America’s Gun Police Could Not Protect Its Evidence -By Fransiscus Nanga Roka

The agency responsible for tracking down illegal weapons, dismantling gangs and probing bombings, the US Bureau of Alcohol, Tobacco and Firearms apparently was unable to keep suspected cybercriminals from gaining access to a system that contained details about its own investigative targets. That is more than just an information-technology problem. This is a possible counterintelligence disaster.

The Bureaus of Alcohol, Tobacco, Firearms and Explosives has reported that on Aug. 26, 2026 unauthorised actor gained access to a stand-alone computer environment. ATF is working with the Justice Department and is doing forensic work on the affected system. It said its enterprise network, eForms platform and other systems showed no signs of being compromised, and that it continued to have operational capabilities. Yet senior DOJ officials classified it as a “major incident.”

Why such a harsh penalty if the system was isolated? Because isolation prevents lateral movement, it did not make the data within expendable.

ATF knew that the material was related to targets of an investigation. Other reports subsequently linked it to the Communications Assistance for Law Enforcement Act, which is a law that provides a framework for authorized electronic surveillance by courts. Breach of a lawful-access system would not only compromise names, but also aspects of investigative methods, communications analysis and even the way that the state conducts surveillance.

On August 26, the Russian-speaking ransomware operation Qilin took credit on its dark-web site. Qilin is a ransomware-as-a-service operation, providing tools to criminal partners in exchange for a cut of the profits. But attribution can only be precise: ATF has not even identified Qilin as the intruder; nor did the group provide any evidence to support its claim at first.

Qilin was forced to publish on a site [allegedly] 6.3GB of files which it claimed came from ATF before taking the download links down, after supposedly being given a deadline of only 72 hours to comply. Independent reviewers reported that the samples appeared to contain material associated with current and historic investigations, mobile device downloads, account information and digital forensic evidence. While these findings bolster the claims of the group, they do not independently verify every document or quantify the total degree of compromise.

Now, who will be able to pay the actual ransom? However, there are informants whose identities may be inferred; undercover officers whose operations can perhaps be reconstructed; suspects who were never charged, and witnesses whose telephone location or association data may float in cyberspace forever.

This is where the phrase “no mission impact” becomes extremely myopic. The confidentiality has already disintegrated, and an investigation can proceed administratively. The difference being that, a removed leak is not a recovered secret: once downloaded sensitive files can be copied endlessly, sold off to criminal organizations or used to craft counter-investigative techniques.

In addition, the “major incident” designation implies harm to national security or public interest interests or civil liberties and alerts congressional reporting. Congress must reject a classified briefing that delivers nothing but institutional comfort.

First, investigate the level of impacts from initial access to persistence, exfiltration and/or encryption, as well breaches through patching (use one service channel independently) influencer (influence where?) – credential controls in contracts (control circulated). The entire report should be provided to Congress, and a redacted version to the public.

And second, ATF must identify everyone whose safety or legal interests could be jeopardized, place prosecutors and courts on notice, conduct a review of ongoing operations, relocate endangered informants if necessary and divulge evidentiary compromises to criminal defendants whenever constitutionally required.

Third, there ought to be an emergency audit of the applicability of CALEA on a government-wide basis in every federal environment. The terms “legacy” and “standalone” should no longer be alibis for poor monitoring, outdated software or unencrypted case files. Even isolated systems must conform to zero-trust authentication, immutable logs, data-loss prevention, and offline encrypted backups with strict retention limits.

Lastly, Washington should abstain from ransom payments, track cryptocurrency streams and seize Qilin’s framework and implicate part by part rather than take action against the group as a fictional singular entity.

ATF contained a network. So far, it has not contained the repercussions. Cybersecurity failure becomes a Liberty Threat when the government loses investigative secrets. November 17, 2023 by George J. Chanos

Fransiscus Nanga Roka

Faculty of Law University 17 August 1945 Surabaya and Managing Partner Law Firm Victorious Indonesia