Law Enforcement Data “Blue Leaker”: a Danger or a Public Service?

Law Enforcement Data “Blue Leaker”: a Danger or a Public Service?

The recent release of a massive cache of sensitive Law Enforcement data has been in the news recently. The trove of roughly 270 gigabytes of data posted to the Denial of Secrets website has been referred to as “BlueLeaks.”

This is just the latest in a long series of data breaches against government agencies that have revealed sensitive information to the public at large. The collection includes over ten years’ worth of sensitive data and has been verified by the National Fusion Centers Association. Data leaked includes images of people under investigation, sensitive government and law enforcement reports, banking information, and Personally Identifiable Information (PII).

An attacker’s motivation to breach a government source and reveal what he or she finds varies widely. Maybe it’s political – someone trying to further a specific party agenda. Perhaps it’s an activist trying to achieve a explicit civic goal. It could even be a group of rival state actors looking to alter the balance of power for political, diplomatic, or economic gain.  There are also criminal organizations with their own goals in mind.  Whatever the motive, as information security professionals our role is to try and prevent these breaches from happening in the first place, and to mitigate the damage as much as possible when they do.

The data released by Denial of Secrets was acquired during a breach of a “Fusion Center” operated by Netsential, a web development firm based in Houston, Texas.  Fusion centers such as this serve as a clearing house to disseminate law enforcement and public safety information between partners.  A Fusion Centers’ typical partners are law enforcement and safety organizations at the federal, state, local, county and tribal levels.

While the timing of this breach makes it especially relevant (during this period of civil tension), it is only unusual in character.  Breaches in both the Public and Private sectors that reveal personal, business, medical, and financial intellectual property data result from similar ploys. Attackers rely on comparable tools and techniques to breach any network perimeter.  While the details of the Netsential breach are not public, they did confirm that the leak was most likely caused by a compromised user account that allowed the attackers to upload malware.  That, in turn, led to the data exfiltration.

The attack relied on common tactics. The techniques used to prevent them are also common.

User education is often the easiest and most logical first step.  This is especially true with our current environment.  While much of the workforce has gone remote since the early months of 2020, how many organizations have updated their policies and process to adapt to this shift in attack surface?  How many users can identify the common attacker techniques used to steal credentials or compromise home systems?  When was the last time the workforce was tested against the kinds of real-world attack scenarios they’re likely to confront?

What about user authentication?  How many organizations are implementing multi-factor authentication for every user login?  While there have been some attacks against MFA systems, they have proven to be much more effective than simple passwords while adding only a slight inconvenience.  In fact, Google reported in 2018 that none of their 85 thousand users had been phished since implementing a hardware based MFA scheme in early 2017.
We can’t tell from the publicly revealed information whether Multi-factor Authentication or improved education would have prevented this particular breach.  It is possible that Netsential already had multi-factor authentication in place and the users had received recent training, leading the attackers to get in through some other vector, but these are still Best Practices and worth implementing.

The organization’s Information Security team and the Security Operations Center team will play a vital role in mitigating a breach.  When an attacker manages to compromise a user or system in the environment, they still need to identify their primary target, traverse laterally to it, and exfiltrate their target data from the network.

With the right tools and training, the SOC can often break the attack chain and prevent the malicious actors from completing their mission.  The challenge is identifying an attack early enough in the cycle to mitigate the effect.  Unfortunately, this task has been made more complex by the shift to more remote workers and the ongoing moves to third party and SaaS applications.

Even with the latest generation of tools in place, such as AI-based advanced security analytics, it can be difficult for an organization to see into the partner environments, SaaS applications, third party vendors, contractors, and more.  It is hard to assure they are also up to the same security standards the organization has set for itself.

Difficult, but not impossible.  By deploying the most effective tools, educating users, and requiring partner organizations follow the same best practices, it is possible to manage risk in our rapidly evolving environments.  We may never reach a perfect 100% effective security solution, but we can keep raising the bar and reduce the number and severity of security incidents.

Featured

  • New Report Reveals Top Trends Transforming Access Controller Technology

    Mercury Security, a provider in access control hardware and open platform solutions, has published its Trends in Access Controllers Report, based on a survey of over 450 security professionals across North America and Europe. The findings highlight the controller’s vital role in a physical access control system (PACS), where the device not only enforces access policies but also connects with readers to verify user credentials—ranging from ID badges to biometrics and mobile identities. With 72% of respondents identifying the controller as a critical or important factor in PACS design, the report underscores how the choice of controller platform has become a strategic decision for today’s security leaders. Read Now

  • Overwhelming Majority of CISOs Anticipate Surge in Cyber Attacks Over the Next Three Years

    An overwhelming 98% of chief information security officers (CISOs) expect a surge in cyber attacks over the next three years as organizations face an increasingly complex and artificial intelligence (AI)-driven digital threat landscape. This is according to new research conducted among 300 CISOs, chief information officers (CIOs), and senior IT professionals by CSC1, the leading provider of enterprise-class domain and domain name system (DNS) security. Read Now

  • ASIS International Introduces New ANSI-Approved Investigations Standard

    • Guard Services
  • Cloud Security Alliance Brings AI-Assisted Auditing to Cloud Computing

    The Cloud Security Alliance (CSA), the world’s leading organization dedicated to defining standards, certifications, and best practices to help ensure a secure cloud computing environment, today introduced an innovative addition to its suite of Security, Trust, Assurance and Risk (STAR) Registry assessments with the launch of Valid-AI-ted, an AI-powered, automated validation system. The new tool provides an automated quality check of assurance information of STAR Level 1 self-assessments using state-of-the-art LLM technology. Read Now

  • Report: Nearly 1 in 5 Healthcare Leaders Say Cyberattacks Have Impacted Patient Care

    Omega Systems, a provider of managed IT and security services, today released new research that reveals the growing impact of cybersecurity challenges on leading healthcare organizations and patient safety. According to the 2025 Healthcare IT Landscape Report, 19% of healthcare leaders say a cyberattack has already disrupted patient care, and more than half (52%) believe a fatal cyber-related incident is inevitable within the next five years. Read Now

New Products

  • ResponderLink

    ResponderLink

    Shooter Detection Systems (SDS), an Alarm.com company and a global leader in gunshot detection solutions, has introduced ResponderLink, a groundbreaking new 911 notification service for gunshot events. ResponderLink completes the circle from detection to 911 notification to first responder awareness, giving law enforcement enhanced situational intelligence they urgently need to save lives. Integrating SDS’s proven gunshot detection system with Noonlight’s SendPolice platform, ResponderLink is the first solution to automatically deliver real-time gunshot detection data to 911 call centers and first responders. When shots are detected, the 911 dispatching center, also known as the Public Safety Answering Point or PSAP, is contacted based on the gunfire location, enabling faster initiation of life-saving emergency protocols.

  • Luma x20

    Luma x20

    Snap One has announced its popular Luma x20 family of surveillance products now offers even greater security and privacy for home and business owners across the globe by giving them full control over integrators’ system access to view live and recorded video. According to Snap One Product Manager Derek Webb, the new “customer handoff” feature provides enhanced user control after initial installation, allowing the owners to have total privacy while also making it easy to reinstate integrator access when maintenance or assistance is required. This new feature is now available to all Luma x20 users globally. “The Luma x20 family of surveillance solutions provides excellent image and audio capture, and with the new customer handoff feature, it now offers absolute privacy for camera feeds and recordings,” Webb said. “With notifications and integrator access controlled through the powerful OvrC remote system management platform, it’s easy for integrators to give their clients full control of their footage and then to get temporary access from the client for any troubleshooting needs.”

  • EasyGate SPT and SPD

    EasyGate SPT SPD

    Security solutions do not have to be ordinary, let alone unattractive. Having renewed their best-selling speed gates, Cominfo has once again demonstrated their Art of Security philosophy in practice — and confirmed their position as an industry-leading manufacturers of premium speed gates and turnstiles.