[HN Gopher] County pays $600k to pentesters it arrested for asse...
___________________________________________________________________
County pays $600k to pentesters it arrested for assessing
courthouse security
Author : MBCook
Score : 222 points
Date : 2026-01-29 18:48 UTC (4 hours ago)
(HTM) web link (arstechnica.com)
(TXT) w3m dump (arstechnica.com)
| ricree wrote:
| I remember reading about this when it first happened. Glad there
| was at least a somewhat positive outcome.
|
| For reference, here is the HN thread shortly after the arrest:
| https://news.ycombinator.com/item?id=21000273
| lgats wrote:
| $600k for 6 years of legal battle and facing felony charges? no
| bueno
| Aurornis wrote:
| The 6 year, $600K lawsuit was something they initiated
| against the county.
|
| The initial charges against them were initially dropped to
| misdemeanors and then dismissed entirely, but that was a
| separate matter resolved earlier.
| giantg2 wrote:
| Even being charged without conviction can result in a
| serious reduction in job opportunities.
| tptacek wrote:
| Probably not in this case though.
| giantg2 wrote:
| It's hard to say if they would be able to gain security
| clearances in the future. Not to mention automated
| application systems will drop them from the system
| immediately with a prior arrest.
| jongjong wrote:
| It seems like a lot. It's not like they were in court full
| time.
| edm0nd wrote:
| I'd gladly take such a payout.
|
| Split 2 ways, that is still 300k.
|
| Parked in an investment at 5% a year, that's an easy
| +$15,000/year for the rest of your life.
| nofriend wrote:
| Once the lawyers take their cut, you could probably split a
| ham sandwich between the two of you.
| dylan604 wrote:
| Don't forget Uncle Sam's cut as well
| wl wrote:
| Compensatory damages aren't taxable income.
| tiahura wrote:
| Bzzt.
|
| Generally taxable unless exclusion applies. Main
| exclusion is personal injury.
| adrr wrote:
| How much did they spend on lawyers?
| tptacek wrote:
| This isn't a felony case. In fact, I'm not sure it ever was?
| It's not clear from their amended complaint, but they were
| ultimately charged with simple trespassing, a misdemeanor.
| Those trespassing charges were themselves dismissed a few
| months later.
|
| What we're talking about today is the resolution of what
| looks to me (not a lawyer) mostly like a defamation case.
| Were they defamed? Absolutely. The problem is, to get
| anything useful out of a defamation case, you need to
| demonstrate damages. They were accused of a crime --- per se
| defamation --- but the point of the suit is to recover
| damages.
|
| I don't want to be glib, and I'm very prepared to be wrong,
| but the Dallas County Courthouse Incident is likely one of
| the top 3 world events to have happened to both these
| pentesters. They've been cause celebres in the field for
| years and years. It might be pretty tricky to actually
| demonstrate damages.
| lazyasciiart wrote:
| Lost clearances at least must count for something.
| tptacek wrote:
| Did they lose clearances? If they did, it's not in their
| civil complaint.
| sophacles wrote:
| They were arrested, arraigned and bonded for felony
| charges. Those were later reduced to misdemeanor charges
| and the case was eventually dropped/dismissed (can't
| remember which) - so they were facing felony charges for a
| while.
| unsnap_biceps wrote:
| Darknet Diaries did an interview with the two pentesters:
| https://darknetdiaries.com/episode/59/
| formerly_proven wrote:
| ... six years ago!
| somehnguy wrote:
| Great episode, but infuriating at the same time
| QuercusMax wrote:
| So... the county sheriff showed up, decided he needed to be a big
| boss man, and made everything worse for everyone. Sounds pretty
| typical.
| thinkingtoilet wrote:
| Exactly. A fragile man needed assert his authority.
| mikkupikku wrote:
| You don't know the man, and you don't know all of the details
| and nuances of the situation he was called into. How then do
| you think to judge him like that? You're just stereotyping.
| thinkingtoilet wrote:
| I do know the details of the situation. And so did the jury
| who awarded them $600k.
| tiahura wrote:
| The detail that there was no jury?
| e44858 wrote:
| > And so did the jury who awarded them $600k
|
| What jury? The payment happened before the trial: "five
| days before a trial was scheduled to begin in the case,
| Dallas County officials agreed to pay $600,000 to settle
| the case".
| mikkupikku wrote:
| You're confusing your own assumptions with knowledge.
| GibbonBreath wrote:
| Are they or are you? How have you determined that they
| don't understand the details?
| petcat wrote:
| I might be mistaken, but it sounds like these guys showed up at
| a facility and did the classical "breaking and entering" thing.
| The onsite (terrified) staff called 911, the police showed up
| and arrested them. The perps said that they were _hired to do
| this_ (they were), but nobody told the Sheriffs office or the
| staff about it.
|
| So yeah, it sucks for these guys' reputations and criminal
| histories, but... what? The onsite staff didn't know what was
| going on, the Sheriffs didn't know what was going on.
|
| The county basically said: "We want you to go try to break into
| this government building. We aren't going to tell the staff or
| the local police about it. Tell us what you find."
| unsnap_biceps wrote:
| you are mistaken. There was no (terrified) staff present. The
| building was empty and they tripped an alarm on entry.
| QuercusMax wrote:
| Did you _read_ the article?
|
| They broke in and set off an alarm, the local cops responded,
| the pentesters showed their credentials, and there was no
| issue.
|
| Then the sheriff arrived, was butthurt because he felt left
| out and wanted to show his authority, and caused these guys 6
| years of grief for literally no reason at all.
| petcat wrote:
| > the local cops responded
|
| Extremely dangerous and irresponsible for the county not to
| alert the local police and Sheriffs office that this
| operation was taking place.
|
| I'm glad these guys got their money.
| noitpmeder wrote:
| Did you even read the article or review the story? The police
| showed up, reviewed and even verified their documents (called
| the numbers on the form to confirm their authorization) and
| we're seemingly satisfied all was in order.
|
| Only once the sheriff himself arrived on scene did he order
| the arrest that caused all the issues. If that didn't happen
| it wouldn't have been a story other than "security
| professionals doing their authorized job".
| Aurornis wrote:
| > reviewed and even verified their documents (called the
| numbers on the form to confirm their authorization)
|
| Apparently there's more to this story. From the original
| article https://arstechnica.com/information-
| technology/2019/11/how-a...
|
| > Another reason for doubt: one of the people listed as a
| contact on the get-out-of-jail-free letter didn't answer
| the deputies' calls, while another said he didn't believe
| the men had permission to conduct physical intrusions.
|
| It's actually kind of amazing that the police first let
| them go after the official contact on the form said they
| _were not_ authorized to intrude in the building.
| sowbug wrote:
| > I might be mistaken [snip].
|
| FTFY
|
| Also - a red-team exercise doesn't work if you tell the
| targets that they're about to be tested.
| petcat wrote:
| Sure, but that's different than not telling the local
| police department. Because they will show up with K9s and
| guns. And then it becomes a very dangerous situation.
| mindslight wrote:
| That sounds like a problem with police procedures and
| accountability. It's weird to blame potential victims for
| that.
|
| And in this case, notifying the police would have
| seemingly affected the test. Based on the reaction they
| did have, I would guess such notification would have
| resulted in the police doing many more drive-bys of the
| courthouse and generally being alert.
| aksss wrote:
| Definitely some things could have been done a bit
| differently. I get that they want to keep staff in the dark,
| and even beat cops, but it seems reasonable and prudent to
| have the highest level of local law enforcement brought into
| the loop in planning red team exercises. The likelihood is
| high that the team will interface with law enforcement. The
| escalation path within the enforcement side of the state
| regulatory machine should be cleared in advance.
|
| I think the takeaway for security teams is that you shouldn't
| let the customer "authorize" what is otherwise criminal
| activity warranting a police response without getting some
| air cover from the enforcement side. Coordinating that is the
| customer's burden to bear and that cover should be secured
| before letting them hand-wave away the risks with a "just
| have the police call me and I'll clear it all up". In
| hindsight only, when you look at it like that, the security
| team was not covering their ass appropriately. In a perfect
| world, you'd assume there's some better planning and
| communication going on behind the curtain. In the real world,
| you need more than the flimsy "guarantee" of calling a guy
| who knows a guy in the middle of the night. At the very
| least, that get out of jail free card should have had as
| signatories judiciary representation and enforcement
| representation (e.g. sheriff).
| wat10000 wrote:
| If the sheriff had found out what was going on and then let
| them go, this wouldn't be news.
|
| If the sheriff had arrested them and found out in the morning
| what was going on and then let them go, this wouldn't be
| news.
|
| If the sheriff had arrested them and brought them before a
| judge who let them go, this wouldn't be news.
|
| What actually happened is the sheriff found out what was
| going on, decided it was still criminal anyway, arrested
| them, and then the county charged and prosecuted them. The
| charges were eventually dismissed. _That_ is why it 's news.
|
| And icing on the cake, the current county attorney disagrees
| with the dismissal done by his predecessor, and says that he
| will prosecute any future incidents of this nature.
| https://www.kcci.com/article/coalfire-contractors-settle-
| dal...
| edm0nd wrote:
| why even bother commenting if you didnt even read the
| article. You just spewed out a bunch of bullshit nonsense of
| nothing that happened lol
| Aurornis wrote:
| That was my first impression, but reading the original story
| from 2019 has a much less one-side pictures:
| https://arstechnica.com/information-technology/2019/11/how-a...
|
| My other comment has more details, but a summary is that they
| the pentesters had been drinking before breaking into the
| building, were doing things that could be interpreted as being
| forbidden by their own contract, and the big one: The person
| listed on their authorization letter denied that they were
| approved to enter the building when called.
|
| That last one is a big deal. If your own authorization contacts
| start telling the police you're not authorized to be in the
| building, you're in trouble.
| janalsncm wrote:
| Yeah I think that's pretty useful context. I can understand
| arresting them and clearing it up with a judge in the
| morning. I can't understand continuing to defame them as the
| lawsuit alleged.
|
| If that's all that had happened I'm guessing it would've
| avoided a lawsuit, since their purpose was to restore their
| reputational damage.
| tag2103 wrote:
| This seems to be on par for this Iowa county which their
| ignorance sadly has painted a major target on their
| innocent citizens- related article:
|
| "Dallas County Attorney Matt Schultz told KCCI: "I want to
| be clear that the decision to dismiss the criminal charges
| that resulted in this civil case against Dallas County was
| made by a previous County Attorney. I am putting the public
| on notice that if this situation arises again in the
| future, I will prosecute to the fullest extent of the law."
|
| https://www.kcci.com/article/coalfire-contractors-settle-
| dal...
| lux-lux-lux wrote:
| Schultz (a 'tough on crime Republican') is the prosecutor
| who filed charges when this thing happened originally, so
| no surprise he still defends his decision.
| OutOfHere wrote:
| For someone who is in such a position in the future, always
| notify the local police in writing and by phone call, if not also
| in person, before starting such an exercise. Make sure they have
| the get-out-of-jail documentation in advance of the exercise. If
| the police doesn't approve, don't do it. It would be better to
| get a no-objection letter from the police in advance. Make sure
| an attorney is aware of the activities and all documentation. Do
| not take any chances. You don't live in a kind or forgiving
| world. Handling unknown unknowns is the point.
| sehugg wrote:
| They had written authorization from the state court and verbal
| confirmation from state court officials. They didn't know there
| would be a pissing match between the judicial branch and the
| sheriff.
| 827a wrote:
| But afaik this wasn't a state courthouse; it's a county
| courthouse. Legally, obviously, the state has authority and
| they were in the right, but functionally this is really good
| advice: if you're doing a penetration test of a space, you
| functionally need to clear it with the people who are
| responsible for the security of that space, and whom you
| might encounter defending it.
|
| Frankly, I would not have taken this gig unless you had
| verbal confirmation that the Sheriff knows about it and has
| signed off. If you're entering a red team situation where the
| State wants to assess the security of their county
| courthouses, but doesn't want the local authorities to know
| its happening because they don't trust them: That is _not_ a
| situation you want to be in the middle of, they gotta sort
| that out.
| jstanley wrote:
| Easy to say in hindsight.
| OutOfHere wrote:
| Considering today's world, they're lucky they didn't get
| shot dead with an entire clip.
| aksss wrote:
| Hindsight's how we all learn. Doing it over again, I'm
| sure those guys would have done things differently. Any
| team would be crazy today to not be more prudent in how
| they operate.
| jstanley wrote:
| Sure, the part I thought was "easy to say in hindsight"
| was:
|
| > I would not have taken this gig unless you had verbal
| confirmation that the Sheriff knows about it and has
| signed off.
|
| We don't know that! We don't know what we would have done
| in that scenario, especially in the context of a thread
| about the very outcome one's supposed foresight would
| have prevented.
|
| From https://en.wikipedia.org/wiki/Hindsight_bias#Attempt
| s_to_red... :
|
| > Research suggests that people still exhibit the
| hindsight bias even when they are aware of it or possess
| the intention of eradicating it. [...] The only
| observable way to decrease hindsight bias in testing is
| to have the participant think about how alternative
| hypotheses could be correct.
|
| So here's an alternative hypothesis:
|
| "Hey, do you reckon we should clear this with the county
| first? The sheriff might come and arrest us on the basis
| that nobody told him we were going to break into the
| courthouse"
|
| "Nah, don't worry about it, I've done this sort of thing
| hundreds of times. And besides, the state has superiority
| over the county anyway, so even if we get caught which
| let's face it we won't because we're leet hackers and
| very incognito... the sheriff won't have any power to do
| anything to us as soon as we tell him it's authorised by
| the state"
|
| "SGTM"
| tiahura wrote:
| _Legally, obviously, the state has authority_
|
| That's not legally obvious. State v county control over
| courthouses creates fights over everything from Aesbestos
| to parking to security. The legal answers lie in state
| constitutional provisions that nobody ever reads and aren't
| particularly helpful.
| xmcp123 wrote:
| Wouldn't that in a lot of ways invalidate the test?
|
| You're trying to see what can be done and what the response is
| from the current security practices and the police showing up
| seems like an important part of that.
| OutOfHere wrote:
| It is not clear what as the defined purpose of the test, if
| it was to measure a successful entry+exit, or measure police
| response, or both. If measuring the police response was a
| purpose, the police should still have been notified, just not
| of the exact date when it would happen. Executing it on a
| random day should offset the prior awareness of the police.
| Secondly, it is up to the police leadership to keep it quiet.
| Aurornis wrote:
| > If the police doesn't approve, don't do it. It would be
| better to get a no-objection letter from the police in advance.
|
| The article says they did have an authorization letter from the
| state court officials (the people running the building) and
| they were released right after the letter was verified with the
| court officials.
|
| At least from what I can see, the police officers involved were
| doing the right thing. They detained the suspects, made a
| proper effort to listen to them and validate their story, and
| then released them.
|
| It was the Sheriff who showed up and didn't like it who then
| hassled them further.
|
| They basically had a no-objection letter from the people in
| charge of the building and the police _officers_ were onboard.
| It was one person who tried to turn it into something else.
| antonymoose wrote:
| That simply is not how the police work. If they get a call
| about a break in they're going to respond and assess.
|
| I bought property with a shooting range years ago from a
| retired SWAT officer with the county. He mentioned that "he
| always calls the sheriff's office to let them know if he was
| doing anything." Now I'd never owned a private range and am not
| from this county.
|
| I called up the sheriff's office and asked for clarification. I
| was advised that no such policy / program exists or is required
| and if the officer must have had is own internal policies and
| chain o command and that is irrelevant to me as a random
| citizen. In short, if a call is made about a shooter they will
| have to respond and so long as I'm not doing anything stupid,
| dangerous, or outright illegal I have nothing to worry about.
| The same goes for any other type of call.
| giantg2 wrote:
| If the state wants to verify the counties are doing an adequate
| job, then tipping them off could result in an invalid
| assessment. The sheriff's reaction raises suspicion that there
| are deficiencies he doesn't want found
| rappatic wrote:
| This happened in 2019. The wheels of justice turn very slowly.
| lazide wrote:
| Justice delayed is justice denied.
| ddtaylor wrote:
| Two people for six years in that industry they probably lost
| a lot more than $600k.
| IshKebab wrote:
| I doubt they were out of work for that whole time.
| tptacek wrote:
| They were held for a total of 20 hours.
| sudobash1 wrote:
| Particularly not with the free advertising they got from
| this.
| otikik wrote:
| Except for the wealthy, who can dial it up or down
| tptacek wrote:
| Certainly the wheels of civil suits do.
| giantg2 wrote:
| My state, like many, defines a speedy criminal trail as the
| trial commencing any time within 5 years of being charged...
| giantg2 wrote:
| When they turn this slowly it's disingenuous to call it
| justice. Spending 10% of your adult life locked in legal
| battles is a ridiculous price to pay for something that should
| be resolved in under a year.
| samrus wrote:
| I kinda hate that it settled. I fully understand the plaintiffs
| not wanting to proceed, but i really wish the sheriff was
| actually punished for what he did. This sort of power tripping
| should be a fireable offence
| worik wrote:
| An elected officer. So punishment by ballot box?
| QuercusMax wrote:
| Since when are elected officials immune from prosecution for
| crimes?
| mminer237 wrote:
| Nobody was pressing (or even alleging) crimes by the
| sheriff AFAIK.
| simonw wrote:
| That thing where law enforcement officers can be elected is
| such a weird American oddity.
|
| Most countries appoint law enforcement officers who are
| qualified for the job.
|
| We had a problem last year here in San Mateo County,
| California where our sheriff was corrupt but we had to pass a
| ballot measure because we couldn't just fire them:
| https://calmatters.org/justice/2025/10/san-mateo-sheriff-
| rem...
| wrs wrote:
| On the other hand, look at our current appointed DoJ and
| FBI leadership. No solution is foolproof.
| toast0 wrote:
| In larger counties, the elected Sherrif is usually more
| managerial and less hands on. If not elected directly, the
| Sherrif would likely be chosen by the elected County Board
| of Supervisors. Which I guess gives you more ability to
| fire, but also means more indirection from the will of the
| people.
| noitpmeder wrote:
| Appointments are a whole other issue (see the extreme
| turnover in the American executive branch every 4 years).
| Id rather the head of my local police dept be significantly
| supported by the populating instead of an appointment from
| a governor, mayor, ... whose entire schtick can change on a
| dime.
|
| Independent elections are a good thing. Bundling offices
| together under a single election that appoints the rest of
| the world is terrible and only leans further into the two
| party see-saw that exists in the USA.
|
| I really wish for proportional representation. Not that it
| really applies to your local police force, but we need to
| break apart the complete A-or-B nature of American
| politics. Form coalitions, not monoliths that trade off
| earning 51% of the electorate every cycle that the
| completely repoints the entirety of the govt for the next 4
| years.
| canucker2016 wrote:
| Sheriff Chad Leonard (queue chad references...) retired in
| 2022.
|
| see
| https://www.desmoinesregister.com/story/news/2022/08/29/dall...
| justin66 wrote:
| It's a pity the $600k won't be deducted from his retirement
| income.
| zerr wrote:
| Should have been at least 6 mln for each, and 15+ years of max
| security jail for those who abuse power, including those who
| "just followed orders".
| Aurornis wrote:
| I'm glad the charges were dismissed, but to be honest the
| original reporting shows the story was actually more nuanced than
| this article led me to believe. 2019 article:
| https://arstechnica.com/information-technology/2019/11/how-a...
|
| I'll probably get downvoted for even questioning the narrative,
| but here are some of the nuances that stood out to me:
|
| - When the police contacted someone listed on the authorization
| letter, that person denied that they had been authorized to
| conduct physical intrusions. Another contact didn't answer their
| phone. What are the police supposed to do if the people
| supposedly authorizing the intrusion are actively denying the
| authorization?
|
| - The contract had vague language that say they couldn't "force-
| open doors". The two men told police they had used a tool to open
| a locked door. The language should have been more specific about
| what was and was not allowed. (EDIT: This is causing a lot of
| controversy. The legal definition of "forced entry" in my state
| does not require literal damage to the property, only a bypassing
| of barriers. I don't know about the circumstances in this state,
| but to be clear the term "force-open doors" doesn't necessarily
| mean using destructive force everywhere)
|
| - The contract said "alarm subversion" was not allowed, but
| supposedly the police had evidence that they were trying to
| manipulate the alarm. They deny this.
|
| - The men had been drinking alcohol before the break-in. By the
| time they were breathalyzed it was at 0.05, meaning the number
| was even higher when they started the break-in. Drinking alcohol
| before you do a professional job guaranteed to get the police
| responding is a terrible idea.
|
| - After they tripped the alarm and the police showed up, they
| didn't immediately identify themselves and end the exercise. They
| hid from the police, claiming that they were "testing the
| authorities' response" which seems obviously out of scope for
| their agreement.
|
| So I agree that the charges were excessive and the Sheriff was in
| the wrong on a lot of things, but after reading the details this
| wasn't really a clear cut case. The pentesters weren't really
| doing everything "by the book" if they thought that testing _the
| police response_ by hiding was in scope of their contract and
| doing this job after a few alcoholic beverages is a bizarre
| choice.
| arcfour wrote:
| I'm not saying it's the most professional choice, but if I were
| about to burgle a courthouse as part of my work, I'd like a
| beer or two to calm my nerves beforehand.
|
| Regarding force, this article says:
|
| > The rules of engagement for this exercise explicitly
| permitted "physical attacks," including "lockpicking," against
| judicial branch buildings so long as they didn't cause
| significant damage.
|
| And later that they entered through an unlocked door, which
| they (it sounds like) kept unlatched by inserting something
| between the latch and the doorjamb. Not unreasonable.
| Aurornis wrote:
| > I'm not saying it's the most professional choice, but if I
| were about to burgle a courthouse as part of my work, I'd
| like a beer or two to calm my nerves beforehand.
|
| This is a job where having impaired judgment is a terrible
| idea.
|
| If someone needs alcohol to do a job that involves taking the
| role of a criminal and summoning the police, drinking alcohol
| before it is a terrible choice no matter how you look at it.
| If they can't do the job without alcohol, they shouldn't be
| doing the job at all. Maintaining unimpaired judgment is a
| baseline expectation for a job like this.
| arcfour wrote:
| I doubt judgement is heavily impaired at 0.05 BAC. That is
| at or below the legal limit to drive a car.
|
| And it really is more of a red herring since they were
| obviously not visibly intoxicated and they didn't actually
| do anything illegal. Their BAC is more of an issue between
| them and their employer, and has no bearing on their false
| arrest.
| Aurornis wrote:
| > I doubt judgement is heavily impaired at 0.05 BAC. That
| is at or below the legal limit to drive a car.
|
| 0.05% BAC will result in a DUI in many countries.
| Regardless, any impairment on a job where you're doing
| things guaranteed to summon the cops is a very bad idea.
|
| BAC also declines linearly over time. I doubt (hope?)
| they weren't drinking on the job, but a 0.05% BAC
| measured after their arrest means their BAC would have
| been higher when they started breaking into the building
| earlier in the night.
| tptacek wrote:
| Only Utah has a 0.05 standard. (I think drinking before a
| nighttime physical pentest is a bad idea).
| shawn_w wrote:
| Washington might be moving to 0.05 too. (A bill just
| narrowly passed the state Senate; still has to clear the
| state house)
| janalsncm wrote:
| > I doubt judgement is heavily impaired at 0.05 BAC
|
| Physical coordination becomes an issue. 70% of subjects
| tested struggled to maintain lane position at 0.02%.
|
| https://pmc.ncbi.nlm.nih.gov/articles/PMC102344
| arcfour wrote:
| I don't see how that relates to, say, software
| engineering or physical pentesting though. And 1/3 people
| is still a fairly significant number that do not suffer
| ill effects. I also said _heavily_ impaired--not that
| they were categorically not suffering from any effect of
| the alcohol.
|
| My point is not that they definitely should have done it.
| It is simply that, in this context, it's really not a big
| deal & is not really germane to the discussion at all.
| They did nothing wrong, stone cold sober or not.
| lux-lux-lux wrote:
| That's not what your link says; impairment at 0.02 BAC is
| _measurable_ , but a fraction of standard day-to-day
| variation for a person. It's roughly equivalent to
| missing coffee at breakfast.
| themafia wrote:
| > heavily impaired
|
| The level of impairment doesn't matter. They are
| impaired. There is no standard or testing which reveals
| the minimum level of impairment that one can safely do
| the job. So, you don't do it impaired, at any level,
| period.
|
| > and has no bearing on their false arrest.
|
| Two people that have obviously been drinking, hiding from
| police, and then making up fantastic sounding stories as
| to why they're in a tax payer owned facility outside of
| working hours. The police had good reason to effect an
| arrest so it can't be "false arrest."
| kstrauser wrote:
| I'd have more "eager" than "anxious" nerves, and I wouldn't
| need a beer for that. The fun thing about pentesting is that
| it doesn't matter if you get caught, although it's more fun
| if you don't.
|
| Hard agree about "forcing", though. The very word implies,
| you know, non-trivial amounts of _force_. Like technically
| walking toward a door in a normal human room at standard
| temperature and pressure means you 're applying non-zero
| amounts of force to it, so arguments like "they applied any
| force at all" can be ignored as goofy.
| janalsncm wrote:
| Is drinking common for physical pentesters? I just do boring
| software stuff but I'm pretty sure drinking on the job would
| be a fireable offense for me.
|
| And even if their BAC was technically under the legal limit,
| their ability to e.g. drive was impaired. So it seems
| unprofessional.
| arcfour wrote:
| Their ability to drive being impaired is somewhat dubious
| since they are under the legal limit in all of the states I
| have heard of.
|
| W/r/t drinking and working, I personally dislike the
| puritanical zero tolerance for alcohol approach that people
| here in the US seem to take by default. Most people can
| have one or two drinks and work just fine, with obvious
| exceptions.
|
| I don't think we should judge people who have to travel to
| a boring small town in Iowa and have to go to work in the
| middle of the night for having a drink or two.
|
| If you can't have just a drink or two, or have to do it
| every day, that's a bigger issue that goes beyond work vs.
| simply having a drink and doing work on occasion.
| chneu wrote:
| Agreed about the puritanical stance here in the US.
|
| People drive on prescription drugs like it's nothing. But
| a beer? Haha.
|
| For context, I've been sober for a decade. I don't mind
| if people have a beer. I get it.
| IshKebab wrote:
| > I just do boring software stuff but I'm pretty sure
| drinking on the job would be a fireable offense for me.
|
| What?? For real?
| Aurornis wrote:
| > Is drinking common for physical pentesters?
|
| Absolutely not.
|
| Physical pentest scenarios are highly likely to end with an
| alarm tripping and the police arriving, except in cases
| where the alarm wasn't armed, didn't have connectivity, or
| was broken.
|
| An encounter with the police was virtually guaranteed in
| this case. Drinking before the job was highly unusual and
| irresponsible.
| kube-system wrote:
| > I just do boring software stuff but I'm pretty sure
| drinking on the job would be a fireable offense for me.
|
| I've never worked a software job where I wasn't provided
| free alcohol at work.
| mandevil wrote:
| Obligatory XKCD: https://xkcd.com/323/
|
| Note that Monroe's number for the peak (0.13%) is
| significantly higher than legal limit for driving, and than
| these guys recorded here.
| technion wrote:
| I'll note 0.05 means you can't legally drive in Australia and
| would be issued a DUI.
| 1970-01-01 wrote:
| The police settled for $600k, it wasn't dismissed.
| Aurornis wrote:
| The original charges against them were dismissed.
|
| They brought a separate case against the police and were
| awarded $600K
|
| Two separate legal matters for the same event.
| 1970-01-01 wrote:
| Ok that makes much more sense
| bink wrote:
| I performed these types of physical pen tests years ago. If we
| were testing security for something like a courthouse we
| would've had a card on each of us with the personal cell phone
| number of the county clerk along with a statement of work that
| described exactly what we were authorized to do, with
| signatures. In some cases we'd have a backup contact number for
| more dangerous stuff. The idea that the emergency contact would
| not answer the phone would've seemed ludicrous. They were
| always aware of where we were and what we were doing at all
| times.
|
| Damaging property was never approved. Drinking alcohol before a
| test would never happen. The insurance risk alone would've been
| nuts, not to mention the reputational damage if someone smelled
| it on your breath. Hiding from law enforcement? I'd need to
| know more about that. If a cop shows up with a gun you
| absolutely do not hide. If it's a security guard on rounds and
| you're waiting for them to move on... sure.
|
| It was often dangerous though. Some security and law
| enforcement types take it personally that they're being
| "tested" and do not react well. We always tried to have some
| former law enforcement or military with us because they were
| less likely to be targeted for abuse than us hackers/nerds.
| rainonmoon wrote:
| > If we were testing security for something like a courthouse
| we would've had a card on each of us with the personal cell
| phone number of the county clerk along with a statement of
| work that described exactly what we were authorized to do,
| with signatures.
|
| You mean... the thing that they had? FTA:
|
| "Within minutes, deputies arrived and confronted the two
| intruders. DeMercurio and Wynn produced an authorization
| letter--known as a "get out of jail free card" in pen-testing
| circles. After a deputy called one or more of the state court
| officials listed in the letter and got confirmation it was
| legit, the deputies said they were satisfied the men were
| authorized to be in the building."
|
| There's also no indication that they damaged property (they
| used a UDT to trip a sensor to bypass the door). Neither of
| us were there, but based on the actual reporting it sounds
| like the worst anyone could accuse these people of being is
| stupidly unprofessional and bad communicators, which if you
| worked with pentesters shouldn't seem like an unprecedented
| aberration.
| Aurornis wrote:
| Read the article further. When the police called the phone
| number on the document, the person on the other end denied
| that they were authorized to be in the building.
| rainonmoon wrote:
| But I'm responding to the notion that they should've had
| signed documentation with the scope with them. They did.
| The fact that their own company hung them out to dry by
| not informing everyone on that list is not the
| pentesters' fault.
| tiahura wrote:
| IIRC they had permission from the state court administrator,
| but not the county. The building is a county building. And,
| as it does in all sorts of jurisdictions with a similar
| setups, pissing contests arise over various issues.
| Aurornis wrote:
| > Hiding from law enforcement? I'd need to know more about
| that. If a cop shows up with a gun you absolutely do not
| hide. If it's a security guard on rounds and you're waiting
| for them to move on... sure.
|
| According to the article, they were hiding from the police
| who showed up, not security guards.
|
| Testing the police is undeniably out of scope in a situation
| like this. If the police show up, the exercise needs to be
| over. You announce your presence and de-escalate, not try to
| outmaneuver the police.
|
| These two guys only look like heroes in contrast to the over
| zealous sheriff. Everything else about their operation ranges
| from amateur hour to complete incompetence, such as drinking
| before a job.
| tiahura wrote:
| All of that is true, but it only means that it should have
| taken a few hours to sort out instead of 15 minutes. It became
| a pissing match between the courts and the county and these guy
| got squeezed. As a lawyer, I can't believe that there wasn't a
| lawyer for the county telling them that night that this was
| going to cost them.
| ottah wrote:
| Seems reasonable to assume some blame from the pentesters, but
| neither are police known to be faithful and honest presenters
| of the truth. I'm not firmly convinced that the police story
| isn't exaggerated or embellished.
| aussieguy1234 wrote:
| Not bad bug bounty if you ask me
| mschuster91 wrote:
| Public service sector: we can't find employees and contractors
| willing to work for us!
|
| Also public service sector: this right here.
|
| Besides, let me guess, that sheriff is elected?
___________________________________________________________________
(page generated 2026-01-29 23:00 UTC)