I obtained some interesting material through a Right-To-Know-Law request recently. This was material that I did not even request, however, I thought it was rather useful for anyone interested in the computer networks of the Pennsylvania State Police and other PA agencies. WARNING: I do not condone, nor am I supporting hacking, DoSing, signal jamming, or anything else that would be deemed illegal by the state of Pennsylvania. This is merely an analysis of research and theoretical based discussion.

With recent “enhancements” in technology, the Pennsylvania State Police now file all citations electronically through the TraCS (Traffic and Criminal Software) system. Yes, this may reduce a lot of overhead and manual data entry, however, it also introduces numerous security risks.

Here are the detailed steps that a trooper performs to create a citation in the TraCS system:

Pennsylvania State Police eFiling Work Flow

Step #1

• PSP Trooper initiates a traffic stop and begins the citation issuance process.
• The Trooper accesses the Pennsylvania State Police (PSP) Traffic and Criminal Software (TraCS) in their vehicle.
• Using the TraCS software, the Trooper enters information into the TraCS e-citation module.
• The Trooper then submits the citation electronically and provides a printed copy to the driver.

Step #2

• An electronic copy of the information submitted by the Trooper into TraCS is encrypted and sent over the Commonwealth 800MHz radio system to the TraCS application server at PSP.
• The information is stored in the PSP TraCS database.

Step #3

• The JNET Integration Bridge (JIBlet) monitors the TraCS citation database for changes.
• When updates are detected, JNET secures a copy of the information from the citation and passes it to the JNET – AOPC messaging queue.

Step #4

• The citation information is published to the AOPC Court Filing Server.
• AOPC validates that the information received from JNET is properly configured and formatted.

Step #5

• The citation information is then published to the work queue for the staff of the specific AOPC Magisterial District Judge (MDJ) who’s jurisdiction the citation was issued.

Step #6

• Each MDJ office has staff specifically responsible for checking and importing e-citation submission into their MDJ records management system.
• Once MDJ staff accepts and imports the citation, MDJ staff members proceed through their usual course of business in the processing and filing of the citation; including the scheduling of hearing dates for the defendant and/or payments accepted.
• The importation of the e-citation by the MDH staff replaces staff from having to manually enter in information from the physical citation that the Trooper would physical deliver to the MDJ office.

Refer to the Visio diagram below for additional network infrastructure and a visual view (click to view full size):

Granted, this is a fairly simplified view of their network infrastructure, but surprising none the less that they gave this to me, but not the records I requested. After viewing the steps and diagram, you’re probably already thinking of a few ways to hack a speeding ticket or another citation…well here’s a theoretical breakdown for you:

• Create an 800MHz jammer – Although this would be considered illegal, one can easily be made with basic electronics knowledge. All citation data from the trooper’s vehicle is sent over an 800MHz encrypted wireless radio network. Jam the signal and nothing is going to get sent. Granted, they most likely have some type of fail or batch processing system in place to send the data later (maybe not), but if you can jam all signals from being sent to or from a trooper’s vehicle, then they may just let you go thinking there is something wrong with their car or equipment.
• 800MHz receiver and sniffer – With a receiver and sniffer, theoretically you can capture the signals sent to and from the trooper’s vehicle to later analyze and attack their encryption method. Theoretically you can discover enough information to transmit false citation information and attack the TraCS application server directly.
• Denial of Service attack on JIBlet – It’s firewalled, but theoretically, you can perform a DoS attack on it so it would never pass any information onto the messaging queue or other servers further in the process.
• Data modification/corruption – Theoretically you could somehow modify the data that’s sent from JIBlet to the AOPC to make it so it is never valid and generates rejection messages.
• Social Engineering – This is probably the easiest attack as people are always the weakest link in any system. Social engineering attacks could be performed on employees of any of the agencies who maintain servers/data part of the citation filing process. Personally if I were to perform such an attack, I would most likely focus on the lower level MDJ offices and the AOPC to essentially delete the records for you. Existing backups and any replication of the data is unknown, but from my research and what was stated in other RTKL requests (probably lies), it is believed that only the local MDJ office stores the final citation information as the local courts are who you must request citation records from. Certainly, I am sure they would have copies of the data stored on the other servers it passes through, but they stated to me that “JNET does not keep/retain the information”. This depends on one’s definition of JNET, however, JNET is a network, which would consist of all the devices and servers connected to it. Apparently the Agency Open Records Officer of the Pennsylvania Office of Administration (the agency that controls JNET) thinks of it only as a communications signal not including any of the devices connected to it. Does not compute.