The threat actor could compromise the website just as they did for the email, Or create a legitimate looking fake one, not every department has one or is indexed well
Tech support staff handling these requests cannot possibly know the thousands of police departments sites to know if the site is legitimate.
There is simply no single national authoritative source for validation ( international is even more complex with different laws and languages)
Yes, the police web site is another point of vulnerability. But with any luck you can reliably find the area code for Podunk, then call directory assistance in that area code to ask for the police department number. So the crooks would have to compromise that too.
You know who probably would be in a better position to know? Your corporate counsel. Chances are pretty high they not only know who to contact, they probably have additional contacts that your 'tech support' staff do not in the nearby agencies and beyond, not to mention having the actual knowledge on the response mechanisms that said agency requires for compliance with requests for corporate data.
Which forces me to ask this question: I understand that as technologists we probably have an abundance of confidence in the knowledge and skills we possess in our domain, so why are tech support staff even 'handling' legal requests at all?
The only "handling" they should be doing is "handing" whatever evidence or materials that have been requested directly to the company's legal counsel, who should have been the party liaising with the 'requestor'.
Also in my experience counsel who practice civil and corporate law have very little experience with law enforcement. Companies don't generally keep lawyers who practice criminal law inhouse .
To an extent, yes as a matter of fact, or at minimum a Registered Agent. Because in almost all of those 200 Jurisdictions, for a majority of business types (including Corporations) a Registered Agent is required by law for exactly this purpose: to receive and help your company properly respond to legal requests.
https://www.upcounsel.com/registered-agent
Similarly, an Authorized Agent for your business is empowered to respond to such inquiries
Also having an general counsel for your place of business, is not same as having an firm 24/7 on call.
So I’m not sure what is being rebutted here.
For all of the box ticking, theatrical diligence and audit-preparedness work I’ve had assigned to me in my Devops career, and bespoke security “services” and “products” out there that merely exist to enable more box ticking in the name of “security and compliance”, I think maybe we should start.
The bad actors are explicitly exploiting an emergency provision intended for quick information return to prevent serious harm/death using verified police accounts they've compromised.
You either end up with the headline we have here or "Apple's failure to comply with an emergency request led to the death of X"
I don't know what the right policy is, but this is just a tradeoff without an easy answer.