The Short Answer. In early 2024, attackers replaced the free, publicly downloadable JAVS Viewer installer on the Justice AV Solutions website with a tampered copy carrying malicious code. The issue was publicly disclosed in May 2024. Viewer software installed by JAVS technicians was never affected, and neither was the courtroom recording and capture platform. Three courts worldwide saw confirmed infections, and no court records or JAVS source code were taken. Since then, JAVS has removed software downloads from its open public website, moved distribution to its authenticated support portal, strengthened its code-signing process, and audited its current builds against their source code.
The news coverage was loud. When security researchers at Rapid7 flagged a tampered installer on the Justice AV Solutions public website, some outlets framed it as a threat to all 10,000-plus JAVS courtrooms. What actually happened was far narrower. The compromised file was the free public download of JAVS Viewer, the application courts and attorneys use to play back and review recordings. Copies of Viewer installed on court systems by JAVS technicians were never affected, and neither was the courtroom recording and capture platform courts depend on every day.
The investigation that followed, coordinated with federal cybersecurity authorities, confirmed that scope. Three confirmed infections worldwide, no court records touched, and no source code taken. Court administrators weighing any software vendor deserve that full account, along with a clear picture of what strong software supply chain security actually looks like.
What Software Supply Chain Security Means for a Court
Every application a court runs is assembled, not written from scratch. Modern software pulls in open source software, third-party libraries, and other software components before it reaches a recorder or workstation. The software supply chain is that whole path, starting at the source code and ending with the installer a court downloads.
Software supply chain attacks go after the weak points along that path instead of the finished product. The SolarWinds breach in 2020 is the example most people know, when attackers slipped malicious code into a trusted vendor’s update that shipped to thousands of customers. The 2024 incident was smaller and worked differently, a swapped download on a public website rather than a tampered build system.
Best Practices Courts Should Expect From a Software Vendor
Industry groups have turned these lessons into shared best practices. The Linux Foundation’s OpenSSF publishes Supply-chain Levels for Software Artifacts, a framework for tracing a software artifact to its source and proving it was not altered. SLSA focuses on build integrity and provenance. Together with related guidance such as NIST’s Secure Software Development Framework, it points to practices any software vendor a court might hire should follow:
- Software bill of materials (SBOM): a list of every component and open source dependency inside a software application, so a known problem can be found quickly. A software bill of materials makes that inventory auditable instead of guesswork.
- Software composition analysis: automated scanning of third-party dependencies for potential vulnerabilities.
- Code signing: a digital signature, like the DigiCert signatures JAVS uses on its files, that proves a download came from the vendor and was not altered.
- Access control and multi-factor authentication: limits on who can change source code, a CD pipeline, or a published download.
- Reproducible builds and continuous monitoring: rebuilding software from its own source and checking that the result matches, plus an ongoing watch for tampering.
What Happened in May 2024
In early 2024, attackers placed tampered copies of the free JAVS Viewer 8.3.7 installer on the public downloads page; one was downloaded as early as March 5. The files were signed with a code-signing certificate issued to an unrelated company, Vanguard Tech Limited, rather than to Justice AV Solutions, so they looked authentic at a glance. On May 10, 2024, security firm Rapid7 began investigating an alert at one of its own customers and traced it to that public download. Rapid7 alerted the Cybersecurity and Infrastructure Security Agency (CISA), which notified JAVS on May 15. The issue was logged as CVE-2024-4978.
JAVS pulled all versions of Viewer 8.3.7 from the public site, reset all passwords, and conducted a full internal audit of its systems in coordination with federal cybersecurity authorities. The company’s statement at the time said plainly that the malicious file “did not originate from JAVS or any 3rd party associated with JAVS.” Brian Green, Chief Operating Officer of Justice AV Solutions, described the same finding on camera, saying the tampered download “wasn’t in our corporate environment whatsoever” and that “there was nothing at JAVS that came in here and caused any issues.” The investigation backed that up, and the split between what was hit and what was not is sharp:
| Affected | Not affected |
|---|---|
| The free public download of JAVS Viewer 8.3.7 (installer 8.3.7.250-1) on javs.com | Viewer software installed by JAVS technicians, and the JAVS core courtroom recording and capture platform |
| Three confirmed infections worldwide, two in Kentucky and one in Canada | Source code, digital certificates, and internal systems |
| Two tampered installers, signed with a certificate issued to an unrelated company rather than to JAVS | Zero court records, any case data, zero courtroom recordings, and other sensitive data |
Some early coverage described the incident as a compromise of “JAVS Viewer 8” as a whole. In fact, only the tampered 8.3.7 installer files posted to the public downloads page were affected. Viewer installations performed by JAVS technicians, and every other Viewer release, were genuine.
What Has Changed Since
The fixes map directly onto the supply chain security practices above. Each one closes the specific gap the attackers used. The support portal sits behind multi-factor authentication, so a stolen password on its own will not unlock a download. Together, the steps in the table below route JAVS software through one verified channel and add checks across the software development lifecycle, which is how a vendor guards against software supply chain attacks without slowing a court down.
| Supply chain best practice | What Justice AV Solutions put in place |
|---|---|
| Control who can reach and change published software | Software downloads were removed from the open public page and moved to the authenticated support portal at support.javs.com, which requires multi-factor authentication. |
| Verify every software artifact is genuine | JAVS strengthened its code-signing process, so a court can confirm a JAVS installer is signed by Justice AV Solutions before running it. |
| Confirm builds match their source | A full internal audit verified that current builds match their original source code with no malicious code present |
| Protect the distribution point | The public website was hardened against unauthorized access and unauthorized modification of hosted files |
| Keep watching | Continuous monitoring and coordination with federal cybersecurity authorities continue. |
Reliability Built Into the Record Itself
The court record never lived in the affected download. JAVS recorders run on-premises inside the courthouse, so recordings and case data can stay entirely on hardware the court controls, including on-premises captioning for courts that want nothing to leave the building. Retention and backup follow the court’s own policies, because at that point the record is a non-proprietary file the court owns.
That same purpose-built hardware and software carries the accessibility tools courts rely on day to day:
- Assistive listening feeds for participants who are hard of hearing, with bench conferences automatically masked for privacy.
- Live AI translation into up to five languages at once, so a family member can follow a proceeding in their own language.
- Live captions and the courtroom video feed on any tablet or browser through Control Dock, for participants who are deaf or hard of hearing.
- Web-based access through JAVS Suite 9, so staff start a scheduled session from a browser in one click, with docket details pulled from the court’s case management system where integrated.
For a court facing the national court reporter shortage, the AV record runs as a headless system. Someone presses start at the beginning of the day and stop at the end, or Auto Start and Auto Stop handle it from the schedule, at a one-time system cost comparable to a single reporter’s yearly salary.
Andrew Green, President and CEO of Justice AV Solutions, puts the standard plainly. “Our reputation is everything.” More than four decades of courtroom work and more than 10,000 installations in 17 countries rest on it, and so does the way the company answered for 2024.
Talk to Justice AV Solutions About Your Courtroom
Courts weighing a courtroom recording partner can contact the Justice AV Solutions team for an assessment of their rooms. Ask about the JAVS Suite platform, the JAVS recorder lineup, and the FlexMic line built for courtroom voice clarity, and the team will walk through how a secure, court-specific system fits the way you make the record.