My experience from working in Police IT in a Police Force in Australia in revealed.. interesting practices,
(I wont relate the story of one squad having a roof bbq in front of mWave antennas.)
The various departments in the Crime dept. maintained their own databases of varying kinds, mostly access and excel.
Members tended to do two things:
dump stuff for analysis and manipulation
or keep personal/CI/ close hold or squad specific data and share it with other squad members.
I'm sure some bright spark has installed mysql to do precisely this
squads and members guard their own data jealously and regard it as assets and leverage.it accordingly
mainframe DB's (DB2/CICS/|IMS) had assigned DBA's and access to this data was audited
and acess to PI on the mainframe systems (and connections to RTA/power and gas Utility dbs police used to cross-check addresses)
was beginning to be policed and improper access sanctioned.
I know that a seven year audit trail of access to one mainframe db was kept and that traffic analysis on access patterns/logins.
would likely have been an obvious tool in tracing leaks.
As there have been recent convictions for acess to mainframe hosted PI by police members/civilan staff and also by
Federal public servants in tax and social services.. this probably accelerated the drawing in and
establishment of myriad data islands in an unmanaged or oversighted environment.