Records and photos of recovered firearms are, in most cases, criminal justice information. The agency that collected them stays responsible for them wherever they are stored. Before any outside system holds them, including ours, someone at the agency should get clear answers to the questions below.
Where is it, and who can reach it?
- Where are the records and photos stored, and is that environment approved for criminal justice information?
- Who at the vendor can reach agency data, under what circumstances, and how would the agency know?
- Have those people passed the fingerprint-based background checks the CJIS Security Policy requires?
How is it protected?
- Is data encrypted in transit and at rest, and is the encryption validated to the standard the CJIS Security Policy calls for?
- How do officers and analysts sign in? Does it work with the agency's existing accounts, and is multi-factor authentication required?
- What happens to a session left open on a phone in a patrol car or on a shared workstation?
Who saw what?
- Is every access to a record logged, including searches and attempts that were refused?
- Can the agency read that log itself, without filing a ticket?
- How long is it kept, and can anyone, the vendor included, change it?
Who else can see it?
- Can any other agency see our records? Who decides that, and can we change it later?
- Is our data used for anything other than serving our agency?
What happens when it ends?
- Can we export everything, photos included, in a format we can use without the vendor?
- When the contract ends, how and when is our data deleted, and how will we know it happened?
Get the answers in writing
None of these are trick questions, and a vendor that has done the work should be glad to answer them. The right place for the answers is the agency's security review, in writing, where the people responsible for CJIS compliance at the agency and the state can check them. A sales call or a marketing page is not that place, ours included.
We answer every one of these for agencies evaluating Fusillade. If your agency is starting a review, ask us.