1. A method, comprising: receiving surveillance data; deriving a first signature for the surveillance data; storing the first signature; associating extrinsic data with the first signature; storing the extrinsic data separate from the surveillance data; receiving identity data; deriving a second signature for the identity data; comparing the first signature to the second signature to determine if there is a match; if the first signature matches the second signature, associating the identity data with the extrinsic data associated with the first signature, wherein the extrinsic data comprises a time the surveillance data was recorded, and a location at which the surveillance data was recorded, and the storing the extrinsic data separate from the surveillance data comprises: deleting the surveillance data; and storing the first signature and the extrinsic data comprising the time and the location in a database, wherein the first signature is stored in the database comprising a plurality of additional signatures derived from additional surveillance data; and identifying a signature trend from the database, wherein the signature trend is identified as suspicious based on a number of times the second signature matches the first signature.