🤖 AI Summary
2021年9月11日、アイオワ州ダラス郡の裁判所で、コロラド拠点のサイバーセキュリティ会社Coalfire Labsに所属していたペネトレーションテスターのジャスティン・ウィン(29)とゲイリー・デ・メルキオ(43)が、州裁判所行政が依頼したシステム脆弱性テストのために潜入したことが判明しました。警官に身分証明書と許可書を提示したものの、郡保安官チャド・レナードは「州が郡庁舎への侵入を許可する権限はない」として、3度目の重罪(後に軽罪)で逮捕し、約20時間拘留しました。
その後、窃盗と侵入道具所持の容疑は取り下げられたものの、二人は刑事記録が就職に悪影響を及ぼすと主張し、2021年7月に訴訟を提起。2026年1月、州・連邦裁判所間での係争を経て、ダラス郡は和解金として合計60万ドル(約8,000万円)を支払うことで合意しました。
被告側は「仕事は正式に依頼された公共の利益のためのものであり、逮捕は不当だった」と主張。一方、郡検事は前任者の判断で起訴を取り下げたとし、保安官の行為は違法ではないと主張しています。
この和解は、政府依頼のセキュリティテストが誤って犯罪扱いされるリスクを示すとともに、同業者への「凍結」メッセージが公共安全に逆効果を及ぼす可能性があることを指摘しています。
"They were crouched down like turkeys peeking over the balcony," the county sheriff told Ars Technica. A half hour past midnight, they were skulking through a courthouse in Iowa's Dallas County on September 11 "carrying backpacks that remind me and several other deputies of maybe the pressure cooker bombs." More deputies arrived...
Justin Wynn, 29 of Naples, Florida, and Gary De Mercurio, 43 of Seattle, slowly proceeded down the stairs with hands raised. They then presented the deputies with a letter that explained the intruders weren't criminals but rather penetration testers who had been hired by Iowa's State Court Administration to test the security of its court information system. After calling one or more of the state court officials listed in the letter, the deputies were satisfied the men were authorized to be in the building.
But Sheriff Chad Leonard had the men arrested on felony third-degree burglary charges (later reduced to misdemeanor trespassing charges). He told them that while the state government may have wanted to test security, "The State of Iowa has no authority to allow you to break into a county building. You're going to jail."
More than six years later, the Des Moines Register reports:
Dallas County is paying $600,000 to two men who sued after they were arrested in 2019 while testing courthouse security for Iowa's Judicial Branch, their lawyer says.
Gary DeMercurio and Justin Wynn were arrested Sept. 11, 2019, after breaking into the Dallas County Courthouse. They spent about 20 hours in jail and were charged with burglary and possession of burglary tools, though the charges were later dropped. The men were employees of Colorado-based cybersecurity firm Coalfire Labs, with whom state judicial officials had contracted to perform an analysis of the state court system's security. Judicial officials apologized and faced legislative scrutiny for how they had conducted the security test.
But even though the burglary charges against DeMercurio and Wynn were dropped, their attorney previously said having a felony arrest on their records made seeking employment difficult. Now the two men are to receive a total of $600,000 as a settlement for their lawsuit, which has been transferred between state and federal courts since they first filed it in July 2021 in Dallas County. The case had been scheduled to go to trial Monday, Jan. 26 until the parties notified the court Jan. 23 of the impending deal...
"The settlement confirms what we have said from the beginning: our work was authorized, professional, and done in the public interest," DeMercurio said in a statement. "What happened to us never should have happened. Being arrested for doing the job we were hired to do turned our lives upside down and damaged reputations we spent years building...."
"This incident didn't make anyone safer," Wynn said. "It sent a chilling message to security professionals nationwide that helping government identify real vulnerabilities can lead to arrest, prosecution, and public disgrace. That undermines public safety, not enhances it."
County Attorney Matt Schultz said dismissing the charges was the decision of his predecessor, according to the newspaper, and that he believed the sheriff did nothing wrong.
"I am putting the public on notice that if this situation arises again in the future, I will prosecute to the fullest extent of the law."
Read more of this story at Slashdot.