Georgia Attorney General's Office

The Georgia Department of Law represents the state's executive branch in court and prosecutes violent crime across it. The evidence it works from is not its own. It arrives from dozens of law enforcement agencies, lands in a system built by a third organisation, and has to be searchable, readable, redactable and defensible before any of it is useful.

Three Organisations, One Evidence Problem

Most evidence deployments involve a single agency. This one involves three, and the relationship between them shapes everything that follows.

The Georgia Department of Law is the office of the Attorney General. It is organised into an executive office, five legal divisions covering criminal justice, general litigation, commercial transactions and litigation, regulated industries and professions, and government services and employment, alongside specialty units for special prosecutions, Medicaid fraud, consumer protection and the Solicitor General. Each of the five divisions is subdivided again into sections supervised by senior assistant attorneys general, and an operations division carries IT, human services and the State Law Library.

The contributing agencies are the source of the evidence. Between 29 and 50 law enforcement agencies across Georgia supply material, depending on caseload.

The Georgia Technology Authority built the system it all lands in. GTA is the state's central IT and cybersecurity organisation, providing infrastructure, cloud services and shared enterprise technology to Georgia government entities. It developed LEMS, the department's evidence management system, running on AWS with content held in S3.

What LEMS Did, and What It Did Not

LEMS stored evidence reliably and securely. That is what GTA built it to do, and it did it.

What it lacked was everything that happens to evidence after storage. There was no playback, no advanced search and no analysis, so legal teams reached for other tools and manual effort to find and assess what they needed. There was no transcription, so a recording could only be reviewed by listening to it. There was no translation, so a document in another language was a document nobody could act on. And there was no redaction, which for a department whose evidence goes to court and out under records requests is a missing step rather than a missing convenience.

The department did not want a different evidence system. LEMS is where the evidence lives, the state built it, and replacing it to add capabilities would have been a disproportionate answer to the problem. What it needed was for LEMS to gain what it did not have while remaining the system of record.

Moving Multi-Gigabyte Evidence Without Moving It Twice

Evidence files here run to several gigabytes: body-worn footage of long incidents, multi-camera recordings, high-resolution imagery.

LEMS holds these in S3. Pulling a file of that size out of a bucket, across a network and into another system for processing is slow enough to change how the entire workflow feels, and multiplying that by the volume arriving from up to fifty agencies turns an inconvenience into the constraint that decides whether people use the system at all.

Ingestion pulls content directly from the bucket rather than routing it through an intermediary. Connector behaviour is scoped rather than pointed at everything: which paths are included and excluded, which extensions are accepted, whether the source hierarchy is preserved or flattened, and whether the source file is left in place, moved or deleted once it has been taken.

Results That Find Their Own Way Back

Processing evidence outside LEMS creates a second problem immediately. LEMS has to know what happened to it.

The department did not want its system polling for status, and it needed partial results to make their way back as they became available rather than only once everything finished. Webhooks answer that. The platform calls out to a customer endpoint when something happens, covering media actions, metadata changes, live sessions and workflow completion, so LEMS reacts to events rather than asking repeatedly whether anything has changed.

For an integration between a state-built system and a processing platform, that is what keeps both in step without either one having to own the other.

Making Evidence Searchable

Once evidence is ingested, AI processing gives the department what LEMS never could.

Audio and video are transcribed, so a recording becomes text that can be searched rather than a file that has to be listened to end to end. Content is analysed, tagged and categorised automatically, with keyword and label detection, so evidence can be retrieved by what is in it rather than by remembering where it was filed. Legal teams run advanced searches across the corpus in seconds instead of navigating between files and systems one at a time.

Evidence can also be annotated. Attorneys and contributing agencies mark the passages that matter, which turns a case file from something each person reads alone into something a team works on together.

Evidence in Languages the Reviewer Does Not Read

Evidence does not arrive in English simply because the court works in English.

The department receives documents in other languages, and a document nobody in the room can read is a document nobody can act on. It cannot be assessed for relevance, and it certainly cannot be redacted, because deciding whether a passage is exempt or whether a name belongs to a party or a bystander is impossible in a language you do not speak.

Two capabilities answer this together. Text in scripts beyond Latin is classified by script and routed to the recognition engine that handles it, so a document mixing scripts is read rather than partly missed. Then documents are translated with their layout preserved, so the translated text sits on the page in place rather than arriving as a detached block. A reviewer reads the translation without losing the visual context of the document it came from, which for evidence is not cosmetic: where something sits on a page is frequently part of what it means.

Translation runs on a local language model, so evidence is not sent to an external service to be read.

Redaction Before Evidence Leaves

Two exits from the repository need redaction, and they are the two that matter most. Evidence goes to court, where personal information not material to the matter has no business being submitted. And evidence goes out under records requests, where the department must release what it must release and withhold only what it is entitled to withhold.

Evidence arriving from dozens of agencies is video, audio, documents and images, frequently all attached to the same matter, so all four redact through one system against the same policy with one record of what was done. A document-only tool would cover the reports and leave the body-worn footage.

The harder category is bystanders. A recording made lawfully in public captures people with no connection to the case: someone crossing the street behind an arrest, a face at a window, a plate on a parked car belonging to a person who was never involved in anything. None of them are parties, none consented, and their presence in a released file is a disclosure the department never intended and cannot justify, because no exemption covers "we did not notice". This is also where manual review fails quietly. A reviewer watching for the subject of a case finds the subject; the misses are by definition the people nobody was looking at. Detection runs per frame and tracking carries the mask through movement, occlusion and re-entry.

Twelve to Fourteen Departments, Kept Apart

A department organised into five legal divisions, four specialty units and an operations division does not have one security posture. Medicaid fraud, consumer protection, criminal prosecution and general civil litigation handle different material under different rules, and the people working one should not be able to see the others.

The deployment runs twelve to fourteen separate portals. A portal is a self-contained space with its own users, content, branding, security policy and settings, so several departments operate on a single deployment without seeing each other.

That is a governance answer rather than a technical one. The alternatives are a separate deployment per division, which multiplies cost and administration, or one shared space with access controls layered on top, which holds until somebody configures a control wrong. Separating at the portal boundary means isolation is the default and access is what has to be granted.

Live Surveillance

The department also extended the deployment to live operations, installing cameras in high-crime areas so officers can monitor footage as it happens and store incident recordings for later. When an incident occurs, the relevant moment can be located in the footage rather than found by watching, which is the same search problem as the archive and the same answer.

What Changed

• Legal teams locate and review evidence through search and AI analysis instead of navigating files and systems one at a time.
• Evidence ingests automatically from S3 with its metadata intact, removing manual data handling from the process entirely.
• Documents in other languages are readable in English with their layout preserved, so they can be assessed and redacted rather than set aside.
• Video, audio, documents and images redact through one system before evidence reaches a courtroom or a requester.
• Over 100 users across multiple divisions reach evidence securely, in portals that keep divisions separate by default.
• LEMS remains the system of record, extended rather than replaced, with results returning to it by webhook as they are produced.

Why It Works

The state's system stayed the state's system. GTA built LEMS and Georgia owns it. It was extended, not migrated, which for a public body with custody obligations over criminal evidence is the difference between a project that can be approved and one that cannot.

The integration is event-driven in both directions. Content comes out of S3 directly, results return by webhook, and neither system waits on the other or polls it.

Language was handled before redaction rather than after. A document that cannot be read cannot be assessed or redacted, so recognition and translation sit upstream of every decision that follows.

The controls suit criminal justice material. Role-based access, MFA and SSO, encryption at rest and in transit, and audit logging on every action support the department's CJIS obligations, which is the baseline for any system holding law enforcement evidence.

Governance was designed in, not bolted on. Twelve to fourteen portals mean separation is the default state rather than the result of configuring access correctly every time.