footage and the only copy of the key in the same unlocked closet. Tapo-class kits that fail on the same LAN they were sold for belong on a dedicated cable, not on payroll Wi-Fi.

The kit that holds up on a contractor site:

• Record on the property. Cloud viewing can sit on top. Cloud-only with a vendor password you cannot audit is a different product. Know which one you bought.
• No inbound ports for cameras. Not 80, 443, 554, 8000, 37777, or whatever the app asked for. VPN into a small management network, or a vendor path that only calls out. If the installer cannot explain how they avoided inbound ports, stop.
• Cameras off the office LAN. A VLAN or a dedicated switch is enough. The recorder should not sit next to QuickBooks. The GS1900 that feeds those cameras needs the June firmware if it is a model on Zyxel's table, and it needs to be off guest Wi-Fi.
• Unique admin passwords. Disable unused accounts and P2P you do not use. Turn off UPnP. If the kit emailed a password in plain text, change it.
• Firmware on a calendar. Digital Watchdog this month, Tapo last week, silent vendors forever. A dead vendor is a finding.
• Lock the recorder. A thief who wants the claim to fail will take the NVR. Bolt it. Keep a second copy of the last export window if you have a live claim.
• Named logins for the phone app. A crew-wide shared password is how footage leaks and how the same login shows up on the next site.

We review camera fleets the same way we review servers. A site-security assessment is not a requirement to buy hardware from us.

Build the evidence package before anyone steals anything

Adjusters do not want a folder of unnamed MP4s. They want a short package that answers the claim and shows you did not invent the clip on Monday.

Do this while the yard is quiet:

• Time you can defend. Point the NVR at a known NTP source, or write the offset if you cannot. A clip that is 17 minutes off is an argument.
• A camera map. One page: name, what it sees, what it does not. "CAM3 shop south" is useless if the dome moved in April.
• Retention you chose. Thirty days is a common yard starting point. If the disk overwrites on day nine, your policy is fiction. Write the number.
• A practice export. Original file, not a phone video of the monitor. Camera ID and time window in the filename. SHA-256 hash in the cover note. Keep a copy you do not email around.
• A cover note. Who exported, when, from which recorder, what the clip shows, and what it does not. "No camera on the north fence" belongs in that note.
• Chain of custody on a live claim. One person. No edits. Log who got copies (insurer, police, counsel). If you trim for email, keep the original and say you trimmed.

Stills help: plate, hitch, face at the gate, machine leaving. Pair them with the clip.

Footage is a backup problem. Yesterday Microsoft said the September updates can stop File History from writing. Do not park the only NVR export on a shop PC that uses File History to a USB disk and call it off-site. Copy the export to a dated folder you can name, and prove you can open it. Veeam Agent on that same PC needs a current build if you use it. The copies can stop, and the agent can become a privilege path. We wrote both this week. The yard version is the same sentence: who can wipe the video, and when did anyone open a file from last month.

Tell the broker what you have in one paragraph: zones, retention, how you export, who owns the policy. Ask what their theft wording wants to see. None of this guarantees a payout. It makes the conversation shorter.

Alberta and B.C. privacy you can put on a sign

Yards record staff, contractors, drivers, and sometimes the street. That is personal information. Private-sector shops in Alberta and British Columbia sit under each province's Personal Information Protection Act. Public bodies sit under different statutes. This is a field guide. Union, live complaint, or indoor cameras on people all day: talk to counsel.

Purpose that is true. Safety, site security, and loss prevention hold up. Grading smoke breaks with the same cameras is how complaints start. An Alberta OIPC workplace-camera case (Hoffman Holdings, 2005) treated security and safety as reasonable in that case and treated general performance monitoring as not. Do not put productivity on the sign if you cannot defend it.

Notice before people walk in. Signs at the gate and shop entries. A sentence that works: "Cameras are in use for site security and loss prevention. Questions: [name, phone or email]." Put the same line in orientation papers. OIPC Alberta's private-sector video guidance expects noticeable signage and a contact. B.C.'s commissioner expects people to know they are recorded before they choose to enter.

Minimize. Gate, apron, laydown, fuel, crib. Not toilets, change rooms, or the lunch table. Do not grab more sidewalk or neighbour lot than the job needs.

One-page policy. Purpose, camera locations, retention, who can watch or export, how someone asks for their own images, what you do with a police or insurer request. Name the owner. Both PIPAs expect policies and someone accountable.

Protect the recordings. Access control, no shared admin, no inbound ports, exports with a hash and a log. An open camera system is a cyber finding and a privacy finding. If identifiable footage leaks and there is a real risk of significant harm, Alberta PIPA has breach-notification duties. Do not invent that process after the leak.

Access requests. People can ask for images of themselves. Know who answers and what you would withhold (other faces, security methods).

Covert indoor cameras and face biometrics are not defaults. Hidden shop recording is a different legal problem than an obvious dome at the gate. A yard does not need face search to prove a trailer left at 1:14 a.m.

A week you can run after this month's news

Today. Night walk. Serial photos. Key list. Write last year's real losses. Note what the current cameras cannot show.

Tomorrow. Gate habit, fuel, crib, machine parking, lighting. Name the quitting-time walker. If a solar trailer is in the quote pile, get the five answers above in writing.

This week. Recorder and switch hygiene. Defaults. Inbound ports. Separate network. Firmware on Digital Watchdog, and the GS1900 (...2)C0 if that brick is yours. Lock the NVR. Camera map. Practice export with a hash. Signs and the one-page policy. Tell staff what the system is for.

Before Thursday. GS1900 firmware if you have one. Update Stack on the shop PCs if you have not. Then look at the last backup date on whatever holds the exports.

If you want a second set of eyes after that, a scoped site walk is the next step. Written coverage plan. Review of the system you already have. Hardware is optional and separate.

Bottom line

Yards lose iron because the easy path is open, and they lose claims because the footage cannot be used. Close the physical path. Record at the edge without opening the network. Treat the recorder and the cheap switch as computers. Keep a package an adjuster can read. Treat staff and visitors as people with privacy rights.

Forensic Five is in St. Albert, Alberta. We review contractor and industrial yards the same way we review websites: scope in writing, findings you can hand to a broker, no requirement to buy the kit from us. Site security on the contact form if you want that walk.