The Public Prosecution Service is gradually reconnecting to the internet. This was decided by the Board of Prosecutors General on Monday.
Based on the research results of the technical investigation into the breach of the ICT, it has been established that vulnerabilities in the system have indeed been exploited. So far, it has not been established that any data (criminal or otherwise) has been manipulated or removed. However, some Citrix systems have been compromised, meaning these systems have been exposed to unauthorized access. Based on the research results and the advice of external experts, the Board believes that a phased and controlled go-live can now responsibly take place. The IT environment is continuously monitored, so that any suspicious movement in the system can be immediately recognized and acted upon.
Offline
On July 17, the Public Prosecution Service disconnected its internal systems from the internet as a precaution. This was prompted by reports from the National Cyber Security Centre (NSCS) about vulnerabilities in the widely used Citrix systems and the signal that abuse had been made of them. This was not an easy decision, given the enormous impact that going offline has had on its own work, all involved, and the entire criminal justice chain. However, the Public Prosecution Service had no insight into the extent of the abuse and chose to scan all internal systems offline (the technical investigation). In the meantime, hard work has been done with chain partners to create emergency processes to keep the work going as well as possible.
Safely online in phases
A new phase is about to begin: the Public Prosecution Service is going online again, but not fully. This was also not a light-hearted decision, but responsible and necessary given the significant importance of the proper functioning of the criminal justice chain. Hence the choice to go online in phases, controlled and under strict conditions.
A phased go-live is also necessary because the systems and applications are interconnected, but also linked to those of, for example, the judiciary, the police, the CJIB, and the NFI. The restart will be carefully coordinated with all chain partners to cause as few disruptions to their systems and processes as possible. The Public Prosecution Service is also in contact with the legal profession and Victim Support Netherlands (SHN) about the next steps.
One of the first functionalities that will be made available as soon as possible is emailing for Public Prosecution Service employees with the outside world. Furthermore, the phases roughly follow the order of the legal proceedings. This is necessary because missing digital information must be entered in the correct order; it is not possible to register a conviction or release without first registering an arrest.
Rinus Otte, chairman of the Board of Prosecutors General: It will take some time before all systems function as before. How long it will take is currently difficult to estimate, but the Public Prosecution Services aim is, of course, to minimize the effects of this for victims, suspects, and convicted persons. The Board is very aware that a lot will be asked of Public Prosecution Service employees, chain partners, and other stakeholders in the coming period. Without everyones effort, goodwill, and patience in the past - and hopefully also in the coming - weeks, it would not have been possible to achieve much within all the limitations. I have great admiration for that.
Criminal investigation
A criminal investigation has also been initiated under the direction of the National Prosecutors Office. This investigation is still ongoing. No further announcements can be made about it.
