Communication, communication – and politics: Iowa saga of cuffed infosec pros reveals pentest pitfalls

It has been six weeks since Coalfire's Gary Demercurio and Justin Wynn were arrested in Dallas County, Iowa, while performing a paid-for security penetration test at a courthouse. Despite everyone acknowledging there was no foul play, the pair still face criminal charges. They deny any wrongdoing. The Des Moines Register (no …

[Sir Runcible Spoon]

Due diligence

Perhaps next time the pen test team might want to verify that their client actually has the authority to give them the go-ahead to break in. Not an easy one to solve however, and I can't see them being found guilty (the pen testers that is, not the court house people who authorised the test).

Still, it's a topsy turvy world so best of luck to them from across the pond.

[My other car WAS an IAV Stryker]

Re: Due diligence

It shouldn't be the pen tester's job to have to worry about political jurisdictions. The contract was with the State of Iowa (government body) and they were within the state of Iowa (geophysical region). One county's beef with the State shouldn't matter. Since when does the State not have jurisdiction within any/every county in said state?

[Mark 85]

Re: Due diligence

Well, that's not uncommon as local county cops usually have big egos and hate the city and state police and governments. One can almost hear the sheriff saying "Boys, you in a heap of trouble."

[Doctor Syntax]

Re: Due diligence

One can almost hear the sheriff saying "Boys, you in a heap of trouble."

Until the writ for malicious prosecution lands.

[Nathanwesley]

Re: Due diligence

That’s right and it’s crying shame not one cop in Iowa has any guts or balls to take the Dallas county sheriff to jail and book him in for what he done. This is another perfect example of how all cops are trash and we’re all human might I add so let’s hold the cops accountable for their misbehavior same as we would any human.

[Anonymous Coward]

Re: Due diligence

So you think the US government should be able to sign a contract that allows a private company to break into every state's governmental offices, or into every city's governmental, including local jails? I'm sure that would go over well with a Trump administration contract into New York, or if Obama's administration did that in Alabama.

Just because the counties are inside the state doesn't give the state COMPLETE jurisdiction over the counties. Should the state of Iowa also be able to allow private parties to break into the private homes of Iowa residents? Maybe the state thinks their security should be tested as well?

[Claptrap314]

Re: Due diligence

The states are the original sovereignties in this nation. They created the federal government to handle certain matters, and ceded certain authority to do so. In most states, counties are created by the state, and are a localized extension of it. In particular, no state needs the permission of the US government to sue the US government, but a county may well need the permission of the enclosing state to sue that state.

In other words, there is a REALLY good chance that the sheriff is full of it.

But in any event, arresting an individual and charging them with a crime that you KNOW will not stick is the very definition of oppression. This sheriff is on the wrong side of the bars.

[veti]

Re: Due diligence

"The state of Iowa" can't just grant permission to break into anything they like, just because it happens to be in Iowa. If I were an Iowan householder (read: voter), I'd want to be very clear about that.

In this case, it seems pretty clear that the sheriff's real target is the state-level officials who authorised the test. If he can establish that the guys who did the breaking-in were doing something illegal, then it follows that the people who commissioned them to do it were, at the very least, accessories to that. I don't know what local politics are in play, but I'm pretty sure that's the goal here.

[mmccul]

Re: Due diligence

Tell that to Nixon. Couldn't he authorize a breakin in the country of the United States?

County and state are different jurisdictions, and state governments do not own county buildings.

[Claptrap314]

Re: Due diligence

In many or most states, the counties are extensions of the state. While the county might own the building, the state "owns" the county.

[STOP_FORTH]

Caper movie

Sounds like a good plot for a novel or film?

Probably needs a cyborg from the future.

[Yet Another Anonymous coward]

Hoodie stock image drinking game

Every takes a shot

[0laf]

Hard to have a contingency for politics and bloody-mindedness. But the testers shouldn't be caught in the middle.

I would hope in the UK the Courts or the Procurator would have sense to see there would be no public interest in pursuing a case like this.

[AVee]

There was very little reason to cuff them and drag them into jail. And even less reason to keep them there, once the situation was clear. As such they where unfairly caught in the middle.

However, if the situation indeed is that they signed a contract with someone not allowed to authorize that test there is a public interest in pursuing it further. The question is if the pen-testers should have known this and/or had the obligation to make sure the people they where dealing with had proper authority. This is a very interesting one, you can't have random people be allowed to break in anywhere just because another random person signed a piece of paper. But there (probably) also is a limit to the amount of research you can reasonably expect a pen-tester to do before signing a contract. And behind that there is the question if the testers are personally responsible or if their employer is (as they signed the contract).

Having a judge rule on that might actually provide a clear framework which I'd say is useful for the pen-testers mostly.

[Anonymous Coward]

It's all government politics and asshole cops

The article makes it pretty clear, and from my experience in government, including with cops and courts (not as a criminal, mind), I have no trouble at all believing that this is all political, and these poor guys are caught up in bullshit not of their devising.

As another poster pointed out, since when does the state not have jurisdiction in a county? Also, under what statute were they charged? Probably the Iowa Criminal Code or some such which is, oh yeah, STATE law.

Hopefully this will end with the judge dismissing the charges and giving the idiot cop a good talking to from the bench.

Anonymous because I know too much about this kind of crap.

[chivo243]

petty skirmish

Just a bunch of willy wagging between the state and the county. Too bad these guys got caught in the crossfire.

[david 12]

can't find the iowa code

I haven't read the Iowa law. It's normally a defence against this offense that the persons had or reasonably believed that they had permission.

So... the prosecution knows they can't win this -- on appeal it will go to the state court that sent the men in. They aren't trying for a conviction. They are just trying to be assholes.

[iron]

> clear communication, clear guidelines, and clear plans for what to do in any scenario

Except none of that helps when you come up against a backwoods cop who wants to wave his gun and his dick around. Like the poor guys in question.

[Anonymous Coward]

Mens rea?

If this goes to court, wouldn't the prosecutor have to prove that the testers intended to commit a crime?

[Eclectic Man]

Conspiracy

I do hope the State Official(s) who signed the contract and set up the test have also been arrested for conspiracy to break into the court house. If not, then the local Sheriff would seem to be acting rather inconsistently.

[Grinning Bandicoot]

Where there's a will

If someone at the state level thought the situation out, the Sheriff's office after the alarm would have either stand by or assist in the testing. The people performing the test be deputized as special officers authorized to serve warrants and the department wishing the test gets a search warrant for some suspected violation that requires a no-knock stealth approach.

A legal break in!

[Nathanwesley]

Worthless

In the United States of America’s, it is illegal for any officer of the law to arrest anyone that they know is innocent. This is a prime example of this law and that sheriff should be made an example out of. Don’t let that sheriff get away with trampling your rights. Sue his sorry tail and the other officers who booked you in. Any officer in Iowa can make the arrest on that sheriff because what that sheriff did affects all Iowa residents. Shame on Iowa police for not doing their duty.