Former DJJ Officer Faces 570 Years for 114 Computer Crime Counts After Breach

For legal professionals, this case is a stark example of how negligent access management can intersect with criminal prosecution: the severe sentencing structure under Florida’s Computer Crimes Act—up to 5 years per count—could yield a half-millennium sentence, while the $1.14 million bond signals judicial intolerance. Meanwhile, the agency’s failure to deprovision may open doors to civil liability and regulatory scrutiny, challenging sovereign immunity norms.

A former Florida Department of Juvenile Justice (DJJ) probation officer, Crystal Lawson, faces 114 felony counts of computer crimes after investigators discovered she exploited retained access to the state’s Comprehensive Case Information System (CCIS) database to leak sensitive law enforcement information to a violent drug trafficking organization. Lawson was hired in February 2022 but fired just eight months later following a battery arrest. Despite her termination, her CCIS credentials were never revoked. Between January and May 2026, she allegedly logged in 106 times, searching for active criminal cases and providing active arrest warrant details to criminals, warning them that investigators were closing in. The breach resulted in lost evidence, unrecovered assets, and at least one suspect fleeing the area—though that individual was later apprehended. Lawson’s first court appearance occurred on June 19, 2026, where bond was set at $10,000 per count, totaling $1.14 million.

“

Lawson’s first court appearance occurred on June 19, 2026, where bond was set at $10,000 per count, totaling $1.14 million.

The incident is a glaring indictment of fundamental failures in user access lifecycle management within a state agency that handles highly sensitive juvenile and criminal justice data. The fact that Lawson’s access persisted for over three years after her termination without detection points to a complete breakdown of offboarding procedures, periodic access reviews, and anomaly monitoring. In the cybersecurity community, this case is already being cited as a textbook example of the insider threat—a disgruntled former employee with unrevoked privileges causing disproportionate harm. The DJJ’s inability to enforce the most basic principle of least privilege and timely deprovisioning not only compromised ongoing criminal investigations but also eroded public trust in the confidentiality of court records. The scale of the unauthorized access—106 logins over five months—demonstrates that this was not a single oversight but a sustained, observable pattern that should have triggered alerts in any mature identity and access management (IAM) system.