3 ms·

If this is true, is it Coalfire's fault for not verifying and are the two testers SOL with the burglary charge? Then is it also the fault of the two testers in

If this is true, is it Coalfire's fault for not verifying and are the two testers SOL with the burglary charge? Then is it also the fault of the two testers in this case that they too did not verify that all the correct stakeholders were brought in? It would suck to be in the position of the testers having little or no recourse.

iforgotpassword 7y ago
I'm very hesitant to blame the two individuals. While you should have basic understanding of the legal circumstances when working this job, you should be able to trust your higher ups that the paperwork is legit and thorough. A company the size of coalfire certainly has dedicated personnel just for dealing with that.
- kerng 7y ago
  Agreed - very little blame goes to the pentesters, they didn't act with malicious intent as far as described. It's the higher ups on both sides that are accountable for the dilemma.
- alteria 7y ago
  I am too, but was curious what degree of responsibility is expected of them by the law. i.e., is deferring to whatever sales/legal drafted enough of a defense, or something else. I work in professional services (although not pentesting), so I curious about what would happen to me if I was in a similar position.
larssorenson 7y ago
The previous discussion on HN highlighted Mens rea with regards to establishing intent, i.e. they didn't have criminal intent (they went in with the understanding that they had full rights and privileges to be there) and would probably (hopefully) be vindicated in a court of law. There is still a matter of CoalFire vs State / Local govt, where CoalFire might be liable for not confirming that they had the proper authorization to dispatch their testers (which is part of the state vs local issue that's ongoing). IANAL but I've been tracking this pretty closely since I'm also a pentester; everything seems to reasonably indicate that the two guys should be released, but someone else is likely ending up in a court over this.

iforgotpassword 7y ago

I'm very hesitant to blame the two individuals. While you should have basic understanding of the legal circumstances when working this job, you should be able to trust your higher ups that the paperwork is legit and thorough. A company the size of coalfire certainly has dedicated personnel just for dealing with that.

kerng 7y ago
Agreed - very little blame goes to the pentesters, they didn't act with malicious intent as far as described. It's the higher ups on both sides that are accountable for the dilemma.
alteria 7y ago
I am too, but was curious what degree of responsibility is expected of them by the law. i.e., is deferring to whatever sales/legal drafted enough of a defense, or something else. I work in professional services (although not pentesting), so I curious about what would happen to me if I was in a similar position.

larssorenson 7y ago

The previous discussion on HN highlighted Mens rea with regards to establishing intent, i.e. they didn't have criminal intent (they went in with the understanding that they had full rights and privileges to be there) and would probably (hopefully) be vindicated in a court of law. There is still a matter of CoalFire vs State / Local govt, where CoalFire might be liable for not confirming that they had the proper authorization to dispatch their testers (which is part of the state vs local issue that's ongoing). IANAL but I've been tracking this pretty closely since I'm also a pentester; everything seems to reasonably indicate that the two guys should be released, but someone else is likely ending up in a court over this.