From pen-testing to penitentiary
TWO MEN HIRED to conduct a penetration test of an Iowa courthouse have been arrested after attempting a break-in of the facility.
The pen-testing duo were arrested on Wednesday after attempting the break-in of Dallas County Courthouse in Adel, Iowa.
Under interrogation, the men told police that they were hired by the state court administration to test the safety of court records and to sniff out potential security vulnerabilities.
According to the Des Moines Register, Gary Demercurio, 43, of Seattle, Washington, and Justin Wynn, 29, of Naples in Florida, were arrested were found in the courthouse after Dallas County deputies responded to a reported burglar alarm.
Both were allegedly “walking around on the third floor of the courthouse” when the deputies’ arrived at the site.
Two pentesters with burglary tools were arrested for breaking into Dallas County Courthouse – said they were hired to do so to test courthouse alarm system and law enforcement response time. County said no agreement existed, but turns out they were wrong. https://t.co/RVxhFYjRof
— Kim Zetter (@KimZetter) September 12, 2019
Wynn and Demercurio were in possession of numerous burglary tools and told deputies that they were hired to test the viability of the courthouse alarm system and to check the response time of law enforcement agencies.
The Dallas County officials, however, were not aware of the alleged contract, the criminal complaint revealed.
Later, the County official discovered that the two men were in fact, hired by the state court administration to try to “access” court records through “various means” to find out potential security vulnerabilities of the electronic court records.
The state court administration acknowledged that the two men had been hired, but said they were not supposed to physically break into the courthouse.
“It’s a strange case,” said Dallas County Sheriff Chad Leonard. “We’re still investigating this thing.”
Gary Demercurio and Justin Wynn were employed by cybersecurity firm Coalfire, based in Colorado, Iowa, and the state court administration had contacted Coalfire to test the security of court records.
“Our employees work diligently to ensure our engagements are conducted with utmost integrity and in alignment with the objectives of our client,” Coalfire said in a statement.
The company declined to provide further detail on this specific case.
Both men have been charged with third-degree burglary and possession of burglary tools. They are being held on a $50,000 bond each.
The state court administration said such penetration tests are required to ensure safety of personal information contained in the court documents. The administration has also issued an apology to Dallas County officials, who are still investigating the case. µ