7 ms·

I think what's interesting for me is the lack of transparency on the system in use here and the guarantees that the data truly is being protected from alteratio

by csydas 5y ago

I think what's interesting for me is the lack of transparency on the system in use here and the guarantees that the data truly is being protected from alteration well. Losing data is common and should not be a big deal for a County sized office, muchless a Texas based one, yet somehow here we are. https://regmedia.co.uk/2021/08/16/dallas_county_memo.pdf https://regmedia.co.uk/2021/08/16/dallas_county_memo.pdf Reading the actual memo, there's another interesting aspect on whatever "TechShare" is; a quick look suggests this is the site of the software in question[0], but there is absolutely no technical information available about it at all. Based on the blurbs, it looks like some project tracker but custom made for law enforcement, but again it's a complete black box as to what the software does, how it ensures data integrity, etc. The memo is very specific about ensuring data gets uploaded to this TechShare, but this just makes me wonder "how does TechShare guarantee data integrity?", and I question if it really would have helped, but it's impossible to know because both the Dallas County's data processing methods and any information on TechShare are complete black boxes. This adds no value to security for them, and in fact probably just makes it worse as the software is never really audited nor are the IT practices. Combined with the fact that this data-loss was not announced for 4 months after the fact and that cases that may have been affected by the data-loss (e.g., missing evidence), I come away with a very bad picture of law enforcement technology. I'm not sure why there isn't more publicly available scrutiny on the IT practices of law enforcement †, particularly when it comes to handling evidence/case data. [0] https://techsharetx.gov https://techsharetx.gov † As I'm very cynical of US law enforcement in general (many more of course, but right now focusing on US), my own answer for this is that it's intentionally done to obfuscate the process, but this is just the cynical and myopic part of me, which I want to separate from the rest of the post.

ubermonkey 5y ago
I've been around long enough to notice that LOTS of domains / businesses are really heavy with "we know best" kinds of attitudes even when the subject being discussed is FAR afield of their actual areas of expertise. Medicine is one. Law still is, though less so as digital document management has made their lives a little easier. Law enforcement is a BIG one. You can sell snake oil to LEOs very easily, and many people DO. I think it's a combination of organizational hubris and a sort of "nobody understands our work" bullshit that keeps them from listening to industry authorities and makes them susceptible to ignorant charlatans peddling crap that's Made For Police or whatever.
- jamal-kumar 5y ago
  I like to call it Inspector Gadgetarianism. Cops LOVE stupid gadgets and they don't care if they work or not on a scientific level, they just like having their biases confirmed. This goes all the way to stuff like police dogs acting on cues instead of training to showing potential pervert recruits videos of dudes fucking chickens while hooked up to penile plesmography. There's a fuckboat of this kind of stuff, like you could write a book's worth on it considering how much is coming into the fore. Reading the parent comment and it being pretty much "Blockchain for law enforcement and justice record keeping" definitely makes me feel a little off here but then again this one actually looks like it's at least trying to approach the problem of record keeping maintenance. I don't really think there's a hell of a lot out there but this field has an interesting and controversial history. Just check out the inslaw/PROMIS (prosecutor's management inventory system) scandal. I think the US Justice Dept concluded there was no wrongdoing but Canada's RCMP has a very different opinion about the compromising of their law enforcement record keeping system breach.
kkielhofner 5y ago
I have a few friends in law enforcement (from local to federal) and I gathered (through conversation with them) that there are "pretty good" processes and procedures in place when it comes to chain of custody, verification, etc for physical evidence. This has likely evolved over the years with various high profile cases, perhaps most famously with the OJ Simpson trial[0]. Given it was the mid-90s that case had no digital forensic evidence that I'm aware of. With physical evidence this has evolved to a pretty tight system where evidence is tracked, sealed, and secured from collection to trial with physical security - relatively secure tamper proof seals, fairly strict chain of custody, logging, etc. In further conversations with them I was surprised to learn there is essentially nothing when it comes to digital evidence security, of which there is increasingly more and more of (of course). Everything from crime scene photos to phone dumps, entire hard drives, police body cam footage, etc. There is virtually nothing in place to track the chain of custody, detect potential evidence tampering, etc for this evidence. I'm convinced that if there were a high-profile case today with a modern legal "Dream Team" the lack of these systems for digital evidence verification would be front and center from an expert (and resource rich) defense. On the other side of the aisle, what's to stop the prosecution from actual digital evidence tampering? This was actually one of the applications that provided the genesis for my startup Tovera[1]. It's still in very early stages but I'm hoping we can make some inroads in law enforcement as I think it has real potential to address the digital evidence verification issue and make for a more transparent and secure justice system (which both sides of the process should value). It remains to be seen if they actually do. [0] https://www.pasadenastarnews.com/2014/06/08/oj-simpson-case-taught-police-what-not-to-do-at-a-crime-scene/ https://www.pasadenastarnews.com/2014/06/08/oj-simpson-case-... [1] https://tovera.com https://tovera.com
- dylan604 5y ago
  It's funny to me that they will build/secure/protect a large amount of physical square footage to store physical evidence, and that's part of its budget. It would not surprise me that things are so screwy that buying hard drives and other backup type of purchases are not budgeted for and have to be made at the expendable type of requests.
  - 5y ago
drocer88 5y ago
"muchless a Texas based one" What's with the Texaphobia?
- csydas 5y ago
  Please re-read it - I'm sorry you got downvoted, but you misunderstood what I wrote. Texas as a state is fairly well off (2nd in GDP [0]) and my expectation is more that they would have a fairly robust system set up. There's no phobia here, just that my expectation is Texas has the money to design a better system with backups and redundancies. Even a storage volume level snapshot would have saved them here and I'm a bit shocked they didn't even do that. [0] https://en.wikipedia.org/wiki/List_of_states_and_territories_of_the_United_States_by_GDP https://en.wikipedia.org/wiki/List_of_states_and_territories...
- addingnumbers 5y ago
  The State/County/City balance of authority in Texas is biased far more toward Counties than in any other state. They have 4x more counties than more populous California and over 10x more than larger Alaska. It reads to me like any "phobia" over this simple fact is inferred by the reader, not implied by the writer.
breckenedge 5y ago
The tech part of this is the least concerning to me. We all know there is already a lack of transparency in government IT procurement. The complete breakdown of accountability is what concerns me the most. Not being forthcoming when something as critical as your evidence system fails is, at best, a huge cover up.
appleflaxen 5y ago
> Losing data is common and should not be a big deal for a County sized office, muchless a Texas based one... But it's a big deal when it prevents the state from putting a person who committed murder in jail, right? Humans make mistakes, but it seems like law enforcement should have a big enough budget to make that /really/ unlikely.
- kkielhofner 5y ago
  If nothing else you would think "cops don't like losing cases, and prosecuting attorneys REALLY don't like losing cases". Like my comment elsewhere here, government tends to be reactionary and unfortunately incidents like this will keep occurring until the pressure is put on for change.
- Forbo 5y ago
  They DO have a big enough budget, they just choose to spend it on overtime and militarizing their forces instead.
stephen_g 5y ago
Well, it recently came out in an audit here in Australia that our Federal Police keep 90% of their records on shared drives with no proper access control or anti-tamper protection [1]… So even worse situations are not unheard of… 1. https://www.itnews.com.au/news/afp-told-to-end-over-reliance-on-network-drives-565718 https://www.itnews.com.au/news/afp-told-to-end-over-reliance...
- kkielhofner 5y ago
  Unfortunately seems to align with my anecdotal/limited conversations with law enforcement in the US. Thank you for providing this - with my new startup Tovera [0] I'm pursuing potential law enforcement use cases and it's good to see that some countries/jurisdictions have already raised the issue. Thanks again! [0] https://tovera.com https://tovera.com
nonameiguess 5y ago
> Losing data is common and should not be a big deal for a County sized office, muchless a Texas based one, yet somehow here we are. Don't overestimate Dallas. I can't speak to what the heck we're doing with actual tax revenue, but the city services and infrastructure are terrible. I actually don't have many complaints about the police, but it's not like my information is rooted in research and statistics. I've just lived downtown for a while and seen quite a few interactions between homeless and police and they seem unusually good at de-escalation and not just rushing in and beating people up as seems common in other big cities. But ... our infrastructure is terrible. A quarter-inch of rain and over half the street lights in the city stop working. Any bit of wind knocks out power lines constantly, and it's pretty windy. Partly because they're all above ground, partly because the poles are old and falling over, partly because the city doesn't trim trees nor force property owners to do it, so branches are constantly overhanging and destroying things. We had a somewhat notorious incident a few years ago where someone managed to set off all the tornado alarms citywide for a full day. They managed to do this because the control system was just radio. Not encrypted, not authenticated. Just direct the right channel at the right receiver and you could set off all of the city's tornado alarms. City infrastructure here is an absolute mess, and if they cut costs on everything else by buying crap and not performing any maintenance, it doesn't surprise me one bit they do exactly the same thing with IT infrastructure.
- jmnicolas 5y ago
  Out of curiosity, do you have an explanation for the root cause of all of this?
  - trentnix 5y ago
    Pournelle's Law
    - jmnicolas 5y ago
      I'm French, we probably have the biggest number of civil servants to population ratio in the world. We're not dysfunctional (yet?) like parent described so I'm not sure every problem in Texas can be attributed to bureaucracy.

by csydas 5y ago

ubermonkey 5y ago

I've been around long enough to notice that LOTS of domains / businesses are really heavy with "we know best" kinds of attitudes even when the subject being discussed is FAR afield of their actual areas of expertise. Medicine is one. Law still is, though less so as digital document management has made their lives a little easier. Law enforcement is a BIG one. You can sell snake oil to LEOs very easily, and many people DO. I think it's a combination of organizational hubris and a sort of "nobody understands our work" bullshit that keeps them from listening to industry authorities and makes them susceptible to ignorant charlatans peddling crap that's Made For Police or whatever.

jamal-kumar 5y ago
I like to call it Inspector Gadgetarianism. Cops LOVE stupid gadgets and they don't care if they work or not on a scientific level, they just like having their biases confirmed. This goes all the way to stuff like police dogs acting on cues instead of training to showing potential pervert recruits videos of dudes fucking chickens while hooked up to penile plesmography. There's a fuckboat of this kind of stuff, like you could write a book's worth on it considering how much is coming into the fore. Reading the parent comment and it being pretty much "Blockchain for law enforcement and justice record keeping" definitely makes me feel a little off here but then again this one actually looks like it's at least trying to approach the problem of record keeping maintenance. I don't really think there's a hell of a lot out there but this field has an interesting and controversial history. Just check out the inslaw/PROMIS (prosecutor's management inventory system) scandal. I think the US Justice Dept concluded there was no wrongdoing but Canada's RCMP has a very different opinion about the compromising of their law enforcement record keeping system breach.

kkielhofner 5y ago

I have a few friends in law enforcement (from local to federal) and I gathered (through conversation with them) that there are "pretty good" processes and procedures in place when it comes to chain of custody, verification, etc for physical evidence. This has likely evolved over the years with various high profile cases, perhaps most famously with the OJ Simpson trial[0]. Given it was the mid-90s that case had no digital forensic evidence that I'm aware of. With physical evidence this has evolved to a pretty tight system where evidence is tracked, sealed, and secured from collection to trial with physical security - relatively secure tamper proof seals, fairly strict chain of custody, logging, etc. In further conversations with them I was surprised to learn there is essentially nothing when it comes to digital evidence security, of which there is increasingly more and more of (of course). Everything from crime scene photos to phone dumps, entire hard drives, police body cam footage, etc. There is virtually nothing in place to track the chain of custody, detect potential evidence tampering, etc for this evidence. I'm convinced that if there were a high-profile case today with a modern legal "Dream Team" the lack of these systems for digital evidence verification would be front and center from an expert (and resource rich) defense. On the other side of the aisle, what's to stop the prosecution from actual digital evidence tampering? This was actually one of the applications that provided the genesis for my startup Tovera[1]. It's still in very early stages but I'm hoping we can make some inroads in law enforcement as I think it has real potential to address the digital evidence verification issue and make for a more transparent and secure justice system (which both sides of the process should value). It remains to be seen if they actually do. [0] https://www.pasadenastarnews.com/2014/06/08/oj-simpson-case-taught-police-what-not-to-do-at-a-crime-scene/ https://www.pasadenastarnews.com/2014/06/08/oj-simpson-case-... [1] https://tovera.com https://tovera.com

dylan604 5y ago
It's funny to me that they will build/secure/protect a large amount of physical square footage to store physical evidence, and that's part of its budget. It would not surprise me that things are so screwy that buying hard drives and other backup type of purchases are not budgeted for and have to be made at the expendable type of requests.
- 5y ago

drocer88 5y ago

"muchless a Texas based one" What's with the Texaphobia?

csydas 5y ago
Please re-read it - I'm sorry you got downvoted, but you misunderstood what I wrote. Texas as a state is fairly well off (2nd in GDP [0]) and my expectation is more that they would have a fairly robust system set up. There's no phobia here, just that my expectation is Texas has the money to design a better system with backups and redundancies. Even a storage volume level snapshot would have saved them here and I'm a bit shocked they didn't even do that. [0] https://en.wikipedia.org/wiki/List_of_states_and_territories_of_the_United_States_by_GDP https://en.wikipedia.org/wiki/List_of_states_and_territories...
addingnumbers 5y ago
The State/County/City balance of authority in Texas is biased far more toward Counties than in any other state. They have 4x more counties than more populous California and over 10x more than larger Alaska. It reads to me like any "phobia" over this simple fact is inferred by the reader, not implied by the writer.

breckenedge 5y ago

The tech part of this is the least concerning to me. We all know there is already a lack of transparency in government IT procurement. The complete breakdown of accountability is what concerns me the most. Not being forthcoming when something as critical as your evidence system fails is, at best, a huge cover up.

appleflaxen 5y ago

> Losing data is common and should not be a big deal for a County sized office, muchless a Texas based one... But it's a big deal when it prevents the state from putting a person who committed murder in jail, right? Humans make mistakes, but it seems like law enforcement should have a big enough budget to make that /really/ unlikely.

kkielhofner 5y ago
If nothing else you would think "cops don't like losing cases, and prosecuting attorneys REALLY don't like losing cases". Like my comment elsewhere here, government tends to be reactionary and unfortunately incidents like this will keep occurring until the pressure is put on for change.
Forbo 5y ago
They DO have a big enough budget, they just choose to spend it on overtime and militarizing their forces instead.

stephen_g 5y ago

Well, it recently came out in an audit here in Australia that our Federal Police keep 90% of their records on shared drives with no proper access control or anti-tamper protection [1]… So even worse situations are not unheard of… 1. https://www.itnews.com.au/news/afp-told-to-end-over-reliance-on-network-drives-565718 https://www.itnews.com.au/news/afp-told-to-end-over-reliance...

kkielhofner 5y ago
Unfortunately seems to align with my anecdotal/limited conversations with law enforcement in the US. Thank you for providing this - with my new startup Tovera [0] I'm pursuing potential law enforcement use cases and it's good to see that some countries/jurisdictions have already raised the issue. Thanks again! [0] https://tovera.com https://tovera.com

nonameiguess 5y ago

> Losing data is common and should not be a big deal for a County sized office, muchless a Texas based one, yet somehow here we are. Don't overestimate Dallas. I can't speak to what the heck we're doing with actual tax revenue, but the city services and infrastructure are terrible. I actually don't have many complaints about the police, but it's not like my information is rooted in research and statistics. I've just lived downtown for a while and seen quite a few interactions between homeless and police and they seem unusually good at de-escalation and not just rushing in and beating people up as seems common in other big cities. But ... our infrastructure is terrible. A quarter-inch of rain and over half the street lights in the city stop working. Any bit of wind knocks out power lines constantly, and it's pretty windy. Partly because they're all above ground, partly because the poles are old and falling over, partly because the city doesn't trim trees nor force property owners to do it, so branches are constantly overhanging and destroying things. We had a somewhat notorious incident a few years ago where someone managed to set off all the tornado alarms citywide for a full day. They managed to do this because the control system was just radio. Not encrypted, not authenticated. Just direct the right channel at the right receiver and you could set off all of the city's tornado alarms. City infrastructure here is an absolute mess, and if they cut costs on everything else by buying crap and not performing any maintenance, it doesn't surprise me one bit they do exactly the same thing with IT infrastructure.

jmnicolas 5y ago
Out of curiosity, do you have an explanation for the root cause of all of this?
- trentnix 5y ago
  Pournelle's Law
  - jmnicolas 5y ago
    I'm French, we probably have the biggest number of civil servants to population ratio in the world. We're not dysfunctional (yet?) like parent described so I'm not sure every problem in Texas can be attributed to bureaucracy.