5 ms·

I'm glad the charges were dismissed, but to be honest the original reporting shows the story was actually more nuanced than this article led me to believe. 2019

by Aurornis 10mo ago

I'm glad the charges were dismissed, but to be honest the original reporting shows the story was actually more nuanced than this article led me to believe. 2019 article: https://arstechnica.com/information-technology/2019/11/how-a-turf-war-and-a-botched-contract-landed-2-pentesters-in-iowa-jail/ https://arstechnica.com/information-technology/2019/11/how-a... I'll probably get downvoted for even questioning the narrative, but here are some of the nuances that stood out to me: - When the police contacted someone listed on the authorization letter, that person denied that they had been authorized to conduct physical intrusions. Another contact didn't answer their phone. What are the police supposed to do if the people supposedly authorizing the intrusion are actively denying the authorization? - The contract had vague language that say they couldn't "force-open doors". The two men told police they had used a tool to open a locked door. The language should have been more specific about what was and was not allowed. (EDIT: This is causing a lot of controversy. The legal definition of "forced entry" in my state does not require literal damage to the property, only a bypassing of barriers. I don't know about the circumstances in this state, but to be clear the term "force-open doors" doesn't necessarily mean using destructive force everywhere) - The contract said "alarm subversion" was not allowed, but supposedly the police had evidence that they were trying to manipulate the alarm. They deny this. - The men had been drinking alcohol before the break-in. By the time they were breathalyzed it was at 0.05, meaning the number was even higher when they started the break-in. Drinking alcohol before you do a professional job guaranteed to get the police responding is a terrible idea. - After they tripped the alarm and the police showed up, they didn't immediately identify themselves and end the exercise. They hid from the police, claiming that they were "testing the authorities' response" which seems obviously out of scope for their agreement. So I agree that the charges were excessive and the Sheriff was in the wrong on a lot of things, but after reading the details this wasn't really a clear cut case. The pentesters weren't really doing everything "by the book" if they thought that testing the police response by hiding was in scope of their contract and doing this job after a few alcoholic beverages is a bizarre choice.

arcfour 10mo ago
I'm not saying it's the most professional choice, but if I were about to burgle a courthouse as part of my work, I'd like a beer or two to calm my nerves beforehand. Regarding force, this article says: > The rules of engagement for this exercise explicitly permitted “physical attacks,” including “lockpicking,” against judicial branch buildings so long as they didn’t cause significant damage. And later that they entered through an unlocked door, which they (it sounds like) kept unlatched by inserting something between the latch and the doorjamb. Not unreasonable.
- Aurornis 10mo ago
  > I'm not saying it's the most professional choice, but if I were about to burgle a courthouse as part of my work, I'd like a beer or two to calm my nerves beforehand. This is a job where having impaired judgment is a terrible idea. If someone needs alcohol to do a job that involves taking the role of a criminal and summoning the police, drinking alcohol before it is a terrible choice no matter how you look at it. If they can't do the job without alcohol, they shouldn't be doing the job at all. Maintaining unimpaired judgment is a baseline expectation for a job like this.
  - arcfour 10mo ago
    I doubt judgement is heavily impaired at 0.05 BAC. That is at or below the legal limit to drive a car. And it really is more of a red herring since they were obviously not visibly intoxicated and they didn't actually do anything illegal. Their BAC is more of an issue between them and their employer, and has no bearing on their false arrest.
    - Aurornis 10mo ago
      > I doubt judgement is heavily impaired at 0.05 BAC. That is at or below the legal limit to drive a car. 0.05% BAC will result in a DUI in many countries. Regardless, any impairment on a job where you're doing things guaranteed to summon the cops is a very bad idea. BAC also declines linearly over time. I doubt (hope?) they weren't drinking on the job, but a 0.05% BAC measured after their arrest means their BAC would have been higher when they started breaking into the building earlier in the night.
      - tptacek 10mo ago
        Only Utah has a 0.05 standard. (I think drinking before a nighttime physical pentest is a bad idea).
        shawn_w 10mo ago
        Washington might be moving to 0.05 too. (A bill just narrowly passed the state Senate; still has to clear the state house)
1970-01-01 10mo ago
The police settled for $600k, it wasn't dismissed.
- Aurornis 10mo ago
  The original charges against them were dismissed. They brought a separate case against the police and were awarded $600K Two separate legal matters for the same event.
  - 1970-01-01 10mo ago
    Ok that makes much more sense
bink 10mo ago
I performed these types of physical pen tests years ago. If we were testing security for something like a courthouse we would've had a card on each of us with the personal cell phone number of the county clerk along with a statement of work that described exactly what we were authorized to do, with signatures. In some cases we'd have a backup contact number for more dangerous stuff. The idea that the emergency contact would not answer the phone would've seemed ludicrous. They were always aware of where we were and what we were doing at all times. Damaging property was never approved. Drinking alcohol before a test would never happen. The insurance risk alone would've been nuts, not to mention the reputational damage if someone smelled it on your breath. Hiding from law enforcement? I'd need to know more about that. If a cop shows up with a gun you absolutely do not hide. If it's a security guard on rounds and you're waiting for them to move on... sure. It was often dangerous though. Some security and law enforcement types take it personally that they're being "tested" and do not react well. We always tried to have some former law enforcement or military with us because they were less likely to be targeted for abuse than us hackers/nerds.
- rainonmoon 10mo ago
  > If we were testing security for something like a courthouse we would've had a card on each of us with the personal cell phone number of the county clerk along with a statement of work that described exactly what we were authorized to do, with signatures. You mean... the thing that they had? FTA: "Within minutes, deputies arrived and confronted the two intruders. DeMercurio and Wynn produced an authorization letter—known as a “get out of jail free card” in pen-testing circles. After a deputy called one or more of the state court officials listed in the letter and got confirmation it was legit, the deputies said they were satisfied the men were authorized to be in the building." There's also no indication that they damaged property (they used a UDT to trip a sensor to bypass the door). Neither of us were there, but based on the actual reporting it sounds like the worst anyone could accuse these people of being is stupidly unprofessional and bad communicators, which if you worked with pentesters shouldn't seem like an unprecedented aberration.
  - Aurornis 10mo ago
    Read the article further. When the police called the phone number on the document, the person on the other end denied that they were authorized to be in the building.
tiahura 10mo ago
All of that is true, but it only means that it should have taken a few hours to sort out instead of 15 minutes. It became a pissing match between the courts and the county and these guy got squeezed. As a lawyer, I can't believe that there wasn't a lawyer for the county telling them that night that this was going to cost them.
ottah 10mo ago
Seems reasonable to assume some blame from the pentesters, but neither are police known to be faithful and honest presenters of the truth. I'm not firmly convinced that the police story isn't exaggerated or embellished.

arcfour 10mo ago

I'm not saying it's the most professional choice, but if I were about to burgle a courthouse as part of my work, I'd like a beer or two to calm my nerves beforehand. Regarding force, this article says: > The rules of engagement for this exercise explicitly permitted “physical attacks,” including “lockpicking,” against judicial branch buildings so long as they didn’t cause significant damage. And later that they entered through an unlocked door, which they (it sounds like) kept unlatched by inserting something between the latch and the doorjamb. Not unreasonable.

Aurornis 10mo ago
> I'm not saying it's the most professional choice, but if I were about to burgle a courthouse as part of my work, I'd like a beer or two to calm my nerves beforehand. This is a job where having impaired judgment is a terrible idea. If someone needs alcohol to do a job that involves taking the role of a criminal and summoning the police, drinking alcohol before it is a terrible choice no matter how you look at it. If they can't do the job without alcohol, they shouldn't be doing the job at all. Maintaining unimpaired judgment is a baseline expectation for a job like this.
- arcfour 10mo ago
  I doubt judgement is heavily impaired at 0.05 BAC. That is at or below the legal limit to drive a car. And it really is more of a red herring since they were obviously not visibly intoxicated and they didn't actually do anything illegal. Their BAC is more of an issue between them and their employer, and has no bearing on their false arrest.
  - Aurornis 10mo ago
    > I doubt judgement is heavily impaired at 0.05 BAC. That is at or below the legal limit to drive a car. 0.05% BAC will result in a DUI in many countries. Regardless, any impairment on a job where you're doing things guaranteed to summon the cops is a very bad idea. BAC also declines linearly over time. I doubt (hope?) they weren't drinking on the job, but a 0.05% BAC measured after their arrest means their BAC would have been higher when they started breaking into the building earlier in the night.
    - tptacek 10mo ago
      Only Utah has a 0.05 standard. (I think drinking before a nighttime physical pentest is a bad idea).
      - shawn_w 10mo ago
        Washington might be moving to 0.05 too. (A bill just narrowly passed the state Senate; still has to clear the state house)

1970-01-01 10mo ago

The police settled for $600k, it wasn't dismissed.

Aurornis 10mo ago
The original charges against them were dismissed. They brought a separate case against the police and were awarded $600K Two separate legal matters for the same event.
- 1970-01-01 10mo ago
  Ok that makes much more sense

bink 10mo ago

I performed these types of physical pen tests years ago. If we were testing security for something like a courthouse we would've had a card on each of us with the personal cell phone number of the county clerk along with a statement of work that described exactly what we were authorized to do, with signatures. In some cases we'd have a backup contact number for more dangerous stuff. The idea that the emergency contact would not answer the phone would've seemed ludicrous. They were always aware of where we were and what we were doing at all times. Damaging property was never approved. Drinking alcohol before a test would never happen. The insurance risk alone would've been nuts, not to mention the reputational damage if someone smelled it on your breath. Hiding from law enforcement? I'd need to know more about that. If a cop shows up with a gun you absolutely do not hide. If it's a security guard on rounds and you're waiting for them to move on... sure. It was often dangerous though. Some security and law enforcement types take it personally that they're being "tested" and do not react well. We always tried to have some former law enforcement or military with us because they were less likely to be targeted for abuse than us hackers/nerds.

rainonmoon 10mo ago
> If we were testing security for something like a courthouse we would've had a card on each of us with the personal cell phone number of the county clerk along with a statement of work that described exactly what we were authorized to do, with signatures. You mean... the thing that they had? FTA: "Within minutes, deputies arrived and confronted the two intruders. DeMercurio and Wynn produced an authorization letter—known as a “get out of jail free card” in pen-testing circles. After a deputy called one or more of the state court officials listed in the letter and got confirmation it was legit, the deputies said they were satisfied the men were authorized to be in the building." There's also no indication that they damaged property (they used a UDT to trip a sensor to bypass the door). Neither of us were there, but based on the actual reporting it sounds like the worst anyone could accuse these people of being is stupidly unprofessional and bad communicators, which if you worked with pentesters shouldn't seem like an unprecedented aberration.
- Aurornis 10mo ago
  Read the article further. When the police called the phone number on the document, the person on the other end denied that they were authorized to be in the building.

tiahura 10mo ago

All of that is true, but it only means that it should have taken a few hours to sort out instead of 15 minutes. It became a pissing match between the courts and the county and these guy got squeezed. As a lawyer, I can't believe that there wasn't a lawyer for the county telling them that night that this was going to cost them.

ottah 10mo ago

Seems reasonable to assume some blame from the pentesters, but neither are police known to be faithful and honest presenters of the truth. I'm not firmly convinced that the police story isn't exaggerated or embellished.