Remember those infosec fellas who were cuffed while testing the physical security of a courthouse? The burglary charges have been dropped Criminal charges have been dropped against two infosec professionals who were arrested during a sanctioned physical penetration test gone wrong. On Thursday, the Des Moines Register – no relation – reported that a judge in Dallas County, Iowa, formally dismissed the third-degree burglary and possession of burglary tools …
An added rider on the contract along the lines of...
"In the event of arrest and/or legal charges in carrying out the contract, you agree to post bail, pay all legal fees and should this involve jail time agree to pay the professionals involved, directly, double time throughout their period of incarceration (calculated on an hourly basis) upfront, on the assumption no time off for good behavior is received. Hourly rate to be based on day rate divided by seven point five where appropriate."
That should cover the bare minimum.
The sheriff in question was out of the loop and claimed jurisdiction due to federalism (the building was of municipal jurisdiction, the state normally doesn't get involved in municipal matters under federalism). If you tried something like the above on him, he probably would've added additional charges, sued to have the terms declared null and void, and try to fine the people involved several times over.
That's the problem when you start dealing with government agencies: sovereignty gets involved (which means someone's going to claim overriding authority--that includes contracts).
That is partially true when dealing with the states and the feds. At the county and municipal level it is a bit different. How the various levels work together is governed by the state constitution and how much independence is granted by the state constitution. In some states, power is more centralized than in others. So what we would need to do to determine if the sheriff and county DA actually had the authority they claimed is read the Iowa Constitution and relevant state laws, something I have not seen anyone comment knowledgeably on. Given the outcome, I tend to doubt they had the authority they claimed.
I suspect the locals were kept out of the loop deliberately by the state partly because the state authorities probably did not think they are all that competent and because they wanted to see what would happen if the locals were caught napping.
Counties are not sovereign in the US. States are sovereign. The state court system set this up. It was a test of the state court's security. Therefore, the break-in was to a state court building, not a county or municipal court building.
It may have happened in the sheriff's physical jurisdiction, but he doesn't get to just make up law as he goes along, as much as he may like to. He had no legitimate authority to arrest those guys as soon as he learned that they had permission from the building's managers — the state court system.
The sheriff was probably upset that he wasn't in the loop, so he threw a tantrum that cost everyone a lot of money. But he has a point. He and the local police should have known what was happening. He just expressed his point in an infantile manner. He should be fined, have to pay everyone's legal expenses, be demoted, and feel lucky if he isn't sued for false arrest.
Considering how trigger happy US cops are, they are probably grateful this is the only problem they had to deal with. This is not a job I'd choose to do in the US of gun obsession!
(What skin colour were the info-sec people - I suspect pale otherwise there certainly would have been casualties!)
"[...] he doesn't get to just make up law as he goes along, as much as he may like to. [...] upset that he wasn't in the loop, so he threw a tantrum [...]"
Does this sound familiar to anyone? Societal norms are driven from top down.
Strangest thing is... if an employee had tripped the alarm in error, would they also "book em"? Technically an allowed/legal contracted employee tripping the alarm, even if "to test intrusion protection", is not a crime. So booking them starts a bad route.
No, it's established law that you can't contract for the benefit of a criminal party. You'd get laughed out of court if you tried to enforce a lot of those provisions. Legal costs and civil damages, maybe, but you can't contract for criminal fines, community service or jail time.
And unless that particular law is fucked up (which wouldn't be a surprise), you would be laughed out of court to argue for a "criminal party" where none exists - not according to any relevant judiciary.
Being arrested is not a crime in itself, nor does it prove criminal intent. So most of the clause proposed by the OP (apart from the jail time and actual crime-related legal sanctions) appears to be sound.
So let me get this straight. You enter into a contract with one party, to break into a building owned by a different party, and expect that contract to be honored? The stupidity wasn't the county sheriff. El Reg, these people were in the wrong, got caught, and should have paid for it.
None of the security professionals I work with were concerned about this incident, except in the form of the stupidity of Coalfire management.
Not all county jurisdictions are equal. Some municipalities don't have the ability to override the state like in this situation. It's understandable they got caught up in this, even if it could have been avoided.
Lest we forget, Sheriff Big Pants could have said "oh makes sense" and just left. The instigation was all due to not wanting the state to have its way, not because the guys were innocent or guilty. They were about to be sacrificed in the name of political bickering.
Why were these people in the wrong? If all the legal paperwork, signed off by what appears to be the state’s own legal mandarin seemed legit, then if laws were broken, why did the sheriff only go after the testers and ignored the rest of the chain of command that got to that point?
From the article, only the testers got time in the big house, not the DA’s office or the states judiciary who could be considered the brains - and the money - behind this conspiracy?
Well because it's legally very difficult to give someone authority to commit a crime.
In this case getting the sheriff to agree in advance would have prevented the issue that happened, but it would have been very hard to forsee that issue happening.
The other approach would have been to arrange a pardon beforehand.
Why do you think the "building [was] owned by a different party"? Previous El Reg reporting has been rather sloppy by referring to the courthouse's location rather than its judicial level.
I cannot imagine that the state court system would approve of testing of a county courthouse, unless they have an integrated system where county courthouses are also controlled by the state court system. In that case, the sheriff would still be in the wrong. Sheriffs do not control courthouses — judges do.
Be very, VERY careful about making absolutist claims in the middle of what is already a subtle problem of jurisdiction.
Judges certain control their courtrooms. But I would be utterly shocked if the rest of the building was not under the control of the sheriff--at the county level. For state courthouses, I would expect some version of a state marshal service to be in charge. Unless there is a contract with the county for the sheriff to do so.
And so on.
>make sure the federal authorities are aware of the existence of a legal penetration testing event
After this little SNAFU you'd involve yet another law enforcement agency with a completely different area of jurisdiction? Someone's a glutton for punishment....
Seriously, there's good grounds for thinking of the US as a sort of 'organized anarchy' because there really isn't a unified, top down, legal system with its enforcement arms. There are numerous agencies who's jurisdictions interlock and overlap. Its true that they usually cooperate -- commit an obvious major crime and all law enforcement will react the same way and cooperate with each other -- but there's no actual requirement for them to do this, its just that they have various agreements and practices that evolved over time. This, and the notion that what constitutes a violation of law is often open to opinion and negotiation, is a very good reason for anyone to avoid any dealings with law enforcement in the US unless they have to, especially if they're not a citizen.
As for the practicalities of this test, may I draw your attention to something called "Fast and Furious" -- aka "The ATF Gunwalking Scandal". Count the agencies involved.....
Presumably this is fully legit?
Y'know, the state wasn't spying on the locals, then covering it up?
Anyway. There were un-mitigating factors based on the contract:
"Earlier on the fateful day, the two security workers had gained access to the judicial buildings through an open door. The team locked the door and “intentionally tripped the alarm in order to test the security response”
For one thing, the test was supposed to take place in normal operational hours but took place after midnight.
Secondly, the two infosec pros had picked the locks of four courthouse doors and videotaped the contents on a judge’s desk, according to Leonard."
The two testers PLAYED A VERY VERY RISKY GAME !!!
Night guards in U.S. court houses CARRY GUNS !!! Nice large 9mm Glock 17s/19s/21s that go very well through much clothing! While the guard is supposed Observe, Record and Report, if they FEEL they are in danger those guards have EVERY RIGHT to fire away and we'd now be hearing news reports about two dead assailants shot after a cell was mistaken for a gun! AND because it WAS a trespass the legal case against the guard doing the shooting WOULD HAVE BEEN non-existent! It would be a straight NO CHARGES FILED against the guards and even a wrongful death suit by the families of the two could-have-been-dead infosec employees would have been dismissed outright!
Talk about STUPID !!!
What were they thinking? This is also IOWA !!! They could have been SHOT coming out of the courthouse by off-duty cops, other armed citizens or security guards from other buildings! Iowa is a Single Permit Required state in most cities. Just show up at the local sheriff's office to show'em your weapon and driver's licence and after 15 minutes for an online felony check, you get your card allowing you to open-carry or concealed-carry within city limits!
.
The Register 
Biting the hand that feeds IT
Copyright. All rights reserved © 1998–2024
