Secrets in a public docket: the court filing breach and where the sensitive tier ends

The week

On August 6, 2025, Politico reported that the federal judiciary’s electronic case management and filing system, known as CM/ECF, had been compromised. CM/ECF is the system lawyers use to file documents with federal courts and that courts use to manage their dockets, the official running list of everything filed in a case. The concern centered on sealed filings that could identify confidential informants.

Somewhere in that system sit documents that can get people killed. A sealed filing might name a confidential informant who is helping prosecutors against a violent gang, or describe a cooperating witness’s deal with the government. Those documents are “sealed,” meaning a judge has ordered them hidden from public view. But hidden from the public is not the same as hidden from a determined intruder.

The next day, the Administrative Office of the U.S. Courts, the agency that provides administrative support to the federal courts, cited recent escalated cyberattacks of a sophisticated and persistent nature. It said it was strengthening protections for sensitive case documents.

On August 12, The New York Times reported that investigators had found evidence Russia was at least partly responsible. According to the Times, the intruders searched for criminal cases in New York and several other cities, and court officials urged that sensitive documents be removed from the system quickly.

Several district courts then took a strikingly old-fashioned step. They ordered that sealed documents be filed on paper or otherwise kept off CM/ECF. The response to a sophisticated digital intrusion was, for the most dangerous documents, to take them out of the digital system altogether.

The courts did not lack a plan for sensitive material; they had created one years earlier. The question the week raised was whether the line between “sensitive enough for special handling” and “ordinary sealed filing” had been drawn in the right place. Every organization holding a small number of truly dangerous records inside a large, general-purpose system faces the same question.

Court filing systems are built for openness. Dockets and most filings are public by design; that openness is a pillar of the justice system. The same systems also hold sealed material whose exposure can endanger witnesses, informants and investigations. Many agencies share that pattern: a case system built for broad access that also stores a small number of records that could get someone hurt.

The judiciary had already faced this problem once. After the SolarWinds-related compromise disclosed in January 2021 (an intrusion in which attackers slipped malicious code into widely used network management software and reached many government networks through it), it adopted special procedures for what it called highly sensitive documents. Those could be filed on paper or on a secure standalone system instead of CM/ECF. The guidance at the time said many sealed filings would likely not qualify, and individual courts wrote their own definitions.

A separate tier existed. The 2025 breach showed that it was drawn too narrowly, since sealed filings that later needed urgent removal were still in the main system. Getting the tier right involves three decisions: how to define what belongs in it, where it lives, and how access to it is controlled and watched. The first is the one most often gotten wrong.

Tiers, legacy systems and the limits of a seal

Data classification is the practice of sorting information by how sensitive it is and handling each category accordingly. A familiar household version: everyday papers on the kitchen counter, tax returns in a filing cabinet, passports and wills in a fireproof safe. Organizations do the same with labels such as public, internal, confidential and restricted, each with its own rules.

A tier is a group of records that gets its own level of protection. A “protected tier” is the fireproof safe: a small set of records stored, accessed and watched more carefully than everything else.

A legacy system is an older technology platform still doing essential work, often built before today’s threats were well understood. Legacy systems tend to be hard to change, because so much depends on them, and hard to secure to modern standards, because they were not designed for it. Replacing one can take years.

Sealing is a court’s order that a document be kept from public view: a legal protection rather than a technical one. A sealed document in an electronic system is typically marked so that the public website will not display it, while court staff and authorized parties can still open it. To an intruder who has gained access to the system itself, that marking may be no barrier at all.

Put those together and the problem becomes clear. If an organization cannot make its whole legacy platform as secure as it would like, quickly, it can still take the small number of truly dangerous records and put them somewhere better protected. That only works if the organization correctly identifies which records those are.

Defining the tier by consequence

Most organizations classify records by legal status: public, confidential, sealed, protected by a named statute. Legal status is necessary but makes a poor boundary for architecture, meaning the design of where systems store data and who can reach it. A sealed trade secret and a sealed cooperation agreement share a label. The harm from exposing them differs enormously. One may cost a company money; the other may cost a person their life.

A better boundary asks what happens if the record is exposed: whether someone could be physically harmed, whether an investigation would be compromised, and whether the damage would be irreversible. A breach notice cannot un-expose an informant. Records that meet that test belong in the protected tier regardless of their legal label. Outside the courts, the set includes child welfare case notes, protected witness details, domestic violence survivor addresses, undercover officer identities and some public health investigation records.

A narrow, label-based definition fails in a predictable way. Filers use the general system for anything that does not clearly meet the special definition, because it is easier. The sensitive tier stays small and tidy while dangerous records accumulate outside it. On paper, the organization looks well protected. In practice, the protected tier holds a handful of records while the dangerous ones pile up in the general system.

The people best placed to draw the line are clerks, caseworkers and records officers, who know which documents are dangerous. A short consequence-based list, owned by them and reviewed on a schedule, keeps the boundary honest. Each addition should record why the record qualifies, so that reviewers can test the reasoning rather than inherit it.

Placing the tier

Once defined, the protected tier should not share storage, access paths and credentials with everything else. Credentials here means the usernames, passwords, keys and administrator accounts that unlock a system. Many agencies keep the tier inside the general case system because one search and one workflow are convenient. That convenience means a single compromise of the general system reaches the protected records too.

Separation can take several forms, each with a different trade-off between protection and ease.

• A distinct repository with its own access controls and encryption keys offers the most protection. Encryption scrambles data so it is unreadable without a key; if the keys are separate, a thief who breaks into the main system still cannot read the protected records. Its keys and administrator accounts should be managed apart from the general system’s, so that one compromised administrator cannot unlock both.
• A segregated partition of the existing system with stronger authentication is cheaper and easier to adopt, though it still sits inside the same system.
• Offline or paper handling, the courts’ emergency response, sharply reduces remote exposure for a small number of records. It costs speed, searchability and sometimes the integrity of the docket, because a paper filing must still be tracked and shared with the right parties.

The intake path matters as much as storage. If attorneys, partner agencies or contractors upload protected documents through the same portal as everything else, separation is undone at the front door. The protected tier needs its own submission route. It must be simple enough that busy filers actually use it, or they will default to the familiar portal.

Controlling and watching access

Separation reduces exposure without eliminating it. People with a legitimate need still reach the protected records. Access should be limited to named individuals with a current need, use phishing-resistant authentication, and expire when a case or assignment ends. Phishing-resistant authentication means login methods, such as physical security keys, that cannot be tricked out of a user by a fake website or a convincing email, unlike passwords or codes sent by text message.

Monitoring is where legacy systems are weakest. An audit log is the system’s diary of who did what and when. Older platforms often keep thin audit logs for short periods, on the same servers an intruder controls. After an intrusion, the agency then cannot say which records were viewed, which in turn makes it impossible to decide whom to warn. For the protected tier, logs should record who opened which record and when. They should be shipped to a separate system the intruder cannot reach, and retained long enough to cover intrusions discovered months later.

Detection rules can be simple because the tier is small. Bulk access, searches by name across many cases, and access from new locations or at unusual hours are all signals worth an alert. A small, well-defined tier makes those alerts meaningful. In a general system serving thousands of users, the same rules would drown in noise.

The three decisions together produce a proportionate design. Most records stay where they are, with ordinary controls. A small, clearly defined set receives separate storage, its own intake path and close monitoring. That is achievable for most agencies sooner than securing an entire legacy platform to the highest standard. It also gives leaders a precise answer when asked which records were at risk in a breach of the main system.

A county’s child welfare records, before and after

Take a county family services department whose case management system, more than a decade old, holds tens of thousands of records: eligibility paperwork, payment histories, appointment notes. It also holds a few hundred records that would be dangerous if exposed, such as the current address of a child placed in foster care away from an abusive parent, or the location of a domestic violence shelter resident.

In the “before” picture, the department classifies records by statute. Everything is “confidential,” so nothing stands out. The protected addresses sit in the same database, behind the same logins, as routine paperwork. A contractor’s compromised password would expose all of it, and the system’s logs, kept for a few weeks on the same server, would not show what was viewed.

In the “after” picture, caseworkers and the records officer draw up a one-page list based on consequence: any record that reveals the location of a child in protective placement, a survivor’s address or a confidential informant. Those records move to a separate store with its own keys and administrator accounts. Caseworkers submit them through a dedicated form that takes no longer than the usual one. Access is limited to assigned workers and expires when a case closes. Logs flow to a separate system, and an alert fires if anyone searches across many cases by name.

The department has not modernized its entire platform; that will take years and a budget it does not yet have. But if the main system is breached tomorrow, the director can tell the county board, with confidence, which records were within reach and which were not. That clarity is worth a great deal to the children and survivors involved, and to the county’s legal exposure and public standing.

How the boundary erodes in everyday work

No one sets out to put an informant’s name in the wrong place. The boundary erodes through hundreds of small, reasonable decisions made by busy people.

Say a paralegal at a law firm has a sealed motion due at 5 p.m. The special procedure requires a paper filing delivered to the clerk’s office across town, or a separate secure upload she has used once before and cannot remember the login for. The motion is sealed, not obviously “highly sensitive” under the court’s written definition, and the general portal is open on her screen. She files it there. Nothing in the rules says she was wrong.

Or a caseworker in a county agency writes a note mentioning a foster child’s new school. The note goes into the general case file because that is where notes go. The school’s name is not, on its own, a protected address. Combined with a few other details, it tells an abusive parent exactly where to wait.

A contractor migrating old records to a new server copies everything, including a folder that had been carefully restricted, because the migration tool does not carry over the special permissions. For three months, until someone notices, the folder is readable by anyone with ordinary access.

Each of these is a process problem, not a technology failure. Each is also why a consequence-based definition matters: it asks the people doing the work, “could this hurt someone?” rather than “does this match the label?” And each is why the separate intake route has to be as easy as the general one. If the safe path is slower, people under deadline will take the fast one, every time.

The protected tier is therefore a standing commitment rather than a one-time project. It needs a named owner, periodic sampling of what is landing in the general system, and a feedback loop so that clerks and caseworkers can flag new kinds of dangerous records as they appear.

The price of uncertainty, and the price of a tier

The stakes are concrete. Exposure of the most dangerous records can cause physical harm, wreck investigations and destroy trust in an institution. It also brings legal liability, oversight inquiries and lasting reputational damage. When an informant’s identity leaks, the harm falls on a person who trusted the institution to keep them safe, and no settlement or apology can undo it.

There is a less visible cost, too. Every time an organization cannot say which records a breach reached, it must assume the worst: notify broadly, warn everyone who might be affected, reassign staff, and in a criminal case perhaps reconsider an investigation. Uncertainty is expensive. A well-defined, well-logged protected tier turns a sprawling, open-ended response into a bounded one.

The cost of a protected tier, by contrast, is modest: some engineering, a dedicated intake path, better logging and the time of the people who draw the list. That is a small fraction of what a full platform replacement costs, and it can be done in months rather than years.

A tier that works has four features: a short list defined by the consequence of exposure, owned by front-line experts, with reasons recorded; separate storage, keys and administrator accounts, so one compromise cannot unlock everything; a dedicated, easy intake route that filers and partners actually use; and logs kept off the main system and long enough to investigate a late discovery.

The tiers that fail tend to share the opposite traits. They rely on legal labels alone, so the protected tier stays tidy while dangerous records pile up outside it. They feed a secure repository through the general upload portal. They wait for a full platform replacement before protecting the records that matter most. And they grant access by role forever, rather than by current case or assignment.

Listing, routing, access and logs for your own dangerous records

• Which of our records could get someone hurt, or wreck an investigation, if exposed, and who made that list and when was it last reviewed?
• Do those records live in the same system, behind the same administrator accounts, as everything else?
• How do partners, contractors and outside filers submit those records, and does that route bypass our general portal?
• Who can open a protected record today, with what kind of login, and does that access end when their case or assignment ends?
• If our main system were breached tonight, could we say by tomorrow exactly which protected records were viewed, from logs kept off that system?

With hindsight

The judiciary did not publish a full account of the intrusion’s scope, and we would not claim more than was reported. Courts continued to adopt and revise procedures for sensitive filings into 2026. The judiciary’s own notice acknowledged that safeguarding legacy systems posed a particularly difficult challenge, and modernizing the case system remained the long-term answer.

That acknowledgement is candid and important. Replacing a nationwide case system is a large, slow undertaking. In the meantime, the documents that matter most still need protecting, which is why the interim decisions about the protected tier carry so much weight.

What the episode adds to the record is the boundary problem. A special tier for the most sensitive documents had existed since 2021, and it still proved too narrow when the main system was breached. The courts had done the hard part of recognizing the need. Where the line was drawn determined what was exposed.

Agencies that hold dangerous records inside general-purpose case systems face the same risk. Child welfare agencies, prosecutors’ offices, police departments, public health departments and benefits programs all keep a small number of records whose exposure could cause irreversible harm, alongside a much larger volume of routine material.

Those that define their protected tier by consequence, give it a separate intake path and keep its logs outside the main system can now say precisely what a breach of the general platform would expose. Those relying on legal labels usually cannot. The difference shows up at the worst possible moment: the morning after an intrusion, when the board, the press and the people whose safety is at stake all want to know what was taken. Being able to answer that question clearly is one of the most valuable things a security program can deliver.