CJIS audit findings on authentication usually come down to one overlooked path into criminal justice information (CJI). The dispatch center workstations were covered. The patrol laptops were covered. Then a detective ran a plate from a parking lot on a tablet, through a browser session that asked only for a password. 

That one path is what the finding names, and it is what the corrective action plan will have to answer for. Officers use voice radio, in-vehicle computers, and handheld devices at a single traffic stop, and the CJIS security requirements attached to those channels differ.

Voice Radio Remains the Backbone

Dispatch traffic still moves over land mobile radio (LMR). Units can keep talking radio to radio even when cellular networks are saturated or down, and LMR carries one-to-many voice on a single channel, which matters in a large-scale response. The SAFECOM and National Council of Statewide Interoperability Coordinators (NCSWIC) best practices on LMR and Long Term Evolution (LTE) integration treat LTE as the stronger data technology and LMR as the more resilient voice technology. 

Interoperability across agency lines comes from shared standards, not device features. Project 25, a suite of open, standards-based specifications, enables mutual aid channels to work when neighboring jurisdictions buy from different vendors.

When a dispatcher reads a wanted status over the air, for example, the officer is hearing the result of a query someone else ran on a workstation. The radio transmits the answer as speech, and such voice traffic over cellular devices falls outside the Criminal Justice Information Services (CJIS) requirements that govern data. Section 5.20.1.2.2 of the CJIS Security Policy version 6.1 exempts a cellular device transmitting CJI by voice from encryption and authentication requirements. 

That exemption is narrow, and other actions (e.g., when information is queried, displayed, or stored on a device) may trigger their own requirements.

Mobile Data Terminals and In-Vehicle Systems

An officer who queries that same wanted status from the computer in the vehicle has taken the dispatcher out of the sequence. The query leaves the laptop, reaches the state system, and puts the answer on the screen. The laptop is a terminal that happens to be in a car, and it has submitted a transaction and displayed CJI. 

The same authentication and encryption requirements apply in the car as in the dispatch center. Policy Area 20 then adds mobile device requirements on top of them, including mobile device management, local device authentication, and advanced authentication.

Connectivity shapes how those controls are built. Coverage drops in parking garages and rural stretches. Software that needs a live connection for the whole round trip loses the query when the signal cuts out, and the officer starts over. Asynchronous message handling queues it and delivers the response when the link returns. To address issues like these, tools such as browser-based workstation access through MessengerNow provide intermittent connections and ruggedized hardware from the start.

The hardware is the other condition. In-vehicle devices are shared across shifts. That puts individual accountability in the architecture, because the audit trail has to attribute a query to a person, not a console. Section 5.20.7.1 requires local device authentication to be used to unlock the device before that mobile device is released for use. Control AC-19(5) covers data at rest through container-based or full device encryption, and AC-11 device lock covers the terminal an officer walks away from.

Where the Queries Actually Go

Behind every field query sits a message switch that decides where it goes and how the answer comes back. One plate check can require the state motor vehicle file, an out-of-state registration through Nlets, and a wanted person check against the National Crime Information Center (NCIC), which is three destinations in three formats. 

The OpenFox Message Switch handles that routing along with the connections to computer-aided dispatch, records management, courts, and corrections systems. Nlets alone reports more than 3 billion transactions a year across more than 45,000 user agencies.

Auditability is written into the transaction rather than added at the reporting stage. Control IA-0 requires an FBI-authorized originating agency identifier on every transaction on CJIS systems, so the sending agency is identified and the correct level of access is applied, and a servicing agency running an inquiry for another has to maintain an audit trail for the specified retention period.

That is why switch-level logging is a common request for auditors. Field devices get replaced and reassigned, while the switch stays the one place every transaction passes through.

HotFiles answers whether the person or property in front of the officer is flagged right now, and a criminal history query answers what the record says over time. A query that returns in four seconds every time beats one that returns in one second most of the time.

Smartphones, Tablets, and Remote Access

Handheld access has moved most of what used to live in the vehicle onto a phone or tablet, and the policy treats that access according to what the device can do rather than what it looks like. Mobile device management is required under section 5.20.2, with one exception. 

Mobile Device Management (MDM) is not required when a device receives CJI from an indirect access system, meaning one with no capability to conduct transactional activity against state or national repositories, applications, or services. The CJIS Systems Officer (CSO) makes the final determination of whether access counts as indirect.

Advanced authentication is required under section 5.20.7.2 when an authorized user reaches CJI from a mobile device, with the same carve-out. Where an agency cannot meet it because of a technical or business constraint, section 5.20.7.2.1 permits CSO-approved compensating controls under strict conditions. 

MDM has to be in place first, the controls have to meet the intent of the requirement and provide similar protection, and they cannot rely on existing authentication requirements. They expire on the CSO-approved date or when a compliant solution goes in, which makes a compensating control a scheduled project rather than a settled answer. 

Remote sessions carry their own layer through control AC-17, covering monitoring, encryption, and managed access control points.

Where Field Channels Overlap and Create Gaps

A single stop can move the same information across three channels in under two minutes. The plate goes out over the radio, the return comes back on the in-vehicle terminal, and the officer photographs a document on an agency phone before clearing the call. Each handoff has a different authentication path behind it, and the weakest one sets the agency’s exposure.

Many authentication findings trace back to that unevenness. Very few come from a deliberate decision to skip a control. Many agencies implemented mobile and remote access last, often with a different team, sometimes through a vendor portal that predates the current policy. An inventory that holds up under audit lists every path by which CJI can be reached, the authentication method and audit trail for each, and whether that path is transactional or indirect.

Why Authentication Is the Common Requirement

All of these channels converge on identification and authentication, which the CJIS Security Policy treats as a policy area of its own. Control IA-2 requires that organizational users be identified and authenticated as individuals and carries a Priority 1 marking. Its first two enhancements, multi-factor authentication to privileged and to non-privileged accounts, carry the same marking. 

CPI OpenFox has been building software for the law enforcement industry since 1989 and now supports 31 states and more than 1,000 agencies. That exclusive focus allows us to design authentication, audit logging, and transaction-level accountability into the OpenFox Suite natively. 

What do police use to communicate securely in your jurisdiction today? Ask CPI OpenFox to review every channel that reaches CJI and to show where your implementation stands against the controls an auditor tests. Request a consultation to start that review.