Netherlands Public Prosecution Service is gradually going online
The Public Prosecution Service is gradually being reconnected to the internet.
This was decided by the Board of Prosecutors General on Monday, August 4. Based on the results of the technical investigation into the IT breach, it has been determined that vulnerabilities in the system were indeed exploited. To date, no manipulation or removal of data (criminal or otherwise) in the systems of the Public Prosecution Service has been established. Some Citrix systems have been compromised, meaning these systems were exposed to unauthorized access. Based on the investigation results and the advice of external experts, the Board believes that a phased and controlled go-live can now proceed responsibly. The IT environment of the Public Prosecution Service will continuously be monitored so that any suspicious activity in the system can be immediately identified and action can be taken if necessary.
Offline
On July 17, the Public Prosecution Service disconnected its internal systems from the internet as a precaution. This was prompted by reports from the National Cyber Security Center (NSCS) about vulnerabilities in the widely used Citrix systems and the indication that these had been abused. This was not an easy decision, given the enormous impact that the Public Prosecution Service's going offline had on its own work, other parties involved and the entire criminal justice system. However the Public Prosecution Service had no insight into the scope of the abuse and opted to scan all internal systems offline (the technical investigation). In the meantime, the Public Prosecution Service, together with its partners, worked hard on emergency procedures to ensure that work could continue as smoothly as possible.
Online safely in phases
A new phase will soon begin. The Public Prosecution Service will return online, but not completely. This decision, too, was not taken lightly. It was responsible and necessary, given the paramount importance of the proper functioning of the criminal justice system. Hence the decision was made to return online in phases, in a controlled manner and under strict conditions.
A phased relaunch is also necessary because the systems and applications are interconnected as well as linked to those of, for example, the judiciary, the police, the CJIB (Central Fine Collection Agency) and the NFI (Netherlands Forensic Institute). The restart is being carefully coordinated with all partners to minimize disruptions to their systems and processes. The Public Prosecution Service is also in contact with the Netherlands Bar and with Victim Support Netherlands (SHN) regarding the next steps.
One of the first features to be available again as soon as possible is emailing with the outside world for Public Prosecution staff. Furthermore, the phases roughly follow the order of the legal proceedings. This is necessary because missing digital information must be entered in the correct order. It is not possible to register a conviction or release without first registering an arrest.
Rinus Otte, chairman of the Board of Prosecutors General: "It will take some time before all systems will be functioning like they used to. At this time, it is difficult to estimate exactly how long this will take, but the Public Prosecution Service is obviously committed to minimizing the impact on victims, suspects and convicted persons. The Board fully realizes that much will still be demanded of Public Prosecution staff, partners and other stakeholders in the coming weeks. Without everyone's dedication, goodwill and patience it would not have been possible to still get so much done within all these limitations. I have great admiration for that. Hopefully we can still count on this in the coming weeks."
Criminal investigation
A criminal investigation has also been launched under the supervision of the National Office of the Public Prosecution Service. This investigation is still ongoing. No further information can be provided.