The evidence is on camera. Keeping it there requires an identity resilience strategy
AndreyPopov via Getty Images
COMMENTARY | Footage captured by CCTV and other devices is only as trustworthy as the identity infrastructure controlling it.
As law enforcement expands its digital footprint, the same happens to its attack surface. And adversaries have taken notice. Recent examples of stolen data include informant identities, crime scene photos, weapon licensing records and video evidence.
Hackers aren't just locking public safety organizations out of systems. They're positioning themselves to manipulate what law enforcement sees and what courts see:
- An attacker inside a compromised video management system can delete footage retroactively, alter timestamps or kill camera feeds mid-incident.
- Ransomware groups and nation-state actors increasingly target identity infrastructure because controlling identity means controlling everything downstream.
- Compromise the right account, and an attacker will shut off cameras, destroy evidence or lock investigators out of case files at the worst possible moment.
The consequences are severe. Case dismissals. Civil liability. Wrongful releases. Broken chains of custody.
Build Identity Recovery From the Start
Security frameworks that restore clean identities, roll back tampered configurations and footage and re-establish an evidence chain that organizations can trust.
Closed-circuit television networks authenticate through enterprise identity platforms. When an attacker steals credentials, they're not just getting a password. They're getting every permission Active Directory says that account holds, including access to evidence.
CCTV Security Starts With Identity Recovery, Not the Cameras
When a ransomware group compromises an organization, the cameras keep recording, but the evidence may already be gone. Footage is only as trustworthy as the identity infrastructure controlling it.
That's why an identity recovery strategy should be built before an attack, not after.
- Tampered footage starts with tampered identity. When attackers access identity configurations, they control what cameras record, what investigators retrieve and what courts see. Immutable backups are the integrity guarantee for every frame of video captured.
- Where organizations restore matters as much as how fast. Rebuilding Active Directory or Entra ID inside a breached network risks reintroducing the same vulnerabilities. Clean-room recovery, restoring identity in an isolated, verified environment, belongs in an organization’s operational playbook.
- Siloed recovery tactics create siloed blind spots. Various public safety organizations run on-prem AD and cloud Entra ID. The organizations that recover fast can pinpoint exactly what changed: which accounts, which permissions, which timestamps. For instance, in an active case, that precision determines whether evidence holds up in court.
Identity recovery should also be viewed as a chain-of-custody decision. Every CCTV expansion, evidence management modernization and offender tracking system runs through identity. Building recovery capability into the architecture before the cameras go live can reduce risk.
A Model for What's Possible
A major West Coast sheriff's department offers the blueprint. When the department expanded its CCTV network, leadership recognized that their network infrastructure was only as valuable as the identities controlling it.
Rather than ripping out legacy systems, they layered identity resilience on top. This strategy protected existing investments and new ones simultaneously.
Identity protection isn't a separate security project. It's the insurance policy on every public safety technology investment made for government modernization.
What’s Next for CISOs, Sheriffs and State IT Leaders
The next major identity layer breach won't appear outright.
It will look like missing footage. A dismissed prosecution. A corrupted offender record.
The organizations that get ahead of this moment share one trait: they treat identity infrastructure with the same rigor they apply to physical security.
The funded projects are already on the table. The cameras are going in. The only question is whether identity protection is part of the conversation before they go live.
Lou Karu is area vice president for U.S. state and local government and education at Rubrik. The views expressed in this article are those of the author and do not necessarily reflect the official policy or position of Rubrik. These views are for informational purposes only and do not constitute business or legal advice. Organizations should consult with legal and compliance professionals to ensure their cybersecurity strategies meet all applicable federal, state and international requirements.