A security analysis of police computer systems

Every day we entrust our privacy, safety, and security to police officers sworn to protect and serve. While many critical infrastructure computer systems have been well studied, the computer infrastructure supporting these officers remains to be surveyed in public literature. We remedy this by characterizing a sample police department's systems through a security lens, discussing weak points and areas for future work. Pen-testing of the security camera and web application systems were performed to give hard data points on the security of this department's systems. Our characterization shows that the security of the department we study is good overall, but enough weaknesses exist in this department and others to be concerned for the state of police security. We determine that compliance with FBI security policies is an appropriate first step for departments, but it is not sufficient. More research and increased support for security education and resource services is needed in order to defend these critical systems against adapting adversaries.