8.1 Cybersecurity, Encryption & Access Control

8.1 Cybersecurity, Encryption & Access Control

Quick Summary: Modern court reporters operate as primary data custodians for sensitive, highly confidential legal proceedings. Protecting unedited notes, audio backups, and certified transcripts calls for full-disk encryption (BitLocker with a TPM, or FileVault), operating system hygiene (disabling SMBv1, host firewalls, prompt patching), long passphrases with multi-factor authentication, a trusted VPN on public Wi-Fi, and encrypted portals or SFTP instead of plain email attachments.

The Court Reporter as a High-Value Cybersecurity Custodian

The RPR job analysis task "Understand and maintain security of computers/information" (Domain 1) lists internet security and vulnerabilities, firewalls and antivirus software, personally identifiable and sensitive personal information, and secure file transfer protocols. Court reporters routinely capture and store trade secrets, grand jury proceedings, sealed depositions, medical records, and proprietary financial ledgers. A laptop stolen from a vehicle or compromised over an unsecured network can expose that information, and Provision 4 of the NCRA Code of Professional Ethics requires members to "preserve the confidentiality and ensure the security of information, oral or written, entrusted to the Member by any of the parties in a proceeding."

Securing digital court reporting assets requires an active, defense-in-depth posture spanning physical endpoint encryption, operating system hygiene, robust access controls, network communication defense, and cryptographic file transmission protocols.

---

Full-Disk Encryption (FDE): BitLocker & Hardware Security Modules

Standard operating system user passwords merely lock the graphical desktop interface; they provide zero protection if an attacker physically removes the hard drive or solid-state drive (SSD) and connects it to an external reader. Without encryption, notes files, job dictionaries, synchronized audio recordings, and draft transcripts can be read directly from the drive.

[Physical Theft of Unencrypted Laptop]
Solid-State Drive Removed  ──▶  Connected to USB Dock  ──▶  All Transcripts & Audio Read as Plaintext

[Physical Theft of BitLocker / TPM-Protected Laptop]
Solid-State Drive Removed  ──▶  Connected to USB Dock  ──▶  Unreadable Ciphertext Without the Key

BitLocker Drive Encryption Architecture

On Windows CAT workstations, BitLocker is Microsoft's built-in full-disk encryption (FDE):

• Cryptographic Standards: BitLocker employs Advanced Encryption Standard (AES) in Cipher Block Chaining (CBC) or XTS mode with 128-bit or 256-bit keys; current Windows versions default to XTS-AES 128-bit, and administrators can require 256-bit.
• Trusted Platform Module (TPM 2.0): BitLocker integrates with a dedicated hardware microchip mounted on the motherboard called the TPM (Trusted Platform Module). The TPM stores the volume master encryption key securely in hardware and performs cryptographic platform integrity measurements. If the laptop's boot loader, firmware, or hardware configuration is tampered with, the TPM refuses to release the decryption key.
• Pre-Boot Authentication: Higher-security configurations add a startup PIN or USB startup key before Windows loads, which helps defend against some attacks on the boot process.
• BitLocker To Go: Extends AES encryption to removable storage media, including USB flash drives and external backup solid-state drives. Reporters who carry backups or exhibit scans on thumb drives should encrypt those drives so a lost drive does not expose them.

macOS FileVault

On Macs, FileVault encrypts volumes with the AES-XTS algorithm. On Macs with Apple silicon or the T2 Security Chip, FileVault key handling takes place in the Secure Enclave, so the encryption keys are not exposed directly to the main processor.

[!IMPORTANT] The BitLocker Recovery Key Protocol: When full-disk encryption is enabled, an emergency 48-digit numerical Recovery Key is generated. Store this recovery key in a secure location (such as an encrypted cloud vault or physical fireproof safe) completely separate from the laptop bag. If firmware updates or motherboard replacements trigger BitLocker recovery mode, the data is permanently unrecoverable without this numerical key.

---

Operating System Hygiene & Endpoint Security Hygiene

Protecting the court reporting workstation requires continuous defensive maintenance of the underlying operating system environment.

+-----------------------------------------------------------------------------------------+
|                         Court Reporter Endpoint Defense Baseline                        |
+-----------------------------------------------------------------------------------------+
|  1. Full-Disk Encryption     : BitLocker (XTS-AES) + TPM                                  |
|  2. Protocol Hardening       : Permanently disable legacy SMBv1 file-sharing            |
|  3. Host Firewall Defense    : Windows Defender Firewall blocking unsolicited inbounds  |
|  4. Endpoint Protection      : Real-time EDR / Next-Gen Antivirus with behavioral scans |
|  5. Patch Management         : Rapid deployment of OS and CAT software security updates |
+-----------------------------------------------------------------------------------------+

Disabling SMBv1 (Server Message Block Version 1)

One of the most critical protocol hardening steps on a legal reporting computer is the permanent deactivation of Server Message Block version 1 (SMBv1):

• Vulnerability History: Developed in the 1980s, SMBv1 is an archaic local network file-sharing protocol that lacks modern cryptographic message signing and buffer overflow protections. In 2017, the WannaCry and NotPetya outbreaks used the SMBv1 exploit known as EternalBlue to spread across networks.
• Current Guidance: Microsoft recommends keeping SMBv1 disabled, and it is not installed by default on current Windows versions. Office file sharing should use SMB 3.x, which supports encryption and pre-authentication integrity checks.

Local Host-Based Firewalls

A properly configured host firewall (e.g., Windows Defender Firewall) inspects all incoming and outgoing network traffic packets against predefined security rules:

• Default Inbound Posture: Block unsolicited inbound connections, especially on the Public network profile.
• Realtime Port Isolation: When configuring CAT software for wireless realtime output over local IP sockets, reporters should open only the ports the realtime software needs and, where possible, limit them to the private realtime network.

Antivirus vs. Endpoint Detection and Response (EDR)

Traditional antivirus software relies on static signature files to detect known malware. Many firms now use Endpoint Detection and Response (EDR) or next-generation antivirus, which adds:

• Heuristic & Behavioral Analysis: Monitors active running processes for anomalous actions, such as an unknown script attempting to read CAT dictionary files or encrypt multiple transcript directories simultaneously.
• Ransomware Protection: Some products watch for mass file encryption (for example, with hidden decoy files) and can stop the process and isolate the computer.

---

Password Entropy, Access Control & Multi-Factor Authentication (MFA)

Weak, recycled, or predictable credentials remain the primary attack vector used by malicious actors to compromise cloud transcript repositories, email accounts, and legal portals.

Password Entropy & NIST SP 800-63B Guidelines

The National Institute of Standards and Technology (NIST) Special Publication 800-63B (Revision 4, August 2025) sets authentication guidelines for federal systems that are widely used as a model elsewhere:

Entropy: Password strength can be measured in bits of entropy, the base-2 logarithm of the number of equally likely possibilities. Each word chosen at random from a 7,776-word list adds about 12.9 bits, so four random words give about 52 bits and six give about 78 bits. A short password built from a predictable pattern is far weaker than its symbols suggest.

Multi-Factor Authentication (MFA) Mechanisms

Court portals, cloud backup accounts, and email should be protected with multi-factor authentication, which combines at least two different factors: something you know (passphrase), something you have (hardware token/authenticator), or something you are (biometrics).

[MFA Security Hierarchy]
1. Hardware Security Keys (FIDO2 / WebAuthn / YubiKey)  ──▶  STRONGEST (Phishing-Resistant)
2. Software Authenticator Apps (TOTP - RFC 6238)        ──▶  STRONG (Time-based One-Time Codes)
3. SMS / Voice Call Verification Codes                  ──▶  WEAKEST (NIST "Restricted"; SIM-Swap Risk)

• Software Authenticator Apps (TOTP): Applications such as Google Authenticator, Microsoft Authenticator, or Aegis generate dynamic, six-digit time-based one-time passwords (RFC 6238) every 30 seconds. Because codes are generated locally via a shared secret key, they cannot be intercepted over cellular radio networks.
• Hardware Security Keys (FIDO2 / WebAuthn): Physical USB or NFC security keys use public-key cryptography tied to the real website's address, so a look-alike phishing site cannot reuse the login. This makes them phishing-resistant.
• The Insecurity of SMS 2FA: NIST classifies authentication through the telephone network (SMS or voice codes) as "restricted," and security agencies such as CISA urge phishing-resistant MFA instead. Attackers can use SIM-swapping attacks (bribing or deceiving mobile carrier staff to reassign a victim's phone number to an attacker's SIM card) or intercept cellular traffic via SS7 telecommunications vulnerabilities.

---

Wireless Vulnerabilities: Public Wi-Fi & VPN Encryption Tunnels

Court reporters frequently work in mobile environments—courthouses, hotel conference rooms, deposition suites, and airports—connecting to public or shared local area networks.

The Dangers of Public & Courthouse Wi-Fi

Unencrypted or shared public Wi-Fi networks present severe attack vectors:

• Packet Sniffing: Attackers on the same unsegmented wireless network running promiscuous packet capture software (e.g., Wireshark) can capture unencrypted traffic traversing the airwaves.
• Man-in-the-Middle (MitM) Attacks: A malicious actor positions their computer between the court reporter's laptop and the internet gateway, intercepting, inspecting, and altering data streams.
• Rogue Access Points & "Evil Twins": An attacker configures a portable wireless hotspot broadcasting the exact Service Set Identifier (SSID) of the venue (e.g., Courthouse_Guest_WiFi or Marriott_Conference). The reporter's laptop automatically connects to the rogue AP, routing all transcript uploads directly through the attacker's monitoring proxy.
• ARP Cache Poisoning & DNS Spoofing: Attackers broadcast fraudulent Address Resolution Protocol (ARP) packets across the local subnet, redirecting the reporter's outbound web requests to spoofed malicious servers designed to steal authentication tokens.

Virtual Private Network (VPN) Encryption Tunnels

When a reporter connects to an untrusted or public network, a trusted Virtual Private Network (VPN) adds a layer of protection before opening email or transmitting files.

[Public / Courthouse Wi-Fi Environment]
Court Reporter Workstation  ──▶  [Public Access Point (Untrusted / Eavesdroppers)]
           │                                                │
           ▼                                                ▼
  Encrypted VPN Tunnel                             Raw Packets Opaque
  (WireGuard / OpenVPN AES-256)                    (Intercepted Ciphertext Only)
           │
           ▼
[Secure Enterprise VPN Gateway]  ──▶  [Internet / Court Servers / Cloud Repository]

• Full-Tunnel Architecture: A full-tunnel VPN (as opposed to split tunneling) sends all network traffic—including Domain Name System (DNS) lookups, email synchronization, and cloud CAT backup syncs—is encapsulated inside an encrypted tunnel and routed to the secure VPN gateway before entering the public internet.
• Modern VPN Protocols: Modern secure VPN implementations utilize WireGuard (utilizing ChaCha20 encryption and Curve25519 key exchange) or OpenVPN (utilizing AES-256-GCM over TLS). Obsolete protocols such as PPTP (Point-to-Point Tunneling Protocol) should not be used.

[!WARNING] The Free VPN Trap: Be wary of "free" consumer VPN services. Some have made money by logging browsing activity, injecting ads, or selling data. Use a firm-managed VPN or a reputable provider whose privacy practices have been independently audited.

---

Secure File Transmission: SFTP & Client Portals vs. Unencrypted Email

Delivering completed transcripts, certified exhibits, and audio recordings to litigators, judges, and court reporting agencies is a critical point of exposure.

The Fatal Security Flaws of Standard Email Attachments

Sending confidential transcripts or rough drafts as ordinary email attachments has real weaknesses:

1. Lack of Enforced End-to-End Transit Encryption: Standard email was engineered in the 1980s without inherent encryption. While modern email servers attempt to negotiate opportunistic Transport Layer Security (STARTTLS), if an intermediate mail exchange server does not support TLS, the email silently drops back to cleartext transmission.
2. Multi-Server Cleartext Storage: An emailed transcript does not travel directly from sender to recipient. It traverses multiple intermediate Mail Transfer Agents (MTAs), and copies can be retained on mail servers, backups, and relays outside the reporter's control.
3. Zero Access Revocation & Auditability: Once an unencrypted email attachment is sent, the sender cannot revoke access, recall the file, verify who viewed it, or enforce data deletion if sent to an unintended recipient.

Secure Transmission Alternatives

Enterprise Encrypted Client Portals

Many firms deliver transcripts through an HTTPS-based encrypted client portal:

• Authenticated Access: Litigators log in using individual, authenticated credentials protected by multi-factor authentication.
• Role-Based Access Control (RBAC): Access permissions are strictly segregated. Plaintiff's counsel can only view depositions taken in their specific case, while transcripts designated under protective orders as "Confidential - Attorneys' Eyes Only" are restricted strictly to authorized trial attorneys.
• Audit Logging: The system keeps an audit trail recording every transaction: the exact user account, IP address, timestamp, and specific file viewed or downloaded.
• Dynamic Access Expiration & Watermarking: Download links expire automatically after a specified duration (e.g., 14 days), and document viewers can apply dynamic, user-specific background watermarks to discourage unauthorized transcript leakage.