SecureNTP DES for Cities™  and the vLEO™ Eval­u­a­tion Program

As a part of Certichron’s new vLEO work­ing group efforts Cer­tichron is pleased to announce the avail­abil­ity of DES for a 90 day trial period for Cities using secure time ser­vices as a new evi­dence anchor for the Law Enforce­ment and City Oper­a­tions ser­vices. 

SecureNTP for Cities program

SecureNTP for Cities profides a secure source of time for City IT Oper­a­tions which is prov­able. SecureNTP  for Cities pro­vides a City Man­ager with a secure source of time which is prov­able to the point of court admis­si­bil­ity. With this ser­vice the City Man­ager work­ing to pro­duce a court-​​admissible evi­dence work­flow will have the time-​​base trust anchor to prove the syn­chro­niza­tion of the local time ser­vice as well as any servers which peer­ing was setup for. 

SecureNTP with DES

Addi­tion­ally DES offers the City Man­ager the abil­ity to cre­ate their own Dig­i­tal Evi­dence Pol­icy and IT Prac­tice for its cre­ation in the form of NTP based content-​​timestamps. Most IT peo­ple are unaware that NTP has two optional pay­loads which can be used to carry addi­tional hashes which can be used to rep­re­sent events in time. Certichron’s SecureNTP DES does exactly this and allows for the time-​​stamping and archival stor­age through the Peer­ing Pro­gram com­po­nent of SecureNTP. 

DES pro­vides its adopters an unprece­dented Audit and Evi­dence Prac­tice Enablement

This capa­bil­ity allows a City Man­ager and IT Direc­tor to pro­vide a Time-​​stamping prac­tice which can be used like a Cash Reg­is­ter Receipt only one which can con­tain any num­ber of event or prac­tice types. The ser­vice is an audit design­ers dream because they can cre­ate third-​​party time­stamps which are prov­ably cre­ated through the use of the NIST(UTC) time stan­dard itself. No other time man­age­ment and evi­dence creation/​management process offers this level of capability.

DES for Cities is a new pro­gram to imple­ment new dig­i­tal evi­dence prac­tices atop exist­ing and emerg­ing city-​​operations work flows. This key prac­tice adds sup­port­ing value to exist­ing work flows and can be used as the basis of a vir­tual Law Enforce­ment Oper­a­tions (vLEO) sys­tem. 

vLEO and Law Enforce­ment or Court Practices

vLEO uses Certichron’s patent applied for OpenTDI and Cer­e­monies in Soft­ware™ process which allows for the vir­tu­al­iza­tion of a Law Enforce­ment Officer’s com­mis­sion through the NCCSL eNo­tary Pro­vi­sions now on the books in all fifty states. If your Cam­era Sys­tem or Red­light Ser­vice is down now, this vLEO ser­vice may be just what you need.  Call Cer­tichron at 800−511−2301 or email us at Sales@​Certichron.​COM

Police and Sheriff’s Depart­ments have a new hur­dle to leap and that is in meet­ing the new con­straints Khaled placed against their exist­ing evi­dence cap­ture and man­age­ment prac­tices

To make it pos­si­ble for Law Enforce­ment (LE) to pro­tect our cul­ture and to deal with the ris­ing costs of insur­ing that secu­rity Law Enforce­ment processes are turn­ing to both out­sourced or remotely oper­ated sur­veil­lance sys­tems which depend on vir­tu­al­iza­tion of inter­nal LE and many of the field-​​based LE Data Cap­ture Oper­a­tions which would ulti­mately lead to some form of pros­e­cu­tion and settlement-​​fine.

Tra­di­tional Evi­dence has been first-​​person in form

Tra­di­tion­ally in these mat­ters any cita­tions issued through those processes would gen­er­ally need to be issued by the Police Offi­cer or Sheriff’s Deputy who was oper­at­ing that sys­tem under the com­mis­sion of their office as a law enforce­ment offi­cer. Some States actu­ally have law lim­it­ing the issuance of cita­tions to requir­ing the office of a com­mis­sioned Law Enforce­ment Offi­cer to issue which com­pli­cates many sur­veil­lance and auto­mated traf­fic man­age­ment practices.

Certichron’s “Cer­e­monies in Soft­ware” allows for the vir­tu­al­iza­tion of Law Enforce­ment Functionality

Certichron’s Vir­tu­al­ized Law Enforce­ment Offi­cer, a Cer­e­mony in Soft­ware Prac­tice based on already-​​approved eNo­tary prac­tice addresses this require­ment fully mean­ing with Certichron’s sys­tem exist­ing Law Enforce­ment Agen­cies are ‘good-​​to-​​go’ to restart their traf­fic enforce­ment prac­tices immediately.

The use of the Notary statures ampli­fy­ing the Law Enforce­ment com­mis­sion cre­ates a new and pow­er­ful elec­tronic sign­ing resource with the inte­grated $15,000 bond all nota­rized sign­ings cre­ate. This sys­tem fully meets Cal­i­for­nia and other State require­ments since these states already rat­i­fied the spe­cific por­tions of the Notary Prac­tices Act’s as UCC mak­ing the Cer­tichron model already approved for roll­out across all 50 states.

In fact with proper imple­men­ta­tion of a new evidence-​​capture mind­set, many if not all exist­ing sys­tems can be brought into align­ment with the new con­trol require­ments to main­tain their admis­si­bil­ity into US and Cal­i­for­nia Courts.

The Vir­tu­al­ized LEO

The vir­tiual­ized LEO allows for Inten­tional Evi­dence from each stage of each process to be cre­ated under the com­mis­sion of the offi­cer attest­ing to the issuance of the cita­tions. The cap­ture of the data can be cer­ti­fied by adding a hash­ing time­stamp for each event. The report­ing or con­tain­ment receipt can be prop­erly acknowl­edged with a time­stamp request show­ing each com­po­nent move­ment of evi­dence con­tent, and when that con­tent is ephemeral in form this is the only way to prop­erly doc­u­ment con­trolled man­age­ment of that data.

With this sys­tem any exist­ing sys­tem can have trans­parency and the cer­ti­fy­ing process added to the process by the LEO sign­ing into the Ses­sion Man­ager and attest­ing that they are apply­ing their com­mis­sion as a LEO to that oper­at­ing ses­sion. The prac­tice also can be facil­i­tated against the Cam­era Oper­a­tions Mod­els today for any and all sys­tems (Red­Flex and Lock­heed, or ATS oper­ated in form). For all of these con­trol prac­tices the Cer­tichron DES infra­struc­ture allows the cre­ation and appli­ca­tion of the human com­mis­sion in a vir­tual sense
to these exist­ing systems.

For more infor­ma­tion on our ser­vices and tech­nolo­gies, please email Cer­tichron with your require­ments or con­tact the sales office directly at 800−511−2301 (9−5 PST). Cer­tichron, Inc. © 2009, 2010

The Khaled rul­ing has unique impact on Orange County busi­nesses and campus-​​security oper­a­tions for com­mer­cial, med­ical and edu­ca­tional cen­ter operators.

The issues with the cre­ation and man­age­ment of trust­wor­thy sur­veil­lance data is directly an issue with Orange County courts mean­ing now to reduce risk, oper­at­ing groups need to cre­ate reli­able evi­dence of their actions.

Most processes which only include two par­ties are inher­ently weak, those with a trusted third party. Now there is a real require­ment to cre­ate the Trust­wor­thi­ness of the Dig­i­tal Evi­dence they in all sys­tems cap­tur­ing or con­tain­ing it for the Risk Mit­i­ga­tion Model that allows those enti­ties to obtain insur­ance for their operations.

Certichron’s SecureNTP and the DES time­stamp­ing tech­nol­ogy is exactly what the doc­tor ordered in that it allows a law enforce­ment or civic oper­a­tor to pro­vide court admis­si­ble evi­dence. Adding DES with its SecureNTP com­pletely meets the exist­ing require­ments and when cou­pled with our Cer­e­monies in Soft­ware ser­vice model, can set up a notar­ial con­trol ser­vice on Red­Light Cam­era and other sys­tems designed to auto­mate law enforce­ment activities.

For those fol­low­ing this mat­ter, the fil­ing of the peti­tion for the amend­ment of the Cal­i­for­nia Util­ity Code to reflect the dig­i­tal evi­dence require­ments is in. The docket num­ber is P1007015 and we invite any and all responses.
The vision behind this effort is to bring evidence-​​competence to the Cal­i­for­nia Util­ity Grid as a part of Crit­i­cal Infra­struc­ture Pro­tec­tion efforts in the State of California.

Orange County
While this rul­ing is ini­tially spe­cific to the County of Orange and its Appel­late Court Dis­trict, it also impacts any elec­tronic mes­sag­ing or energy con­trols which flow through this area as elec­tronic media of any form.

Khaled — as a stan­dard or the col­lec­tion o sur­veil­lance data of any form now cre­ates a level-​​of-​​competence for any and all data used in sur­veil­lance or con­trol­ling sys­tems which would come to be used as part of a Court process, whether Civil or Crim­i­nal in nature. Khaled then has wide sweep­ing impact in that all sys­tems and processes, includ­ing con­tract dis­putes and other civil mat­ters which the Supe­rior Court would come to resolve or which would be tried in Supe­rior Courts as part of a State lead pros­e­cu­tion in any mat­ter, or a locally lead pros­e­cu­tion in any mat­ter must also meet this new “trustworthiness”.

The “I Said So” Evi­dence Model
The days when it was just blindly accepted that the sys­tems worked as the man in the White Coat said they do are over. Proof and reli­able proof are now needed for all dig­i­tal cap­ture sys­tems or data con­trol mod­els which the courts will accept as fac­tual or at least review­able and authen­ti­cated to one level or another. With­out this data is just that unsup­ported and unprov­able data.

It is Certichron’s inten­tion to fos­ter a bet­ter under­stand­ing of the needs or foren­sic con­trols in all sys­tems which are intended to cre­ate what we call “Inten­tional Evi­dence”, that which is pre-​​approved court-​​admissible con­tent. The Cal­i­for­nia Power Grid is the most gran­u­lar place to enforce that and is the basis of a model which touches us all and as such is a very impor­tant part of upgrad­ing the US and Cal­i­for­nia Util­ity Grid infra­struc­ture.
The Cer­tichron CPUC fil­ing can be seen at

• Khaled Rul­ing
• Our Peti­tion for Rule­mak­ing in regard to Evi­dence Stan­dards before the CPUC
• Our sup­port­ing com­men­tary before the CPUC

California’s Orange County sets for­mal stan­dard for court admis­si­bil­ity of dig­i­tal sur­veil­lance data.
The term Trust­wor­thy was used in numer­ous barbs in the rul­ing with estab­lishes a legal-​​compliance hur­dle for any com­mer­cial enti­ties doing busi­ness in the Orange County area includ­ing as it hap­pens, any and all con­trol processes in the used in admin­is­ter­ing since “sur­veil­lance data” is in fact just the out­put of a set of processes which are accorded spe­cific sta­tus in the real world.

So what does this mean with sys­tems or enti­ties deliv­er­ing elec­tronic ser­vices of any type to Orange County Enti­ties? Since they are required to pro­duce evi­dence mod­els com­pli­ant to lev­els which meet the Khaled stan­dard any ser­vices which they pur­chase, use, resell, or pro­duce in Orange County must meet those.

This then means any and all Energy, Water or other util­i­ties or for that mat­ter any oper­at­ing data which pro­duces reports on what other sys­tems or con­trols includ­ing sur­veil­lance data (dig­i­tal video) and inte­grated elec­tronic sur­veil­lance (sys­tems which watch other sys­tems or process flows) are con­trolled by Khaled.

• PUC Fil­ing — Docket num­ber 1007015 Peti­tion to amend PUC data man­age­ment prac­tice rules.
• KHALED
• 32733089-​​ca-​​khaled

For the rest of the State of Cal­i­for­nia, it means Khaled is now the inter­op­er­abil­ity goal for other coun­ties. The rul­ing is also dri­ving other States to turn off their Red-​​Light Cam­era sys­tems (15 of them to date) so it is an impor­tant one.

Our analy­sis
Cer­tichron believes that con­trol and cer­ti­fied sur­veil­lance sys­tems which add the legally defined min­i­mums must be avail­able every­where. To enable this suc­cess­ful deploy­ment on secure time as a trust-​​anchor of reg­u­la­tory man­dated evi­dence trust­wor­thi­ness Certichron’s regional ser­vice cen­ters pro­vides access to the NIST time sources as the evidence-​​source for all foren­sic con­trols con­tem­plated for in-​​place operations.

Adding secure time-​​stamping to exist­ing processes pro­vides all the required evidence-​​readiness and Certichron’s vision is a uni­fied evi­dence model every­where, one which allows mechan­i­cal review of its integrity and events.

Stay tuned for more infor­ma­tion on Khaled and its applic­a­bil­ity in the use most of SoCalEdison’s area of the County of Orange.

Cer­tichron and Relify Secu­rity annouc­nce the avail­abil­ity of Certichron’s SecureNTP ser­vices to Relify Secu­rity customers.

Cer­tichron announces its part­ner­ship with Relify Secu­rity. Relify is a well estab­lished provider of com­mer­cial con­sult­ing and secu­rity review ser­vices for bank­ing, credit union and other PCI-​​DSS type clients as well as other Finan­cial Providers.

To quote Relify Security’s man­ag­ing part­ner:
“Relify Secu­rity has recently launched a part­ner­ship to deliver what Relify believes is a pretty unique and needed ser­vice. It address a prob­lem that we often don’t think about… Where do you get your time?”…

“SecureNTP pro­vides one time source for all uses: What this means is that there is one time source for every­thing finally — from Build­ing, Power, Secu­rity, IT Oper­a­tions and at last uni­form evi­dence across the entire entity. In most cases SecureNTP requires no instal­la­tion of hard­ware or soft­ware, since your busi­ness is likely already run­ning the NTP pro­to­col. Once you have reg­is­tered with Cer­tichron, it only takes a few minor con­fig­u­ra­tion changes and instal­la­tion of the dig­i­tal key, along with set­ting up audit log­ging and key man­age­ment practices.”
Mike Pear­son, CISSP
Man­ag­ing Partner

For more infor­ma­tion con­tact Relify Secu­rity, LLC
O/​F: 866.897.6900
M: 813.523.0151
www​.reli​fy​se​cu​rity​.com
Reli­able and Ver­i­fi­able Advanced Secu­rity Solutions

For those of you not aware — there was a very impor­tant rul­ing out of the Orange County Appel­late called Cal­i­for­nia v Khaled which set new evi­dence stan­dards for “Unat­tended evi­dence col­lec­tion devices and sys­tems” in use as to what is admis­si­ble before Cal­i­for­nia Courts.

While the core focus on this would be speed-​​trap type cam­eras this also clearly applies to “any and all devices which would col­lect evi­dence which would be used in a crim­i­nal or civil pros­e­cu­tion” which means Smart­Grid too… yeah that’s right, since a power meter is used to pro­duce evi­dence before the Pub­lic Util­i­ties Com­mis­sion or the Cal­i­for­nia Court’s it means the Smart­Grid and in par­tic­u­lar the meters are them­selves cov­ered as Evi­dence Col­lec­tion Devices too.

Cer­tichron serves CPUC notice of Khaled Rul­ing
To help sup­port the imme­di­ate adop­tion of this same rul­ing in Cal­i­for­nia Util­ity Law, Cer­tichron served the Cal­i­for­nia PUC for­mal (elec­tronic) notice that this prece­dent per­tains to “any and all sys­tems used in energy or util­ity oper­a­tion, deliv­ery of ser­vice, or through which a ser­vice con­trolled under the PUC’s char­ters, were directly con­trolled under this same prece­dent because they pro­duce content-​​records which are used in rec­on­cil­li­a­tion of finan­cial mat­ters which are for­mally reg­u­lated at the State and Fed­eral level, and for which that con­tent would come to be admit­ted as evi­dence for­mally before a Arbi­tra­tion, Medi­a­tion in civil mat­ters, or Court pro­ceed­ing in both civil and crim­i­nal mat­ters per­tain­ing to the oper­a­tions of those pub­licly reg­u­lated services”

The effect of this fil­ing
What this post­ing to the CPUC does today is sup­ports a for­mal motion to the Admin­is­tra­tive Law Judges of the Cal­i­for­nia PUC that any and all Smart­Grid oper­a­tions must meet min­i­mum Dig­i­tal Evi­dence stan­dards for their oper­a­tion and have pub­lic structure/​architecture mod­els per sec­tions 10.3 and 10.4 of the PUC ser­vice code.

This for­mal motion was filed last Wednes­day and the post­ing this AM served as a sup­port­ing brief and Mem­o­ran­dum of Points and Author­i­ties fil­ing as a sup­ple­ment to the orig­i­nal motion and also noticed that one of the core tech­nolo­gies being used to cre­ate this evi­dence today, that being the unau­then­ti­cated L1 GPS ser­vice is eas­ily spoofed and jammed, and that as such it fails the evi­den­tiary tests now man­dated by Khaled.

See this related post for more information.

Why?
The intent is to set a stake in the ground for the basic level of com­pe­tence that any evi­dence should meet to be con­sid­ered ‘prov­able’ and for admis­si­bil­ity to State and Fed­eral Courts. The Fed­eral Courts have rul­ings like Lor­raine v Markel to sup­port real world con­trols under the Fed­eral Rules of Evi­dence but after the fiasco of the over­sight in the San Fran­cisco DA’s Foren­sic Lab­o­ra­tory, any device pro­duc­ing tes­ti­mony which is used to pros­e­cute any­thing, whether civil or crim­i­nal must meet a min­i­mum stan­dard of com­pe­tence or be rel­e­gated as hear-​​say and inadmissible.

The impli­ca­tions have broad reach­ing impact on all reg­u­lated com­mu­ni­ca­tions, util­i­ties, and media-​​delivery rules as well so it will be inter­est­ing to see how the court’s react to these man­dates and motions to cre­ate respon­si­ble evi­dence rules.

Q: The staged or delayed deploy­ment prac­tice model enu­mer­ated in the PCI DSS Pri­or­i­tized Approach implies I can put 10.4 com­pli­ance off until later in the com­pli­ance prac­tice — is that true?

A: This is a really good ques­tion and from my per­spec­tive I under­stand the intent in the pri­or­i­tized approaches lan­guage in mak­ing it eas­ier for smaller Mer­chants and lower-​​volume enti­ties to com­ply, but I think there are other under­ly­ing issues which make it imper­a­tive to address time man­age­ment in the secu­rity model and control/​default service/​password changes in the con­fig­u­ra­tion report process of Require­ments 1 and 2. Let me explain this logic… the Pay­ment Indus­try Coun­cil (www​.pcissc​.org) only con­trols the use of the PCI DSS stan­dard within the Pay­ment Indus­try. That use of the PCI DSS is con­trac­tu­ally con­trolled by the CARD Brands them­selves as part­ners and found­ing mem­bers of the PCI SSC. Any use of the PCI DSS stan­dard then out­side of that nar­row con­trac­tual use would be con­strained by what­ever other con­straints con­trol that other model.

PCI DSS is a stan­dard — The Pri­or­i­tized Deploy­ment Approach is an Con­sor­tia Opin­ion, and the two are separate

The same tech­ni­cal stan­dard is now ref­er­enced under Law in sev­eral States in the US most promi­nently Nevada which func­tion­ally took the Pay­ment Counsel’s abil­ity to allow par­ties to only meet parts of the Data Secu­rity Stan­dard (now a part of Law and Prac­tice therein) is moot, since those same par­ties must meet all of the DSS and that is based in Pri­vacy Law and not the con­trac­tual con­trols of the Pay­ment Counsel’s mem­ber credit/​payment card brands.

It’s not true!

Before argu­ing this isn’t true, lets walk the walk. Take the per­spec­tive that the PCI SSC is an indus­try con­sor­tia and not a Leg­isla­tive Body so the first thing to do is to per­fect the ques­tion so we can come to a real answer.

Per­fect­ing the right question

The real ques­tion here to answer is “are there any leg­isla­tive or reg­u­la­tory require­ments which are cod­i­fied in Law or prac­tice which would make me imple­ment the Time Man­age­ment Solu­tion por­tion of the PCI DSS (sec­tion 10.4) imme­di­ately rather than sec­ond or third year as the Pri­or­i­tized Approach guide implies???” and in my opin­ion there is an answer and its YES.

Oper­at­ing in a man­ner which ensures (and insures) Court Admis­si­bil­ity of Dig­i­tal Data.

My asser­tion is that the com­pli­ance with the PCI DSS is not the core com­pli­ance issue here because you have to oper­ate legally. Because of this you can­not wait until the third year to imple­ment a prac­tice which insures court admis­si­bil­ity of your data records because you have a legal oblig­a­tion which extends beyond the PCI DSS require­ments to insure your records are court admissible,

Fol­low the logic — Because this is above and beyond what the PCI DSS require­ments may put in place, while the PCI com­pli­ance process may defer proper time man­age­ment you can­not because you must always oper­ate your busi­ness or dig­i­tal trans­ac­tion sys­tems in a man­ner which makes them prov­ably con­trolled under the local or spe­cific Jurisdiction’s require­ments. No con­tract with any other party (includ­ing the CARD Brand Provider you do busi­ness with can elim­i­nate that need, nor can the PCI DSS require­ments either.

Nevada Com­pli­ance tops it all

Like­wise if those records have Nevada State Res­i­dent Per­son­ally Iden­ti­fi­able Infor­ma­tion in them then they like­wise would also need to com­ply to the con­trols of the PCI DSS and that also can­not be delayed. Nevada State Pri­vacy require­ments man­date the use of the PCI DSS process con­trol tech­nol­ogy and more impor­tantly not its rec­om­mended low-​​effort roll out time­line for easy mer­chant accep­tance and this is impor­tant to under­stand the imme­di­ate impli­ca­tion of. I am not a lawyer and you should get real good legal advice on this but I am bet­ting that the Pay­ment Coun­sel can­not absolve you of any legal respon­si­bil­i­ties to imple­ment con­trols to address keep­ing pri­vacy impacted infor­ma­tion as well as your finan­cial con­trols. The PCI SSC lost con­trol of how the DSS con­trols are rolled out when they allowed the State of Nevada to write them into law mean­ing that State of Nevada pushed the roll out as a national stan­dard therein.

Now every­one with online ser­vices or national oper­a­tions which may include Nevada State pro­tected infor­ma­tion must imme­di­ately meet those Nevada State Legal require­ments to insure their data is both secure and is Court Admis­si­ble. Those issues are now are defined in before higher tri­bunals than an Indus­try Con­sor­tia like the PCI SSC. The real ques­tion is how you com­ply. I sug­gest you send us email to EvidenceNow@​certichron.​com and Cer­tichron will send you back a pack­age on mak­ing your infra­struc­ture evi­dence ready in today’s newly emerged dig­i­tal integrity world.

NGC Reg­u­la­tions say Gam­bling Sys­tems need secured time services

In today’s gam­bling ter­mi­nals and area con­trollers the time man­age­ment ser­vices need spe­cial atten­tion. Linux and other sys­tems which run NTP natively are more eas­ily con­fig­ured but many of them only run SNTP mean­ing that they are not capa­ble of rea­son­able strength authen­ti­ca­tion in their time-​​setting process and as such the evi­dence value of the time set­ting event is questionable.

In infra­struc­ture where dis­trib­uted or group gam­ing prac­tices are run, this has direct impli­ca­tions espe­cially in instance or reac­tion based games where the when of &9;when’ an event hap­pens is mea­sured in an instance locally and gen­er­ally trans­ferred into a multi-​​event sched­uler which is the core of the multi-​​terminal gam­ing sys­tem. There are of course many vari­ants, but the goal and the real win is in uni­fy­ing the evi­dence model such that real-​​automated inline con­trols are effective.

The fol­low­ing are exam­ples of the lan­guage (com­ments are in ital­ics):

Reg­u­la­tions:

http://​gam​ing​.nv​.gov/​s​t​a​t​s​_​r​e​g​s​/​a​l​l​_​r​e​g​s​.​pdf

 Oper­a­tion of Gam­ing Estab­lish­ments 5.108.2.(f) At the request of the chair­man, an oper­a­tor shall pro­vide and main­tain, at its sole expense and at such loca­tion as the chair­man may des­ig­nate, a ter­mi­nal and printer for the pur­pose of mon­i­tor­ing infor­ma­tion regard­ing the sys­tem includ­ing, but not lim­ited to, the cur­rent pro­gres­sive pay­off sched­ules, reset funds, the real-​​time date and time, the num­ber and loca­tion of gam­ing devices and games con­nected to the sys­tem, the names of per­sons access­ing the main com­puter or data com­mu­ni­ca­tion com­po­nents of the sys­tem, the iden­ti­fi­ca­tion of func­tions being per­formed by such per­sons, the audi­ble noti­fi­ca­tion of any pro­gres­sive pay­off sched­ule won, and the iden­ti­fi­ca­tion of the loca­tion, machine num­ber, and amount of any pro­gres­sive pay­off sched­ule won.

5.200.3.(b) Estab­lish a log that con­tains the name of each salon patron of the gam­ing salon, as well as the times each salon patron enters and leaves the gam­ing salon. The log shall be main­tained for a period of not less than two years.

Sur­veil­lance Stan­dards 2.010.7. The sur­veil­lance sys­tem must include date and time gen­er­a­tors which pos­sess the capa­bil­ity to dis­play the date and time of recorded events on video tape record­ings. The dis­played date and time must not sig­nif­i­cantly obstruct the recorded view.

Dig­i­tal Video Record­ing Stan­dards: 5. All dig­i­tal video disks or other stor­age media pro­duced from the DVR sys­tem must con­tain the data with the time and date it was recorded super­im­posed, the media player that has the soft­ware nec­es­sary to view the DVR images, as well as a video ver­i­fi­ca­tion encryp­tion code (also known as a watermark).

Tech­ni­cal Stan­dards for Gam­ing Devices and On-​​Line Slot Sys­tems: 1.050.2.(b) For the sys­tem por­tion of the sys­tem sup­ported game, gam­bling event server or sys­tem com­po­nent must reside in a secure area where access is lim­ited to autho­rized per­son­nel. Log­i­cal access to the sys­tem sup­ported game shall be logged on the server com­po­nent and remotely on a log­ging device which resides out­side the secure area and is not acces­si­ble to the indi­vid­ual access­ing the secure area. Logged data shall include: time and date of the access and the iden­ti­fi­ca­tion of the access­ing individual(S). The result­ing logs shall be retained for a min­i­mum of 90 days.

1.066.5. A sys­tem sup­ported or sys­tem based game must log each remote access on the server or sys­tem part of the gam­ing device and on the sec­ondary log­ging device. The log must include time and date of the access and a list of pro­grams trans­ferred or changed.

1.084.5. Sys­tem sup­ported games must pro­vide a log entry any­time an indi­vid­ual causes a soft­ware com­po­nent to be added, removed or altered in the server or sys­tem por­tion of the device. Each log entry must con­tain the date and time of the action, iden­ti­fi­ca­tion of the com­po­nent affected, the iden­ti­fi­ca­tion of the indi­vid­ual per­form­ing the mod­i­fi­ca­tion, the rea­son for the mod­i­fi­ca­tion and any per­ti­nent val­i­da­tion infor­ma­tion. (See sim­i­lar lan­guage in 1.084.6, 1.086.5 and 1.086.6,)

The require­ments are like­wise enu­mer­ated through­out all of the NGC Stan­dard for all other devices in the Casino or Gam­bling Ter­mi­nal oper­a­tions. L1 GPS sys­tems alone don’t cut it any­more, proof demands evi­dence which will stand the test of time. 

Certichron’s SecureNTP anchor’s gam­bling net­works so that their time­stamps are prov­able. Self-​​attested time­stamps are no longer prov­able and since fraud in eTrans­ac­tions hap­pens in an instant, the proper time­line cor­re­la­tion in pros­e­cu­tions and sur­veil­lance sys­tems is key.

See also Certichron’s press release about the new Las Vegas SecureNTP™ ser­vice cen­ter open­ing up there.