Topic starter
04/06/2026 6:48 pm
TL;DR: FBI guidance says criminal VPN infrastructure has been used by at least 25 ransomware groups and maps to proxy use, remote services, valid accounts, brute-force, and network discovery, underscoring that CJIS-regulated access must be both trusted and usable, according to Imprivata. Shared devices, remote support, and legacy workflows now need identity-aware controls, because blocking bad infrastructure alone does not prove who should be trusted.
Editorial analysis by NHI Mgmt Group, based on content published by Imprivata: “What the FBI’s criminal VPN warning means for CJIS compliance and public safety access security”.
By the numbers:
- A criminal VPN service active since approximately 2014 has been used by at least 25 ransomware groups.
Key questions
Q: What breaks when CJIS access is treated as a network problem instead of an identity problem?
A: If agencies focus only on blocking suspicious infrastructure, they can still allow legitimate-looking sessions through valid accounts, vendor tools, or remote services.
Q: Why do valid accounts make criminal VPN abuse harder to detect in public safety environments?
A: Valid accounts let attackers blend into normal authentication flows, so the access looks approved even when the usage is not.
Q: How can security teams reduce CJIS risk without slowing down officers and dispatchers?
A: They should design controls around workflow fit, not just policy strength.
Practitioner guidance
- Strengthen identity-bound remote access Require authentication and session checks that tie remote access to a specific user, device, and context before criminal justice information can be reached.
- Eliminate shared credential habits Replace shared logins on workstations and mobile terminals with individual attribution, fast user switching, and session-level accountability.
- Treat third-party access as a governed workflow Limit vendor support sessions to approved systems, monitor them for unusual locations or IP addresses, and revoke access as soon as the support task ends.
Bottom line: Criminal VPN infrastructure is a practical reminder that CJIS access cannot rely on network trust alone when valid accounts and remote services are already part of daily operations.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
04/06/2026 7:01 pm
CJIS access control fails when organisations confuse reachability with trust: Public safety operations need remote access, vendor support, and shared-device workflows, but none of those requirements prove the session is appropriate. The FBI guidance shows that criminal infrastructure can look indistinguishable from ordinary connectivity until identity-aware controls inspect it. The practitioner conclusion is that CJIS programmes must govern trust at the identity layer, not the network layer.
A question worth separating out:
Q: What should agencies do when VPN access is necessary but cannot be fully trusted?
A: Use least privilege, segmentation, and continuous session monitoring so a valid VPN connection does not become blanket access. Agencies should limit what a remote session can reach, watch for unusual identity or location patterns, and treat remote access as something to verify throughout the session. Trust must be continuously tested, not assumed at login.
👉 Read our full editorial: CJIS access control gaps exposed by criminal VPN abuse