12 ms·
Men Arrested at Courthouse Say They Were Sent to Test Its Security
- ptah 7y agoi can just imagine the scene: cops: you are under arrest for breaking and entering. pentester: we were just checking your security. you passed! congratulations! sorry couldn't resist /getscoat
- pstrateman 7y agoSounds like they were authorized and the court administration just made a mistake in the contract.
- gtirloni 7y ago> and possession of burglary tools Is that a crime? Like picks and stuff?
- casylum 7y agoEach state is different: https://toool.us/laws.html https://toool.us/laws.html
- elif 7y agoKevin mitnick's business card has a popout lockpick in it. He came to give us a talk, and gave out cards afterward. Later, I learned we all committed crime that day.
- driverdan 7y agoAnything used to commit burglary is a burglary tool. A hammer, screwdriver, picks, etc.
- diablerouge 7y agoThat varies by state and circumstance. In some states it's legal to own them, but if you are caught using them or being somewhere you shouldn't be while carrying them it can be tacked onto your charges. Other states it's totally illegal to own or carry them.
- Sebguer 7y agoDepends on the state. I believe in some states it's legal so long as you're not actively engaged in a crime, but becomes illegal if you get caught with them in a criminal act, even if they weren't directly related to the criminal act? Edit: People REALLY like answering this question, apparently. :D
- leetrout 7y agoLOL yea I noticed that too and took a screen shot of all of us with "0 minutes ago"
- busterarm 7y agoI do locksport and breaching for fun (in a safe, legal manner) and I live here in NY. Certain tools only have a purpose for forced entry, like the shove it tool and halligan bar. If you are caught with such tools and are not a first responder, you will be treated as a burglar and in all likelihood successfully prosecuted.
- ineedasername 7y agoIt seems odd. A halligan bar is basically a hybrid between a large crow bar and a pick axe. Seems strange for a sort of multi-tool to be illegal when its individual components are just fine (and equally up to the breaking -> entering job)
- rootusrootus 7y agoYeah I can't find anything at all about possession of such a tool being illegal by itself. In Oregon, our law is very specific that possessing burglary tools is only illegal when you intend to use them to commit burglary, or know that someone else intends to use them for it.
- leetrout 7y agoIn most states, unless you are a locksmith, yes it is a crime.
- lawnchair_larry 7y agoIn most states, no, it is not a crime unless intent to burglarize can also be demonstrated. Simply having them or using them where you have permission is fine.
- alasdair_ 7y ago>In most states, unless you are a locksmith, yes it is a crime. This is not true. Only nine of forty one states make lockpicks illegal. https://tihk.co/blogs/news/116232133-lock-pick-legality https://tihk.co/blogs/news/116232133-lock-pick-legality
- rhinoceraptor 7y agoThey're not illegal in any state. They become illegal when used in a crime, but then so does a crowbar. A few states consider them evidence of criminal intent, so you'd have to provide evidence to the contrary.
- toomanybeersies 7y agoIt's a crime if you're found in possession with intent to commit a crime: https://aizmanlaw.com/possession-of-burglary-tools/ https://aizmanlaw.com/possession-of-burglary-tools/ Depending on the state, owning lock picking equipment without a licence is also illegal.
- olliej 7y agoOh yeah the law has all sorts of things to increase charges. In some jurisdictions having a crowbar while “committing a crime” turns the crowbar into a burglary tool. Better yet: having a burglary tool can count as evidence you were committing a crime (see an interesting bit of logic there?) Or CA using possession of condoms as evidence women were sex workers. Immediately resulting in a reduction in use of protection (remember the anti-prostitution laws are all in the interests of “public safety”). Literally the interpretation of reality chosen was one where if a woman in a specific location had a condom they were automatically a sex worker, carrying evidence of sex work.
- luxuryballs 7y agoIn some states I feel like they just thought “well we can’t just keep letting these guys off when we catch them before actually picking the lock” so they made the lock picks illegal.
- sandworm101 7y ago>>> Mr. Demercurio told the deputies that part of the job was to “check out law enforcement response time,” the documents say HA! There is nothing that cops like more than to participate in random timed response tests. I cannot imagine anything worse that one could ever say to a cop. Even if it is true, do not ever admit that you are "testing" police, not to the overworked, under-staffed and generally frustrated officers who are stuck working the night shift.
- olliej 7y ago... especially when they are trigger happy and don’t experience consequences for shooting people
- qzx_pierri 7y agoyou didn’t need to take it there
- WaxProlix 7y agoGP made a point of talking about how overworked and aggrieved the cops tend to be, which is a talking point among thin blue line types; I didn't necessarily read anything into their statement other than maybe wondering about how true it is (IME cops more-or-less tend to be well compensated and work reasonable hours, due to strong unions and cultural priorities) -- but I can see where someone would read more into it.
- sandworm101 7y agoWhether the cops are actually overworked or not doesn't matter. If the responding officers think themselves overworked, they will react negatively to being tested. What matters isn't reality but how they think of themselves.
- journalctl 7y agoToo bad the people who got shot aren’t here to offer up their opinions.
- aaron695 7y agoIt is confirmed(allegedly) they also broke into Polk County Courthouse two days earlier - https://www.desmoinesregister.com/story/news/crime-and-courts/2019/09/16/iowa-polk-county-courthouse-dallas-burglaries-linked-same-two-suspects-judicial-branch-coalfire/2343135001/ https://www.desmoinesregister.com/story/news/crime-and-court...
- np_tedious 7y agoI'd be very interested to learn who hired them / their firm. Hope we find out!
- lalaithion 7y agoWe know who hired them. Read the article. Iowa’s State Court Administration contracted with Coalfire, of which the two men are employees.
- np_tedious 7y agoDoh. I skimmed the article and missed that. Thought they might have a common client for both Iowa and Texas and therefore it was likely to be something federal / higher up. Thanks for correcting
- ummonk 7y agoSo from the sounds of it the courts hired coalfire to do pen testing but neglected to mention it should be electronic only so they attempted physical access?
- scott113341 7y agoReminds me of this story posted a while ago: Story of a failed pentest https://news.ycombinator.com/item?id=18475438 https://news.ycombinator.com/item?id=18475438
- userbinator 7y agoWell, I guess the (physical) security has been tested and found acceptable.
- jcrawfordor 7y agoIt's extremely important to include a clear statement of work in any pentesting contract exactly for this reason. The contents of the contract will become very important in this case, and depending on whether or not the SOW included physical intrusion into the buildings, one side or the other will end up with egg on their face. Without the contract and/or other agreements it isn't clear who's at fault here, the pentesting firm involved may very well have been an incompetent one that exceeded their SOW or did not even produce one to be agreed on--and I tend to suspect that this is the case, because physical intrusion testing will almost always include measures to prevent the police being called or make them aware of the test due to both the expense of an intentional false alarm call and the risk involved in triggering a law enforcement response.
- arcticfox 7y agoThis is such an absurd case on so many levels. This miscommunication should have never happened, obviously. Even if they turn out to be the criminally incompetent party in this relationship, I feel kind of bad for the contractors. They're facing felony charges for making what was clearly a mistake. I can't imagine they're consistently this incompetent - surely one of their previous clients would have noticed if they were physically broken into and didn't anticipate it. So either they've never done this before, or they messed up their contract. I've seen plenty of similarly boneheaded, incompetent things in Big Tech (losing massive amounts of data, getting systematically defrauded in pretty stupid ways, etc) that resulted in getting fired at worst and a reprimand at best, so I feel kind of bad that these guys face felonies for being bad at their job.
- dannyw 7y agoAmazed they are charged. Any good lawyer should be able to get them off on mistake of fact, of simply lacking the elements of the crime.
- shawxe 7y agoYeah, not a lawyer outside of my armchair, but I don't really see how they could ever be convicted of any of this. It sounds like there's a very good chance they were contracted by a legitimate security auditing firm to do a job of a nature they had no reason to believe was not already outlined some statement of work agreed upon by all parties. Even if there was some misunderstanding, it sounds like the fault lies with the firm rather than with the contractors themselves. Obviously there are more facts that would need to be reviewed to come to definitively arrive at a conclusion like this, but at a glance this whole thing seems ridiculous.
- Ice_cream_suit 7y agoThey appear to be employees of Coalfire Labs. "The State Court Administration hired Coalfire Labs to test the security of the court’s electronic records, said Steven Davis, a spokesman for the state judicial branch." Mr Demercurio's LinkedIn page appears state that he employed by that organisation. I understand that hubris is followed by nemesis...
- Mathnerd314 7y agohttps://www.coalfire.com/Solutions/Coalfire-Labs/Red-Team-Exercise https://www.coalfire.com/Solutions/Coalfire-Labs/Red-Team-Ex... does list physical testing, but who knows what the agreement was. The case numbers are 05251 FECR042175 and 05251 FECR042176 if anyone's interested: https://www.iowacourts.state.ia.us/ESAWebApp/DefaultFrame https://www.iowacourts.state.ia.us/ESAWebApp/DefaultFrame. The latest appears to be that this guy is representing them: http://www.grllaw.com/blog/attorneys/Matthew-Lindholm-A3.aspx http://www.grllaw.com/blog/attorneys/Matthew-Lindholm-A3.asp...
- vivekd 7y agoHere in Canada the prosecution would have quickly withdrawn the charges. It's pretty clear that they were acting under the color of law, given that the State admitted they hired them. If they went beyond the contract, it seems pretty clear they did it under the mistaken but reasonable belief that they had proper authority to enter. I understand ignorance of law isn't a defense but ignorance of the facts is and it seems pretty clear that's what happened here. It seems unreasonable and unnecessary to hold them in jail and unnecessary to take this to trial. I don't see how proceeding with a prosecution like this could be in the public interest.
- peteretep 7y ago> Here in Canada the prosecution would have quickly withdrawn the charges There in Canada, prosecutors are not elected, because that would be completely batshit insane.
- shkkmo 7y agoI've up-voted this because I agree with you that the election of prosecutors (and judges) is a bad idea. I suspect you are getting down-voted mostly due to your poor choice of terminology.
- C1sc0cat 7y agoIt is because they are being "Canada Nice" :-) "fucking Batshit Insane " is what they should have said.
- ineedasername 7y agoThey "did not intend, or anticipate, those efforts to include the forced entry into a building" Isn't that the point of the test? If you thought you were properly anticipated all attack vectors you wouldn't need the test. Or if you did, it would be to find out if you were right. It will be interesting to see what the actual RFP or statement of work said on the matter though. If it was specific in mentioning only electronic methods, that's a problem. It doesn't seem like it should be a "Charge them with felony burglary" problem though. More like "make them pay damages" (if any)
- dmix 7y agoThe court is claiming it wasn't a prearranged part of the test that they were aware of. It will be up to the company to prove that it was. > But it added that the administration “did not intend, or anticipate, those efforts to include the forced entry into a building.” It's possible they misunderstood something in the contract such as what physical entry means and the scope of red teaming. In the article it said they were aware of a forced entry made at another court house, but I'm assuming it was after the fact and the security company told them they did it before? If it was before the test then that changes the story but I dont know why they'd admit it to the press otherwise. > Iowa’s State Court Administration also said in the statement that it had been made aware of a break-in at the Polk County Historic Courthouse in nearby Polk County on Sept. 9 that was similar in nature to the break-in at the Dallas County Courthouse. The fact they courts aren't fully supporting the guys raises a lot of questions. It's not like the guys were caught doing anything for personal gain. But there's a small possibility they wanted to show off their ability and keep it hyper realistic, and crossed a lined that should have been better communicated.
- ineedasername 7y agoThe court is claiming it wasn't a prearranged part of the test that they were aware of. It will be up to the company to prove that it was It should be pretty straightforward to determine if the contract explicitly specified electronic penetration or left some ambiguity. Unfortunately it looks like they won't release the contract so we won't know. (I'm sure the defense will get to see it, unless they go to Kafka land, though presumably they also wouldn't have charged these guys if there was such a large hole in the contract language.)
- dmix 7y agoI'm curious, couldn't they have warned the police or alarm security company ahead of time so they dont get accidentally shot by confused responding police? Or were they so confident/cocky that they assumed this wasn't a possible outcome? At a minimum you could warn the top managers the night in question. Especially at a serious government building that's typically always has law enforcement during the day as security there in important. As opposed to some mid-level corporation office which they'd normally hit up. Some precautions in the situation just sound prudent.
- kevin_thibedeau 7y agoThe police aren't supposed to be shooting unarmed people.
- markovbot 7y agoThat's never stopped them before
- frankharv 7y agoExactly. Police killed an innocent man with no gun and won't even charge the policeman who opened fire. https://www.usatoday.com/story/news/nation/2019/09/15/casey-viner-ohio-gamer-prison-swatting-call-of-duty/2336255001/ https://www.usatoday.com/story/news/nation/2019/09/15/casey-... Heck, the state will not even tell the cops name who executed a civilian at his own door.
- giancarlostoro 7y agoIf that had been in Florida it would of been revealed.
- edoceo 7y agoFalse. Some un-armed have been shot. I've had police point guns at me and I'm not shot, same with the folk I was with - mixed racial group, Oakland, CA, c1995, 1997, 2001 E: oh yeah, and I've seen Seattle police draw but not fire on many occasions. Most recently was a few months ago, chasing a dealer up my street and hiding in the stairwell just outside my place. E2: also, this is not the place for it - like all the other flagged comments
- doctor_eval 7y agoSuccessful test!!
- mythrwy 7y agoWhat a surreal article. `the administration “did not intend, or anticipate, those efforts to include the forced entry into a building.”` It seems a little crazy they went so far as to break into the building when it looks like what was actually wanted was just do a few things and sign off on our security. You know, things we "anticipate" (doesn't that defeat the entire purpose?). Contractors seem like they went above and beyond really. Bureaucrats don't appear to like that.
- mythrwy 7y agoMoving on to phase 2 of the test: Jail containment capabilities.
- wfbarks 7y agoReminds me of that time I hired a boxing coach and he punched me in the face, what a jerk!
- dschuetz 7y agoWhat sort of pentesters was that who didn't specify and get a signed off code of conduct before they did a physical pentest? Having a paper to wave in front of the arresting cops is more important than the promise of money. Jesus. Amateurs.
- rhinoceraptor 7y agoWhat's more likely, a big pentesting company messed up this one engagement, or the state is incompetent and doesn't understand pentesting? I'm leaning towards the latter.
- danpalmer 7y agoIt's not clear exactly what happened here, but hypothetically... If the state/public office did _not_ agree to it in contract, but if the individuals doing the breaking in a) do it for a living, and b) were operating under the knowledge that they had a contract enabling them to do so legally... what happens to them? In this case they committed a crime, to them everything including past experience led them to believe it was explicitly not a crime. Obviously the contracting company would be ultimately at fault (at least morally so), but the person messing up the contract isn't going to go to prison for burglary. How would this likely be resolved? Would the burglary case be dropped and it be turned into a criminal negligence case against the company? If not, how do we effectively protect physical penetration testers like this?
- golergka 7y agoIANAL, especially in American law, but mens rea is usually a neccessary element for criminal liability.
- giancarlostoro 7y agoHadnt heard of the term before: https://en.m.wikipedia.org/wiki/Mens_rea https://en.m.wikipedia.org/wiki/Mens_rea
- Ensorceled 7y agoIt's okay, there are a number of people in this thread who haven't. The interesting part is, legally, how there are two separate parts: intent (I intended to do this action, why car accidents are not murder) and knowledge (I knew, or should have known, this was a crime). In this case, they could not form mens rea because, to their knowledge, they had permission to "break into" the building. Like when you lock yourself out of your house and hire a locksmith to "break in". The locksmith has intent, but no "criminal knowledge" because you gave them permission.
- danpalmer 7y ago
- thrownaway954 7y agoI don't understand all the secrecy in doing these types of pen-testing. Why wouldn't you just tell the cops what you intend to do and make sure everyone involved has a clear understanding of what is going to be done and what not. Personally, there is NO WAY I would have tried to break into a court for a pen-test without the cops and a representative from the state right there while I'm doing it. Sorry everyone, but as you can see, now these employees risk criminal records and prison over something stupid. And if you think some over zealous prosecutor isn't going to see this to the end, you have another thing coming. And the worst part about it, I highly doubt the company does ANYTHING to help these dudes. I feel so bad for them.
- elliekelly 7y ago> I don't understand all the secrecy in doing these types of pen-testing. Why wouldn't you just tell the cops what you intend to do and make sure everyone involved has a clear understanding of what is going to be done and what not. It's not really an accurate measure of response time if the responding parties are told ahead of time. That said, I would imagine the benefit of an accurate measurement vs. the cost of a heads-up is vastly different when you're dealing with first responders as opposed to a vendor.
- Ratiofarmings 7y agoSo now, next question. Have they done anything in there. They've caught the intruders, good on them. But as a security guy myself I am asking: did they check ALL electronics for tampering as well as do a basic bug sweep. I am not saying it was, in fact I don't think the courthouse who let's them rot in jail now gives a damn, but a thorough test could also test whether after catching intruders the court bothers to check their equipment. Something added/manipulated is sometimes worse than something stolen.
- sli 7y agoThis shows such a comical level of incompetence from Iowa's state admin that it borders on malicious.
- dlgeek 7y agoUPDATE: https://www.desmoinesregister.com/story/news/crime-and-courts/2019/09/18/iowa-courts-dallas-county-courthouse-coalfire-contract-judicial-branch-test-security-ia-crime-arrest/2356047001/ https://www.desmoinesregister.com/story/news/crime-and-court... HN: https://news.ycombinator.com/item?id=21012191 https://news.ycombinator.com/item?id=21012191