7 ms·

Coalfire Comments on Penetration Tests for Iowa Judicial Branch

100 points by ajay-d 7y ago

exabrial 7y ago
Sounds like yet another over-zealous prosecutor hell bent on putting non-violent [and non-criminals] behind bars.
- jnbiche 7y ago
  Yep. Someone has his or her eye on a higher office.
  - itomato 7y ago
    Or an interest in disruption at any and all available opportunities.
  - jstanley 7y ago
    Can you ELI5 why putting pentesters in prison would help a prosecutor get promoted to a higher office? Wouldn't it just piss off (among others) the very people who have the authority to promote the prosecutor to a higher office?
    - fotbr 7y ago
      Prosecutor gets to go trumpet a victory over those who would show such disresepect to the law as to try to break into the courthouse itself (or various press releases to similar effect). The "very people who have the authority to promote the prosecutor" are the voters, who, for the most part, do not understand what pen-testing is, or that it exists, or that it is (or can be, when done correctly) a legitimate thing. ELI5 A person is smart, people are stupid. Voters are people, and details get lost in campaigns.
    - ptyyy 7y ago
      Perceived "easy win" for conviction rate due to a fundamental lack of understanding of the issue. This backfired hilariously.
- jerf 7y ago
  That seems unlikely. How would prosecuting this case rebound to a prosecutor's advantage in anyone's eyes? "Ha ha, we contracted with these people to do security work for us, but we sure showed them when we hit them with criminal charges for the things we're paying them to do! Nothing says I'll pursue justice like paying to entrap people and prosecuting people with the opposite of mens rea. Elect me or promote me as appropriate, I'm openly a treacherous lunatic!" Incarceration is a tool for over-zealous prosecutors, not a terminal goal. That tool won't help them advance their actual goals in this case. (Of course, tools that get used a lot can accidentally become terminal goals if a non-self-reflective agent gets too cognitively lazy. Still, the intelligence bar for "prosecutor" is probably high enough we should credit them with generally knowing what they're doing. And even if they were being this lazy, their full attention would be brought to this case when it first hit the media.)
  - PeterisP 7y ago
    The goal of the sheriff and the prosecutor is to stand tall in their ongoing conflict with the state institution, of which this pentest is just the latest event. It's empathically not "we contracted with these people to do security work for us", it's that "our enemies from the Iowa state contracted these people to try and screw us". They succeeded in getting some of these enemies caught, so they will make a point to their local voters as "we sure showed those bastards from the state agencies that they have no right to come here and shove their noses in our business" (which they've already explicitly stated to local press in pretty much the same words), that's a win already for a certain class of the local voters. Their goals explictly include making it harder for 'enemy agents' to operate. If they use every technicality within the bounds of the law to make it as prolonged and difficult as possible, they're making a statement that attempting to attack them in this manner will result in retailiation - if it makes it hard for Iowa state to employ other pentesters in the future, excellent, mission accomplished, that fits the goals of these local agencies very well. They treat this mission as an explicit attack against them, and they want to deter attacks like these with whatever power they've got - which includes the ability to arrest people.
- sjcoles 7y ago
  Nah just an idiot sheriff having a power trip[1]. [1] https://www.desmoinesregister.com/story/news/crime-and-courts/2019/09/18/iowa-courts-dallas-county-courthouse-coalfire-contract-judicial-branch-test-security-ia-crime-arrest/2356047001/ https://www.desmoinesregister.com/story/news/crime-and-court...
- rootusrootus 7y ago
  Or just an relatively innocent combination of dumbfuckery and confusion. The prosecutor probably already wants to drop the whole matter and try to forget about it, but it's political now.
deleted 7y ago
[deleted]
zelon88 7y ago
Here's a post about the subject that's actually worth reading. https://www.scmagazine.com/home/security-news/vulnerabilities/pen-test-gone-awry-coalfire-staffers-arrested-for-burglary/ https://www.scmagazine.com/home/security-news/vulnerabilitie...
heyflyguy 7y ago
Are these bot comments? Looks like a simple contractual misunderstanding, probably exasperated by a bureaucratic communication issue of some sort. I'm sure we'll discover that coalfire had ducks in a row and Iowa didn't know what they bought. Nobody communicated it and here we are.
- cududa 7y ago
  It so far appears the county sheriff is behind this, insisting that the courthouse belongs to the county, and the state had to right to authorize this test.
  - mitchty 7y ago
    Remember that Sherriffs are elected, they can have zero training related to the job. That alone can explain a lot of this. You might be surprised at recent efforts to politicize them as well. https://www.politicalresearch.org/2019/06/10/how-a-right-wing-network-mobilized-sheriffs-departments https://www.politicalresearch.org/2019/06/10/how-a-right-win...
Slenth 7y ago
This article [1] seems to imply the reason for the arrest is a disagreement between the county sheriff's department and the state as to who has the authority to sign off on them attempting to break in to the building. [1] https://www.desmoinesregister.com/story/news/crime-and-courts/2019/09/18/iowa-courts-dallas-county-courthouse-coalfire-contract-judicial-branch-test-security-ia-crime-arrest/2356047001/ https://www.desmoinesregister.com/story/news/crime-and-court...
- danShumway 7y ago
  Importantly, in this story it's confirmed that the pen testers were carrying documentation and phone numbers of people in the State department who could (and did) confirm their stories. When this story first broke, there was speculation that, "this is why you carry a get out of jail free card." But if this story is true, the testers did everything right, and the deputy just decided to jail them anyway.
  - malka 7y ago
    Unsurprisingly, cops are assholes
    - mxuribe 7y ago
      It isn't only that - there are both good and a$$hole cops...But, it seems in the U.S. there isn't a consistent governance of law enforcement across all levels of government, nor across the whole geography of the nation...leading to some (many?) cops abusing their power.
  - metalliqaz 7y ago
    There is going to be a lawsuit and Iowa is going to settle.
  - kerng 7y ago
    It's not good enough to have an authorization- you need to have authorization from the proper stakeholder! That is the dispute here.
sullivanmatt 7y ago
Here's the scoping doc: https://iowacourts.gov/static/media/cms/Rules_of_Engag_E9D807B3D13D3.pdf https://iowacourts.gov/static/media/cms/Rules_of_Engag_E9D80... Some highlights include authorization to attempt entry by tail gating, lock picking, place devices once access has been gained, etc. It's a total vindication for Coalfire (IMO).
- nekoashide 7y ago
  They specifically stated that this access would only be between 6AM and 6PM MST or "Normal Business hours". Not seeing anything that's allowing them outside of these hours.
  - alteria 7y ago
    Which is interesting since they said that the physical pentesting could be "during day and evening," but you're right. Haven't seen anything affirmatively allowing them to conduct outside of 6am-6pm MST. They DID have permission to lockpick, and maybe the state asked for testing after 6pm MST but hasn't released the request (per the blurb below) "Requests for testing outside this time period outside the above may result in additional charges per the terms of the MSA"
  - foota 7y ago
    I felt like that was more about billing than limiting the scope, but you're right that there's seemingly a conflict.
  - scrumper 7y ago
    "Expected to be" is not the same as "will only be", and that's the sort of thing that gets decided by a judge. (The existence of the additional charges language does weaken that argument a bit since if "expected to be" really was meaning that things could happen outside of those hours, then you wouldn't need to reference those MSA terms.) IANAL, but have written more than my share of SOWs and contracts of this type. Drafters tend to always default to the position of greatest optionality for them. Hence, "expected to be".
- 7y ago
matthewdgreen 7y ago
Why is this still going on? It made sense before when there was a possibility of confusion, but at this point it is at worst a mistake, not someone with intent to commit a crime. Are charges still being pressed?
- metalliqaz 7y ago
  Power is a helluva drug.
- doctoboggan 7y ago
  The question here is not whether they were contracted to do the pen test, I think everyone agrees they were. The question is whether those who contracted them had the authority to authorize it. If someone from craigslist give me a contract to break into a house to test their security system, but it turns out the owner of the house did not know about the contract, who is at fault for the break-in? I do think that Coalfire acted in good faith here, but it is a complicated situation.
  - mcherm 7y ago
    > The question here is not whether they were contracted to do the pen test, I think everyone agrees they were. The question is whether those who contracted them had the authority to authorize it. No, the question is whether the prosecutor believes beyond a shadow of a doubt that the accused had the requisite intent to be committing burglary. If not, the they have an ethical obligation to drop the prosecution.
    - doctoboggan 7y ago
      You are correct, I didn’t know burglary was a specific intent law.
- nathanyz 7y ago
  Agreed, I mean these guys are now pawns in some political game. But these are people's lives. Let them off the hook and then you can commence with your dick measuring contests.
Animats 7y ago
One of the many books on CIA training describes how they handle this. The CIA has written agreements with law enforcement in the areas where they do training exercises. Trainees are given a number to call. If they call it, someone from CIA HQ comes over, with, as one trainee put it, the "rumored but never seen get out of jail free letter". This usually means the trainee failed the exercise.
equalunique 7y ago
There is a legend from the time of my Uncle's tenure at the US DOJ. During the Clinton administration, he hired so-called hackers he met at DEF CON to conduct a pen test of an immigration processing center somewhere around New England. The hackers were given some form of "get out of jail free card" for use during the pen test. In spite of it, they were arrested anyway by the overzealous administrator of the center. My uncle's group in the DOJ had a hard time getting those hackers out of jail, and when they finally came out, they were quite mad, since the whole fiasco had put their permanent records at risk of a bad mark. The pen test project was still on, and it seems they went to extra lengths to exact their revenge on that overzealous administrator. As proof of their total compromise of the immigration processing center, the then Attorney General Janet Reno received in the mail from a green card for a Kang G. Roo. Subsequently, said administrator was demoted and reassigned to some cold desolate part of Alaska. (So the story goes, anyway.) Edit: The "reassignment" may have led to an almost-immediate resignation.
- metalliqaz 7y ago
  sounds believable until the Alaska part
  - GhettoMaestro 7y ago
    Being "sent to Alaska" is really just a saying that the organization is super-super-super pissed at you, and desires to send you to the crappiest location (job) possible in an effort to make you leave the organization. EG: He fucked up so bad, he will be manning a remote radar station in Alaska for the rest of his military career.
  - dsfyu404ed 7y ago
    "Demoted and sent to Alaska" is shorthand for "some non-specific shitty assignment" in this context. Nobody thinks he was literally sent to Alaska.
  - equalunique 7y ago
    I have no idea what actually happened to the former administrator, but I'm told that this hyperbole is method for forcing Special Executive Service employees to resign. There are many hoops to jump through if the intent is to fire them, but part of being an SES includes not having much leeway when it comes to where you are assigned. So by forcing the person to work in some unwanted location, they tend to almost always submit their resignation instead. Where they were reassigned to I don't know for certain, but that's the tactic I'm told was used. I suppose "forced to resign" might have been a more belivable way to end the story, but supposedly the mechanism by which that happens involves reassignment to some unwanted location.
sandworm101 7y ago
>> It's a total vindication for Coalfire (IMO) But think about this from the perspective of the cops. The contract can get coalfire out of any liability for damage done to the building and any potential break and enter. That is consent between contracting parties. But an alarm was set off. The police were called. This isn't exactly a case of them filing a false police report, but the police were indeed called under false pretenses. I used to work in a building with remote monitoring and extensive security, including armed response (military). We did these tests monthly. But as soon as the alarm was triggered, someone was on the phone to the military police. If their supervisor decided to roll the cars and test his officer's response time that was with his permission. We would never, ever, have insist that cops stop what they were doing, possibly something dangerous/real/important, and physically respond to our not-real security test.
- tantalor 7y ago
  Who cares about the cops? They don't have any role in prosecution. "In the criminal justice system, the people are represented by two separate, yet equally important, groups: the police, who investigate crime; and the district attorneys, who prosecute the offenders. These are their stories."
stevespang 7y ago
I predict there will be a lawsuit for damages by the two testers arrested.
aaron695 7y ago
Any action that causes the police to investigate and leaves them continuing to investigate what they think is a crime, is irresponsible. (Polk break in) Using locking picking tools is destructive (it technically causes damage) "Social Engineering" (What the physical access section is under) to gain physical access is not lock picking, although there's no evidence they used the tools? and not opening doors or windows they are not allowed to open, when no one is there. This is stupid, yes, the men should not be put in prison, but equally Coalfire messed up bad, maybe they verbally got the ok then it's back onto state who messed up bad. What if the cops had drawn weapons. Someone does need to get into some sort of trouble for this.

100 points by ajay-d 7y ago

exabrial 7y ago

Sounds like yet another over-zealous prosecutor hell bent on putting non-violent [and non-criminals] behind bars.

jnbiche 7y ago
Yep. Someone has his or her eye on a higher office.
- itomato 7y ago
  Or an interest in disruption at any and all available opportunities.
- jstanley 7y ago
  Can you ELI5 why putting pentesters in prison would help a prosecutor get promoted to a higher office? Wouldn't it just piss off (among others) the very people who have the authority to promote the prosecutor to a higher office?
  - fotbr 7y ago
    Prosecutor gets to go trumpet a victory over those who would show such disresepect to the law as to try to break into the courthouse itself (or various press releases to similar effect). The "very people who have the authority to promote the prosecutor" are the voters, who, for the most part, do not understand what pen-testing is, or that it exists, or that it is (or can be, when done correctly) a legitimate thing. ELI5 A person is smart, people are stupid. Voters are people, and details get lost in campaigns.
  - ptyyy 7y ago
    Perceived "easy win" for conviction rate due to a fundamental lack of understanding of the issue. This backfired hilariously.
jerf 7y ago
That seems unlikely. How would prosecuting this case rebound to a prosecutor's advantage in anyone's eyes? "Ha ha, we contracted with these people to do security work for us, but we sure showed them when we hit them with criminal charges for the things we're paying them to do! Nothing says I'll pursue justice like paying to entrap people and prosecuting people with the opposite of mens rea. Elect me or promote me as appropriate, I'm openly a treacherous lunatic!" Incarceration is a tool for over-zealous prosecutors, not a terminal goal. That tool won't help them advance their actual goals in this case. (Of course, tools that get used a lot can accidentally become terminal goals if a non-self-reflective agent gets too cognitively lazy. Still, the intelligence bar for "prosecutor" is probably high enough we should credit them with generally knowing what they're doing. And even if they were being this lazy, their full attention would be brought to this case when it first hit the media.)
- PeterisP 7y ago
  The goal of the sheriff and the prosecutor is to stand tall in their ongoing conflict with the state institution, of which this pentest is just the latest event. It's empathically not "we contracted with these people to do security work for us", it's that "our enemies from the Iowa state contracted these people to try and screw us". They succeeded in getting some of these enemies caught, so they will make a point to their local voters as "we sure showed those bastards from the state agencies that they have no right to come here and shove their noses in our business" (which they've already explicitly stated to local press in pretty much the same words), that's a win already for a certain class of the local voters. Their goals explictly include making it harder for 'enemy agents' to operate. If they use every technicality within the bounds of the law to make it as prolonged and difficult as possible, they're making a statement that attempting to attack them in this manner will result in retailiation - if it makes it hard for Iowa state to employ other pentesters in the future, excellent, mission accomplished, that fits the goals of these local agencies very well. They treat this mission as an explicit attack against them, and they want to deter attacks like these with whatever power they've got - which includes the ability to arrest people.
sjcoles 7y ago
Nah just an idiot sheriff having a power trip[1]. [1] https://www.desmoinesregister.com/story/news/crime-and-courts/2019/09/18/iowa-courts-dallas-county-courthouse-coalfire-contract-judicial-branch-test-security-ia-crime-arrest/2356047001/ https://www.desmoinesregister.com/story/news/crime-and-court...
rootusrootus 7y ago
Or just an relatively innocent combination of dumbfuckery and confusion. The prosecutor probably already wants to drop the whole matter and try to forget about it, but it's political now.

deleted 7y ago

[deleted]

zelon88 7y ago

Here's a post about the subject that's actually worth reading. https://www.scmagazine.com/home/security-news/vulnerabilities/pen-test-gone-awry-coalfire-staffers-arrested-for-burglary/ https://www.scmagazine.com/home/security-news/vulnerabilitie...

heyflyguy 7y ago

Are these bot comments? Looks like a simple contractual misunderstanding, probably exasperated by a bureaucratic communication issue of some sort. I'm sure we'll discover that coalfire had ducks in a row and Iowa didn't know what they bought. Nobody communicated it and here we are.

cududa 7y ago
It so far appears the county sheriff is behind this, insisting that the courthouse belongs to the county, and the state had to right to authorize this test.
- mitchty 7y ago
  Remember that Sherriffs are elected, they can have zero training related to the job. That alone can explain a lot of this. You might be surprised at recent efforts to politicize them as well. https://www.politicalresearch.org/2019/06/10/how-a-right-wing-network-mobilized-sheriffs-departments https://www.politicalresearch.org/2019/06/10/how-a-right-win...

Slenth 7y ago

This article [1] seems to imply the reason for the arrest is a disagreement between the county sheriff's department and the state as to who has the authority to sign off on them attempting to break in to the building. [1] https://www.desmoinesregister.com/story/news/crime-and-courts/2019/09/18/iowa-courts-dallas-county-courthouse-coalfire-contract-judicial-branch-test-security-ia-crime-arrest/2356047001/ https://www.desmoinesregister.com/story/news/crime-and-court...

danShumway 7y ago
Importantly, in this story it's confirmed that the pen testers were carrying documentation and phone numbers of people in the State department who could (and did) confirm their stories. When this story first broke, there was speculation that, "this is why you carry a get out of jail free card." But if this story is true, the testers did everything right, and the deputy just decided to jail them anyway.
- malka 7y ago
  Unsurprisingly, cops are assholes
  - mxuribe 7y ago
    It isn't only that - there are both good and a$$hole cops...But, it seems in the U.S. there isn't a consistent governance of law enforcement across all levels of government, nor across the whole geography of the nation...leading to some (many?) cops abusing their power.
- metalliqaz 7y ago
  There is going to be a lawsuit and Iowa is going to settle.
- kerng 7y ago
  It's not good enough to have an authorization- you need to have authorization from the proper stakeholder! That is the dispute here.

sullivanmatt 7y ago

Here's the scoping doc: https://iowacourts.gov/static/media/cms/Rules_of_Engag_E9D807B3D13D3.pdf https://iowacourts.gov/static/media/cms/Rules_of_Engag_E9D80... Some highlights include authorization to attempt entry by tail gating, lock picking, place devices once access has been gained, etc. It's a total vindication for Coalfire (IMO).

nekoashide 7y ago
They specifically stated that this access would only be between 6AM and 6PM MST or "Normal Business hours". Not seeing anything that's allowing them outside of these hours.
- alteria 7y ago
  Which is interesting since they said that the physical pentesting could be "during day and evening," but you're right. Haven't seen anything affirmatively allowing them to conduct outside of 6am-6pm MST. They DID have permission to lockpick, and maybe the state asked for testing after 6pm MST but hasn't released the request (per the blurb below) "Requests for testing outside this time period outside the above may result in additional charges per the terms of the MSA"
- foota 7y ago
  I felt like that was more about billing than limiting the scope, but you're right that there's seemingly a conflict.
- scrumper 7y ago
  "Expected to be" is not the same as "will only be", and that's the sort of thing that gets decided by a judge. (The existence of the additional charges language does weaken that argument a bit since if "expected to be" really was meaning that things could happen outside of those hours, then you wouldn't need to reference those MSA terms.) IANAL, but have written more than my share of SOWs and contracts of this type. Drafters tend to always default to the position of greatest optionality for them. Hence, "expected to be".
7y ago

matthewdgreen 7y ago

Why is this still going on? It made sense before when there was a possibility of confusion, but at this point it is at worst a mistake, not someone with intent to commit a crime. Are charges still being pressed?

metalliqaz 7y ago
Power is a helluva drug.
doctoboggan 7y ago
The question here is not whether they were contracted to do the pen test, I think everyone agrees they were. The question is whether those who contracted them had the authority to authorize it. If someone from craigslist give me a contract to break into a house to test their security system, but it turns out the owner of the house did not know about the contract, who is at fault for the break-in? I do think that Coalfire acted in good faith here, but it is a complicated situation.
- mcherm 7y ago
  > The question here is not whether they were contracted to do the pen test, I think everyone agrees they were. The question is whether those who contracted them had the authority to authorize it. No, the question is whether the prosecutor believes beyond a shadow of a doubt that the accused had the requisite intent to be committing burglary. If not, the they have an ethical obligation to drop the prosecution.
  - doctoboggan 7y ago
    You are correct, I didn’t know burglary was a specific intent law.
nathanyz 7y ago
Agreed, I mean these guys are now pawns in some political game. But these are people's lives. Let them off the hook and then you can commence with your dick measuring contests.

Animats 7y ago

One of the many books on CIA training describes how they handle this. The CIA has written agreements with law enforcement in the areas where they do training exercises. Trainees are given a number to call. If they call it, someone from CIA HQ comes over, with, as one trainee put it, the "rumored but never seen get out of jail free letter". This usually means the trainee failed the exercise.

equalunique 7y ago

There is a legend from the time of my Uncle's tenure at the US DOJ. During the Clinton administration, he hired so-called hackers he met at DEF CON to conduct a pen test of an immigration processing center somewhere around New England. The hackers were given some form of "get out of jail free card" for use during the pen test. In spite of it, they were arrested anyway by the overzealous administrator of the center. My uncle's group in the DOJ had a hard time getting those hackers out of jail, and when they finally came out, they were quite mad, since the whole fiasco had put their permanent records at risk of a bad mark. The pen test project was still on, and it seems they went to extra lengths to exact their revenge on that overzealous administrator. As proof of their total compromise of the immigration processing center, the then Attorney General Janet Reno received in the mail from a green card for a Kang G. Roo. Subsequently, said administrator was demoted and reassigned to some cold desolate part of Alaska. (So the story goes, anyway.) Edit: The "reassignment" may have led to an almost-immediate resignation.

metalliqaz 7y ago
sounds believable until the Alaska part
- GhettoMaestro 7y ago
  Being "sent to Alaska" is really just a saying that the organization is super-super-super pissed at you, and desires to send you to the crappiest location (job) possible in an effort to make you leave the organization. EG: He fucked up so bad, he will be manning a remote radar station in Alaska for the rest of his military career.
- dsfyu404ed 7y ago
  "Demoted and sent to Alaska" is shorthand for "some non-specific shitty assignment" in this context. Nobody thinks he was literally sent to Alaska.
- equalunique 7y ago
  I have no idea what actually happened to the former administrator, but I'm told that this hyperbole is method for forcing Special Executive Service employees to resign. There are many hoops to jump through if the intent is to fire them, but part of being an SES includes not having much leeway when it comes to where you are assigned. So by forcing the person to work in some unwanted location, they tend to almost always submit their resignation instead. Where they were reassigned to I don't know for certain, but that's the tactic I'm told was used. I suppose "forced to resign" might have been a more belivable way to end the story, but supposedly the mechanism by which that happens involves reassignment to some unwanted location.

sandworm101 7y ago

>> It's a total vindication for Coalfire (IMO) But think about this from the perspective of the cops. The contract can get coalfire out of any liability for damage done to the building and any potential break and enter. That is consent between contracting parties. But an alarm was set off. The police were called. This isn't exactly a case of them filing a false police report, but the police were indeed called under false pretenses. I used to work in a building with remote monitoring and extensive security, including armed response (military). We did these tests monthly. But as soon as the alarm was triggered, someone was on the phone to the military police. If their supervisor decided to roll the cars and test his officer's response time that was with his permission. We would never, ever, have insist that cops stop what they were doing, possibly something dangerous/real/important, and physically respond to our not-real security test.

tantalor 7y ago
Who cares about the cops? They don't have any role in prosecution. "In the criminal justice system, the people are represented by two separate, yet equally important, groups: the police, who investigate crime; and the district attorneys, who prosecute the offenders. These are their stories."

stevespang 7y ago

I predict there will be a lawsuit for damages by the two testers arrested.

aaron695 7y ago

Any action that causes the police to investigate and leaves them continuing to investigate what they think is a crime, is irresponsible. (Polk break in) Using locking picking tools is destructive (it technically causes damage) "Social Engineering" (What the physical access section is under) to gain physical access is not lock picking, although there's no evidence they used the tools? and not opening doors or windows they are not allowed to open, when no one is there. This is stupid, yes, the men should not be put in prison, but equally Coalfire messed up bad, maybe they verbally got the ok then it's back onto state who messed up bad. What if the cops had drawn weapons. Someone does need to get into some sort of trouble for this.