10 ms·

At first, I assumed I was going to be only angry at the justice system, but after understanding the contract document was split in 3 with very wishy/washy langu

At first, I assumed I was going to be only angry at the justice system, but after understanding the contract document was split in 3 with very wishy/washy language, part of the problem is on the contracted company. This is why you have explicit language in your documents. It's not there for when things go well - it's when things go bad like this situation. In fact, I argue this is an expected outcome. How can you run a security contract that does explicitly illegal things w/o having clear language about what is supposed to happen. FWIW: - The pen testers should be ready to spend time in jail and be compensated as such. A piece of paper should not get you off free immediately. That thing needs to be verified, so expect it to take time. - Language in your doc needs to be clear exactly what will happen. The whole fiasco afterwards should not needed to have taken place. If the customers want 'more pen testing' charge them for it. Overall this is a great outcome. Just need to clean up the edges a bit.

olliej 7y ago
yeah, but the problem is this shouldn't have taken months to be dropped - the full info about the contract was available by the end of that week, and should have results in the charges being dropped then and there.
bawolff 7y ago
Also make sure the people who hire you actually own the system being tested. Like if my neighbour hires some random to pentest my house for kicks, it doesnt make it ok for pentester to break into my house because they signed a contract with my neighbour
- p1necone 7y ago
  Depends, if the pentesters didn't ask for any proof that your neighbour owned and occupied the house then sure, the neighbour and the pentesters should be prosecuted. But if your neighbour lied and falsified documents to the point reasonable due diligence would have been fooled, perhaps the pentesters can be considered not at fault?
  - bigiain 7y ago
    > But if your neighbour lied and falsified documents to the point reasonable due diligence would have been fooled, perhaps the pentesters can be considered not at fault? And here we end up back with irjustin's proposal that if pentesters are doing things that would be illegal without proper permission, they need to be prepared to spend some time in jail. Their risks there for which they need to be compensated include their own organisation failing in their due diligence and sending them into a test for which they're genuinely not legally authorised.
    - SkyBelow 7y ago
      >And here we end up back with irjustin's proposal that if pentesters are doing things that would be illegal without proper permission, they need to be prepared to spend some time in jail. This sounds very unreasonable once you start applying it to other actions in life. For example, picking up someone's kids so they can go on a play date with your own kids. That's kidnapping without permission. Should everyone who picks up another person's kids need to be prepared to spend time in jail for kidnapping?
      - gowld 7y ago
        This is an issue in schools today regarding after-school care and custody handoffs, with the liberty/efficiency-oriented people battling the law& order/safety/think-of-the-children people. They both have valid perspectives, as is usually case in matters of statistically danger.
- thaumasiotes 7y ago
  In this case, branches of two different governments were colocated in the same building.
- Lazare 7y ago
  > Also make sure the people who hire you actually own the system being tested. There's an ongoing political dispute in Iowa over the extent to which the court system controls court buildings. The courts maintain they have full control (and thus can legally authorise, eg, pen testing), and (perhaps unsurprisingly) they keep winning court cases about it. Some of the criticism of Coalfire, DeMercurio, and Wynn was about how they were pentesting buildings their client did not control, but it's worth noting that this is 1) disputed and 2) almost certainly wrong (at least from a legal realism point of view). It's worth emphasising, I think, how much this story had to do with jurisdictional fights between different branches and levels of the Iowa state government, and how little it had to do with Coalfire, DeMercurio, Wynn, or pentesting.
  - deleted 7y ago
    [deleted]
  - kjs3 7y ago
    This is a very important bit of insight. Thanks for this perspective. My comments about contractual protections aren't nearly as strong in light of this.
  - dillonmckay 7y ago
    Seriously, stay out if politics are involved as a pentester, or even as an MSP. We had a legal matter with a county commissioner requesting the MSP use an external harddrive to transfer documents for which the commissioner had no right to access. This happened in broad daylight.
    - Stratoscope 7y ago
      Forgive me, but what is an MSP?
      - _jal 7y ago
        Managed Service Provider.
- peteretep 7y ago
  > Also make sure the people who hire you actually own the system being tested. I feel like an alternative take on this is “inform the local police department of your plans”
  - muro 7y ago
    Reaction time of the local police department might be part of the test.
    - michaelt 7y ago
      Unless you're hired by the chief of police, that sounds very close to testing a system - the police - without the permission of the owner? And there are safer ways to find the police's reaction time than having them turn up with guns drawn, finding signs of forced entry, and finding you - a non-employee - sneaking around with burglary tools. For example, you could make a FOIA request for their internal records, ask a local journalist - or if you insist on a real-world test, have the alarm 'accidentally' tripped by a legitimate employee arriving for work early.
  - matt_the_bass 7y ago
    Yes. I don’t understand why this isn’t part of the game plan. I understand not informing the patrol level of the police dept, but I do t see how informing the admin above does. The deputy chief is not involved in the management of an enforcement patrol/stop.
Covzire 7y ago
I realize we're in the wild west still with the industry, but I disagree that pen-testers should be ready to spend time in jail. A far better solution, it seems to me, would be to make sure all police and security officers are trained to be aware that A) penetration tests exist and may occur and B) a process to authenticate a pen-tester when they're discovered.
- kjs3 7y ago
  We aren't in the wild west. I've been doing these engagements for more than 20 years. There are well worn guidelines for how to structure the contracts and other rules of engagement to prevent or mitigate this sort of overreaction. I suspect (with zero evidence) that an over-eager sales rep or sales management booked a deal without contract due-diligence and a pen-test team trusted that the due-diligence had been done.
  - jimnotgym 7y ago
    > There are well worn guidelines for how to structure the contracts and other rules of engagement to prevent or mitigate this sort of overreaction. Could you point me to them? Who sets them? Is there some kind of industry body?
- blackearl 7y ago
  We can't even get cops to not start every situation guns blazing. Good luck getting them to do actual policework
kjs3 7y ago
This is why you have explicit language in your documents. It's not there for when things go well - it's when things go bad like this situation. This a thousand time! Put another way (via one of my lawyers): Contracts are for all times when you aren't happy with each other. In fact, I argue this is an expected outcome. How can you run a security contract that does explicitly illegal things w/o having clear language about what is supposed to happen. Completely agree. I would never send a pen-test team/red team/whatever into an engagement without a detailed rules of engagement, an escalation path and a get-out-of-jail-free proviso. A bit crazy these folks didn't pay attention to the details.
ngcc_hk 7y ago
I do not agree. Investigation is needed as the doc can be fake. But charge ? Psychological pressure ? What harm they do, any broken things? Compensation not chasing after the minor contract issue. You let go of the police and the gov lawyer bit by bit you lost your liberty. Make them pay! At least there is a negative feedback loop. Otherwise you end up with police state. Or gov lawyer state. Or worst like hk both.
- FateOfNations 7y ago
  > What harm they do, any broken things? The county sheriff's ego.
peeters 7y ago
> - The pen testers should be ready to spend time in jail and be compensated as such. A piece of paper should not get you off free immediately. That thing needs to be verified, so expect it to take time. Sure, that might explain the 12 hours in jail. It does NOT explain why the county attorney continued with prosecution well after it was clear the men had no criminal intent and were acting on the direction of the state of Iowa. That was a pissing contest, full stop, and the men caught in the middle should be pursuing legal action against the county.
- cosmodisk 7y ago
  What's that saying about motivated fools?...I'm sure there's plenty of those in the justice system.
- GlitchMr 7y ago
  After it became clear they had no criminal intent, they decided to change the crime to one that doesn't require criminal intent. The initial charges were on "third-degree burglary", but then changed to "misdemeanor trespassing".
  - ashtonian 7y ago
    ... When the charge should have been dropped instead as the prosecutor and sheriff were both handed binding legal docs.
  - nighthawk648 7y ago
    Article didn’t mention how they got caught. Further research shows it was while doing the activities. Would’ve been impressive if they got away with it...
    - HenryBemis 7y ago
      > DeMercurio and Wynn were arrested in the early hours of September 11 after a dispatcher with the Dallas County sheriff’s department observed the men wandering through the closed county courthouse with dark backpacks. I understand that they didn't resist arrest: > Deputies were friendly and interested as DeMercurio and Wynn explained how they used a lock-picking device to bypass a locked front door. Looks like all participating in that initial encountered were having a laugh about this (while the dispatch center of course was running the check/authenticity of the claim). And then the politics/pissing contest started. It would have been better if they (pentesters) had bodycams to have the evidence of the whole attempt. That would give them extra defensive points in court.
whatsmyusername 7y ago
I’m happy with the outcome because Coalfire came out looking great and I now know not to take security work in Iowa.
SkyBelow 7y ago
>How can you run a security contract that does explicitly illegal things w/o having clear language about what is supposed to happen. Many actions are very illegal without permission yet we find it very unreasonable to spend time in prison if permission was given. Use sex for example. If you had permission you shouldn't spend any time in prison for it. If the police think you didn't have permission, they should establish that without enough confidence before acting upon it. It is one thing to open an investigation, but the point of arresting people should only be once it has been determined they didn't have permission. >A piece of paper should not get you off free immediately. Only once the police have reason to believe it was fake should you be arrested. Arrest first and ask questions later is a dystopian legal tactic.
- Accujack 7y ago
  > Arrest first and ask questions later is a dystopian legal tactic. It's also the only practical tactic when there's a chance of the targets of an investigation hiding evidence, fleeing, or otherwise hindering that investigation.
  - gowld 7y ago
    "arrest" is a vague term. There is a gap between "detaining" someone while investigating the situation, and "jailing" them. Note that if jails were designer according to "innocent until proven guilty" as legally required, then being jailed temporarily wouldn't be so bad.
  - Retric 7y ago
    None of which was involved in this case. You don’t arrest people for minor traffic violations for example. You detain them to collect relevant information aka pull them over, then let them go.
    - Accujack 7y ago
      You're missing the point... it's not possible to tell in advance whether someone should be arrested or not, you have to follow a standard procedure for a lot of reasons, not the least of which is that doing so safeguards everyone's rights. In the case of traffic violations, the decision to not arrest by default is made far in advance as a matter of policy. When someone at a traffic stop gets arrested, it's not for the traffic violation, it's for another crime they're wanted for, and the standard process for that overrides the traffic stop process.

olliej 7y ago

yeah, but the problem is this shouldn't have taken months to be dropped - the full info about the contract was available by the end of that week, and should have results in the charges being dropped then and there.

bawolff 7y ago

Also make sure the people who hire you actually own the system being tested. Like if my neighbour hires some random to pentest my house for kicks, it doesnt make it ok for pentester to break into my house because they signed a contract with my neighbour

p1necone 7y ago
Depends, if the pentesters didn't ask for any proof that your neighbour owned and occupied the house then sure, the neighbour and the pentesters should be prosecuted. But if your neighbour lied and falsified documents to the point reasonable due diligence would have been fooled, perhaps the pentesters can be considered not at fault?
- bigiain 7y ago
  > But if your neighbour lied and falsified documents to the point reasonable due diligence would have been fooled, perhaps the pentesters can be considered not at fault? And here we end up back with irjustin's proposal that if pentesters are doing things that would be illegal without proper permission, they need to be prepared to spend some time in jail. Their risks there for which they need to be compensated include their own organisation failing in their due diligence and sending them into a test for which they're genuinely not legally authorised.
  - SkyBelow 7y ago
    >And here we end up back with irjustin's proposal that if pentesters are doing things that would be illegal without proper permission, they need to be prepared to spend some time in jail. This sounds very unreasonable once you start applying it to other actions in life. For example, picking up someone's kids so they can go on a play date with your own kids. That's kidnapping without permission. Should everyone who picks up another person's kids need to be prepared to spend time in jail for kidnapping?
    - gowld 7y ago
      This is an issue in schools today regarding after-school care and custody handoffs, with the liberty/efficiency-oriented people battling the law& order/safety/think-of-the-children people. They both have valid perspectives, as is usually case in matters of statistically danger.
thaumasiotes 7y ago
In this case, branches of two different governments were colocated in the same building.
Lazare 7y ago
> Also make sure the people who hire you actually own the system being tested. There's an ongoing political dispute in Iowa over the extent to which the court system controls court buildings. The courts maintain they have full control (and thus can legally authorise, eg, pen testing), and (perhaps unsurprisingly) they keep winning court cases about it. Some of the criticism of Coalfire, DeMercurio, and Wynn was about how they were pentesting buildings their client did not control, but it's worth noting that this is 1) disputed and 2) almost certainly wrong (at least from a legal realism point of view). It's worth emphasising, I think, how much this story had to do with jurisdictional fights between different branches and levels of the Iowa state government, and how little it had to do with Coalfire, DeMercurio, Wynn, or pentesting.
- deleted 7y ago
  [deleted]
- kjs3 7y ago
  This is a very important bit of insight. Thanks for this perspective. My comments about contractual protections aren't nearly as strong in light of this.
- dillonmckay 7y ago
  Seriously, stay out if politics are involved as a pentester, or even as an MSP. We had a legal matter with a county commissioner requesting the MSP use an external harddrive to transfer documents for which the commissioner had no right to access. This happened in broad daylight.
  - Stratoscope 7y ago
    Forgive me, but what is an MSP?
    - _jal 7y ago
      Managed Service Provider.
peteretep 7y ago
> Also make sure the people who hire you actually own the system being tested. I feel like an alternative take on this is “inform the local police department of your plans”
- muro 7y ago
  Reaction time of the local police department might be part of the test.
  - michaelt 7y ago
    Unless you're hired by the chief of police, that sounds very close to testing a system - the police - without the permission of the owner? And there are safer ways to find the police's reaction time than having them turn up with guns drawn, finding signs of forced entry, and finding you - a non-employee - sneaking around with burglary tools. For example, you could make a FOIA request for their internal records, ask a local journalist - or if you insist on a real-world test, have the alarm 'accidentally' tripped by a legitimate employee arriving for work early.
- matt_the_bass 7y ago
  Yes. I don’t understand why this isn’t part of the game plan. I understand not informing the patrol level of the police dept, but I do t see how informing the admin above does. The deputy chief is not involved in the management of an enforcement patrol/stop.

Covzire 7y ago

I realize we're in the wild west still with the industry, but I disagree that pen-testers should be ready to spend time in jail. A far better solution, it seems to me, would be to make sure all police and security officers are trained to be aware that A) penetration tests exist and may occur and B) a process to authenticate a pen-tester when they're discovered.

kjs3 7y ago
We aren't in the wild west. I've been doing these engagements for more than 20 years. There are well worn guidelines for how to structure the contracts and other rules of engagement to prevent or mitigate this sort of overreaction. I suspect (with zero evidence) that an over-eager sales rep or sales management booked a deal without contract due-diligence and a pen-test team trusted that the due-diligence had been done.
- jimnotgym 7y ago
  > There are well worn guidelines for how to structure the contracts and other rules of engagement to prevent or mitigate this sort of overreaction. Could you point me to them? Who sets them? Is there some kind of industry body?
blackearl 7y ago
We can't even get cops to not start every situation guns blazing. Good luck getting them to do actual policework

kjs3 7y ago

This is why you have explicit language in your documents. It's not there for when things go well - it's when things go bad like this situation. This a thousand time! Put another way (via one of my lawyers): Contracts are for all times when you aren't happy with each other. In fact, I argue this is an expected outcome. How can you run a security contract that does explicitly illegal things w/o having clear language about what is supposed to happen. Completely agree. I would never send a pen-test team/red team/whatever into an engagement without a detailed rules of engagement, an escalation path and a get-out-of-jail-free proviso. A bit crazy these folks didn't pay attention to the details.

ngcc_hk 7y ago

I do not agree. Investigation is needed as the doc can be fake. But charge ? Psychological pressure ? What harm they do, any broken things? Compensation not chasing after the minor contract issue. You let go of the police and the gov lawyer bit by bit you lost your liberty. Make them pay! At least there is a negative feedback loop. Otherwise you end up with police state. Or gov lawyer state. Or worst like hk both.

FateOfNations 7y ago
> What harm they do, any broken things? The county sheriff's ego.

peeters 7y ago

> - The pen testers should be ready to spend time in jail and be compensated as such. A piece of paper should not get you off free immediately. That thing needs to be verified, so expect it to take time. Sure, that might explain the 12 hours in jail. It does NOT explain why the county attorney continued with prosecution well after it was clear the men had no criminal intent and were acting on the direction of the state of Iowa. That was a pissing contest, full stop, and the men caught in the middle should be pursuing legal action against the county.

cosmodisk 7y ago
What's that saying about motivated fools?...I'm sure there's plenty of those in the justice system.
GlitchMr 7y ago
After it became clear they had no criminal intent, they decided to change the crime to one that doesn't require criminal intent. The initial charges were on "third-degree burglary", but then changed to "misdemeanor trespassing".
- ashtonian 7y ago
  ... When the charge should have been dropped instead as the prosecutor and sheriff were both handed binding legal docs.
- nighthawk648 7y ago
  Article didn’t mention how they got caught. Further research shows it was while doing the activities. Would’ve been impressive if they got away with it...
  - HenryBemis 7y ago
    > DeMercurio and Wynn were arrested in the early hours of September 11 after a dispatcher with the Dallas County sheriff’s department observed the men wandering through the closed county courthouse with dark backpacks. I understand that they didn't resist arrest: > Deputies were friendly and interested as DeMercurio and Wynn explained how they used a lock-picking device to bypass a locked front door. Looks like all participating in that initial encountered were having a laugh about this (while the dispatch center of course was running the check/authenticity of the claim). And then the politics/pissing contest started. It would have been better if they (pentesters) had bodycams to have the evidence of the whole attempt. That would give them extra defensive points in court.

whatsmyusername 7y ago

I’m happy with the outcome because Coalfire came out looking great and I now know not to take security work in Iowa.

SkyBelow 7y ago

>How can you run a security contract that does explicitly illegal things w/o having clear language about what is supposed to happen. Many actions are very illegal without permission yet we find it very unreasonable to spend time in prison if permission was given. Use sex for example. If you had permission you shouldn't spend any time in prison for it. If the police think you didn't have permission, they should establish that without enough confidence before acting upon it. It is one thing to open an investigation, but the point of arresting people should only be once it has been determined they didn't have permission. >A piece of paper should not get you off free immediately. Only once the police have reason to believe it was fake should you be arrested. Arrest first and ask questions later is a dystopian legal tactic.

Accujack 7y ago
> Arrest first and ask questions later is a dystopian legal tactic. It's also the only practical tactic when there's a chance of the targets of an investigation hiding evidence, fleeing, or otherwise hindering that investigation.
- gowld 7y ago
  "arrest" is a vague term. There is a gap between "detaining" someone while investigating the situation, and "jailing" them. Note that if jails were designer according to "innocent until proven guilty" as legally required, then being jailed temporarily wouldn't be so bad.
- Retric 7y ago
  None of which was involved in this case. You don’t arrest people for minor traffic violations for example. You detain them to collect relevant information aka pull them over, then let them go.
  - Accujack 7y ago
    You're missing the point... it's not possible to tell in advance whether someone should be arrested or not, you have to follow a standard procedure for a lot of reasons, not the least of which is that doing so safeguards everyone's rights. In the case of traffic violations, the decision to not arrest by default is made far in advance as a matter of policy. When someone at a traffic stop gets arrested, it's not for the traffic violation, it's for another crime they're wanted for, and the standard process for that overrides the traffic stop process.