Arizona police procedures exposed in massive policy database hack
pabst_ell via Getty Images
Some agencies said they were unconcerned with the breach since the final documents are already publicly available.
This story was originally published by Arizona Mirror.
Hackers who broke into the systems of a Texas-based company that develops internal policies, manuals and other training material for law enforcement have published thousands of finished and draft procedure manuals for police departments across the country, including many in Arizona.
Lexipol boasts that it works with thousands of police departments and first responders across the country to help them create policy and procedure manuals that are used to guide those agencies on a myriad of topics.
The Arizona Mirror examined the over 8,500 files leaked by a hacking group calling itself “the puppygirl hacker polycule” and published by the nonprofit DDoSecrets that archives leaked and hacked material.
The agencies that the Mirror found included in the leak are: Chino Valley Police Department, Chandler Police Department, Bisbee Police Department, Flagstaff Police Department, Prescott Valley Police Department, Prescott Police Department, Lake Havasu Police Department, Maricopa Community College District Police Department, Buckeye Fire and Rescue Department, Pima County Community College Police Department, La Paz County Sheriff’s Office and the Phoenix Police Department.
Many of the documents appear to be drafts, with blank spaces to be filled in by the local law enforcement agency. In the case of the Phoenix Police Department policy manual that was in the leak, the oath that officers must take was likely copied from a document made for an Oregon law enforcement agency, as it refers to swearing to uphold the Oregon Constitution.
The departments that responded to the Mirror’s request for comment were unaware of the breach. Lexipol did not respond to a request for comment asking if they were notifying the agencies that were included in the hack.
“We have not received any information about this from Lexipol,” Lake Havasu Police Department Sgt. Kyle Ridgeway said in an email to the Mirror. “We began using Lexipol in early 2013. At this time there is no additional information I can provide.”
Many of the agencies already publicly post their policy and procedure manuals online, and some of the leaks are of early drafts of those documents. Some said they were unconcerned with the breach since the final documents are already publicly available.
“We are not particularly concerned about our policies being published, as they are already publicly available for transparency and accessibility,” Flagstaff Police Department Sgt. J.L. Rintala said. “Additionally, we have not engaged with Lexipole (sic) regarding this matter. Our organization has been utilizing Lexipole’s (sic) services for over ten years.”
Lexipol has come under fire for the work it performs for law enforcement agencies, particularly for its resistance to police reform and the use-of-force policies it creates. Groups like the American Civil Liberties Union have accused the group of writing policies that aid in protecting law enforcement that acts unethically.
And it’s policies have been criticized for crafting police policies that could “lead to racial profiling and harassment of immigrants,” as the ACLU has asserted. The ACLU of Washington claimed that Lexipol policies led to an incident where an officer in Spokane unlawfully detained a victim of a car wreck in order to let them be questioned by immigration authorities.
Additionally, some critics have complained that the policy and procedure manuals and other documents created by Lexipol for public agencies are copyrighted by the company.
Some of the agencies that responded to the Mirror made sure to mention that they have not used the company and have switched to other groups to help in crafting their policies.
“We have not been contacted directly by Lexipol in regards to this breach however we have transitioned away from the Lexipol platform for our policy management to Power DMS which is what is adopted across the city of Buckeye. We utilized them for 3-4 years,” Buckeye Fire and Rescue Department Fire Chief Jake Rhoades said in an email to the Mirror.
Maricopa Community Colleges Police Chief Blair Barfuss said the agency had not been contacted by Lexipol and was unaware of the breach until the Mirror asked about it. Other police departments made similar statements.
Barfuss said while the breach is “very concerning and upsetting,” the information released is available to the public through a public records request.
“We aim to be transparent in how and why we perform our public safety efforts,” Barfuss said.
The leak also includes documents that show Lexipol was demoing their product to fire departments, police and local governments.
Arizona Mirror is part of States Newsroom, a nonprofit news network supported by grants and a coalition of donors as a 501c(3) public charity. Arizona Mirror maintains editorial independence. Contact Editor Jim Small for questions: info@azmirror.com.
NEXT STORY: Navigating the increasing government cybersecurity challenges in 2025 and beyond