Atlanta police recovering from breach, ‘years’ of dashcam video lost

The ransomware cyberattack has been causing headaches across several of the city’s municipal departments.

The Atlanta Police Department has mostly recovered from a March ransomware attack that crippled systems across the city, Chief Erika Shields said Friday, but the criminals that infiltrated the city's network compromised "years" of dashcam videos.

In an exclusive interview with The Atlanta Journal-Constitution and Channel 2 Action News, Shields assured the public her department has not lost access to investigatory files or other crucial evidence. Initially, the department had limited access to investigative files on its servers, but she said access was quickly restored.

“I would not sugarcoat that. I have been asking since Day One, ‘… Do we have criminal investigatory files that have been compromised?’ And I have been told, no,” she said.

Atlanta Chief of Police Erika Shields addresses the audience after taking her oath of office at the Commerce Club on Tuesday, Jan. 10, 2017, in Atlanta. Curtis Compton/ccompton@ajc.com

icon to expand image

But Shields said “years” of dashcam footage from before the March attack “is lost and cannot be recovered.” The chief said the lost footage could compromise DUI cases if an officer’s testimony isn’t sufficient. It’s unclear how many investigations might be affected.

Shields downplayed the potential effect on cases, including potential use of force incidents.

“I’m not overly concerned, I’m really not, because that’s a tool, a useful tool, for us,” she said. “But the dashcam doesn’t make the cases for us. There’s got to be the corroborating testimony of the officer. There will be other pieces of evidence. It’s not something that makes or breaks cases for us.”

But a former Atlanta police investigator and a Georgia State University law professor said lost video concerns them.

Ken Allen, an Atlanta police union official and a retired investigator, said in a use of force or officer-involved collision investigation, video evidence can help determine if an officer or suspect’s actions were appropriate or not.

“I think what it does, in a climate we already have that’s anti-police and seems to question our reactions, is it hurts that relationship that is already strained,” he said.

Jessica Gabel Cino, a Georgia State law professor who specializes in trial procedure and forensic and scientific evidence, said dashcams often provide vital video and audio evidence.

“These days cases are broken or they’re made on dashcam footage,” she said.

The City of Atlanta entered into emergency contracts worth $2.7 million to help restore the city’s computer network in the days following the March 22 ransomware cyber attack.(WSB-TV)

icon to expand image

The hack did not compromise other sources of video evidence, such as police bodycam footage, Shields said.

In March, hackers held for ransom much of Atlanta's computer network, disrupting city services and forcing some departments to perform their jobs on paper. Municipal court, for instance, was effectively out of commission for weeks.

At a hearing this week of the city’s Civil Service Board, a police investigator said 105,000 files on his computer had been compromised, including video of a police sting of a former employee fired for allegedly destroying an open records request.

Shields said the matter was isolated to that investigator, and she has been told none of his criminal case files were lost as those were preserved on the city’s servers. She said other evidence supported the former employee’s firing, which is being appealed.

“Employees have to back up documents,” she said. “Even if it’s not related to a criminal investigation, if it is of some value to you, you have got to be backing this stuff up. I think it was a painful but useful lesson in IT security for all of us.”

Shields said she has “complete faith” in the city’s information technology recovery.


Story so far:

March 22: Atlanta officials announced the city's systems had been breached by a ransomeware attack, disrupting services across the city.

May 18: Atlanta Chief Operating Officer Richard Cox tells the AJC and Channel 2 most city services restored.

Friday: Atlanta police Chief Erika Shields said her department has mostly recovered from the attack, but "years" of dashcam footage "is lost and cannot be recovered."