7 comments

  • ricree2 hours ago
    I remember reading about this when it first happened. Glad there was at least a somewhat positive outcome.<p>For reference, here is the HN thread shortly after the arrest: <a href="https:&#x2F;&#x2F;news.ycombinator.com&#x2F;item?id=21000273">https:&#x2F;&#x2F;news.ycombinator.com&#x2F;item?id=21000273</a>
    • lgats2 hours ago
      $600k for 6 years of legal battle and facing felony charges? no bueno
      • tptacek3 minutes ago
        This isn&#x27;t a felony case. In fact, I&#x27;m not sure it ever was? It&#x27;s not clear from their amended complaint, but they were ultimately charged with simple trespassing, a misdemeanor. Those trespassing charges were themselves dismissed a few months later.<p>What we&#x27;re talking about today is the resolution of what looks to me (not a lawyer) mostly like a defamation case. Were they defamed? Absolutely. The problem is, to get anything useful out of a defamation case, you need to demonstrate damages. They were accused of a crime --- per se defamation --- but the point of the suit is to recover damages.<p>I don&#x27;t want to be glib, and I&#x27;m very prepared to be wrong, but the Dallas County Courthouse Incident is likely one of the top 3 world events to have happened to both these pentesters. They&#x27;ve been cause celebres in the field for years and years. It might be pretty tricky to actually demonstrate damages.
      • Aurornis1 hour ago
        The 6 year, $600K lawsuit was something they initiated against the county.<p>The initial charges against them were initially dropped to misdemeanors and then dismissed entirely, but that was a separate matter resolved earlier.
      • edm0nd5 minutes ago
        I&#x27;d gladly take such a payout.<p>Split 2 ways, that is still 300k.<p>Parked in an investment at 5% a year, that&#x27;s an easy +$15,000&#x2F;year for the rest of your life.
    • unsnap_biceps2 hours ago
      Darknet Diaries did an interview with the two pentesters: <a href="https:&#x2F;&#x2F;darknetdiaries.com&#x2F;episode&#x2F;59&#x2F;" rel="nofollow">https:&#x2F;&#x2F;darknetdiaries.com&#x2F;episode&#x2F;59&#x2F;</a>
  • rappatic2 hours ago
    This happened in 2019. The wheels of justice turn very slowly.
    • tptacek40 minutes ago
      Certainly the wheels of civil suits do.
    • lazide1 hour ago
      Justice delayed is justice denied.
      • ddtaylor1 hour ago
        Two people for six years in that industry they probably lost a lot more than $600k.
        • IshKebab17 minutes ago
          I doubt they were out of work for that whole time.
          • tptacek10 minutes ago
            They were held for a total of 20 hours.
    • otikik1 hour ago
      Except for the wealthy, who can dial it up or down
  • Aurornis1 hour ago
    I&#x27;m glad the charges were dismissed, but to be honest the original reporting shows the story was actually more nuanced than this article led me to believe. 2019 article: <a href="https:&#x2F;&#x2F;arstechnica.com&#x2F;information-technology&#x2F;2019&#x2F;11&#x2F;how-a-turf-war-and-a-botched-contract-landed-2-pentesters-in-iowa-jail&#x2F;" rel="nofollow">https:&#x2F;&#x2F;arstechnica.com&#x2F;information-technology&#x2F;2019&#x2F;11&#x2F;how-a...</a><p>I&#x27;ll probably get downvoted for even questioning the narrative, but here are some of the nuances that stood out to me:<p>- When the police contacted someone listed on the authorization letter, that person denied that they had been authorized to conduct physical intrusions. Another contact didn&#x27;t answer their phone. What are the police supposed to do if the people supposedly authorizing the intrusion are actively denying the authorization?<p>- The contract had vague language that say they couldn&#x27;t &quot;force-open doors&quot;. The two men told police they had used a tool to open a locked door. The language should have been more specific about what was and was not allowed.<p>- The contract said &quot;alarm subversion&quot; was not allowed, but supposedly the police had evidence that they were trying to manipulate the alarm. They deny this.<p>- The men had been drinking alcohol before the break-in. By the time they were breathalyzed it was at 0.05, meaning the number was even higher when they started the break-in. Drinking alcohol before you do a professional job guaranteed to get the police responding is a terrible idea.<p>- After they tripped the alarm and the police showed up, they didn&#x27;t immediately identify themselves and end the exercise. They hid from the police, claiming that they were &quot;testing the authorities&#x27; response&quot; which seems obviously out of scope for their agreement.<p>So I agree that the charges were excessive and the Sheriff was in the wrong on a lot of things, but after reading the details this wasn&#x27;t really a clear cut case. The pentesters weren&#x27;t really doing everything &quot;by the book&quot; if they thought that testing <i>the police response</i> by hiding was in scope of their contract and doing this job after a few alcoholic beverages is a bizarre choice.
    • bink29 minutes ago
      I performed these types of physical pen tests years ago. If we were testing security for something like a courthouse we would&#x27;ve had a card on each of us with the personal cell phone number of the county clerk along with a statement of work that described exactly what we were authorized to do, with signatures. In some cases we&#x27;d have a backup contact number for more dangerous stuff. The idea that the emergency contact would not answer the phone would&#x27;ve seemed ludicrous. They were always aware of where we were and what we were doing at all times.<p>Damaging property was never approved. Drinking alcohol before a test would never happen. The insurance risk alone would&#x27;ve been nuts, not to mention the reputational damage if someone smelled it on your breath. Hiding from law enforcement? I&#x27;d need to know more about that. If a cop shows up with a gun you absolutely do not hide. If it&#x27;s a security guard on rounds and you&#x27;re waiting for them to move on... sure.<p>It was often dangerous though. Some security and law enforcement types take it personally that they&#x27;re being &quot;tested&quot; and do not react well. We always tried to have some former law enforcement or military with us because they were less likely to be targeted for abuse than us hackers&#x2F;nerds.
      • rainonmoon12 minutes ago
        &gt; If we were testing security for something like a courthouse we would&#x27;ve had a card on each of us with the personal cell phone number of the county clerk along with a statement of work that described exactly what we were authorized to do, with signatures.<p>You mean... the thing that they had? FTA:<p>&quot;Within minutes, deputies arrived and confronted the two intruders. DeMercurio and Wynn produced an authorization letter—known as a “get out of jail free card” in pen-testing circles. After a deputy called one or more of the state court officials listed in the letter and got confirmation it was legit, the deputies said they were satisfied the men were authorized to be in the building.&quot;<p>There&#x27;s also no indication that they damaged property (they used a UDT to trip a sensor to bypass the door). Neither of us were there, but based on the actual reporting it sounds like the worst anyone could accuse these people of being is stupidly unprofessional and bad communicators, which if you worked with pentesters shouldn&#x27;t seem like an unprecedented aberration.
    • arcfour1 hour ago
      I&#x27;m not saying it&#x27;s the most professional choice, but if I were about to burgle a courthouse as part of my work, I&#x27;d like a beer or two to calm my nerves beforehand.<p>Regarding force, this article says:<p>&gt; The rules of engagement for this exercise explicitly permitted “physical attacks,” including “lockpicking,” against judicial branch buildings so long as they didn’t cause significant damage.<p>And later that they entered through an unlocked door, which they (it sounds like) kept unlatched by inserting something between the latch and the doorjamb. Not unreasonable.
      • Aurornis1 hour ago
        &gt; I&#x27;m not saying it&#x27;s the most professional choice, but if I were about to burgle a courthouse as part of my work, I&#x27;d like a beer or two to calm my nerves beforehand.<p>This is a job where having impaired judgment is a terrible idea.<p>If someone needs alcohol to do a job that involves taking the role of a criminal and summoning the police, drinking alcohol before it is a terrible choice no matter how you look at it. If they can&#x27;t do the job without alcohol, they shouldn&#x27;t be doing the job at all. Maintaining unimpaired judgment is a baseline expectation for a job like this.
        • arcfour56 minutes ago
          I doubt judgement is heavily impaired at 0.05 BAC. That is at or below the legal limit to drive a car.<p>And it really is more of a red herring since they were obviously not visibly intoxicated and they didn&#x27;t actually do anything illegal. Their BAC is more of an issue between them and their employer, and has no bearing on their false arrest.
          • Aurornis51 minutes ago
            &gt; I doubt judgement is heavily impaired at 0.05 BAC. That is at or below the legal limit to drive a car.<p>0.05% BAC will result in a DUI in many countries. Regardless, any impairment on a job where you&#x27;re doing things guaranteed to summon the cops is a very bad idea.<p>BAC also declines linearly over time. I doubt (hope?) they weren&#x27;t drinking on the job, but a 0.05% BAC measured after their arrest means their BAC would have been higher when they started breaking into the building earlier in the night.
            • tptacek36 minutes ago
              Only Utah has a 0.05 standard. (I think drinking before a nighttime physical pentest is a bad idea).
              • shawn_w5 minutes ago
                Washington might be moving to 0.05 too. (A bill just narrowly passed the state Senate; still has to clear the state house)
          • janalsncm32 minutes ago
            &gt; I doubt judgement is heavily impaired at 0.05 BAC<p>Physical coordination becomes an issue. 70% of subjects tested struggled to maintain lane position at 0.02%.<p><a href="https:&#x2F;&#x2F;pmc.ncbi.nlm.nih.gov&#x2F;articles&#x2F;PMC102344" rel="nofollow">https:&#x2F;&#x2F;pmc.ncbi.nlm.nih.gov&#x2F;articles&#x2F;PMC102344</a>
            • arcfour24 minutes ago
              I don&#x27;t see how that relates to, say, software engineering or physical pentesting though. And 1&#x2F;3 people is still a fairly significant number that do not suffer ill effects. I also said <i>heavily</i> impaired—not that they were categorically not suffering from any effect of the alcohol.<p>My point is not that they definitely should have done it. It is simply that, in this context, it&#x27;s really not a big deal &amp; is not really germane to the discussion at all. They did nothing wrong, stone cold sober or not.
      • janalsncm35 minutes ago
        Is drinking common for physical pentesters? I just do boring software stuff but I’m pretty sure drinking on the job would be a fireable offense for me.<p>And even if their BAC was technically under the legal limit, their ability to e.g. drive was impaired. So it seems unprofessional.
        • arcfour26 minutes ago
          Their ability to drive being impaired is somewhat dubious since they are under the legal limit in all of the states I have heard of.<p>W&#x2F;r&#x2F;t drinking and working, I personally dislike the puritanical zero tolerance for alcohol approach that people here in the US seem to take by default. Most people can have one or two drinks and work just fine, with obvious exceptions.<p>I don&#x27;t think we should judge people who have to travel to a boring small town in Iowa and have to go to work in the middle of the night for having a drink or two.<p>If you can&#x27;t have just a drink or two, or have to do it every day, that&#x27;s a bigger issue that goes beyond work vs. simply having a drink and doing work on occasion.
        • IshKebab15 minutes ago
          &gt; I just do boring software stuff but I’m pretty sure drinking on the job would be a fireable offense for me.<p>What?? For real?
      • kstrauser59 minutes ago
        I&#x27;d have more &quot;eager&quot; than &quot;anxious&quot; nerves, and I wouldn&#x27;t need a beer for that. The fun thing about pentesting is that it doesn&#x27;t matter if you get caught, although it&#x27;s more fun if you don&#x27;t.<p>Hard agree about &quot;forcing&quot;, though. The very word implies, you know, non-trivial amounts of <i>force</i>. Like technically walking toward a door in a normal human room at standard temperature and pressure means you&#x27;re applying non-zero amounts of force to it, so arguments like &quot;they applied any force at all&quot; can be ignored as goofy.
    • 1970-01-011 hour ago
      The police settled for $600k, it wasn&#x27;t dismissed.
      • Aurornis1 hour ago
        The original charges against them were dismissed.<p>They brought a separate case against the police and were awarded $600K<p>Two separate legal matters for the same event.
        • 1970-01-0154 minutes ago
          Ok that makes much more sense
  • QuercusMax2 hours ago
    So... the county sheriff showed up, decided he needed to be a big boss man, and made everything worse for everyone. Sounds pretty typical.
    • Aurornis1 hour ago
      That was my first impression, but reading the original story from 2019 has a much less one-side pictures: <a href="https:&#x2F;&#x2F;arstechnica.com&#x2F;information-technology&#x2F;2019&#x2F;11&#x2F;how-a-turf-war-and-a-botched-contract-landed-2-pentesters-in-iowa-jail&#x2F;" rel="nofollow">https:&#x2F;&#x2F;arstechnica.com&#x2F;information-technology&#x2F;2019&#x2F;11&#x2F;how-a...</a><p>My other comment has more details, but a summary is that they the pentesters had been drinking before breaking into the building, were doing things that could be interpreted as being forbidden by their own contract, and the big one: The person listed on their authorization letter denied that they were approved to enter the building when called.<p>That last one is a big deal. If your own authorization contacts start telling the police you&#x27;re not authorized to be in the building, you&#x27;re in trouble.
      • janalsncm27 minutes ago
        Yeah I think that’s pretty useful context. I can understand arresting them and clearing it up with a judge in the morning. I can’t understand continuing to defame them as the lawsuit alleged.<p>If that’s all that had happened I’m guessing it would’ve avoided a lawsuit, since their purpose was to restore their reputational damage.
    • thinkingtoilet1 hour ago
      Exactly. A fragile man needed assert his authority.
      • mikkupikku15 minutes ago
        You don&#x27;t know the man, and you don&#x27;t know all of the details and nuances of the situation he was called into. How then do you think to judge him like that? You&#x27;re just stereotyping.
        • thinkingtoilet13 minutes ago
          I do know the details of the situation. And so did the jury who awarded them $600k.
    • petcat1 hour ago
      I might be mistaken, but it sounds like these guys showed up at a facility and did the classical &quot;breaking and entering&quot; thing. The onsite (terrified) staff called 911, the police showed up and arrested them. The perps said that they were <i>hired to do this</i> (they were), but nobody told the Sheriffs office or the staff about it.<p>So yeah, it sucks for these guys&#x27; reputations and criminal histories, but... what? The onsite staff didn&#x27;t know what was going on, the Sheriffs didn&#x27;t know what was going on.<p>The county basically said: &quot;We want you to go try to break into this government building. We aren&#x27;t going to tell the staff or the local police about it. Tell us what you find.&quot;
      • edm0nd1 minute ago
        why even bother commenting if you didnt even read the article. You just spewed out a bunch of bullshit nonsense of nothing that happened lol
      • unsnap_biceps1 hour ago
        you are mistaken. There was no (terrified) staff present. The building was empty and they tripped an alarm on entry.
      • wat100001 hour ago
        If the sheriff had found out what was going on and then let them go, this wouldn&#x27;t be news.<p>If the sheriff had arrested them and found out in the morning what was going on and then let them go, this wouldn&#x27;t be news.<p>If the sheriff had arrested them and brought them before a judge who let them go, this wouldn&#x27;t be news.<p>What actually happened is the sheriff found out what was going on, decided it was still criminal anyway, arrested them, and then the county charged and prosecuted them. The charges were eventually dismissed. <i>That</i> is why it&#x27;s news.<p>And icing on the cake, the current county attorney disagrees with the dismissal done by his predecessor, and says that he will prosecute any future incidents of this nature. <a href="https:&#x2F;&#x2F;www.kcci.com&#x2F;article&#x2F;coalfire-contractors-settle-dallas-county-lawsuit&#x2F;70179636" rel="nofollow">https:&#x2F;&#x2F;www.kcci.com&#x2F;article&#x2F;coalfire-contractors-settle-dal...</a>
      • noitpmeder1 hour ago
        Did you even read the article or review the story? The police showed up, reviewed and even verified their documents (called the numbers on the form to confirm their authorization) and we&#x27;re seemingly satisfied all was in order.<p>Only once the sheriff himself arrived on scene did he order the arrest that caused all the issues. If that didn&#x27;t happen it wouldn&#x27;t have been a story other than &quot;security professionals doing their authorized job&quot;.
        • Aurornis1 hour ago
          &gt; reviewed and even verified their documents (called the numbers on the form to confirm their authorization)<p>Apparently there&#x27;s more to this story. From the original article <a href="https:&#x2F;&#x2F;arstechnica.com&#x2F;information-technology&#x2F;2019&#x2F;11&#x2F;how-a-turf-war-and-a-botched-contract-landed-2-pentesters-in-iowa-jail&#x2F;" rel="nofollow">https:&#x2F;&#x2F;arstechnica.com&#x2F;information-technology&#x2F;2019&#x2F;11&#x2F;how-a...</a><p>&gt; Another reason for doubt: one of the people listed as a contact on the get-out-of-jail-free letter didn’t answer the deputies’ calls, while another said he didn’t believe the men had permission to conduct physical intrusions.<p>It&#x27;s actually kind of amazing that the police first let them go after the official contact on the form said they <i>were not</i> authorized to intrude in the building.
      • aksss1 hour ago
        Definitely some things could have been done a bit differently. I get that they want to keep staff in the dark, and even beat cops, but it seems reasonable and prudent to have the highest level of local law enforcement brought into the loop in planning red team exercises. The likelihood is high that the team will interface with law enforcement. The escalation path within the enforcement side of the state regulatory machine should be cleared in advance.<p>I think the takeaway for security teams is that you shouldn&#x27;t let the customer &quot;authorize&quot; what is otherwise criminal activity warranting a police response without getting some air cover from the enforcement side. Coordinating that is the customer&#x27;s burden to bear and that cover should be secured before letting them hand-wave away the risks with a &quot;just have the police call me and I&#x27;ll clear it all up&quot;. In hindsight only, when you look at it like that, the security team was not covering their ass appropriately. In a perfect world, you&#x27;d assume there&#x27;s some better planning and communication going on behind the curtain. In the real world, you need more than the flimsy &quot;guarantee&quot; of calling a guy who knows a guy in the middle of the night. At the very least, that get out of jail free card should have had as signatories judiciary representation and enforcement representation (e.g. sheriff).
      • sowbug1 hour ago
        &gt; I might be mistaken [snip].<p>FTFY<p>Also - a red-team exercise doesn&#x27;t work if you tell the targets that they&#x27;re about to be tested.
      • QuercusMax1 hour ago
        Did you <i>read</i> the article?<p>They broke in and set off an alarm, the local cops responded, the pentesters showed their credentials, and there was no issue.<p>Then the sheriff arrived, was butthurt because he felt left out and wanted to show his authority, and caused these guys 6 years of grief for literally no reason at all.
        • petcat1 hour ago
          &gt; the local cops responded<p>Extremely dangerous and irresponsible for the county not to alert the local police and Sheriffs office that this operation was taking place.<p>I&#x27;m glad these guys got their money.
  • OutOfHere2 hours ago
    For someone who is in such a position in the future, always notify the local police in writing and by phone call, if not also in person, before starting such an exercise. Make sure they have the get-out-of-jail documentation in advance of the exercise. If the police doesn&#x27;t approve, don&#x27;t do it. It would be better to get a no-objection letter from the police in advance. Make sure an attorney is aware of the activities and all documentation. Do not take any chances. You don&#x27;t live in a kind or forgiving world. Handling unknown unknowns is the point.
    • sehugg1 hour ago
      They had written authorization from the state court and verbal confirmation from state court officials. They didn&#x27;t know there would be a pissing match between the judicial branch and the sheriff.
      • 827a1 hour ago
        But afaik this wasn&#x27;t a state courthouse; it&#x27;s a county courthouse. Legally, obviously, the state has authority and they were in the right, but functionally this is really good advice: if you&#x27;re doing a penetration test of a space, you functionally need to clear it with the people who are responsible for the security of that space, and whom you might encounter defending it.<p>Frankly, I would not have taken this gig unless you had verbal confirmation that the Sheriff knows about it and has signed off. If you&#x27;re entering a red team situation where the State wants to assess the security of their county courthouses, but doesn&#x27;t want the local authorities to know its happening because they don&#x27;t trust them: That is <i>not</i> a situation you want to be in the middle of, they gotta sort that out.
        • jstanley1 hour ago
          Easy to say in hindsight.
          • aksss58 minutes ago
            Hindsight&#x27;s how we all learn. Doing it over again, I&#x27;m sure those guys would have done things differently. Any team would be crazy today to not be more prudent in how they operate.
          • OutOfHere1 hour ago
            Considering today&#x27;s world, they&#x27;re lucky they didn&#x27;t get shot dead with an entire clip.
    • Aurornis1 hour ago
      &gt; If the police doesn&#x27;t approve, don&#x27;t do it. It would be better to get a no-objection letter from the police in advance.<p>The article says they did have an authorization letter from the state court officials (the people running the building) and they were released right after the letter was verified with the court officials.<p>At least from what I can see, the police officers involved were doing the right thing. They detained the suspects, made a proper effort to listen to them and validate their story, and then released them.<p>It was the Sheriff who showed up and didn&#x27;t like it who then hassled them further.<p>They basically had a no-objection letter from the people in charge of the building and the police <i>officers</i> were onboard. It was one person who tried to turn it into something else.
    • xmcp1231 hour ago
      Wouldn’t that in a lot of ways invalidate the test?<p>You’re trying to see what can be done and what the response is from the current security practices and the police showing up seems like an important part of that.
      • OutOfHere10 minutes ago
        It is not clear what as the defined purpose of the test, if it was to measure a successful entry+exit, or measure police response, or both. If measuring the police response was a purpose, the police should still have been notified, just not of the exact date when it would happen. Executing it on a random day should offset the prior awareness of the police. Secondly, it is up to the police leadership to keep it quiet.
  • samrus1 hour ago
    I kinda hate that it settled. I fully understand the plaintiffs not wanting to proceed, but i really wish the sheriff was actually punished for what he did. This sort of power tripping should be a fireable offence
    • canucker20161 hour ago
      Sheriff Chad Leonard (queue chad references...) retired in 2022.<p>see <a href="https:&#x2F;&#x2F;www.desmoinesregister.com&#x2F;story&#x2F;news&#x2F;2022&#x2F;08&#x2F;29&#x2F;dallas-county-iowa-sheriff-chad-leonard-retires-early-term&#x2F;7927264001&#x2F;" rel="nofollow">https:&#x2F;&#x2F;www.desmoinesregister.com&#x2F;story&#x2F;news&#x2F;2022&#x2F;08&#x2F;29&#x2F;dall...</a>
      • justin661 hour ago
        It&#x27;s a pity the $600k won&#x27;t be deducted from his retirement income.
    • worik1 hour ago
      An elected officer. So punishment by ballot box?
      • simonw1 hour ago
        That thing where law enforcement officers can be elected is such a weird American oddity.<p>Most countries appoint law enforcement officers who are qualified for the job.<p>We had a problem last year here in San Mateo County, California where our sheriff was corrupt but we had to pass a ballot measure because we couldn&#x27;t just fire them: <a href="https:&#x2F;&#x2F;calmatters.org&#x2F;justice&#x2F;2025&#x2F;10&#x2F;san-mateo-sheriff-removed-from-office&#x2F;" rel="nofollow">https:&#x2F;&#x2F;calmatters.org&#x2F;justice&#x2F;2025&#x2F;10&#x2F;san-mateo-sheriff-rem...</a>
        • noitpmeder58 minutes ago
          Appointments are a whole other issue (see the extreme turnover in the American executive branch every 4 years). Id rather the head of my local police dept be significantly supported by the populating instead of an appointment from a governor, mayor, ... whose entire schtick can change on a dime.<p>Independent elections are a good thing. Bundling offices together under a single election that appoints the rest of the world is terrible and only leans further into the two party see-saw that exists in the USA.<p>I really wish for proportional representation. Not that it really applies to your local police force, but we need to break apart the complete A-or-B nature of American politics. Form coalitions, not monoliths that trade off earning 51% of the electorate every cycle.
        • wrs1 hour ago
          On the other hand, look at our current appointed DoJ and FBI leadership. No solution is foolproof.
        • toast01 hour ago
          In larger counties, the elected Sherrif is usually more managerial and less hands on. If not elected directly, the Sherrif would likely be chosen by the elected County Board of Supervisors. Which I guess gives you more ability to fire, but also means more indirection from the will of the people.
      • QuercusMax1 hour ago
        Since when are elected officials immune from prosecution for crimes?
        • mminer2371 hour ago
          Nobody was pressing (or even alleging) crimes by the sheriff AFAIK.
  • zerr1 hour ago
    Should have been at least 6 mln for each, and 15+ years of max security jail for those who abuse power, including those who &quot;just followed orders&quot;.