Overview
- Investigators say Crystal Lawson illegally used her retained credentials to log into the Comprehensive Case Information System roughly 106 times between January and May 2026 to search active cases tied to a drug trafficking organization.
- The Orange County Sheriff’s Office alleges Lawson located and leaked active, unserved arrest warrants and co-defendant identities, which it says caused lost evidence, unrecovered assets, and at least one temporary flight from arrest.
- Lawson was booked in June 2026 on more than 100 felony counts of unauthorized computer access (reported as 113–114 counts), with bond set at $10,000 per count and a judge denying a bond reassessment request.
- Reporting and a cybersecurity expert identified clear offboarding and access-control failures at the Florida Department of Juvenile Justice, including overly broad database privileges, failure to revoke credentials after her 2022 firing, and a lack of routine access monitoring.
- The case could prompt policy and technical fixes — such as least-privilege access, timely credential revocation, and active log monitoring — and it underscores how insider access to court systems can directly compromise ongoing law enforcement investigations.