Public Safety and Law Enforcement

Criminals commit cyber crimes when the benefits outweigh the costs. Preventing cyber crime depends not only on cybersecurity defenses, but also on a law enforcement enterprise that can identify, indict and convict those who violate state and federal computer crime laws. Some state laws, however, do not prohibit unwanted acts. Many state law enforcement agencies are ill-equipped to enforce the laws that do apply. Additionally, these agencies are subject to damaging cyber crimes as well.

What are the primary challenges for public safety agencies?

  1. Many local jurisdictions lack the proper technical expertise (and sometimes the laws) to investigate and prosecute cyber criminals;
  2. Public safety stakeholders frequently lack formal procedures to coordinate a response to cyber emergencies; and
  3. In trying to secure their own computer networks and communications, public safety agencies and first responders face obstacles common in most areas: a lack of skilled personnel, a lack of funding and increasingly complex technology.

Attacking Emergency Communications

In November 2016, a teenager launched a distributed denial of service attack that disrupted 9-1-1 dispatch centers in over 12 states. In April of 2017, tornado sirens in Dallas, Texas were hacked and triggered an alarm, for nearly two hours in the middle of the night. Although the impact of these two events were minimal, they could have had large implications if they were coordinated during an emergency.

Holding Evidence Files Ransom

Many police agencies rely on outdated computer systems, which are especially vulnerable to hackers aiming to extort victims. In one of many examples, in 2017, police in a Texas town lost eight years’ worth of evidence after hackers locked their official files, and leaders refused to pay to recover them.

What Can Governors Do?

Update Relevant Laws

Ensure state law targets all computer-based activities that policymakers deem criminal, and that all laws carry an appropriate penalty. Recent updates made by state legislatures across the country include:

  • Criminalizing attempts to guess passwords (Virginia);
  • Increasing penalties for hackers who infiltrate critical infrastructure systems (Texas);
  • Expanding the definition of computer crime to encompass ransomware (Wyoming);
  • Changing how losses from a computer crime should be calculated (Utah); and
  • Integrating computer crime into prohibitions on solicitation or attempt (California).

Build Capacity to Investigate Cyber Crimes

  • Illustrate the desperate need for more resources. Direct law enforcement leaders, with support from local and national police organizations, to organize in-depth briefings with state legislators and staff to dispel any myths.
  • Define progress early. Mandate the development of metrics for assessing progress—ones that do not focus on the number of cases solved or cyber criminals apprehended.
  • Identify private sector allies. Create a roster of former law enforcement officers—whether cyber crime investigators or not—who now work for technology companies. Contact these former officials to forge a resource network for current investigators.

Other Recommendations

  • Evaluate current legislation to determine if changes need to be made to strengthen cyber crime laws;
  • Ensure that cyber crime enforcement has a place in any planned or existing statewide cybersecurity strategy;
  • Ensure that at least one expert representative from state law enforcement participates in law enforcement associations’ cyber groups;
  • Place public safety stakeholders on any statewide cyber commission or task force;
  • Conduct a statewide review of current community outreach efforts by state and local law enforcement relating to cyber crime and cybersecurity;
  • Mandate the creation of a labor-exchange policy for state IT office and law enforcement agencies to begin building vital personal relationships and develop cross-disciplinary skillsets;
  • Institute mandatory computer forensics training for all law enforcement personnel, whether they are in training or near retirement. In all public awareness distributions related to cybersecurity, include quick and easy tips for preserving forensic evidence that computer crime units need;
  • Devote funding to secure public safety emergency communications from cyber threats, and test their resiliency by simulating cyberattacks against them;
  • Ensure that all public safety leaders have contacts with federal cyber response officials; and
  • Work with the FBI, Secret Service, in-state technology companies and private experts to explore lowcost cyber training opportunities for public safety personnel.