🤖 AI Summary
イオワ州ダラス郡の裁判所で、2019年9月に州司法部が依頼したペンテスト(侵入テスト)を実施していたコロラド拠点のサイバーセキュリティ会社Coalfire Labs所属のジャスティン・ウィンとゲイリー・デ・メルシオが、警官に「侵入は許可されていない」と告げられ、重罪(第三級強盗)で逮捕された。後に罪状は軽罪の不法侵入に減罪され、最終的に全て取り下げられたものの、逮捕歴が就職に支障を来したと主張し、2021年に訴訟を提起。2026年1月、ダラス郡は同二人に対し総額60万ドル(約6600万円)の和解金を支払うことで合意した。裁判所や司法当局は当初のテスト実施手順の不備を認め謝罪したが、郡保安官は「州は郡の建物への侵入を許可できない」と主張し、今後同様のケースが起きた場合は厳格に起訴すると警告している。二人は今回の和解が「公的利益のために正当な仕事をしたにもかかわらず不当な逮捕を受けた」ことの是正であるとコメントし、同様のペンテストが専門家の活動を阻害し公共の安全向上に逆効果になるとの懸念を示した。
"They were crouched down like turkeys peeking over the balcony," the county sheriff told Ars Technica. A half hour past midnight, they were skulking through a courthouse in Iowa's Dallas County on September 11 "carrying backpacks that remind me and several other deputies of maybe the pressure cooker bombs." More deputies arrived...
Justin Wynn, 29 of Naples, Florida, and Gary De Mercurio, 43 of Seattle, slowly proceeded down the stairs with hands raised. They then presented the deputies with a letter that explained the intruders weren't criminals but rather penetration testers who had been hired by Iowa's State Court Administration to test the security of its court information system. After calling one or more of the state court officials listed in the letter, the deputies were satisfied the men were authorized to be in the building.
But Sheriff Chad Leonard had the men arrested on felony third-degree burglary charges (later reduced to misdemeanor trespassing charges). He told them that while the state government may have wanted to test security, "The State of Iowa has no authority to allow you to break into a county building. You're going to jail."
More than six years later, the Des Moines Register reports:
Dallas County is paying $600,000 to two men who sued after they were arrested in 2019 while testing courthouse security for Iowa's Judicial Branch, their lawyer says.
Gary DeMercurio and Justin Wynn were arrested Sept. 11, 2019, after breaking into the Dallas County Courthouse. They spent about 20 hours in jail and were charged with burglary and possession of burglary tools, though the charges were later dropped. The men were employees of Colorado-based cybersecurity firm Coalfire Labs, with whom state judicial officials had contracted to perform an analysis of the state court system's security. Judicial officials apologized and faced legislative scrutiny for how they had conducted the security test.
But even though the burglary charges against DeMercurio and Wynn were dropped, their attorney previously said having a felony arrest on their records made seeking employment difficult. Now the two men are to receive a total of $600,000 as a settlement for their lawsuit, which has been transferred between state and federal courts since they first filed it in July 2021 in Dallas County. The case had been scheduled to go to trial Monday, Jan. 26 until the parties notified the court Jan. 23 of the impending deal...
"The settlement confirms what we have said from the beginning: our work was authorized, professional, and done in the public interest," DeMercurio said in a statement. "What happened to us never should have happened. Being arrested for doing the job we were hired to do turned our lives upside down and damaged reputations we spent years building...."
"This incident didn't make anyone safer," Wynn said. "It sent a chilling message to security professionals nationwide that helping government identify real vulnerabilities can lead to arrest, prosecution, and public disgrace. That undermines public safety, not enhances it."
County Attorney Matt Schultz said dismissing the charges was the decision of his predecessor, according to the newspaper, and that he believed the sheriff did nothing wrong.
"I am putting the public on notice that if this situation arises again in the future, I will prosecute to the fullest extent of the law."
Read more of this story at Slashdot.