Table of Contents
A settlement of $600,000 has been reached in a lawsuit brought by two penetration testers who allege they were wrongfully arrested and defamed after conducting a legally authorized security assessment of a county courthouse in Iowa.Teh case highlights the precarious position security professionals can find themselves in when attempting to proactively identify vulnerabilities for government clients.
The “Red Team” Exercise and Initial Arrest
Gary DeMercurio and Justin Wynn,formerly employed by Colorado-based Coalfire Labs,were contracted by the Iowa Judicial branch in 2019 to perform a “red-team” exercise at the Dallas County Courthouse. These exercises simulate the tactics of malicious actors – including attempted security breaches akin to those employed by criminal hackers or burglars – to evaluate the strength of existing defenses.The objective is to proactively uncover weaknesses before they can be exploited.
The rules of engagement for this particular assessment explicitly allowed for “physical attacks,” including lockpicking, against judicial branch buildings, provided no significant damage occurred. On September 11, 2019, after discovering an unlocked side door, the men secured it and then used a tool to manipulate the locking mechanism, gaining entry. They then intentionally triggered an alarm to alert authorities, a standard practice in such exercises.
Despite possessing written authorization for their work, DeMercurio and Wynn were arrested and charged with felony third-degree burglary. They spent 20 hours in jail before being released on $100,000 bail – $50,000 each. The charges were later reduced to misdemeanor trespassing, but the controversy did not end there.
Public Allegations and Lasting Damage
Even after the charges were reduced, Chad Leonard, the sheriff of Dallas County, continued to publicly assert that the men had acted illegally and should be prosecuted.These statements contributed to significant defamation,potentially jeopardizing the careers of the two security professionals.
“Reputational hits from these sorts of events can be fatal to a security professional’s career,” one analyst noted. The prospect of facing arrest and prosecution for performing authorized work understandably raises concerns among penetration testers and the organizations that hire them.
A “Chilling Message” to the Security Community
The incident sparked widespread concern within the security and law enforcement communities. Wynn stated, “This incident didn’t make anyone safer. It sent a chilling message to security professionals nationwide that helping [a] government identify real vulnerabilities can lead to arrest, prosecution, and public disgrace. That undermines public safety, not enhances it.”
The case underscores the importance of clear communication and understanding between security professionals, law enforcement, and government agencies. It also raises questions about the legal protections afforded to those who work to proactively strengthen cybersecurity defenses. The $600,000 settlement serves as a significant acknowledgement of the harm caused by the wrongful arrest and subsequent public accusations.
Why did this happen? gary DeMercurio and Justin Wynn were contracted by the Iowa Judicial Branch to conduct a “red team” exercise at the Dallas County courthouse, simulating a security breach to identify vulnerabilities. Despite having written authorization,they were arrested after triggering an alarm during the exercise.
Who was involved? The key individuals involved were Gary DeMercurio and Justin Wynn (penet
