14 ms·
County pays $600k to pentesters it arrested for assessing courthouse security
- ricree 9mo agoI remember reading about this when it first happened. Glad there was at least a somewhat positive outcome. For reference, here is the HN thread shortly after the arrest: https://news.ycombinator.com/item?id=21000273 https://news.ycombinator.com/item?id=21000273
- lgats 9mo ago$600k for 6 years of legal battle and facing felony charges? no bueno
- Aurornis 9mo agoThe 6 year, $600K lawsuit was something they initiated against the county. The initial charges against them were initially dropped to misdemeanors and then dismissed entirely, but that was a separate matter resolved earlier.
- giantg2 9mo agoEven being charged without conviction can result in a serious reduction in job opportunities.
- tptacek 9mo agoProbably not in this case though.
- giantg2 9mo agoIt's hard to say if they would be able to gain security clearances in the future. Not to mention automated application systems will drop them from the system immediately with a prior arrest.
- tptacek 9mo agoOne of them went on to start their own physical pentest firm. I think they're doing fine. I also think if they'd lost clearances, or ran into later clearance problems, that would have made it into their complaint. I don't know, maybe you're right. It's not like I disagree with them about suing.
- cartoonworld 9mo agoI mean it was fine for these guys because they got huge press and happen to be in an industry that can handle this. They've got experience, current employment, industry contacts, and there's really barely a functional college curriculum, or certification track for this. You #1 need to be trusted to break in since you know, they teach each other how to break into high-security facilities. I really just wanna point out that getting contracts for government administrative building is already like, way in and near the top of the game, this could have set them back 9 months or none at all, still, someone has to be held accountable when there is an obvious miscarriage like this. I mean they called their boss! They had a special letter! Why didn't shitty sheriff just like demand that the security chief come out and make some calls? 600k sounds fair I suppose but 6 years sure doesn't when its an elected official!
- tptacek 9mo agoCivil litigation takes for-ev-er.
- LadyCailin 9mo agoTHIS should be illegal. If you are arrested and have all charges dropped, you should not show up on any database whatsoever, nor be required to answer “yes” to “gave you been arrested.”
- tptacek 9mo agoThe SF86 has a 7-year lookback on arrests. Clearance is fundamentally discretionary, though; it's a risk assessment. I don't think you have even a due process right to it. I say all this but --- knowing that the principals in this story might read this thread and drop in and correct me, which would be awesome --- I think it's actually more likely that their careers benefited from this news story, and that they probably didn't lose any cleared business from it. I can't say enough that these two became industry celebrities over this case.
- hn_throwaway_99 9mo agoIs that accurate? Being charged with a crime but then having charges subsequently dropped shouldn't show up in a background check. Plus, given their line of work, I think in their profession it would basically be a badge of honor.
- xvector 9mo agoIt does show up in background checks unfortunately, and it is considered.
- giantg2 9mo agoYou'd have to get it expunged for it to not show up. Even then, it will still show up for security clearances and such.
- jimt1234 9mo agoCan confirm. I needed a security clearance for government contracting work when I was in my mid-30s. The background check flagged a dismissed charge from when I was a teenager.
- port443 9mo agoYes it absolutely matters. My brother was charged with three felonies in his only arrest, all of them dropped. It shows up in his background report and no company has cared (or taken the time to notice) that they are dropped charges and not convictions. He's basically treated like a felon and effectively got bumped out of his career.
- ryandrake 9mo agoAlso, I've seen many job applications that ask a question like: "Have you ever been arrested for a crime, regardless of the outcome?" Presumably mere involvement with law enforcement (even if acquitted or charges dropped) is some kind of signal in these guys' risk formulas.
- treebeard901 9mo ago
- jongjong 9mo agoIt seems like a lot. It's not like they were in court full time.
- red-iron-pine 9mo agohow much did those lawyers cost to get the criminal charges dropped? 600k would certainly be on the high end, but 50k wouldn't be crazy. and then impacts for their career, sheer ineptitude of the gubmnt, etc.
- edm0nd 9mo agoI'd gladly take such a payout. Split 2 ways, that is still 300k. Parked in an investment at 5% a year, that's an easy +$15,000/year for the rest of your life.
- nofriend 9mo agoOnce the lawyers take their cut, you could probably split a ham sandwich between the two of you.
- adrr 9mo agoHow much did they spend on lawyers?
- jiveturkey 9mo agoI would guess this would be a contingency case, which would typically be 40%.
- tptacek 9mo agoThis isn't a felony case. In fact, I'm not sure it ever was? It's not clear from their amended complaint, but they were ultimately charged with simple trespassing, a misdemeanor. Those trespassing charges were themselves dismissed a few months later. What we're talking about today is the resolution of what looks to me (not a lawyer) mostly like a defamation case. Were they defamed? Absolutely. The problem is, to get anything useful out of a defamation case, you need to demonstrate damages. They were accused of a crime --- per se defamation --- but the point of the suit is to recover damages. I don't want to be glib, and I'm very prepared to be wrong, but the Dallas County Courthouse Incident is likely one of the top 3 world events to have happened to both these pentesters. They've been cause celebres in the field for years and years. It might be pretty tricky to actually demonstrate damages.
- lazyasciiart 9mo agoLost clearances at least must count for something.
- tptacek 9mo agoDid they lose clearances? If they did, it's not in their civil complaint.
- lazyasciiart 9mo agoI didn’t see how long it took for the charges to change from felony to misdemeanor before being dropped. It would be standard for clearances to be suspended for investigation when you get charged with a felony. (You have to report even an arrest or misdemeanor, but it’s less likely they’ll suspend it while investigating you for those).
- tptacek 9mo agoTheir lawyers issued a press release that sketched out the timeline.
- sophacles 9mo ago
- unsnap_biceps 9mo agoDarknet Diaries did an interview with the two pentesters: https://darknetdiaries.com/episode/59/ https://darknetdiaries.com/episode/59/
- formerly_proven 9mo ago... six years ago!
- somehnguy 9mo agoGreat episode, but infuriating at the same time
- hoistbypetard 9mo agoI really hope he brings them back for a follow-up now that it's settled. (And I've requested it on fedi.)
- QuercusMax 9mo agoSo... the county sheriff showed up, decided he needed to be a big boss man, and made everything worse for everyone. Sounds pretty typical.
- thinkingtoilet 9mo agoExactly. A fragile man needed assert his authority.
- mikkupikku 9mo agoYou don't know the man, and you don't know all of the details and nuances of the situation he was called into. How then do you think to judge him like that? You're just stereotyping.
- thinkingtoilet 9mo agoI do know the details of the situation. And so did the jury who awarded them $600k.
- tiahura 9mo agoThe detail that there was no jury?
- e44858 9mo ago> And so did the jury who awarded them $600k What jury? The payment happened before the trial: "five days before a trial was scheduled to begin in the case, Dallas County officials agreed to pay $600,000 to settle the case".
- bawolff 9mo agoIn fairness, people don't generally give 6 figure settlements if they think the jury will agree with them
- 9mo ago
- OutOfHere 9mo agoFor someone who is in such a position in the future, always notify the local police in writing and by phone call, if not also in person, before starting such an exercise. Make sure they have the get-out-of-jail documentation in advance of the exercise. If the police doesn't approve, don't do it. It would be better to get a no-objection letter from the police in advance. Make sure an attorney is aware of the activities and all documentation. Do not take any chances. You don't live in a kind or forgiving world. Handling unknown unknowns is the point.
- sehugg 9mo agoThey had written authorization from the state court and verbal confirmation from state court officials. They didn't know there would be a pissing match between the judicial branch and the sheriff.
- 827a 9mo agoBut afaik this wasn't a state courthouse; it's a county courthouse. Legally, obviously, the state has authority and they were in the right, but functionally this is really good advice: if you're doing a penetration test of a space, you functionally need to clear it with the people who are responsible for the security of that space, and whom you might encounter defending it. Frankly, I would not have taken this gig unless you had verbal confirmation that the Sheriff knows about it and has signed off. If you're entering a red team situation where the State wants to assess the security of their county courthouses, but doesn't want the local authorities to know its happening because they don't trust them: That is not a situation you want to be in the middle of, they gotta sort that out.
- rappatic 9mo agoThis happened in 2019. The wheels of justice turn very slowly.
- lazide 9mo agoJustice delayed is justice denied.
- ddtaylor 9mo agoTwo people for six years in that industry they probably lost a lot more than $600k.
- IshKebab 9mo agoI doubt they were out of work for that whole time.
- tptacek 9mo agoThey were held for a total of 20 hours.
- rockskon 9mo agoNot relevant to the reputational damage which is particularly punishing in their line of work.
- Scoundreller 9mo agoI wonder how much stigma contractors carry for being successful at filing lawsuits, no matter how legitimate the claim.
- tptacek 9mo agoWhat reputational damage?
- 9mo ago
- samrus 9mo agoI kinda hate that it settled. I fully understand the plaintiffs not wanting to proceed, but i really wish the sheriff was actually punished for what he did. This sort of power tripping should be a fireable offence
- worik 9mo agoAn elected officer. So punishment by ballot box?
- QuercusMax 9mo agoSince when are elected officials immune from prosecution for crimes?
- mminer237 9mo agoNobody was pressing (or even alleging) crimes by the sheriff AFAIK.
- simonw 9mo agoThat thing where law enforcement officers can be elected is such a weird American oddity. Most countries appoint law enforcement officers who are qualified for the job. We had a problem last year here in San Mateo County, California where our sheriff was corrupt but we had to pass a ballot measure because we couldn't just fire them: https://calmatters.org/justice/2025/10/san-mateo-sheriff-removed-from-office/ https://calmatters.org/justice/2025/10/san-mateo-sheriff-rem...
- wrs 9mo agoOn the other hand, look at our current appointed DoJ and FBI leadership. No solution is foolproof.
- toast0 9mo agoIn larger counties, the elected Sherrif is usually more managerial and less hands on. If not elected directly, the Sherrif would likely be chosen by the elected County Board of Supervisors. Which I guess gives you more ability to fire, but also means more indirection from the will of the people.
- zerr 9mo agoShould have been at least 6 mln for each, and 15+ years of max security jail for those who abuse power, including those who "just followed orders".
- Aurornis 9mo agoI'm glad the charges were dismissed, but to be honest the original reporting shows the story was actually more nuanced than this article led me to believe. 2019 article: https://arstechnica.com/information-technology/2019/11/how-a-turf-war-and-a-botched-contract-landed-2-pentesters-in-iowa-jail/ https://arstechnica.com/information-technology/2019/11/how-a... I'll probably get downvoted for even questioning the narrative, but here are some of the nuances that stood out to me: - When the police contacted someone listed on the authorization letter, that person denied that they had been authorized to conduct physical intrusions. Another contact didn't answer their phone. What are the police supposed to do if the people supposedly authorizing the intrusion are actively denying the authorization? - The contract had vague language that say they couldn't "force-open doors". The two men told police they had used a tool to open a locked door. The language should have been more specific about what was and was not allowed. (EDIT: This is causing a lot of controversy. The legal definition of "forced entry" in my state does not require literal damage to the property, only a bypassing of barriers. I don't know about the circumstances in this state, but to be clear the term "force-open doors" doesn't necessarily mean using destructive force everywhere) - The contract said "alarm subversion" was not allowed, but supposedly the police had evidence that they were trying to manipulate the alarm. They deny this. - The men had been drinking alcohol before the break-in. By the time they were breathalyzed it was at 0.05, meaning the number was even higher when they started the break-in. Drinking alcohol before you do a professional job guaranteed to get the police responding is a terrible idea. - After they tripped the alarm and the police showed up, they didn't immediately identify themselves and end the exercise. They hid from the police, claiming that they were "testing the authorities' response" which seems obviously out of scope for their agreement. So I agree that the charges were excessive and the Sheriff was in the wrong on a lot of things, but after reading the details this wasn't really a clear cut case. The pentesters weren't really doing everything "by the book" if they thought that testing the police response by hiding was in scope of their contract and doing this job after a few alcoholic beverages is a bizarre choice.
- arcfour 9mo agoI'm not saying it's the most professional choice, but if I were about to burgle a courthouse as part of my work, I'd like a beer or two to calm my nerves beforehand. Regarding force, this article says: > The rules of engagement for this exercise explicitly permitted “physical attacks,” including “lockpicking,” against judicial branch buildings so long as they didn’t cause significant damage. And later that they entered through an unlocked door, which they (it sounds like) kept unlatched by inserting something between the latch and the doorjamb. Not unreasonable.
- aussieguy1234 9mo agoNot bad bug bounty if you ask me
- mschuster91 9mo agoPublic service sector: we can't find employees and contractors willing to work for us! Also public service sector: this right here. Besides, let me guess, that sheriff is elected?
- aowetlawej 9mo agoGood god I'm so glad I left dallas. I grew up there. What an awful dump of a city.
- duxup 9mo agoWhat is wild about this is the cops showed up, held the guys, they showed them their letter that they were authorized and the cops called the references on the letter and everyone was fine. Then the Sheriff showed up and insisted they be arrested... Everything was fine until one person who didn't get it, who happened to be in charge, showed up.
- exabrial 9mo agoPer the legal system, arrested is probably safe course of action until they could verify the authenticity of the letter. It's really the ensuing events after that were abysmally stupid.
- kadoban 9mo agoIf they know who they are, what's the point? You can track them down later and throw on ~fraud charges if the letter ends up fake.
- exabrial 9mo agoThats exactly what an arrest is...
- lyu07282 9mo agoSo you read this: > the cops showed up, held the guys > they showed them their letter that they were authorized > the cops called the references on the letter > Then the Sheriff showed up and insisted they be arrested... and your response is: > Per the legal system, arrested is probably safe course of action until they could verify the authenticity of the letter. ?
- rrr_oh_man 9mo agoIt's the irresistible taste of boot.
- 9mo ago
- alexfromapex 9mo agoThis is the kind of hacker news I'm here for
- deleted 9mo ago[deleted]
- derangedHorse 9mo agoI remember this story and how dumb I thought it was when it happened. Personally I think the sheriff should be fired, but $100k for every year of incompetency from Dallas county isn’t the worst outcome.
- valbaca 9mo agoThis just shows that even in the most obvious cases, if a cop wants to fuck up your life it might only take SIX YEARS to get back to normalcy.