5 ms·

It's extremely important to include a clear statement of work in any pentesting contract exactly for this reason. The contents of the contract will become very

It's extremely important to include a clear statement of work in any pentesting contract exactly for this reason. The contents of the contract will become very important in this case, and depending on whether or not the SOW included physical intrusion into the buildings, one side or the other will end up with egg on their face. Without the contract and/or other agreements it isn't clear who's at fault here, the pentesting firm involved may very well have been an incompetent one that exceeded their SOW or did not even produce one to be agreed on--and I tend to suspect that this is the case, because physical intrusion testing will almost always include measures to prevent the police being called or make them aware of the test due to both the expense of an intentional false alarm call and the risk involved in triggering a law enforcement response.

arcticfox 7y ago
This is such an absurd case on so many levels. This miscommunication should have never happened, obviously. Even if they turn out to be the criminally incompetent party in this relationship, I feel kind of bad for the contractors. They're facing felony charges for making what was clearly a mistake. I can't imagine they're consistently this incompetent - surely one of their previous clients would have noticed if they were physically broken into and didn't anticipate it. So either they've never done this before, or they messed up their contract. I've seen plenty of similarly boneheaded, incompetent things in Big Tech (losing massive amounts of data, getting systematically defrauded in pretty stupid ways, etc) that resulted in getting fired at worst and a reprimand at best, so I feel kind of bad that these guys face felonies for being bad at their job.
- dannyw 7y ago
  Amazed they are charged. Any good lawyer should be able to get them off on mistake of fact, of simply lacking the elements of the crime.
  - shawxe 7y ago
    Yeah, not a lawyer outside of my armchair, but I don't really see how they could ever be convicted of any of this. It sounds like there's a very good chance they were contracted by a legitimate security auditing firm to do a job of a nature they had no reason to believe was not already outlined some statement of work agreed upon by all parties. Even if there was some misunderstanding, it sounds like the fault lies with the firm rather than with the contractors themselves. Obviously there are more facts that would need to be reviewed to come to definitively arrive at a conclusion like this, but at a glance this whole thing seems ridiculous.
    - aphextim 7y ago
      Probably a bad comparison to make, however in construction if something is built according to the plans from the engineering firm, and somehow those plans were not up to snuff and voided a warranty or worst case could be illegal and not up to code, it will NOT fall on the welders and workers who created the project (Unless they didn't perform job i.e. welds not up to par). Failure would be on the engineering firm who was supposed to ensure all plans were created according to the specifications. If the company these two were working for had a "plan" much like building documents, or a scope of work document/contract then there should be no reason for these guys to get in trouble as physical penetration testing would be listed. I see two possibilities. 1) Company did not have a good scope of work, which at the end of it all this should fall on them and not the employees in charge of performing their work. These guys should be let go, compensation to them paid from the employer for their error, and said employer has to pay everything, including fees and having their reputation tarnished. 2) There was bad miscommunication. There was physical penetration listed in the scope of work, however the police were not informed and acted as they would with anyone breaking into a courthouse. This would then fall on the department who hired them, which should pay the employees for their time/trauma and make an apology exonerating the company who was hired to pen test.
      - charwalker 7y ago
        It's feasible that the charges will go through but the defendants can sue the employer who holds the contract for damages related to any fines or jail time. A mistake or incompetence is no excuse for breaking the law. This was a courthouse. There is either CYA in writing they can request in discovery for that lawsuit or as evidence against the charges they face to demonstrate to a jury that they should be innocent or that an experienced prosecutor will see then look to drop charges. But unless the charges are dropped, the jury favors the contractors, or the judge halts proceeding until a determination can be made, they may be SOL on the charges.
- not_a_cop75 7y ago
  Well, as long as there was an agreement to do pen testing, the criminal portion should be pretty much dropped. Caveat emptor
crb002 7y ago
You don't understand the level of local corruption in Iowa. To be effective the State couldn't tip off County security.
- bsenftner 7y ago
  Love to hear about the level of corruption in Iowa. Grew up there and left...
  - crb002 7y ago
    So dirty the AG's Chief of Staff Eric Tabor has his sister on the Iowa Court of Appeals Mary Tabor who corruptly fails to recuse herself on his cases. Usually she is impartial, but when Eric gets caught in shenanigans she has went so far as to commit fraud (literally lying about the facts of cases in the appellate record she prosecuted to invent case law) to cover his ass. Fun fact, Mary's son Ollie works for Nate Silver.
    - crb002 7y ago
      @ollie
crankylinuxuser 7y ago
The company in question is Coalfire. This company assesses who can become FedRAMP compliant. They also have their pentesting team in-house, and they are fuckig sharp. They know their contracts, rules of engagement, and exactly what they are and aren't allowed to do. These folks do this stuff for their livelihood. They test contractor, state, and fed systems at all scopes and levels. And if 2 broke in (yes, you work in teams ABSOLUTELY onprem), they had the contract explicitly allowing physical penetration ON THEIR BODY. That contract is the difference between felony trespass and 100% legal. I would LOVE to be a fly on the wall and watching the conversation between State IT and the public safety community there, and especially with the AG, who will have to release them.
- october_sky 7y ago
  Ya, I've spoken with Coalfire employees in the past and have respect for them. I'm very curious to follow-up on the outcome of this case, and I feel for the employees sitting in jail right now. Hope it ends well for them
  - elif 7y ago
    They posted bail
- deleted 7y ago
  [deleted]
- alexfromapex 7y ago
  This kind of smells like a classified intelligence op
  - turtlegrids 7y ago
    r/conspiracy amirite?
    - Spare_account 7y ago
      Don't feed them, just Flag (or downvote if you're able) and move on.
MaupitiBlue 7y ago
Shame on the prosecutors. Burglary requires intent. By all appearances, these guys thought they had permission.
- Cthulhu_ 7y ago
  They HAD intent - they intended to break into the building, brought the tools, etc. If the contract does not stipulate that they are allowed to break in then they're basically screwed. "I didn't mean to break in" holds no ground in court if they actually were breaking in.
  - TheSpiceIsLife 7y ago
    Criminal intent.
  - Ensorceled 7y ago
    This isn't how the law works for intent. Google "mens rea", in particular, the "knowing" part. Under your definition, every locksmith is engaging in felony break and enter on a daily basis.

arcticfox 7y ago

This is such an absurd case on so many levels. This miscommunication should have never happened, obviously. Even if they turn out to be the criminally incompetent party in this relationship, I feel kind of bad for the contractors. They're facing felony charges for making what was clearly a mistake. I can't imagine they're consistently this incompetent - surely one of their previous clients would have noticed if they were physically broken into and didn't anticipate it. So either they've never done this before, or they messed up their contract. I've seen plenty of similarly boneheaded, incompetent things in Big Tech (losing massive amounts of data, getting systematically defrauded in pretty stupid ways, etc) that resulted in getting fired at worst and a reprimand at best, so I feel kind of bad that these guys face felonies for being bad at their job.

dannyw 7y ago
Amazed they are charged. Any good lawyer should be able to get them off on mistake of fact, of simply lacking the elements of the crime.
- shawxe 7y ago
  Yeah, not a lawyer outside of my armchair, but I don't really see how they could ever be convicted of any of this. It sounds like there's a very good chance they were contracted by a legitimate security auditing firm to do a job of a nature they had no reason to believe was not already outlined some statement of work agreed upon by all parties. Even if there was some misunderstanding, it sounds like the fault lies with the firm rather than with the contractors themselves. Obviously there are more facts that would need to be reviewed to come to definitively arrive at a conclusion like this, but at a glance this whole thing seems ridiculous.
  - aphextim 7y ago
    Probably a bad comparison to make, however in construction if something is built according to the plans from the engineering firm, and somehow those plans were not up to snuff and voided a warranty or worst case could be illegal and not up to code, it will NOT fall on the welders and workers who created the project (Unless they didn't perform job i.e. welds not up to par). Failure would be on the engineering firm who was supposed to ensure all plans were created according to the specifications. If the company these two were working for had a "plan" much like building documents, or a scope of work document/contract then there should be no reason for these guys to get in trouble as physical penetration testing would be listed. I see two possibilities. 1) Company did not have a good scope of work, which at the end of it all this should fall on them and not the employees in charge of performing their work. These guys should be let go, compensation to them paid from the employer for their error, and said employer has to pay everything, including fees and having their reputation tarnished. 2) There was bad miscommunication. There was physical penetration listed in the scope of work, however the police were not informed and acted as they would with anyone breaking into a courthouse. This would then fall on the department who hired them, which should pay the employees for their time/trauma and make an apology exonerating the company who was hired to pen test.
    - charwalker 7y ago
      It's feasible that the charges will go through but the defendants can sue the employer who holds the contract for damages related to any fines or jail time. A mistake or incompetence is no excuse for breaking the law. This was a courthouse. There is either CYA in writing they can request in discovery for that lawsuit or as evidence against the charges they face to demonstrate to a jury that they should be innocent or that an experienced prosecutor will see then look to drop charges. But unless the charges are dropped, the jury favors the contractors, or the judge halts proceeding until a determination can be made, they may be SOL on the charges.
not_a_cop75 7y ago
Well, as long as there was an agreement to do pen testing, the criminal portion should be pretty much dropped. Caveat emptor

crb002 7y ago

You don't understand the level of local corruption in Iowa. To be effective the State couldn't tip off County security.

bsenftner 7y ago
Love to hear about the level of corruption in Iowa. Grew up there and left...
- crb002 7y ago
  So dirty the AG's Chief of Staff Eric Tabor has his sister on the Iowa Court of Appeals Mary Tabor who corruptly fails to recuse herself on his cases. Usually she is impartial, but when Eric gets caught in shenanigans she has went so far as to commit fraud (literally lying about the facts of cases in the appellate record she prosecuted to invent case law) to cover his ass. Fun fact, Mary's son Ollie works for Nate Silver.
  - crb002 7y ago
    @ollie

crankylinuxuser 7y ago

The company in question is Coalfire. This company assesses who can become FedRAMP compliant. They also have their pentesting team in-house, and they are fuckig sharp. They know their contracts, rules of engagement, and exactly what they are and aren't allowed to do. These folks do this stuff for their livelihood. They test contractor, state, and fed systems at all scopes and levels. And if 2 broke in (yes, you work in teams ABSOLUTELY onprem), they had the contract explicitly allowing physical penetration ON THEIR BODY. That contract is the difference between felony trespass and 100% legal. I would LOVE to be a fly on the wall and watching the conversation between State IT and the public safety community there, and especially with the AG, who will have to release them.

october_sky 7y ago
Ya, I've spoken with Coalfire employees in the past and have respect for them. I'm very curious to follow-up on the outcome of this case, and I feel for the employees sitting in jail right now. Hope it ends well for them
- elif 7y ago
  They posted bail
deleted 7y ago
[deleted]
alexfromapex 7y ago
This kind of smells like a classified intelligence op
- turtlegrids 7y ago
  r/conspiracy amirite?
  - Spare_account 7y ago
    Don't feed them, just Flag (or downvote if you're able) and move on.

MaupitiBlue 7y ago

Shame on the prosecutors. Burglary requires intent. By all appearances, these guys thought they had permission.

Cthulhu_ 7y ago
They HAD intent - they intended to break into the building, brought the tools, etc. If the contract does not stipulate that they are allowed to break in then they're basically screwed. "I didn't mean to break in" holds no ground in court if they actually were breaking in.
- TheSpiceIsLife 7y ago
  Criminal intent.
- Ensorceled 7y ago
  This isn't how the law works for intent. Google "mens rea", in particular, the "knowing" part. Under your definition, every locksmith is engaging in felony break and enter on a daily basis.