A police employee accidentally deleted 22 terabytes of case files when trying to migrate data between servers. Officials say they’re now working to recover what they can and prevent future issues.
August 22, 2021
In Dallas, at least one murder trial has been delayed after a police employee accidentally destroyed 8 terabytes of digital case files and materials during a routine data migration process gone wrong.
A Dallas Police Department (DPD) employee attempting to move older case files out of a cloud-based archive and onto an on-premise server housed in the city’s data center accidentally deleted 22 terabytes worth of files, the DPD told media in an emailed statement.
Police recovered 14 terabytes, but DPD believes the remaining 8 terabytes are “permanently deleted and unrecoverable from the archive location,” per its statement.
The impacted files include audio recordings, case notes, images, videos, and other materials, the DPD said. According to an Aug. 11 memo released by the Dallas County Criminal District Attorney’s Office, the data loss affects prosecution of cases for which the offending event occurred before July 28, 2020.
There does not appear to be any malicious activity behind the far-reaching event. The accidental deletions are instead the result of human error, with the DPD attributing it to an employee who “failed to follow proper, established procedures.”
Given that a mistake can have such extensive impact, the DPD is revising its policies.
The DPD declared that the city is now instituting new safeguards intended to prevent this from happening again and that police are attempting to piece together as much of the destroyed materials as they can by searching for possible file copies that may be saved elsewhere, outside of the archive server.
REAL-WORLD IMPACTS
“Direct file” cases, or those that did not involve a detective, were spared from the data loss, DA John Creuzot said in his memo. That includes charges like driving while impaired (DWI) and evading arrest.
But it seems more complex cases may be impacted; the Dallas Morning News first reported that a trial over a 2019 murder charge was delayed after prosecutors said they needed extra time to determine if their evidence was deleted. (These particular files were later found to be spared, the Associated Press reported). The defendant was granted release on bond as a result of the delay but remained jailed as of Aug. 13.
The Dallas Morning News notes that many of the murder trials being heard in Dallas courts right now date from 2018 and 2019 — years impacted by the data loss — because the COVID-19 pandemic put trials on pause. The DA’s office was not giving interviews at this time, but told Government Technology that it remains too early to estimate the number of affected cases.
The deletions occurred from March 31 through April 5, at which point the city learned of the issue. But the DPD and Dallas Information and Technology Services Department only informed the DA’s office on Aug. 6, after prosecutors inquired about missing files, according to the Creuzot memo. The police department said the four-month delay stemmed from a desire to get a more complete assessment of the extent of the loss, before disclosing.
FILE RECOVERY
Dallas Police are working to pin down the full list of impacted cases and said that one advantage is that they still have metadata recorded about the unrecoverable files. This metadata details the file’s name, size, last access date, originating source and other information that could help identify which items were lost.
The DPD is looking to see if some of the deleted information is still available from its original sources, such as whether the cameras that took videos still have the recordings.
“Because these data files originated from other source locations (e.g. cameras, laptops or other physical locations) the City is reviewing all devices and file locations for potential source files that were not subject to the archive process,” DPD said in an email.
Other systems also may still hold some of the deleted information, with former prosecutor Toby Shook telling The Dallas Morning News that evidence could still be available if detectives uploaded it into a system used to share information with prosecutors.
The DA’s office appears to be trying to take stock of the uploaded information, and its memo instructs prosecutors to hold off on resolving cases until they first confirm with detectives that all relevant police department files have been shared on the system.
“Effective today, all prosecutors have been instructed to verify with the filing detective that all evidence/files were shared with our office via TechShare before disposing of the case,” Creuzot wrote. “This requires the detective to compare the police department’s records to those maintained in TechShare, in order to confirm that all evidence gathered in the case is uploaded into TechShare or to determine if there are any missing files that DPD had not previously shared in TechShare.”
PREVENTING FUTURE MISTAKES
The city of Dallas has now also introduced new protective measures that should stop another such deletion from occurring, DPD said.
File migrations will no longer be entrusted to a single employee, but rather require two individuals — a change intended to ensure that one personnel catches any steps the other might miss. Data will not be able to be destroyed as quickly, either, with system setups now seeing deleted files held in a recycle bin for 14 days before permanent elimination. The police department said the city is also examining its existing systems and procedures for further improvements.
Government Technology is a sister site to Governing. Both are divisions of e.Republic.
