If you haven't been following recent news, two Coalfire employees, Gary DeMercurio and Justin Wynn, were performing a Physical Penetration Test against a Judicial Branch Building, the Dallas County Courthouse in the state of Iowa. The two employees were engaged by the Iowa State Judicial Branch to conduct the Physical Penetration Test, which is an authorized attempt to identify weaknesses and exposures through physical security controls to gain access to a facility. These types of tests are conducted regularly by organizations and are focused on enhancing physical security for buildings all around the globe.

During the physical break-in, the two consultants intentionally triggered the alarm to test the response time for law enforcement. They intentionally waited for law enforcement to arrive and were subsequently arrested and charged with felonies. The argument that Dallas County is making is that the buildings are public and that the Iowa State Judicial Branch didn't have the authorization to give to the consultants, yet the consultants are being held legally liable. The charges have since been reduced to third-degree and possession of burglary tools to criminally trespass.

At TrustedSec, we have dedicated physical security personnel that perform the same type of work that the Coalfire employees were conducting. This is an extremely concerning development for our consultants and consultants in similar situations in other organizations. Coalfire employees appear to be caught in a political battle between the county and the state who authorized the tests.

At TrustedSec, we want to show support for the two consultants, Gary DeMercurio and Justin Wynn, and call for the charges to be immediately dropped. These types of actions call into question countless years of authorized testing on behalf of organizations and the industry’s ability to identify flaws and protect organizations within the United States. It's clear that the state believed they had full rights to conduct these types of tests against their facilities, authorizing the consultants to perform a specific job simulating a break-in to the building. The consultants, their lives, and their families should not be used as leverage points between the state and county.

We will be drafting a letter to both the state of Iowa and Dallas County calling for the immediate charges to be dropped as a sign of support for the Coalfire employees. At a time where threats continue to rise and organizations experience breaches from not only a technology perspective, but also a physical standpoint, this type of work is paramount for improving safety and security. We're deeply saddened that two consultants are in a mix of a battle between the state and county as their careers and livelihoods are placed in jeopardy.

It's always important to verify scope and ensure that you have the proper authorization to conduct such activities. Breaking into the wrong building or not having proper authorization are scenarios that may have legal implications. In this case, it appears that Coalfire and its employees had every assurance from the state that they were fully authorized to conduct this work on the facility in question.

If you are interested in reading more about this case and the statement from Coalfire's CEO Tom McAndrew, you can view it here.

January 30, 2020: The charges against two consultants have been dropped after they were found testing the security of an Iowa courthouse while on contract with the judicial branch. 

Dallas County Attorney Charles Sinnard and Coalfire officials released the following joint statement Thursday:

"Ultimately, the long-term interests of justice and protection of the public are not best served by continued prosecution of the trespass charges," they wrote in a statement provided by Sinnard. "Those interests are best served by all the parties working together to ensure that there is clear communication on the actions to be taken to secure the sensitive information maintained by the judicial branch, without endangering the life or property of the citizens of Iowa, law enforcement or the persons carrying out the testing."