The DeSoto County Sheriff's Office says its IT department learned of a possible security breach on October 23, 2026 involving Detention Deputy Douglas Chirinos, suspected of downloading programs onto an agency computer without permission. On October 26 he was fired and booked into the jail he worked in on a third-degree felony. The review that followed the install flag found surveillance-camera screenshots of partially nude female inmates and criminal case information he was not authorized to access, and the agency says he "bypassed security systems and accessed the user accounts of other agency employees," per WINK News and Fox 13. He is charged, not convicted.
The order of discovery is the finding
A software-install policy violation surfaced the account access. Nothing watching the accounts raised its hand first, and three days separated the install alert from the arrest.
That is the common case, not a quirk of this agency. Install telemetry is low-volume and produces an alert one person can action in ten minutes, so it gets monitored. Per-user access logs for a records or camera system are the opposite: tens of thousands of rows a week, nearly all legitimate, with no automatic way to separate "pulled a case for a shift assignment" from "pulled a case because he wanted to." So they get read after something else names a person.
Two Florida cases written up here ran the same way. An FHP trooper's 22 unauthorized database queries sat in the logs for three years while the investigation started elsewhere, because the query with no case number attached is the signal nobody reads. A Fort Pierce officer ran one plate 382 times through a system that demanded a justification each time and supplied one each time, because a required reason field is not a control until someone reads it. In both, as here, the access log was evidence rather than detection.
As of October 29, the sheriff's office has not described how the security systems were bypassed or how the other accounts were accessed. Any mechanism you read into "bypassed security systems" is your own, and in a live criminal case that is worth nothing.
What is on the record is the location. Sheriff Potter: "I am extremely disturbed by what our IT department discovered on a shared agency computer." That is where the control problem lives. The charge language Fox 13 reported tracks Fla. Stat. §815.06, whose (3)(a) makes a violation of subsection (2) a third-degree felony; no source names the paragraph charged. The statute is the easy half — it turns on entitlement, not technique. Tying the access to a person is the hard half, and a shared machine is where that fails.
The practice: three questions per shared workstation
A shared workstation where a standard user can install software is an attribution hole before it is a security hole. For every shared or kiosk machine you run, in this order:
- Can a standard user install an executable? Here the install telemetry fired, which means the install was detected, not prevented — two different budget lines, and most organisations bought one.
- Does the local administrators group contain anything that is not a service account?
net localgroup administratorson the host, or a Group Policy Results report, answers it in a minute per machine. - Does any log on that host distinguish one human operator from another? If three shifts sign in as the same local or departmental account, every Windows event and every application audit row from that machine attributes to the account, not the person at the keyboard.
Question 3 decides whether an investigation ends in a charge or a shrug, and it is the cheapest to fix. Named per-human accounts cost you a slower shift handover and a password-reset load you did not have before. Stripping local admin costs more, which is why it persists: on a 24/7 floor something needs elevation at 03:00 — a scanner driver, a vendor client that writes into Program Files, a label printer nobody has repackaged. Removing admin breaks that at the worst hour, so the exception gets granted permanently.
Sequence it accordingly: named accounts first, because attribution fails hardest and costs least. Then application allowlisting in audit-only mode for a month, which produces the list of what genuinely needs elevation — the inventory you need before anyone signs off on removing admin. Then remove it.
If none of that fits this quarter, the compensating position is narrow: alert on interactive logons outside a host's own shift pattern, and read the access logs of the systems it can reach on a schedule rather than on an incident. Weaker than the above, and much better than hearing it from an install alert.
What to check this week
- List every shared and kiosk workstation. If no list exists, that is the first finding, the same problem as the network devices nobody owns.
- For each host: can a standard user install an executable, and who is in the local administrators group?
- For each host: name the accounts people actually sign in with. One account shared across shifts means no attribution, whatever the application logs say.
- Pick one records or camera system those hosts reach and ask who read its access log last, and when.
- If you have a written insider-threat programme, check which control it claims fires first — and whether that control is install telemetry wearing an access-monitoring badge.
North InfoSec runs AI-assisted penetration testing and security assessments, including the kind of chained privilege and attribution testing described above. northinfosec.com