Florida's juvenile justice department faces security questions, massive data breach

ORANGE, Fla. - A former Florida Department of Juvenile Justice (DJJ) probation officer is facing 114 felony charges after investigators accused her of using retained access to a court records system to obtain and share sensitive information with members of a drug trafficking organization.

According to an arrest affidavit, Crystal Lawson, 32, was hired as a juvenile probation officer for the DJJ in February 2022. She only worked for the agency for eight months before being fired later that year following a battery arrest.

System failures

What we know:

Despite her termination, Lawson’s access to the state's Comprehensive Case Information System (CCIS) database was never cut off.

Investigators said Lawson routinely logged into the database 106 times between January and May 2026. She allegedly searched for active criminal cases and leaked sensitive data, including active arrest warrants, to members of a violent drug trafficking organization to warn them that "investigators were closing in."

According to the affidavit, Lawson's alleged leaked tips resulted in lost evidence, unrecovered assets, and allowed at least one suspect to flee the area to avoid arrest (that individual was ultimately apprehended).

Faces 570 years in prison

Lawson faced a judge for the first time in connection to this case on Friday.

She is currently facing 114 felony counts of computer crimes. Each individual count carries a maximum prison sentence of 5 years. If convicted on all counts, Lawson faces a maximum penalty of up to 570 years in prison.

In court, the judge set her bond at $10,000 per count, creating a hefty price tag for her release.

Lawson's defense attorney requested non-monetary special conditions instead, arguing the family cannot afford the current bond. The attorney emphasized that while the allegations regarding court documents are serious, the underlying nature of her charges is entirely nonviolent.

What the cyber expert is saying

Internet and cybersecurity expert Jonathan Hochman reviewed the case for FOX 35 and identified several glaring, systemic failures within the DJJ's offboarding and security protocols:

Over-Privileged Access: Lawson had sweeping access to the entire database rather than having her access strictly limited to her assigned cases.

Improper Offboarding: When she was let go, the IT and HR departments failed to properly revoke her credentials and verify that her system access was completely dead.

What they're saying:

"You don't necessarily want to give every employee access to every record... that can do what's called 'minimize the blast radius,'" Hochman explained. "If there's a leak or a problem with that insider, they can't get everything. They only get some of it. That limits the damage. When she was let go, they didn't off-board her properly."

Hochman added the 4-year gap between her firing and the discovery of the breach is another red flag.

"The access logs for these databases should be put out a report every day to the information security office, showing who's accessing what," Hochman said. "And if somebody is accessing a lot of records, and it doesn't make sense, that should come to someone's attention right away."

Bond denied

What's next:

Back in the courtroom, the judge officially denied the defense's request for a bond reassessment. Because her family couldn't afford the bond, as of Friday night, Lawson remained held inside the Orange County Jail.

FOX 35 News reached out directly to the Department of Juvenile Justice to ask if they are modifying their internal security and offboarding protocols following the arrest. As of publication, the DJJ has not responded to requests for comment.