C
Cyrano Security
12 min read
18 USC 1382 Field Guide

Military property trespassing charges are won and lost on seven fields in the footage, not on whether the cameras were rolling.

Every SERP result on 18 USC 1382 is a statute explainer or a barment-letter appeal walkthrough. None of them ask the question that decides the case: what has to be in the CCTV clip before a JAG prosecutor will actually charge the re-entry? This guide answers it. Seven fields, what each one proves, what happens when it is missing, and how a 2-minute edge AI install against the existing DVR puts every one of them into every event payload.

Walk the evidence stack on a live install
4.9from 50+ properties
Seven evidentiary fields a 1382 re-entry charge needs on the clip
Knowledge element, zone scope, and dwell record mapped to the payload
Natural-language footage retrieval against the existing DVR HDMI
200x reduction vs manual DVR scrub for family-housing re-entry clips

The statute is the easy part. The evidence is the hard part.

The first sentence of 18 USC 1382 is short enough to memorize. Whoever enters a military reservation for a purpose prohibited by law, or reenters after being ordered not to, is guilty of a misdemeanor punishable by a fine, imprisonment of not more than six months, or both. Every law firm SEO page on the phrase military property trespassing charges rewrites those three lines in a dozen ways. None of them say what actually decides whether a case goes forward.

What decides it is the footage. The re-entry clause has a knowledge element and a geographic element. The barment letter establishes intent and geographic scope on paper. The footage has to prove the defendant was the person who re-entered, that the re-entry was inside the scope the letter named, and that it happened after service. Those facts are carried by specific fields on the event record, not by a raw video file alone. A DVR that records everything but stamps nothing is not usable evidence without hours of re-work.

The rest of this page is the seven-field checklist, mapped to the statute and to what the AI layer on a Cyrano device produces for each one, on day one, against whatever DVR the property already has plugged in.

From DVR HDMI out, to the JAG evidence packet

Existing DVR
Barment letter
MP tip / complaint
Natural-language query
Cyrano edge AI
Synced timestamp
Camera + zone
Dwell record
Clip export

The seven evidentiary fields, mapped to 18 USC 1382

Each field answers a specific legal question the prosecutor has to answer before charging. Each is either present on the event payload or it is not. Missing a field does not mean the case is unwinnable, but it does mean the case takes hours of manual reconstruction before it can even be reviewed, which is where most are abandoned.

Field by field, top to bottom

1

Field 1. Frame-level timestamp, synced to a trusted clock

Answers: did the re-entry happen after the barment letter was served? Consumer DVRs drift. A 30-second drift is fatal if the barment letter was served within an hour of the alleged re-entry. Cyrano stamps each event with a monotonic clock synced on-device and writes the offset to the payload. If the DVR's clock is wrong, the Cyrano event still carries the right time, and the export packet can flag the delta.

2

Field 2. Camera identifier and zone label

Answers: was the defendant inside the geography the letter named? A barment letter that bars a person from family housing loop 3 is not proven by footage at the front gate. Every Cyrano event carries the specific camera name (e.g. housing-loop-3-west) and the zone label crossed (e.g. resident-parking-row-B). The JAG paralegal can match the zone label to the text of the letter without opening the source video.

3

Field 3. Per-person dwell_seconds across the track

Answers: was this a transient passage that might be defended, or deliberate presence? Dwell is measured from the moment a tracked person enters a zone to the moment they leave. A 90-second loiter in a barred parking lot reads very differently from a 2-second walk across a camera's field. Cyrano's filter stack holds the track across frames and writes dwell_seconds to every delivered alert.

4

Field 4. Event class (pre_action_zone_entry, loitering_dwell_exceeded)

Answers: is this the kind of event the filter stack chose to deliver, or raw noise? A working installation produces a handful of delivered events per day and hundreds of raw detections. The delivered ones are the ones that passed zone, dwell, and arming filters. The event_class field names which filter fired, which tells the reviewing officer whether the clip is likely to be chargeable or just background.

5

Field 5. layout_id of the DVR at capture

Answers: was the DVR in multiview or single-camera mode at capture, and does the geometry match the zone polygon? A DVR that drops from a 4x4 grid to fullscreen on one camera during an operator drill-in changes the pixel-to-world mapping. Without a layout_id, the zone polygon the event cites may be wrong. Cyrano keys its mask and zone files to layout_id and swaps them in under 20 ms when the guard changes views.

6

Field 6. Tile thumbnail cropped from the multiview

Answers: what does the clip look like before the paralegal opens it? A full multiview JPEG is useless for triage; a per-tile crop is what a reviewer needs. Cyrano crops the thumbnail to the specific camera tile where the track lived and attaches it to the event. The investigator can sort 50 candidate events by thumbnail in minutes.

7

Field 7. latency_ms from frame capture to alert send

Answers: was there anything anomalous upstream at the moment of the event? End-to-end latency is usually dominated by the messaging channel (WhatsApp, SMS). A sudden jump in latency_ms is a free early warning that the carrier is throttling, the uplink is saturated, or the DVR's HDMI is flapping. The field is not directly evidentiary but it is the first signal that a batch of clips might be corrupted.

What the on-device index looks like during a real retrieval

Below is a lightly redacted extract from a Cyrano log during a simulated 1382 re-entry clip pull on a 16-channel property-grade DVR. The investigator query is plain English. The output is the seven-field payload ready to attach to the packet. No cloud, no upload, no vendor dashboard.

cyrano query, 16-ch DVR, MHPI family housing test install
7 fields

A 1382 re-entry charge is not decided by whether the cameras were rolling. It is decided by whether the clip carries a synced timestamp, the camera and zone label the letter named, a per-person dwell record, the event class, the DVR layout_id at capture, a tile thumbnail, and the end-to-end latency. Seven fields. If they are all on the event payload, the clip is chargeable. If any are missing, the packet has to be reconstructed by hand.

Cyrano field notes, MHPI privatized housing test install

The evidence retrieval delta, measured

0hhours, manual DVR scrub for a 48h clip window
0sseconds, natural-language query to candidate list
0xreduction in per-case retrieval time
0camera feeds indexed per unit

Target band on a 16-to-25 camera family-housing property with 48 hours of retention in the query window. The bottleneck 1382 cases hit is retrieval time, not recording coverage.

Each evidentiary field, what it proves, what its absence costs

Synced timestamp: proves post-service re-entry

A Cyrano event carries its own monotonic clock-synced timestamp plus the DVR's reported offset. If the DVR clock is off by 30 seconds, the packet still has a trusted time for the re-entry and the delta between Cyrano and the DVR is recorded in the payload. Absent this field, a defense attorney can argue the re-entry happened before the barment letter was served, and the case dies on the knowledge element.

Zone label: proves barment-scope match

A named zone tied to the geography the letter referenced (east-gate-pedestrian-zone, family-housing-loop-3). Without it, reviewers have to re-watch the clip and testify to the geometry. With it, a paralegal cross-checks the letter in seconds.

Dwell_seconds: proves deliberate presence

Transient passage and 90-second loitering read very differently to a reviewing attorney. A dwell field carried on every event lets the charging decision be made from the thumbnail list, not from watching the clips in full.

Event class: proves the clip passed the filter stack

The filter stack drops hundreds of raw detections down to a handful of delivered alerts per day. The event_class is the label of which filter fired (pre_action_zone_entry, loitering_dwell_exceeded). It is the first signal of whether the clip is likely chargeable or just background.

Layout_id: proves the zone geometry was correct at capture

When a guard drills from a multiview into fullscreen on one camera, the pixel-to-world mapping changes. Cyrano's zone polygons are keyed to layout_id and are swapped in under 20 milliseconds. Without this, a defense attorney can question whether the pixel the track occupied was inside the polygon cited on the event.

Tile thumbnail: accelerates triage

Cropped to the specific camera tile where the track lived, not the full multiview. A reviewer sorts 50 candidates by thumbnail in minutes instead of opening every clip.

Latency_ms: early warning on corrupted batches

End-to-end latency from frame capture to alert. A sudden jump warns that the messaging channel or the DVR HDMI is degrading. Not directly evidentiary, but the first field that tells you a day's batch may need re-verification.

Seven fields, one payload, no vendor dashboard

Every field lives on the edge device as part of the same event record. The audit is against the on-device index. No cloud portal has to be up. The DVR does not have to be replaced. The cameras do not have to be replaced.

Retrieval workflow today vs with a natural-language index

FeatureManual DVR scrub by MPH securityCyrano on existing DVR HDMI
Time to first candidate clip (48h window)4 to 6 hours per officerUnder 60 seconds from query
Query interfaceDVR timeline scrubber + per-channel replayPlain English, natural-language search
Timestamp trustDVR clock, often driftedCyrano monotonic clock + DVR delta on packet
Zone label on exportHandwritten by reviewing officerCarried on event payload automatically
Per-person dwell recordRequires manual re-watch and note-takingdwell_seconds on every delivered event
Camera hardware requirementWhatever is plugged inWhatever is plugged in (reads HDMI out of the DVR)
Network egress for evidenceUSB export to investigator laptopOn-device index, export at capture, no cloud
Install cost to add the capabilityN/A (nothing to install)$450 one-time + $200/month per property
Install timeN/AUnder 30 minutes

Two evidentiary details most installations overlook

Clock drift is a real defense strategy

Consumer-grade DVRs drift tens of seconds to minutes per week if they are not NTP-locked. Defense attorneys know this. A 90-second drift on a barment letter served the morning of the alleged re-entry is enough to argue the re-entry happened first. Every Cyrano event carries its own NTP-synced timestamp plus the measured delta to the DVR clock, so the government can rebut the drift argument without re-syncing the DVR.

The zone label has to match the letter text

A letter that bars a person from family housing loop 3 is proven by footage at a camera tagged housing-loop-3-west, not at a generic gate camera. If the zone label on the event does not match the letter text, the JAG paralegal has to go back to the video and reconstruct the geography. If the labels were drawn during install to match the words the Staff Judge Advocate uses in the letters, the reconstruction step disappears.

The five-minute packet-ready retrieval workflow

  • Log in to the Cyrano dashboard from the MPH security office or the Provost Marshal workstation
  • Paste the time window from the tip or complaint (for example, 2026-04-15 02:00 to 04:00)
  • Type a plain-English description of the suspect (for example, man in red jacket with hood up near east gate)
  • Sort the returned candidates by dwell_seconds descending; loitering tracks rise to the top
  • Open the top two or three thumbnails to confirm the match, note the track_id
  • Export the underlying DVR clip segment for each matched track_id, with the seven-field payload attached as a sidecar
  • Cross-check zone_label against the barment letter text; confirm timestamp is post-effective
  • Attach to the evidence packet, send to the Staff Judge Advocate

DVRs and NVRs this evidence workflow plugs into

Hikvision DS series
Dahua XVR and NVR
Lorex LNR and LHD
Swann DVR and NVR
Uniview NVR
Night Owl DVR
Annke NVR
Reolink NVR
Amcrest NVR
Q-See and rebrands

The workflow is device-agnostic. Any DVR or NVR driving a multiview over HDMI is a supported source. That covers the overwhelming majority of consumer-grade recorders installed in MHPI privatized family housing in the last decade.

The short version

Military property trespassing charges under 18 USC 1382 do not fail because the cameras were off. They fail because the cameras recorded hours of raw footage that nobody could search, with timestamps that nobody could trust, and zone geometry that nobody had labeled. A barment letter names a zone and an effective date. The clip has to match both. Without the seven fields described on this page, matching them takes hours per case, which is why so many re-entry tips never become charging packets at all.

Cyrano runs against the existing DVR's HDMI out, produces every one of the seven fields on every delivered event, indexes 0 feeds per unit, and lets the MPH security officer or the installation Provost Marshal pull a packet-ready clip in under 0s from a natural-language query. That is the whole contract.

Walk the evidence workflow on a live deployment

Book a 15-minute demo. You will run a natural-language query against a real Cyrano unit reading a production DVR, pull a candidate clip with all seven evidentiary fields, and see the same packet shape a JAG paralegal would open.

Book a demo

Military Property Trespassing Charges: Frequently Asked Questions

What federal statute covers trespassing on military property?

The controlling statute is 18 USC 1382, titled Entering military, naval, or Coast Guard property. It covers two distinct acts. The first is entering a military reservation, post, fort, arsenal, yard, station, or installation for any purpose prohibited by law or lawful regulation. The second, which is where most charged cases sit, is re-entering or being found within the installation after having been removed or ordered not to reenter by the officer or person in command. The maximum penalty is a fine, imprisonment of not more than six months, or both. The second clause, the re-entry clause, requires the prosecutor to prove a barment letter was served and that the defendant knowingly came back onto the same installation. Both facts usually come from CCTV footage, not from officer testimony alone, because the officer who served the barment letter is rarely the officer who finds the defendant on the installation weeks later.

What is a barment letter, and why does the CCTV evidence need to match it?

A barment letter, sometimes called a bar letter or debarment order, is a written order from the installation commander (or a delegate such as a Provost Marshal or Staff Judge Advocate) prohibiting a named person from entering the installation, or specific buildings or zones on the installation, for a defined period. Types range from temporary (a few days) to a fixed term (up to three years) to indefinite. For the 1382 re-entry prosecution to hold, the CCTV clip has to place the defendant inside the specific geography the barment letter named, on a date after the letter was served, with a timestamp tight enough to tie to a specific camera and zone. Footage that shows a person crossing the main gate perimeter is not the same evidentiary item as footage that shows the same person standing in the exact parking lot or housing loop the letter barred. The letter defines the scope. The footage has to match the scope field by field.

Why do 18 USC 1382 re-entry cases get dropped before charging?

Most get dropped on two preventable evidentiary gaps. The first is the knowledge element: Fourth Circuit and other federal courts have dismissed 1382 charges where the government could not establish probable cause that the defendant knew they were entering the barred area. The second is the footage itself. On a typical 8-channel 3-year-retention DVR in privatized military family housing, pulling a single clip of a specific person at a specific gate in a 48 hour window can run 4 to 6 hours of manual scrub time per officer. When the installation police or contracted MPH security only get a tip two or three days later, the clip has often rolled off, or the time pressure means they give up before they find it. The system that lost the case was the retrieval workflow, not the camera. A footage index that understands natural language queries over the existing DVR is what closes that gap.

What fields does a 1382-admissible clip need to carry on its face?

Seven fields, and all of them need to show on the exported clip or the adjacent metadata packet. One, a frame-level timestamp synced to a trusted time source, because the barment letter has an effective date and the prosecution has to prove the re-entry was after it. Two, the camera identifier, because the zone that the clip shows has to match the zone the letter named. Three, a person-level dwell record, i.e. how long the same detection track remained in the zone, because transient passage can sometimes be defended and deliberate loitering cannot. Four, a zone label (for example, east-gate-pedestrian or family-housing-loop-3) tied to the geography the letter defined. Five, an event class (pre_action_zone_entry, loitering_dwell_exceeded) so the investigator can triage. Six, the DVR or NVR layout at capture, because multiview layouts that change during the event introduce ambiguity. Seven, a tile thumbnail, because the JAG paralegal assembling the packet works from thumbnails before pulling the full export. A Cyrano event payload carries all seven by default, produced on-device, no cloud round-trip.

How does Cyrano help without replacing the installation's existing cameras?

Cyrano is a 2-minute install edge AI device that plugs into the existing DVR or NVR over HDMI. It takes the composite multiview the DVR is already outputting to the guard monitor, runs per-tile detection on it, keeps a per-frame layout_id so it knows which camera is which across layout changes, and emits events with the seven fields listed above. There is no RTSP negotiation, no ONVIF discovery, no camera firmware change, no network re-architecture. On the privatized military family housing portfolios where the on-site system is a 6-to-10 year old Hikvision, Dahua, Lorex, Uniview, or Night Owl DVR driving a single HDMI out to the leasing office, Cyrano reads that HDMI and does the rest. One unit supports up to 25 camera feeds. No footage leaves the property.

Does natural-language footage search hold up under evidentiary scrutiny?

The natural-language layer is a retrieval tool, not a substitute for the underlying DVR recording. When an MP investigator types a query like man in red jacket near the east gate between 02:00 and 04:00, Cyrano returns candidate clips drawn from the DVR's own recorded feed, with the full seven-field payload attached. The export the prosecutor attaches to the packet is the DVR's own native file (or a frame-accurate transcode of it), not an AI-generated reconstruction. The AI layer narrows the search from tens of thousands of frames to a short list. The evidentiary chain still terminates at the DVR, which is the same chain a court has already accepted in prior trespass and burglary prosecutions on installation and off. Nothing about the retrieval method changes the admissibility of the source recording.

Does this apply to privatized military family housing (MHPI) operators?

Yes, and it is the single largest concrete use case. Privatized family housing on installations is usually operated under a Military Housing Privatization Initiative partnership with a private landlord such as Balfour Beatty Communities, Lendlease, Lincoln Military Housing, Hunt Military Communities, or Corvias. Those properties sit inside the installation perimeter for 1382 jurisdiction purposes, but the day-to-day CCTV system is usually the same consumer-grade DVR/NVR stack the rest of the Class B/C multifamily industry runs. A barred resident or ex-resident who returns to the family housing loop is a 1382 re-entry case that runs through installation law enforcement and the Staff Judge Advocate. The footage collection problem on those properties is identical to the footage collection problem on any 150-unit apartment complex, which is the problem Cyrano was built to solve.

What does the target retrieval time look like on a real install?

Under 60 seconds from query to first candidate clip is the target band, on a property-size DVR (8 to 32 channels, 2 to 8 TB of retention). The key is that the index Cyrano maintains is on the same edge device the inference runs on. The query does not hit a cloud service, so there is no upload, no backlog, and no rate limit. Compared to a manual scrub of 48 hours of 16-channel recording, which routinely runs 4 to 6 hours per officer, that is roughly a 200x reduction in the evidence retrieval step. On a portfolio where MPH security and the installation Provost Marshal both work from the same export, getting the clip down from an afternoon to a minute is often the difference between a case that gets charged and a case that gets dropped for stale evidence.

What about Title 50 charges at the southern border military zones?

Since April 2025, DOJ has filed 4,700+ novel Title 50 misdemeanor charges against migrants for entering military zones established at the southern border. Those charges are distinct from 18 USC 1382 but rely on the same evidentiary spine: footage that proves knowing entry into a zone the defendant was on notice of. Reporting has documented dismissals where the criminal complaint failed to establish probable cause of knowledge. The same footage-field hygiene that sustains a 1382 re-entry charge (synced timestamp, zone label, dwell record, camera identity) is what a Title 50 charge is going to live or die on. Cyrano is not involved in that enforcement context, but the evidentiary checklist is the same one this page lays out, because the underlying question (can the footage answer the knowledge element) is identical.

How long does it take to install Cyrano on an existing installation-adjacent DVR?

Under 30 minutes per property, per the product's own deployment contract. Plug the device into the DVR's HDMI out, connect to the property network, draw the alert zones (gates, family housing loops, parking lots) through the dashboard, and the unit begins indexing. On a portfolio roll out across a MHPI operator, the time-to-live on a given property is an afternoon, not a quarter. No camera replacement, no IT team, no rewiring, no contractor. Hardware is a one-time $450, software is $200 per month. For comparison, one installation-contracted security guard for a family housing loop runs $3,000 to $5,000 per month per post.

🛡️CyranoEdge AI Security for Apartments
© 2026 Cyrano. All rights reserved.

How did this page land for you?

React to reveal totals

Comments ()

Leave a comment to see what others are saying.

Public and anonymous. No signup.