> Is there anything plug-and-play that can do a reasonable job of flagging/disconnecting massive outbound data transfers? I don't know of such a tool but you'd

> Is there anything plug-and-play that can do a reasonable job of flagging/disconnecting massive outbound data transfers? I don't know of such a tool but you'd have to run it everywhere you have data. If the LAPD's data was not on prem, which is expected (but not necessarily a good practice for sensitive data), it would be harder to both have an exfiltration monitor for the data they do have on prem and for the data they have in whatever hosting provider or "cloud" they stored it at. Maybe the bill for the egress transfers in the morning plays such a role to a certain extent. PS - where can one find the 7.7 TB data?