The speaker is contemplating whether to leave a hacker logged into a system to avoid missing out on information they need to catch the hacker, or to revoke their access immediately and eliminate the risk of further harm.
A security consultant recounts asking a monitoring company for help during an incident response with a police department - specifically, requesting logs, data, and malware samples in order to investigate. The company was initially hesitant to cooperate with the Secret Service but later relented once permission from relevant parties was confirmed.
The speaker shares their experience of how they dealt with unauthorized access to a remote desktop system and advises on the importance of having secure access to such systems, especially in the case of police departments or sensitive information.