Dubai Police ForceCatching the Detective Who Uploaded Case Files to Google Drive — Before the Court Questioned the Chain of Custody
When a major financial fraud case moved to court and the prosecutor started asking questions about the chain of custody for digital evidence, the IT security team discovered a detective had been uploading classified case files to personal Google Drive — "for working from home." The workstation USB block policy couldn't see the browser. PrivateDLP's AI screen auditing caught the next upload before it became a court problem.
Executive Summary
The client is a major police force in the United Arab Emirates — responsible for criminal investigations, public safety, and national security across Dubai. The force operates across multiple stations, detective divisions, forensic laboratories, and administrative headquarters with hundreds of workstations processing everything from financial fraud case files to intelligence reports and forensic evidence — all of which represent classified operational data with strict chain-of-custody requirements for court proceedings.
The triggering event was a prosecutor's question during a major financial fraud trial: "How do you know the digital evidence hasn't been compromised?" The IT security team's internal investigation found that a detective had been uploading classified case files to personal Google Drive for two weeks — "for working from home during the investigation." The workstation USB block policy couldn't see the browser. When the chain-of-custody question came up, the IT team had email records showing the upload happened but no screenshot evidence of what files were accessed or uploaded.
What the force bought was PrivateDLP's AI screen auditing — specifically the capability to detect browser-based uploads of classified case files to personal cloud storage, with screenshot evidence for court proceedings. What they also discovered: 24 violation events in the first 90 days across detective divisions — case files being uploaded to personal cloud storage during active case periods, screenshots of confidential case material being captured on personal devices, and access patterns that didn't match any active case file.
Client Profile
The client is a major police force in the United Arab Emirates — responsible for criminal investigations, public safety, and national security across Dubai. The force operates across multiple stations, detective divisions, forensic laboratories, and administrative headquarters with hundreds of workstations. The data processed includes financial fraud case files, intelligence reports, forensic evidence documentation, witness statements, and classified operational records — all subject to chain-of-custody requirements for court proceedings and strict UAE data protection regulations.
Operational Scale
Multiple stations, detective divisions, forensic labs, and administrative headquarters
Court Requirements
Digital evidence chain-of-custody documentation for criminal trials and legal proceedings
Data Classification
Financial fraud case files, intelligence reports, forensic evidence, witness statements
Workforce Structure
Detectives, forensic analysts, patrol officers, and administrative staff across multiple shifts
The Challenges
Running a major police force — with hundreds of workstations processing classified case files, operating under court evidence requirements, and managing detectives across multiple shifts on shared workstations
USB Block Policy Can't Catch Browser-Based Case File Uploads — And That's How Classified Files Were Actually Leaving
The workstation USB block policy blocked unauthorized removable storage on detective workstations. None of that stopped a detective on a major financial fraud case from opening Google Drive in Chrome and uploading classified case files to a personal account — every day for two weeks before the IT security team found out. The detective wasn't trying to compromise the case. She genuinely needed 'offline access for working from home.' When the prosecutor asked about chain of custody during the trial, the IT team had email records showing the upload happened but no screenshot evidence of what files were accessed. The USB policy had no visibility into browser-based file transfers.
Chain of Custody Questions in Court — With No Screenshot Evidence to Answer Them
When a prosecutor questions the integrity of digital evidence during a trial, the IT security team needs to answer: Who accessed what case file? When? What happened to it? The force's system logs showed the detective's workstation was active during the period in question — but not what files were opened, uploaded, or transferred through the browser. Three separate court proceedings in the past two years have involved chain-of-custody questions that the IT team couldn't fully answer without screenshot evidence.
24 Case File Violations in 90 Days — And Nobody Could See Them
Division commanders had no data to show how case files were being moved during active case periods. What PrivateDLP's AI screen auditing found in the first 90 days: 24 violation events across detective divisions — case files uploaded to personal cloud storage during active investigations, screenshots of confidential case material captured on personal devices, and access patterns that didn't match any active case file. Not everywhere. But enough to matter. Three detectives on the financial fraud team were responsible for the majority.
Shared Workstations Across Shifts — No Accountability for Which Detective Accessed What Case File
Detective divisions operate across multiple shifts, with three to four detectives sharing each workstation over a 24-hour cycle. When a case file is accessed from a shared workstation, the system logs show the workstation was used — not which detective was signed in at the time. For chain-of-custody documentation, this means the IT team often can't definitively state which detective accessed a specific case file at a specific time, only that someone on that workstation did.
The Solution: PrivateDLP
The force chose PrivateDLP for two capabilities its existing stack didn't have: AI screen auditing that could catch browser-based case file uploads with screenshot evidence for court proceedings, and violation behavior monitoring that could show division commanders how case files were being moved on detective workstations during case periods
Browser-Based Case File Upload Detection
The core capability the force needed: AI screen auditing that could detect when a detective had a classified case file open alongside a personal cloud upload window — and preserve the screenshot as evidence. A division commander writes rules in plain English: "flag any screenshot showing a case file open alongside a personal cloud upload window." The IT administrator deploys the rule from the server console the same day.
Detective Division Violation Visibility
The division commanders had no record of how case files were being moved on detective workstations during case periods. PrivateDLP's AI screen auditing captured screenshots approximately every minute and analyzed them against the violation rules commanders configured. The first 90-day report surfaced 24 violation events across detective divisions — case files uploaded to personal cloud storage, screenshots of confidential case material captured on personal devices, access patterns that didn't match any active case file. The division commanders had documented violation evidence for the first time.
Deployment: The Windows client was deployed across hundreds of detective workstations across multiple stations, forensic laboratories, and administrative headquarters. Screenshots are stored on the force's own on-premises server — which was a hard requirement for the legal and court proceedings team. Division commanders own the violation rule definitions. The IT administrator handles deployment and incident review.
Implementation & Key Capabilities
PrivateDLP gave the police force two capabilities it didn't have before: browser-based case file upload detection with screenshot evidence for court proceedings, and violation behavior monitoring that division commanders could operate without vendor consultants
Browser-Based Case File Upload Detection With Screenshot Evidence
The capability the force was buying: AI screen auditing that could catch browser-based personal cloud uploads alongside open classified case files — with timestamped screenshot evidence for court proceedings:
- Plain-language rule definition: A division commander writes a rule like 'flag any screenshot showing a case file open alongside a personal cloud upload window' — no regex, no DLP consultant
- Screenshot evidence on demand: When a rule fires, the triggering screenshot is preserved — timestamped, linked to the workstation and detective account, available for court proceedings and chain-of-custody documentation
- Customizable alert content: The IT administrator defines what the alert says and who receives it when specific rules are triggered — division commander, IT security, or legal team
- AI model flexibility: Screenshots are analyzed by their own LLM — all data stays within the force's own on-premises server infrastructure
Digital Evidence Chain-of-Custody Documentation
When a prosecutor questions the integrity of digital evidence, the IT security team needs to answer definitively. PrivateDLP provides the documentation:
- Workstation-level accountability: Every screenshot is linked to a workstation ID and timestamp — when combined with shift logs, this establishes which detective was at the workstation
- Chain-of-custody reporting: The IT administrator can generate a report showing all activity on a detective's workstation during a specified period — for court disclosure and internal investigations
- Evidence preservation: When a rule fires, the screenshot is preserved with full metadata — detective account, workstation ID, timestamp, rule triggered — creating an auditable chain of custody
- On-premises storage: All screenshots are stored on the force's own server — not in a third-party cloud. This was a hard requirement for the legal and court proceedings team
Detective Division Violation Behavior Monitoring — In Plain English
The division commanders wanted visibility into case file movement on detective workstations during case periods. PrivateDLP's AI screen auditing provided it:
- Plain-language violation rules: A division commander writes rules like 'flag any screenshot showing case files open alongside a personal cloud upload window' or 'flag any screenshot showing personal messaging applications during active case periods'
- Role-specific rule scopes: Detectives on financial crime cases have different rule sets than those on general investigations — configured per division, not one rule for all
- Division-level violation reports: The AI produces a weekly breakdown by station and division — showing violation events per detective, during active case periods, with screenshot evidence
- Privacy-first design: Screenshots are deleted immediately after AI analysis unless a violation rule is triggered — protecting detective privacy while providing the evidence commanders need
USB Controls and Application Restrictions
The force needed USB controls that wouldn't interfere with legitimate forensic workflows while blocking personal devices:
- Approved forensic device whitelist: Only authorized USB devices used for legitimate evidence collection — encrypted forensic drives, licensed software keys — are allowed. Personal devices are blocked on detective workstations.
- Department-based USB policies: Detective divisions have different USB policies than forensic laboratories or administrative staff — configured by role, not by individual workstation
- Application whitelist: Only approved law enforcement software, case management systems, and official applications can run on detective workstations — preventing unauthorized software that could introduce vulnerabilities
- Web filtering: Access to personal cloud storage services is logged and can be blocked on detective workstations — providing an additional layer of control beyond AI screen auditing
What Changed at the Force
Three months after deployment — during the following major investigations — division commanders are writing their own violation rules, the IT team has screenshot evidence on demand, and the legal team has documented chain-of-custody reports for court proceedings
| Metric / Objective | Before PrivateDLP | After PrivateDLP |
|---|---|---|
Browser-Based Case File Upload Detection | USB block policy showed nothing; the Google Drive uploads were discovered from a prosecutor's court question, not from any internal alert | 1 confirmed personal cloud upload violation in the first 60 days — a detective uploading case file screenshots to personal Google Drive during an active financial fraud investigation |
Detective Division Violation Visibility | Division commanders had no record of how case files were being moved during active case periods — only the aftermath of prosecutor questions that triggered investigations | AI violation behavior reports surfaced 24 violation events in 90 days — case files uploaded to personal cloud storage, screenshots of confidential case material captured on personal devices, access patterns that didn't match any active case file — concentrated in 3 detectives on the financial fraud team |
Court Chain-of-Custody Evidence | System logs showed workstation activity but not what case files were opened, accessed, or uploaded — the three court inquiries took weeks to answer with incomplete documentation | Screenshot evidence is preserved at the moment of rule violation — timestamped, linked to the workstation and detective account, available for the next court proceeding |
Violation Rule Deployment Time | New detection rules required a vendor consultant and regex expertise — division commanders couldn't write or update rules without IT support and vendor engagement | A division commander writes rules in plain English; the IT administrator deploys them from the server console in under an hour. First rule was deployed within the first week |
"The prosecutor's question during the financial fraud trial was the moment that changed everything. He asked: 'How do you know the digital evidence hasn't been compromised?' We could show that the detective's workstation had been used during the period in question. We couldn't show what she'd actually done with the case files. We couldn't definitively say she hadn't uploaded them somewhere. That was the gap. The screenshot evidence is what makes this work for a police force. When the next court proceeding asks about chain of custody, we can show them exactly what happened on that workstation. The legal team specifically asked about on-premises storage — they wouldn't approve a cloud-based solution."
"I wrote the first rule myself. The IT team didn't have to call a vendor or build a regex pattern. I just said 'flag any screenshot showing a case file open next to a personal cloud upload window' and they deployed it the same afternoon. Three months in, I've written rules for personal cloud uploads with case files visible, social media during active case hours, and personal messaging applications during case periods. The IT team is happy because I'm not asking them to build custom DLP policies. I'm happy because I actually have visibility into what my detectives are doing on workstations during active investigations. The part that made this procurementable for a police force: screenshots don't leave our infrastructure. Our legal team and court proceedings coordinator asked about that specifically."
The force's deployment is scoped to hundreds of detective workstations across multiple stations, forensic laboratories, and administrative headquarters — managed from a single on-premises server, with screenshot storage on the force's own infrastructure. Division commanders own the violation rule definitions. The IT administrator handles deployment and incident review. The arrangement is self-sustaining: when a new violation pattern emerges during an active investigation, the division commander writes the rule and the IT administrator deploys it the same day.
What the force bought wasn't a full security overhaul. It was a tool that fit two specific gaps: screen-level visibility on detective workstations where classified case files live, and violation behavior monitoring that division commanders could actually operate without calling a vendor consultant. The deployment stayed within the force's budget, server infrastructure, and legal procurement requirements — and it gave division commanders something they'd never had before: their own rule set, deployed without waiting for IT vendor engagement, with screenshot evidence that holds up in court.