Reasonable. Reunifying. Pattern-aware.

UK transport-hub security is graded against the JCNSS reasonableness standard and the Protect Duty conversation around publicly accessible locations. Manual screen-watching is increasingly read as not reasonable; facial recognition is read as disproportionate. Embedding-only ReID gives the security team measurably more capability than manual review, in a posture that the regulator reads as continuous with existing CCTV rather than an escalation into biometrics.

§ NAMED PAINS

What the Head of Security tells us first.

01

Counter-terrorism reasonableness is the question every audit asks

JCNSS guidance and the Protect Duty conversation around 'publicly accessible locations' both ask whether a transport operator's security posture is reasonable in the context of identified risks. Watching screens by hand is increasingly read as not reasonable; biometric surveillance is read as disproportionate. Embedding-only ReID sits between the two — measurably more capable than manual review, categorically less intrusive than facial recognition.
02

Lost-property reunification is the friendly investigation that takes hours

A bag left on the bench at Platform 4 at 14:00. Today: 90 minutes of footage review across six cameras to find the owner walking away from it. With ReID, the same investigation is a single query — the bag is a stable visual object; the embedding of the person who set it down is a stable vector; the cross-camera trace surfaces in seconds.
03

Anti-stalking pattern review is the investigation nobody runs in time

Transport-hub stalking complaints are typically reviewed after the third or fourth incident, when the victim has already been frightened twice. The pattern — same person, multiple cameras, same victim's commute window — is exactly what cross-camera ReID surfaces. We surface the pattern within the first incident, not the third.

Pain 01

Reasonableness in writing: measurably more than manual, categorically less than AFR.

What we see

Cross-camera traces inside the publicly accessible footprint of the station, depot or terminal. Pattern matches surface to the security team when they exceed configured thresholds.

What we don’t see

Faces — embedding-only.
Names or PNR data — no link to the booking system.
Demographic inference — no age, gender or ethnicity processing.
Behaviour outside the configured rule set — no general-purpose surveillance feed for the security team to dip into.

What concierge does

Head of Security configures the rule set with reference to the JCNSS reasonableness factors (identified risks, proportionality, mitigation effectiveness).
Pattern matches surface to the duty operator; security team triages.
Each escalated match is logged with the matching rule + the operator's action + the outcome.
Annual review against the JCNSS reasonableness test + Protect Duty evolving guidance.

Data lifecycle

Raw video sits in a 72-hour ring buffer on the on-prem edge appliance, then auto-overwrites — we never copy frames off the site. Embeddings (the abstract vectors the system actually compares) live for 30 days in the UK-resident database. Event records (a timestamp + a camera ID + a similarity score) live for 90 days for investigation continuity, then auto-purge. None of the three layers contain a face image, a name, or an ID document.

Legal posture

UK GDPR Art 6(1)(f) — legitimate interest in counter-terrorism + public safety + transport-network resilience. ICO surveillance camera code compliance. ZA-class registration; no biometric escalation. JCNSS reasonableness framing documented; Protect Duty alignment as the regime crystallises. DSPT v8 self-assessment shared with the operator's DPO and SIRO equivalent.

Procurement Q&A

How does this read at a Protect Duty inspection?: The Protect Duty conversation is reasonableness against identified risks at publicly accessible locations. Embedding-only ReID gives the operator a defensible posture between manual screen-watching (increasingly read as not reasonable) and facial recognition (read as disproportionate). We help the operator document the comparator explicitly.
What about a coronial review after an incident?: Coronial reviews ask whether the operator's posture was reasonable in advance of the incident. Documented JCNSS-aligned rule set, documented EIA, documented embedding-only posture, documented operator training — that's the evidentiary stack the coroner reads.
How does this work with British Transport Police?: BTP receive frames + timestamps + camera IDs on request, exactly as they do today. The embedding is the index; the evidence is the frame in the 72-hour ring buffer. We document the police-disclosure workflow.

Pain 02

Bag on Platform 4 at 14:00. Owner reunited by 14:45.

What we see

The bag entering the platform at 13:48 with its owner, the owner walking away from the bench at 14:00, and the owner's embedding moving to the concourse exit at 14:03. A 3-thumbnail strip; staff dispatch to intercept.

What we don’t see

Whose bag it is — no name, no PNR, no Bluetooth tag inference.
Faces — embedding-only.
Anything beyond the public concourse + platform footprint — bags that exit the station are out of scope unless BTP escalation invokes a wider sweep.

What concierge does

Staff find the bag at 14:25; report to the duty operator.
Operator queries by camera + time window (Platform 4, 13:50–14:10); the embedding of whoever set the bag down surfaces in seconds.
Operator follows the embedding forward through concourse cameras; if owner is still in the station, station staff dispatch to intercept.
If owner has left, the bag is processed per the operator's standard lost-property workflow — but the embedding match has already cleared the 'is this an abandoned package' counter-terrorism flag if the operator's rule set scopes both jobs to the same query.

Data lifecycle

Legal posture

Processed under UK GDPR Art 6(1)(f) — legitimate interest in operator safety, balanced against a data subject who is not identified by the system. ICO registration: ZA-class data-controller posture (no biometric-processing escalation; embeddings of body-shape + clothing carry no Schedule 1 special category by construction). DSPT v8 self-assessment shared with the customer's DPO under NDA before contract; written legal opinion on the embeddings-vs-facial-recognition distinction included.

Procurement Q&A

Does this clear the 'unattended package' counter-terrorism flag too?: Often, yes. The same cross-camera query shows whether the bag was set down by someone who walked away (innocuous loss) or left in a pattern that triggers the counter-terrorism rule (rapid placement + immediate exit + no return). Two operationally connected jobs share the query.
What if the owner is a child or vulnerable person?: Operationally the same — the system observes movement, not identity or vulnerability. The staff who intercept the owner handle the duty-of-care conversation per the operator's existing protocol; no inference is made by the camera stack.
How does this scale to a Friday-night peak?: The system runs the same regardless of concourse density; the operator's bandwidth is the bottleneck, not the camera stack's. False-positive rate on lost-property scenarios is operationally low because the bag is a stable visual object and the embedding of whoever set it down is a single vector.

Pain 03

Stalking pattern surfaced in the first incident, not the third.

What we see

The same body-shape embedding present on the victim's regular commute window across multiple days + multiple cameras, within configurable thresholds. Pattern surfaces to the security team with a confidence band and the matching camera + time set.

What we don’t see

Either party's name — no link to ticketing or PNR.
Faces — embedding-only.
Behavioural inference — no motive scoring; we surface the pattern, the security team + BTP handle intent and intervention.
Patterns outside the operator's configured concourse + platform footprint.

What concierge does

Victim reports concern to station staff (or to BTP); the security team configures the matching window around the victim's reported commute camera set and time window.
If the pattern matches within the embedding window (30 days), the security team is alerted on the next match.
Intervention follows the operator's existing protocol — BTP engagement, station-staff safeguarding, victim communication.
Window auto-expires; if no further match within 30 days, the matching evaporates and the system reverts to baseline.

Data lifecycle

Legal posture

UK GDPR Art 6(1)(f), with specific-incident processing posture for the configured matching window. Stalking Protection Order regime + Protection from Harassment Act framing in the safeguarding playbook the operator + BTP run jointly. ICO ZA-class registration; no biometric escalation. DSPT v8 self-assessment.

Procurement Q&A

How is the matching window scoped?: Configurable per incident — camera set, time window, embedding-window length (default 30 days, never longer without a documented review). The narrowness is the point: the system is operating as a safeguarding instrument for one named victim, not as a general watchlist.
What about the rights of the person being matched?: Art 6(1)(f) requires a balancing test. The balancing test for a stalking suspect against a named victim with a credible report tilts toward the victim; we document the test in the safeguarding playbook and the operator's incident log. After 30 days with no further match, the embedding auto-purges and the rights position resets.
Does this work with BTP's existing stalking referral pathway?: Yes — and the BTP officers we've spoken to in pilot framing have explicitly welcomed the embedding-only posture for stalking work, because it gives the safeguarding team a tool that doesn't require the Article 9 escalation of facial recognition. We share the pilot pathway document.

§ ICO + JCNSS POSTURE FOR TRANSPORT

Reasonableness is the test. Embeddings are how it's passed.

The Joint Committee on the National Security Strategy (JCNSS) and the Protect Duty consultation both turn on the reasonableness of the operator's chosen posture against identified risks. The unhelpful answer is biometric surveillance; the no-longer-defensible answer is manual screen-watching alone. Embedding-only ReID is the middle posture — more capable than manual review, categorically less intrusive than facial recognition, and continuous with the existing CCTV DPIA.

For anti-stalking pattern detection in particular, the difference between reviewing footage after the third incident and surfacing the cross-camera pattern inside the first is a measurable safeguarding outcome — the kind a JCNSS or coronial review will read as reasonableness met.

Read the rest of the stack.

How it works → See the demo → The UK posture → Pricing →