The threat actor could compromise the website just as they did for the email, Or create a legitimate looking fake one, not every department has one or is indexed well
Tech support staff handling these requests cannot possibly know the thousands of police departments sites to know if the site is legitimate.
There is simply no single national authoritative source for validation ( international is even more complex with different laws and languages)
Yes, the police web site is another point of vulnerability. But with any luck you can reliably find the area code for Podunk, then call directory assistance in that area code to ask for the police department number. So the crooks would have to compromise that too.
You know who probably would be in a better position to know? Your corporate counsel. Chances are pretty high they not only know who to contact, they probably have additional contacts that your 'tech support' staff do not in the nearby agencies and beyond, not to mention having the actual knowledge on the response mechanisms that said agency requires for compliance with requests for corporate data.
Which forces me to ask this question: I understand that as technologists we probably have an abundance of confidence in the knowledge and skills we possess in our domain, so why are tech support staff even 'handling' legal requests at all?
The only "handling" they should be doing is "handing" whatever evidence or materials that have been requested directly to the company's legal counsel, who should have been the party liaising with the 'requestor'.
Also in my experience counsel who practice civil and corporate law have very little experience with law enforcement. Companies don't generally keep lawyers who practice criminal law inhouse .
To an extent, yes as a matter of fact, or at minimum a Registered Agent. Because in almost all of those 200 Jurisdictions, for a majority of business types (including Corporations) a Registered Agent is required by law for exactly this purpose: to receive and help your company properly respond to legal requests.
https://www.upcounsel.com/registered-agent
Similarly, an Authorized Agent for your business is empowered to respond to such inquiries
Also having an general counsel for your place of business, is not same as having an firm 24/7 on call.
So I’m not sure what is being rebutted here.