Designed the criminal justice information boundary through the consolidated CAD/911 dispatch platform, separating CJI-bearing paths from general dispatch traffic end to end, with encrypted transport to Sheriff’s Office substations, dedicated CJI demilitarized zones, MACsec at the link layer and FIPS 140-2 validated cryptographic platforms throughout.

The design was reviewed with the Florida Department of Law Enforcement — the state’s CJIS authority — and carried through thirty-five revisions.

When policy overrides the engineering-preferred answer

The boundary is the visible half. The less visible half is federal criminal justice information policy acting as a controlling architectural constraint rather than an audit obligation — and overriding the answer the engineering would otherwise have reached. Four decisions in the data center estate were made by compliance, and each is documented.

Physical access was gated. Anyone entering areas holding law enforcement equipment had to be certified through fingerprinting, background check and examination, or be escorted by someone who was. Four whole teams were put through it against a tracking list.

A disaster recovery workload came back out of the cloud-adjacent answer. The state attorney’s workload was pulled out of the out-of-state facility into the county secondary site, and capacity there re-planned to absorb it.

Encryption was written in per segment rather than uniformly. AES-256 on the dispatch and law enforcement networks, none required on the rest — because applying the strongest control everywhere is a way of not having thought about it, and it spends budget and performance where no obligation exists.

Cloud adoption was filtered through it. Hosted email blocked for the courts. A recovery-as-a-service evaluation run against the policy document with a specific clause cited back to the vendor. Facility selection turning on whether the room itself was certified. A later content management procurement for evidentiary material scoped the same way.