A judge dismissed 98 trespassing charges for one reason. Your next clip has to answer that one reason.

The most-cited recent ruling is from U.S. Magistrate Judge Gregory B. Wormuth in the District of New Mexico, issued May 15, 2025. He dismissed the trespassing counts (entering military property and violating a security regulation) against 98 migrants who had crossed into the newly designated National Defense Area along the Southwest border. The third count in the complaint, illegal entry into the United States, was not affected. The controlling reason was simple: the government did not plead facts establishing that each defendant knew they were entering a restricted zone. The knowledge element had been a background issue in trespass law for decades. After this ruling it became a gating element for charging, and that is what this guide is about.

Because the complaints did not allege facts sufficient to show that the defendants knew they had entered a restricted area. Defense attorneys argued that the National Defense Area had been stood up fast, that signage along the 180-mile stretch was either not yet installed or sparse, and that a person walking north across open desert could not be presumed on notice. Wormuth sided with the defense on the knowledge element. Government can refile if it gathers facts that speak to knowledge — footage of a defendant looking at a sign, stopping at a marker, changing direction at a fence line, or dwelling at a posted boundary — but the underlying arrest package on its own does not get across the charging threshold anymore.

It does not change the statutes. It changes the evidentiary bar. A charging decision on a trespass count now routinely asks: does the clip carry any behavioral signal that the subject knew? A short straight-line approach at a fast pace across a zone boundary does not carry that signal. A pause at the edge of a zone, a head turn toward a posted sign, a retreat and re-approach, a 90-second dwell before crossing — any of those read as awareness. The clip carrying or not carrying those signals is now the decisive field on the packet. For private multifamily, industrial, and installation-adjacent properties, the implication is direct: the raw 24/7 recording is not enough on its own, because raw recording does not extract behavior. Something has to read the track and write the behavior to the event.

It is the shape of the track across a zone boundary, not a single frame. Five shapes matter in practice. Shape one: approach_and_pause, the subject moves toward a boundary, stops within arm's reach of it, then crosses. Shape two: approach_retreat_reapproach, the subject enters the zone, leaves, and enters again on the same track, which reads as deliberate return. Shape three: boundary_loiter, the subject is inside the zone for 90 or more seconds before the arrest, which reads as presence, not transit. Shape four: sign_fixation, the track's bounding box orients toward a posted marker for more than two seconds before crossing. Shape five: path_anomaly, the track's straight-line path breaks at the boundary and resumes past it, which reads as the subject noticing the boundary. A dwell-and-track index can tag any of the five on the event payload automatically. A raw DVR cannot.

Because a DVR records frames, it does not read tracks. The evidence a DVR hands off is a continuous video file. To extract a pause, a retreat, a sign fixation, or a dwell, a human operator has to scrub the tape, identify the subject across the track, and describe the behavior in testimony. That manual reconstruction is what takes 4 to 6 hours per clip on a 48-hour window across a 16-channel recorder, and is exactly the retrieval bottleneck that causes cases to drop before charging on the 2-to-5 day complaint clock. On the 6-to-10 year old Hikvision, Dahua, Lorex, Uniview, Night Owl, or Annke DVRs that dominate Class B/C multifamily and installation-adjacent family housing, the per-frame metadata simply is not stored.

Every delivered event carries a per-person track_id, a dwell_seconds number measured from the moment the track entered the zone to the moment it left, an event_class label (pre_action_zone_entry for fast-approach short-dwell events, loitering_dwell_exceeded for events where the track crossed the 90-second threshold), and a camera + zone_label pair that ties the pixel geometry to a named boundary. That combination is what translates into a behavioral claim in a charging affidavit: on camera east-gate-pedestrian, track t_6841 entered zone east-gate-pedestrian-zone at 02:41:18, event_class=pre_action_zone_entry, dwell_seconds=7.2, and re-entered the same zone at 02:43:02 with event_class=loitering_dwell_exceeded, dwell_seconds=94.6. Two re-entries by the same track, one prolonged dwell. That reads as knowledge to a federal magistrate. That specific pair of records, by design, is what Cyrano produces.

No. The device plugs into the existing DVR or NVR over HDMI, reads the composite multiview the DVR is already outputting to the guard or leasing-office monitor, runs per-tile detection on that composite, and writes the event payload locally. No camera replacement, no RTSP negotiation, no ONVIF discovery, no firmware change. One unit indexes up to 25 camera feeds. The evidence chain still terminates at the DVR's own recording, which is the chain courts have already accepted in prior trespass and burglary prosecutions. Cyrano is the retrieval and behavior-extraction layer on top of that chain.

The event record is a retrieval and triage artifact. The evidence attached to the packet is the DVR's native clip (or a frame-accurate transcode) plus the sidecar payload that names the track, the dwell, and the event class. The packet is built the same way modern forensic exports are built: the recording is the exhibit, the metadata is the interpretation, and the expert or system that produced the interpretation is available for foundation testimony. The AI layer narrows tens of thousands of frames to a short candidate list with behavior tagged. The prosecutor still makes the charging decision on the underlying clip. Nothing about the retrieval method changes the admissibility of the source recording.

Target band on a 16 to 25 camera property with a 48-hour query window is under 60 seconds from a natural-language query to a ranked candidate list with full payload. The index runs on the same edge device the inference runs on. No cloud call, no upload, no rate limit. Compared to the 4 to 6 hour manual scrub that is typical on consumer-grade DVRs, that is roughly a 200x reduction in the step that determines whether a tip becomes a charging packet inside the 2-to-5 day federal complaint window. On a portfolio across a privatized-housing operator or a multifamily manager with dozens of properties, the bottleneck was never the cameras, it was always the retrieval.

Under 30 minutes per property. Plug the unit into the DVR's HDMI out, put it on the property network, draw the zone polygons (gates, pedestrian paths, parking rows, leasing office ingress, posted boundaries) through the dashboard, and the unit begins indexing. Hardware is $450 one-time. Software is $200 per month per property, starting month two. For reference, one dedicated contract guard on a single post runs $3,000 to $5,000 per month and cannot see every feed at once. The product's stated contract is live in one afternoon, not one quarter.