Two pen testers hired to check courthouse security arrested for burglary
State commissioned the penetration test hadn't anticipated that the security pros would test the court's physical security
Two men hired to conduct a penetration test of an Iowa courthouse were arrested this week after attempting a break-in of the facility.
The men were arrested early on Wednesday after attempting the break-in of Dallas County Courthouse in Adel, Iowa.
Under interrogation, the men told police that they were hired by the state court administration to test the safety of court records and to find out potential security vulnerabilities.
According to the Des Moines Register, Gary Demercurio, 43, of Seattle, Washington, and Justin Wynn, 29, of Naples in Florida, were arrested on Wednesday for the attempted break-in of the court building. They were found in the courthouse after Dallas County deputies responded to a reported burglary alarm.
Both were allegedly "walking around on the third floor of the courthouse" when the deputies' arrived at the site.
Wynn and Demercurio were in possession of numerous burglary tools and told deputies that they were hired to test the viability of the courthouse alarm system and to check the response time of law enforcement agencies.
The Dallas County officials, however, were not aware of the alleged contract, as claimed by the two men, the criminal complaint revealed.
Later, the County official discovered that the two men were in fact, hired by the state court administration to try to "access" court records through "various means" to find out potential security vulnerabilities of the electronic court records.
The state court administration acknowledged that the two men had been hired, but said they were not supposed to physically break into the courthouse.
"It's a strange case," said Dallas County Sheriff Chad Leonard. "We're still investigating this thing."
Gary Demercurio and Justin Wynn were employed by cyber-security firm Coalfire, based in Colorado, Iowa, and the state court administration had contacted Coalfire to test the security of court records.
"Our employees work diligently to ensure our engagements are conducted with utmost integrity and in alignment with the objectives of our client," Coalfire said in a statement.
The company declined to provide further detail on this specific case.
Both men have been charged with third-degree burglary and possession of burglary tools. They are being held on a $50,000 bond each.
The state court administration said such penetration tests are required to ensure safety of personal information contained in the court documents. The administration has also issued an apology to Dallas County officials, who are still investigating the case.