WEBVTT

00:00:04.740 --> 00:00:06.000
DAD: [PHONE RINGING] Hello?

00:00:06.000 --> 00:00:07.259
JACK: Hey, Papa Bear.

00:00:07.259 --> 00:00:08.950
DAD: Is this Little Boo-Boo Bear?

00:00:08.950 --> 00:00:10.480
JACK: Hey, how’s it going?

00:00:10.480 --> 00:00:14.370
This is my dad and I called him up to have him tell us this story.

00:00:14.370 --> 00:00:19.529
Do you remember the time when we visited the Dean’s office at my university?

00:00:19.529 --> 00:00:21.679
DAD: Oh, that was a nightmare.

00:00:21.679 --> 00:00:23.300
JACK: Yeah.

00:00:23.300 --> 00:00:28.029
First of all, why were we trying to go to see the Dean?

00:00:28.029 --> 00:00:32.390
I think I got denied for like, taking too many courses at once.

00:00:32.390 --> 00:00:37.180
[BACKGROUND TALKING] I was trying to take twenty-five credit hours in one semester or

00:00:37.180 --> 00:00:40.410
something, so my dad was really upset with the school for not letting me do it.

00:00:40.410 --> 00:00:43.399
DAD: This is crap; let’s go down there to the Dean.

00:00:43.399 --> 00:00:44.399
You said really?

00:00:44.399 --> 00:00:46.399
I said yeah, we’ll get these classes approved.

00:00:46.399 --> 00:00:50.750
JACK: Yeah, so I jump in the car with you ‘cause I’m living at home still, so I

00:00:50.750 --> 00:00:51.930
jump in your car.

00:00:51.930 --> 00:00:53.359
You drive us down to the school.

00:00:53.359 --> 00:00:54.359
DAD: Yes.

00:00:54.359 --> 00:00:55.950
JACK: We get to the university.

00:00:55.950 --> 00:00:58.224
My dad doesn’t know the school layout very well so I have to show him where to go.

00:00:58.224 --> 00:01:01.359
DAD: We go into the offices where the Deans are.

00:01:01.359 --> 00:01:05.160
JACK: He sees the name on the door that says this is the Dean’s office.

00:01:05.160 --> 00:01:10.880
DAD: I kick open the door to make my presence and the man behind the desk – I don’t

00:01:10.880 --> 00:01:18.490
know if he stood up and then sat back down but he did look a little terrified.

00:01:18.490 --> 00:01:22.820
I just went into my little tyrant; how dare you stop education?

00:01:22.820 --> 00:01:23.910
Somebody wants to learn.

00:01:23.910 --> 00:01:25.710
How can you say no to this?

00:01:25.710 --> 00:01:29.960
JACK: This whole time I’m saying dad, dad, dad, and I’m tugging on his shirt.

00:01:29.960 --> 00:01:31.050
He turns and tells me…

00:01:31.050 --> 00:01:33.650
DAD: Quiet, this is how you do it.

00:01:33.650 --> 00:01:38.369
Then after, I don’t know, five minutes into it, was it you or the Dean?

00:01:38.369 --> 00:01:44.049
JACK: I kept telling you – I was like hey, dad, dad, dad.

00:01:44.049 --> 00:01:47.420
DAD: I know, and the Dean said I have nothing to do with the IT department.

00:01:47.420 --> 00:01:49.460
I do anthropology or something.

00:01:49.460 --> 00:01:52.010
You’re in the wrong office.

00:01:52.010 --> 00:01:55.070
I went oh, sorry about that.

00:01:55.070 --> 00:02:01.360
JACK: Yep, that’s my dad, the guy who busts down a door, yells at a person for five minutes

00:02:01.360 --> 00:02:05.259
only to realize it’s the wrong door and the wrong guy.

00:02:05.259 --> 00:02:09.690
I was red from embarrassment but I don’t think my dad gets embarrassed for things like

00:02:09.690 --> 00:02:11.690
this. It’s weird.

00:02:11.690 --> 00:02:14.680
The things he gets embarrassed about are wearing glasses or a helmet.

00:02:14.680 --> 00:02:16.810
DAD: It didn’t stop me.

00:02:16.810 --> 00:02:20.250
We went right into the next office unannounced.

00:02:20.250 --> 00:02:24.780
JACK: This worked; he ended up sorting it out somehow and the Dean let me take the extra

00:02:24.780 --> 00:02:25.780
classes.

00:02:25.780 --> 00:02:31.260
But the point of this story is that breaking down the wrong door to yell at the wrong person

00:02:31.260 --> 00:02:35.040
is a big misunderstanding.

00:02:35.040 --> 00:02:39.959
Sometimes hackers also face big misunderstandings, too.

00:02:39.959 --> 00:02:49.120
JACK (INTRO): [INTRO MUSIC] These are true stories from the dark side of the internet.

00:02:49.120 --> 00:02:53.819
I’m Jack Rhysider.

00:02:53.819 --> 00:02:56.660
This is Darknet Diaries.

00:02:56.660 --> 00:03:01.860
[INTRO MUSIC ENDS]

00:03:01.860 --> 00:03:12.409
JACK: Alright, so let’s jump in and meet our guests for this episode.

00:03:12.409 --> 00:03:13.930
JUSTIN: My name is Justin Wynn.

00:03:13.930 --> 00:03:16.720
I’m a senior security consultant with Coalfire Systems.

00:03:16.720 --> 00:03:22.150
I am an offensive penetration tester who specializes in physical security which often entails social

00:03:22.150 --> 00:03:25.630
engineering; physical exploits to gain access to facilities.

00:03:25.630 --> 00:03:31.150
GARY: My name is Gary De Mercurio and pretty much mirror everything Justin said except

00:03:31.150 --> 00:03:35.130
I’m a managing senior and I run the Bellevue office in Washington.

00:03:35.130 --> 00:03:38.959
JACK: I know they said it quickly but the important part here is that they’re both

00:03:38.959 --> 00:03:40.220
penetration testers.

00:03:40.220 --> 00:03:43.720
GARY: I’ve been at Coalfire for six years and I’ve probably been in the military another

00:03:43.720 --> 00:03:44.720
three.

00:03:44.720 --> 00:03:47.830
I’ve got about nine years of experience of physical pen testing.

00:03:47.830 --> 00:03:51.840
JUSTIN: I’ve been with Coalfire for [00:05:00] over four years, so physical penetration testing

00:03:51.840 --> 00:03:52.840
for over four years.

00:03:52.840 --> 00:03:56.610
JACK: They’ve come here today to share some penetration testing stories with us.

00:03:56.610 --> 00:04:01.710
Now, even though these two live on opposite corners of the US, one Florida, one Washington

00:04:01.710 --> 00:04:05.390
state, they team up together on assignments all over the US.

00:04:05.390 --> 00:04:11.000
The assignment is typically like this; a company will call up Coalfire, the company that Justin

00:04:11.000 --> 00:04:14.420
and Gary work for, and ask for a security assessment.

00:04:14.420 --> 00:04:19.040
They might want someone to test their website to see if it’s secure or do a password assessment

00:04:19.040 --> 00:04:23.720
to see how strong the user’s passwords in the network are, or conduct some compliance

00:04:23.720 --> 00:04:24.720
checks.

00:04:24.720 --> 00:04:28.260
This is all to make the company more secure.

00:04:28.260 --> 00:04:34.380
But a few years back, a financial institute called up Coalfire to ask for a physical penetration

00:04:34.380 --> 00:04:39.590
test on their branches basically to test if the building is secure and then if somebody

00:04:39.590 --> 00:04:44.130
were to get in the building, what kind of things could they take or steal or get access

00:04:44.130 --> 00:04:45.259
to once inside?

00:04:45.259 --> 00:04:54.620
GARY: We had a pen test that was in my home state of Washington and we were working with

00:04:54.620 --> 00:04:55.910
a financial institution.

00:04:55.910 --> 00:05:02.540
JUSTIN: That one may have been up to seven locations; so, different branches of this

00:05:02.540 --> 00:05:06.350
financial institution where they wanted us to gain physical access.

00:05:06.350 --> 00:05:11.370
I mean, they wanted kind of everything; full scope, whether it’s during the day or at

00:05:11.370 --> 00:05:12.370
night.

00:05:12.370 --> 00:05:18.590
Show us what can you do, what systems and which people can you compromise to gain access

00:05:18.590 --> 00:05:21.190
to things that you shouldn’t normally be able to touch?

00:05:21.190 --> 00:05:26.890
GARY: But the big part about that particular client was they always want a very, I don’t

00:05:26.890 --> 00:05:33.450
know, I guess blatant or gregarious or outgoing in-your-face kind of social engineering aspect

00:05:33.450 --> 00:05:34.580
to it every year.

00:05:34.580 --> 00:05:38.010
They always wanted some – I don’t know….

00:05:38.010 --> 00:05:41.590
JUSTIN: Now, a big part of that was testing the employees.

00:05:41.590 --> 00:05:45.680
Come in here and do social engineering, give our employees the chance to respond to you

00:05:45.680 --> 00:05:48.580
and see if they’ll follow procedures or pick up on what you’re trying to do and

00:05:48.580 --> 00:05:50.690
if they’ll shut you down in these situations.

00:05:50.690 --> 00:05:55.470
JACK: Now, it’s extremely important to know exactly what the rules of engagement are.

00:05:55.470 --> 00:05:58.280
What is in scope and what isn’t in scope?

00:05:58.280 --> 00:06:01.460
What does the client want and what do they not want?

00:06:01.460 --> 00:06:05.820
Because if there’s a no-holds-barred pen test, you can drive a tractor right in through

00:06:05.820 --> 00:06:09.940
the front door and scoop up all the computers and take off with them which is something

00:06:09.940 --> 00:06:12.430
that some criminals actually do.

00:06:12.430 --> 00:06:15.340
You want to make sure everything is agreed on by everyone.

00:06:15.340 --> 00:06:19.370
JUSTIN: Yeah, so with our company, we have the contract, the scope of work, the rules

00:06:19.370 --> 00:06:20.500
of engagement.

00:06:20.500 --> 00:06:24.290
It’s kind of like the initial outlay for information that we provide to the client.

00:06:24.290 --> 00:06:27.710
They’ll fill it out and say generally, this is what we’re looking for.

00:06:27.710 --> 00:06:29.460
These are things that may be in scope.

00:06:29.460 --> 00:06:33.600
Locking, things like that, are acceptable but really a lot of the meat and the details

00:06:33.600 --> 00:06:35.970
comes on the scoping calls that we’ll have with the clients.

00:06:35.970 --> 00:06:39.850
We’ll hop on the phone with them after they’ve filled this out, we’ll review that contract

00:06:39.850 --> 00:06:40.850
charter.

00:06:40.850 --> 00:06:43.870
We’ll go through and we say okay, so you mentioned you do want lockpicking.

00:06:43.870 --> 00:06:45.190
Let’s explore that a little bit.

00:06:45.190 --> 00:06:46.590
What are you looking for?

00:06:46.590 --> 00:06:49.560
What kind of scenarios, what kind of pretext do you want?

00:06:49.560 --> 00:06:53.720
Do you want us to show up as pest control and see if we can just blatantly lie our way

00:06:53.720 --> 00:06:59.160
through and get in there or are we doing something really hardcore or is it even less sophisticated

00:06:59.160 --> 00:07:00.160
than that?

00:07:00.160 --> 00:07:04.060
Can somebody just walk in and walk behind the teller desk and jack into a USB or something

00:07:04.060 --> 00:07:05.060
like that?

00:07:05.060 --> 00:07:09.370
JACK: This is a really important call because these guys are gonna break into these financial

00:07:09.370 --> 00:07:11.900
branches which is burglary.

00:07:11.900 --> 00:07:16.440
But because it’s all been outlined and agreed on, it’s 100% legal.

00:07:16.440 --> 00:07:21.120
But still, Coalfire has a lot of lawyers that looks over all these contracts to make sure

00:07:21.120 --> 00:07:24.069
everyone and Coalfire is acting within the law.

00:07:24.069 --> 00:07:28.630
The scope of work was agreed on and the only people in this financial institute that knew

00:07:28.630 --> 00:07:34.030
these guys were going to break into the branches were the VP, the head of security, and the

00:07:34.030 --> 00:07:37.840
head of the physical security team, like the security guard’s big boss.

00:07:37.840 --> 00:07:42.720
So, Justin flew into Washington to begin the work and they looked over their goals.

00:07:42.720 --> 00:07:49.740
GARY: We were trying to get unfettered access to a branch of a financial institution, is

00:07:49.740 --> 00:07:51.009
what we were trying to do.

00:07:51.009 --> 00:07:55.819
JACK: Because if they can get into this branch and start looking around, they might be able

00:07:55.819 --> 00:08:01.220
to spot any security issues; things like client info exposed on someone’s desk or a computer

00:08:01.220 --> 00:08:02.900
unlocked when someone’s not there.

00:08:02.900 --> 00:08:05.759
Or they can look for passwords written on a notepad.

00:08:05.759 --> 00:08:09.090
If they find any of this, it’ll all go into the report.

00:08:09.090 --> 00:08:13.720
As they go up to this first branch, they use Google Maps and walk around the building.

00:08:13.720 --> 00:08:17.060
They notice an air conditioning unit.

00:08:17.060 --> 00:08:24.009
[MUSIC] So, they decided to exploit the AC to get into the first building.

00:08:24.009 --> 00:08:25.740
Gary called up the branch.

00:08:25.740 --> 00:08:32.430
GARY: We had contacted on the premise that there was some part in the air conditioning

00:08:32.430 --> 00:08:36.820
that was out of warranty or out of service and that it didn’t cost them anything because

00:08:36.820 --> 00:08:38.970
it was a known issue with the air conditioning.

00:08:38.970 --> 00:08:40.620
We were gonna come out and do it for free.

00:08:40.620 --> 00:08:43.279
JACK: Now that Gary prepped them, Justin went in.

00:08:43.279 --> 00:08:47.880
GARY: Justin actually went in with the outfit, the clipboard, the service order and the whole

00:08:47.880 --> 00:08:53.810
bit, and he just tried to [00:10:00] get them to tell him to do whatever he needed to do;

00:08:53.810 --> 00:08:58.940
work on the air conditioning, test the filtration systems, etc, etc.

00:08:58.940 --> 00:09:00.650
JACK: They let him in.

00:09:00.650 --> 00:09:03.510
Man.

00:09:03.510 --> 00:09:06.370
People ask me all the time if I can send them any hacker tools.

00:09:06.370 --> 00:09:07.810
A clipboard, man.

00:09:07.810 --> 00:09:11.209
All you need is a clipboard; that’s your hacker tool.

00:09:11.209 --> 00:09:15.250
Because imagine if you go into a conference room and see some guy in coveralls with a

00:09:15.250 --> 00:09:19.589
nametag and a hat and he has a ladder set up like, right behind the door and he’s

00:09:19.589 --> 00:09:20.690
got tools all over the table.

00:09:20.690 --> 00:09:24.510
Chances are you’re just gonna leave him alone in that conference room.

00:09:24.510 --> 00:09:29.160
Justin used this trick to get in and at the very least, now he can wander the halls to

00:09:29.160 --> 00:09:30.370
get a layout of the place.

00:09:30.370 --> 00:09:34.510
He can look to see what kind of alarm system they have or what kind of locks on the door

00:09:34.510 --> 00:09:38.830
they have, or maybe he just unlocks a window or a door so that he can use it later that

00:09:38.830 --> 00:09:39.890
night.

00:09:39.890 --> 00:09:43.010
Anything is possible once you get in there and you’re free to walk around, even if

00:09:43.010 --> 00:09:45.290
you’re acting like you’re just checking the filters.

00:09:45.290 --> 00:09:49.500
What Justin found out while he was getting into the first branch was that there was daily

00:09:49.500 --> 00:09:50.620
security codes.

00:09:50.620 --> 00:09:54.710
JUSTIN: Every day they rotate this secret phrase that if you’re internal in the company

00:09:54.710 --> 00:09:58.640
but you can’t verify if somebody’s calling you up over the phone, you can relay this

00:09:58.640 --> 00:10:03.870
code to them and they know okay, you’re on the internal network, you’re one of the

00:10:03.870 --> 00:10:04.870
employees, you have access to this code.

00:10:04.870 --> 00:10:07.500
JACK: This was good intel collected at the first branch so later on that night they go

00:10:07.500 --> 00:10:12.820
over to another branch but this time it was at night, after the branch was closed, in

00:10:12.820 --> 00:10:13.820
the dark.

00:10:13.820 --> 00:10:19.560
JUSTIN: We were able to bypass entry into that branch location and gain access to the

00:10:19.560 --> 00:10:20.560
internal network.

00:10:20.560 --> 00:10:26.060
JACK: Now that they had access to this branch and this network, they get access to a computer

00:10:26.060 --> 00:10:30.910
and start looking for the software that assigned that daily access code.

00:10:30.910 --> 00:10:35.970
They found it, so they waited in the branch until after midnight for the code to change

00:10:35.970 --> 00:10:42.850
over to the next day and bingo, now they had the security code for the next twenty-four

00:10:42.850 --> 00:10:43.940
hours.

00:10:43.940 --> 00:10:48.600
What might they be able to do with this code in the next branch they tried to get into?

00:10:48.600 --> 00:10:53.420
Well, the next day they hit up the third branch and this time, they have more knowledge than

00:10:53.420 --> 00:10:57.260
they had from the first branches because they know the layouts of these places better and

00:10:57.260 --> 00:10:59.269
they have that magic code.

00:10:59.269 --> 00:11:04.170
They head in posing as someone there to do work on the building but for some reason,

00:11:04.170 --> 00:11:07.120
they didn’t act the part well enough and their cover was blown.

00:11:07.120 --> 00:11:10.120
JUSTIN: They call our bluff and they say hey, you’re not really with Trane.

00:11:10.120 --> 00:11:13.070
This wasn’t according to our processes.

00:11:13.070 --> 00:11:14.370
What’s going on?

00:11:14.370 --> 00:11:17.209
We’re like okay, we’re gonna come clean; we’re with the security team.

00:11:17.209 --> 00:11:18.430
Here’s the code of the day.

00:11:18.430 --> 00:11:20.630
We write it down; we slide it over to them.

00:11:20.630 --> 00:11:23.440
They say okay great and they take their time, they verify it.

00:11:23.440 --> 00:11:25.480
Yes, this is the code of the day that we’re using.

00:11:25.480 --> 00:11:29.740
We understand, believe that you’re part of the security team here, so we’re going

00:11:29.740 --> 00:11:31.240
off that text.

00:11:31.240 --> 00:11:36.950
At that point we had relinquished one level of our social engineering attack and at that

00:11:36.950 --> 00:11:40.829
point we were identified as internal security teams.

00:11:40.829 --> 00:11:45.380
JACK: This is common with pen testers; if they get caught, they don’t just give up

00:11:45.380 --> 00:11:47.200
everything and say okay, you got me.

00:11:47.200 --> 00:11:53.329
They try to figure out a lie to stay in the building and keep doing their assessment or

00:11:53.329 --> 00:11:57.940
they might just lie to try to get away without being caught; actually caught, right?

00:11:57.940 --> 00:11:59.970
Like, you’re stopped but not caught.

00:11:59.970 --> 00:12:04.790
These guys weren’t with the internal security team but because they had that code, that

00:12:04.790 --> 00:12:06.610
was enough to believe they were.

00:12:06.610 --> 00:12:10.490
JUSTIN: [MUSIC] From there, Gary was great.

00:12:10.490 --> 00:12:15.450
He occupied the employees and he’s talking about security and great processes; congratulations

00:12:15.450 --> 00:12:19.630
guys, while I was going around the rest of the branch and plugging in devices, taking

00:12:19.630 --> 00:12:24.790
pictures, and had unfettered access to some of the private areas inside that branch.

00:12:24.790 --> 00:12:29.791
GARY: We would definitely do the magician where we want you to look one way and the

00:12:29.791 --> 00:12:33.440
hand that you’re not paying attention to is doing something totally different.

00:12:33.440 --> 00:12:36.519
I was like well here, let me tell you about what I did and how we were able to do this

00:12:36.519 --> 00:12:38.560
and how we were able to do that.

00:12:38.560 --> 00:12:42.820
The entire time I was talking to them, I corralled them all; oh hey, can we get some of the tellers

00:12:42.820 --> 00:12:46.560
in here so I can show you guys some of our techniques so somebody else doesn’t do this

00:12:46.560 --> 00:12:47.560
to you?

00:12:47.560 --> 00:12:48.600
They’re like oh, absolutely.

00:12:48.600 --> 00:12:53.350
They had bought it hook, line, and sinker and I just had them in a big group, basically.

00:12:53.350 --> 00:12:58.870
The whole time I was in the group, Justin was walking around taking pictures and videos

00:12:58.870 --> 00:13:04.430
and getting, you know, what model of alarm systems that they had and what the types of

00:13:04.430 --> 00:13:06.970
safes that they were that they were using.

00:13:06.970 --> 00:13:12.510
Every bit of information you could possibly need in order to hit the bank at night if

00:13:12.510 --> 00:13:17.510
you were an actual criminal, all the information that you would need to do something nefarious

00:13:17.510 --> 00:13:18.510
after hours.

00:13:18.510 --> 00:13:22.160
We’re obviously not gonna steal money from them.

00:13:22.160 --> 00:13:26.690
JACK: They successfully got out of there without giving their real names or identities and

00:13:26.690 --> 00:13:28.170
with all the intel they needed.

00:13:28.170 --> 00:13:30.449
JUSTIN: Then we were progressing onto the next branch.

00:13:30.449 --> 00:13:33.209
We’d been in constant contact with the client.

00:13:33.209 --> 00:13:36.209
They understood; they’re like okay, you know, they’re taking some pictures here

00:13:36.209 --> 00:13:37.209
and there.

00:13:37.209 --> 00:13:41.570
They’re like well, we want you to do an overt test and just kind of see if this other

00:13:41.570 --> 00:13:45.079
branch will catch it and catch onto you.

00:13:45.079 --> 00:13:49.160
We pulled the same pretext, went onsite with you know, your air-cooling unit [00:15:00]

00:13:49.160 --> 00:13:53.940
has a failing part that’s gonna pump carcinogens throughout the air vents unless we get in

00:13:53.940 --> 00:13:54.940
there soon.

00:13:54.940 --> 00:13:58.709
They’re like okay, on the phone.

00:13:58.709 --> 00:14:00.990
As soon as I hang up the phone, I talked to Gary.

00:14:00.990 --> 00:14:03.329
I’m like dude, she said yes but it was a no.

00:14:03.329 --> 00:14:07.269
It’s not gonna work out.

00:14:07.269 --> 00:14:09.970
[MUSIC] We go onsite.

00:14:09.970 --> 00:14:12.910
We know we’re probably pretty much already burned.

00:14:12.910 --> 00:14:13.910
Gary was in the car.

00:14:13.910 --> 00:14:18.790
He was gonna act as a regular bank user and I’d gone in just a little bit before in

00:14:18.790 --> 00:14:20.029
my vest.

00:14:20.029 --> 00:14:24.430
They kind of shut me down so I go in, I’m like hey, I’m here to replace your air conditioning

00:14:24.430 --> 00:14:25.430
stuff, I’m the guy.

00:14:25.430 --> 00:14:29.060
She’s like no you’re not, so please leave the building.

00:14:29.060 --> 00:14:31.060
Okay, we’ll see you later.

00:14:31.060 --> 00:14:36.750
Gary had some pretty funny insight into what happened as soon as I let the doors close

00:14:36.750 --> 00:14:37.750
and I left that branch.

00:14:37.750 --> 00:14:40.240
GARY: I got to hear everything that they said before I actually approached.

00:14:40.240 --> 00:14:44.230
They’re like, what’s that guy’s license plate?

00:14:44.230 --> 00:14:46.279
He’s a criminal, etc, etc.

00:14:46.279 --> 00:14:49.160
The gig was up, 100%.

00:14:49.160 --> 00:14:51.820
They sniffed him out from the get-go.

00:14:51.820 --> 00:14:56.139
I was like well, alright, let’s give it a shot here.

00:14:56.139 --> 00:15:01.260
I walked up to her and I said hey, we’re from the internal security team, we’re just

00:15:01.260 --> 00:15:02.589
doing an internal audit.

00:15:02.589 --> 00:15:04.130
She had none of it, none.

00:15:04.130 --> 00:15:08.160
She’s like, I don’t care who you say you’re with, I don’t believe anything you’re

00:15:08.160 --> 00:15:09.160
about to say.

00:15:09.160 --> 00:15:10.770
JUSTIN: I had come back in.

00:15:10.770 --> 00:15:11.770
We knew we were burned.

00:15:11.770 --> 00:15:13.199
Gary was in there and he’s like, he texted me, he’s like yo, come back inside.

00:15:13.199 --> 00:15:18.070
So, I come back inside and the lady’s on the phone with the police and it was pretty

00:15:18.070 --> 00:15:22.550
obvious ‘cause I’m like hey, just want to talk to you again.

00:15:22.550 --> 00:15:25.449
She’s like mm-hm, mm-hm, and talking to the police and the police on the other end

00:15:25.449 --> 00:15:27.110
of the line are like, are they in there right now?

00:15:27.110 --> 00:15:30.480
She’s like uh, mm-hm, and going through those motions, right.

00:15:30.480 --> 00:15:34.889
I’m waiting for her to hang up on the call and within five minutes police had responded

00:15:34.889 --> 00:15:35.889
to the scene.

00:15:35.889 --> 00:15:40.259
Police, at that point, walk into the branch building, confront us and at that point we

00:15:40.259 --> 00:15:43.640
come completely clean and we give out our get-out-of-jail-free card.

00:15:43.640 --> 00:15:45.960
GARY: Mostly, mostly clean.

00:15:45.960 --> 00:15:50.040
I tried what we had, one last trick up our sleeve, which is we still had the code of

00:15:50.040 --> 00:15:51.139
the day.

00:15:51.139 --> 00:15:54.311
I walked up and I said hey, you know, I do have the code of the day.

00:15:54.311 --> 00:15:55.440
I actually am employed by the bank.

00:15:55.440 --> 00:15:57.600
Would you like to check my code of the day?

00:15:57.600 --> 00:16:01.029
She looked at me and she goes, I don’t care if you have the code of the day.

00:16:01.029 --> 00:16:02.930
I don’t want you in my branch.

00:16:02.930 --> 00:16:08.100
You guys need to leave, etc, etc, etc, and she just went on this rant about she didn’t

00:16:08.100 --> 00:16:12.660
give two flying leaps about what identification we have.

00:16:12.660 --> 00:16:14.940
We could have had legitimate ID.

00:16:14.940 --> 00:16:17.130
We could have worked for the actual bank.

00:16:17.130 --> 00:16:18.240
She did not care.

00:16:18.240 --> 00:16:19.480
She did not want us in there.

00:16:19.480 --> 00:16:21.629
She wanted nothing to do with us.

00:16:21.629 --> 00:16:25.509
Then while we’re having a conversation with her, the police show up.

00:16:25.509 --> 00:16:30.660
She was a, well, we’re again, we’re guessing here ‘cause we don’t know her actual thought

00:16:30.660 --> 00:16:35.649
process but she was the assistant branch manager and the branch manager was gone so she took

00:16:35.649 --> 00:16:39.680
her job very seriously, being in charge of the bank, and she just didn’t trust anybody.

00:16:39.680 --> 00:16:43.330
She was just one of those people that you actually want working for you that was highly

00:16:43.330 --> 00:16:44.330
paranoid.

00:16:44.330 --> 00:16:46.900
JUSTIN: Right, she did a great job handling that security incident.

00:16:46.900 --> 00:16:50.850
At that point, after she had gone through the couple layers, we presented the get-out-of-jail-free

00:16:50.850 --> 00:16:51.850
card.

00:16:51.850 --> 00:16:55.549
She ended up calling one of the point of contacts and she did great.

00:16:55.549 --> 00:16:59.269
She looked up his information in the internal systems, gave him a ring.

00:16:59.269 --> 00:17:04.550
GARY: She said do you know these people, or she said are you performing a test at our

00:17:04.550 --> 00:17:05.720
facility, is what she said.

00:17:05.720 --> 00:17:08.150
He said no, I’m not.

00:17:08.150 --> 00:17:10.300
She said that’s what I thought.

00:17:10.300 --> 00:17:14.170
She hung up the phone and then as we – we’d already handed over our identification and

00:17:14.170 --> 00:17:18.319
stuff to the police officers and showed him the get-out-of-jail-free card, and she said

00:17:18.319 --> 00:17:20.880
I just talked to my boss, or the head of security.

00:17:20.880 --> 00:17:24.780
He says he has no idea who you guys are.

00:17:24.780 --> 00:17:29.280
I said you better call him back and let me talk to him because that is absolutely not

00:17:29.280 --> 00:17:30.280
true.

00:17:30.280 --> 00:17:32.190
We started sweating a little bit.

00:17:32.190 --> 00:17:36.080
[MUSIC] Immediately, the phone rang.

00:17:36.080 --> 00:17:42.630
She answered her phone and what had happened is he had a brain fart or he forgot or something,

00:17:42.630 --> 00:17:45.010
and he just said – he was doing something else.

00:17:45.010 --> 00:17:46.470
I think he was preoccupied.

00:17:46.470 --> 00:17:51.130
He just said no, completely forgetting we were onsite and that’s why he called back

00:17:51.130 --> 00:17:52.130
immediately.

00:17:52.130 --> 00:17:53.640
He was like oh, wait, wait, wait, no, no, no, yes.

00:17:53.640 --> 00:17:55.500
We have contractors onsite, they’re on a test.

00:17:55.500 --> 00:17:57.690
Yes, they work for me, their names are Justin and Gary.

00:17:57.690 --> 00:18:01.570
They’re absolutely supposed to be there, and then her demeanor completely changed after

00:18:01.570 --> 00:18:03.429
she got the okay from them.

00:18:03.429 --> 00:18:10.890
But the part that I think that’s important here is the entire time, the officers on scene,

00:18:10.890 --> 00:18:13.640
they never overreacted, never freaked out.

00:18:13.640 --> 00:18:15.659
They never actually really questioned us.

00:18:15.659 --> 00:18:20.799
They were just like okay; something isn’t quite right and I think there’s a miscommunication.

00:18:20.799 --> 00:18:23.341
But they never overreacted and were like, these guys are trying to rob a bank, these

00:18:23.341 --> 00:18:25.420
guys shouldn’t be here.

00:18:25.420 --> 00:18:31.610
There was never any worry or doubt that we were actually doing something wrong.

00:18:31.610 --> 00:18:37.179
The entire time and the way they portrayed themselves was there’s obviously some confusion

00:18:37.179 --> 00:18:38.179
here.

00:18:38.179 --> 00:18:39.179
Let’s see what the confusion is.

00:18:39.179 --> 00:18:42.091
JACK: After the head of security vouched for them and told the police that it’s their

00:18:42.091 --> 00:18:46.470
job to test their security by breaking in, everything calmed down.

00:18:46.470 --> 00:18:49.840
The branch manager was happy and because of that the police were [00:20:00] happy and

00:18:49.840 --> 00:18:51.250
everyone was free to leave.

00:18:51.250 --> 00:18:55.450
GARY: More often than not, a police officer can look at you and tell if you’re up to

00:18:55.450 --> 00:18:56.450
no good.

00:18:56.450 --> 00:19:00.760
It’s what they do every single day and they can, in my opinion, I think they’re really

00:19:00.760 --> 00:19:04.570
good at telling somebody who’s trying to get away with something and somebody who’s

00:19:04.570 --> 00:19:05.770
being dishonest with them.

00:19:05.770 --> 00:19:08.500
Every scenario we’ve ever been in where we’ve talked to police officers, they’ve

00:19:08.500 --> 00:19:12.350
been extraordinarily professional and actually really helpful.

00:19:12.350 --> 00:19:15.900
After they find out what we’re doing and the job that we do, they usually have a lot

00:19:15.900 --> 00:19:18.570
of questions for us, like oh hey, this is really kind of cool.

00:19:18.570 --> 00:19:20.010
Tell me a little bit about it.

00:19:20.010 --> 00:19:24.040
Then we’ll usually ask them questions such as hey, did we handle everything okay?

00:19:24.040 --> 00:19:26.370
Is there anything we could have done a little bit better?

00:19:26.370 --> 00:19:31.539
If we run on this scenario again, where could we improve our interaction?

00:19:31.539 --> 00:19:35.470
More often than not, the cops are like actually no, you guys did really well, you were very

00:19:35.470 --> 00:19:36.470
professional.

00:19:36.470 --> 00:19:41.420
I guess the most important feedback I’ve gotten from a police officer is no, you did

00:19:41.420 --> 00:19:42.510
exactly what you should be doing.

00:19:42.510 --> 00:19:44.420
Don’t ever let us come in and get you.

00:19:44.420 --> 00:19:51.049
The fact that you came to us and you presented yourselves to us before we had to come get

00:19:51.049 --> 00:19:53.360
you is exactly what you should do in every scenario.

00:19:53.360 --> 00:19:56.059
JACK: That was it for their penetration test engagement.

00:19:56.059 --> 00:19:59.309
The client was happy with all the findings they dug up and was impressed with how clever

00:19:59.309 --> 00:20:01.220
they got into different branches.

00:20:01.220 --> 00:20:04.620
The client did what they could to fix all these problems and even invited them back

00:20:04.620 --> 00:20:08.590
a year later to do it again.

00:20:08.590 --> 00:20:17.030
[MUSIC] But that was not the last time they had a run-in with the police.

00:20:17.030 --> 00:20:20.790
When we come back from the break, we’re gonna hear about what happened to them at

00:20:20.790 --> 00:20:27.400
the Iowa Courthouse.

00:20:27.400 --> 00:20:30.809
The Iowa Judicial Branch is a state department of Iowa.

00:20:30.809 --> 00:20:36.130
It’s a government facility and specifically they handle the court cases and such within

00:20:36.130 --> 00:20:37.910
the state of Iowa.

00:20:37.910 --> 00:20:42.559
It was the Iowa Judicial Branch that called up Coalfire and asked the company to come

00:20:42.559 --> 00:20:47.190
and do a penetration test on the courthouses themselves.

00:20:47.190 --> 00:20:50.539
JUSTIN: It was full-scope for a team penetration test.

00:20:50.539 --> 00:20:55.540
It included things like external pen testing, web application testing, internal testing

00:20:55.540 --> 00:21:00.000
which was to be done after we had gone onsite to see if we could gain access into their

00:21:00.000 --> 00:21:05.320
internal network and do a real-life scenario; can you gain access to our facilities?

00:21:05.320 --> 00:21:10.169
Can you plug in a what we call a drone or remote device to be able to access that network

00:21:10.169 --> 00:21:14.500
later once we’re off-site, and then conduct the internal network penetration test from

00:21:14.500 --> 00:21:15.500
there?

00:21:15.500 --> 00:21:18.870
Throughout the whole time, we’re contacting with the guys at iowacourts.gov.

00:21:18.870 --> 00:21:25.030
JACK: Justin and Gary get assigned to conduct the physical penetration test on the courthouses

00:21:25.030 --> 00:21:26.030
together.

00:21:26.030 --> 00:21:29.880
They’ve been working together for four years on doing physical penetration tests just like

00:21:29.880 --> 00:21:30.880
this.

00:21:30.880 --> 00:21:32.909
They’re used to each other and do good work together.

00:21:32.909 --> 00:21:37.290
Actually, I have a copy of the rules of engagement here in front of me, so let’s see.

00:21:37.290 --> 00:21:42.419
Okay yeah, so this is for the Iowa Judicial Branch and they’re specifically asking for

00:21:42.419 --> 00:21:45.300
a physical penetration test at five locations.

00:21:45.300 --> 00:21:49.980
There’s a judicial branch, the Polk County Courthouse, the Dallas County Courthouse,

00:21:49.980 --> 00:21:53.460
a juvenile justice center, and the Criminal Court Area.

00:21:53.460 --> 00:21:58.059
Five locations and the window to test the security on these buildings is between Sunday,

00:21:58.059 --> 00:22:00.770
September 8th and Friday, September 13th.

00:22:00.770 --> 00:22:05.330
They had a week to do this assessment and this was last year in 2019.

00:22:05.330 --> 00:22:07.580
The rules of engagement list out a ton of things.

00:22:07.580 --> 00:22:10.559
Do they have permission to tailgate behind someone to get in?

00:22:10.559 --> 00:22:11.559
Yes.

00:22:11.559 --> 00:22:13.000
Do they have permission to dig in the dumpsters?

00:22:13.000 --> 00:22:14.000
Yes.

00:22:14.000 --> 00:22:16.600
Does Coalfire have permission to use lockpicks to get in?

00:22:16.600 --> 00:22:17.600
Yes.

00:22:17.600 --> 00:22:20.919
Does Coalfire have permission to plug USB drives into computers that they get access

00:22:20.919 --> 00:22:23.010
to? Yes.

00:22:23.010 --> 00:22:26.730
Does Coalfire have permission to disable alarms?

00:22:26.730 --> 00:22:27.730
No.

00:22:27.730 --> 00:22:31.350
The goal here looks like they’re trying to get into the building, plant rogue devices,

00:22:31.350 --> 00:22:34.970
look around to see if there’s any security problems like unlocked computers, passwords

00:22:34.970 --> 00:22:36.520
written down, that kind of thing.

00:22:36.520 --> 00:22:39.390
So, okay; the rules of engagement seem [00:25:00] pretty clear.

00:22:39.390 --> 00:22:42.900
JUSTIN: That gets filled out before we’re on the call and then as we’re going through

00:22:42.900 --> 00:22:46.169
that with the client, the project manager’s taking notes in there.

00:22:46.169 --> 00:22:50.790
You may see things like okay, at the JB building, we discussed with the client floors three

00:22:50.790 --> 00:22:55.031
and four are specifically off-limits during daytime hours because there was gonna be the

00:22:55.031 --> 00:22:58.840
Supreme Court convening and they obviously didn’t want us interrupting that.

00:22:58.840 --> 00:23:02.760
Part of that we’re discussing with the client on the phone; yeah, during the daytime do

00:23:02.760 --> 00:23:05.500
not touch, do not go on floors three and four.

00:23:05.500 --> 00:23:08.730
Then we enumerate with them; we’re like okay, well, what if we’re in there after-hours?

00:23:08.730 --> 00:23:10.350
What do you want to see from there?

00:23:10.350 --> 00:23:11.350
Is that open-access?

00:23:11.350 --> 00:23:14.309
They’re like ah, yeah, that’d be more acceptable but you know what?

00:23:14.309 --> 00:23:18.980
Let’s play it safe and just show us to see if you can breach the doors that enter on

00:23:18.980 --> 00:23:20.190
that floor.

00:23:20.190 --> 00:23:25.720
The contract will say something like okay, JB building floors three and four are off-limits

00:23:25.720 --> 00:23:31.210
and you see how big those fields are in that table, so it’s really the bare information

00:23:31.210 --> 00:23:33.300
that the project manager wants to put in there.

00:23:33.300 --> 00:23:37.160
Then we have a good understanding of what the client – of what they’re actually

00:23:37.160 --> 00:23:38.160
looking for.

00:23:38.160 --> 00:23:43.210
JACK: Actually, this rules of engagement document I’m looking at is twenty-eight pages long.

00:23:43.210 --> 00:23:45.780
This field he’s talking about is super small.

00:23:45.780 --> 00:23:50.190
All these things you cover on the call in great detail only get jotted down with a couple

00:23:50.190 --> 00:23:51.190
words.

00:23:51.190 --> 00:23:54.570
It’s not fully documented in the scope of work or rules of engagement.

00:23:54.570 --> 00:23:59.920
GARY: These conversations are so granular; if we were to take and actually take the conversation

00:23:59.920 --> 00:24:05.570
that we had on the phone and write it out and put it in a contract, the contract would

00:24:05.570 --> 00:24:07.900
be a hundred pages long.

00:24:07.900 --> 00:24:09.470
JUSTIN: A week of work, yeah.

00:24:09.470 --> 00:24:14.150
GARY: The amount of discussion that we have on what it is exactly they want us to do,

00:24:14.150 --> 00:24:20.309
it would be unfeasible as far as a rules of engagement would be concerned.

00:24:20.309 --> 00:24:25.020
Again, that’s why we have the phone call, that’s exactly why we have, so we can say

00:24:25.020 --> 00:24:26.559
this is what we understand.

00:24:26.559 --> 00:24:27.940
What exactly do you guys want?

00:24:27.940 --> 00:24:29.400
Then we’re all on the same page when we show up.

00:24:29.400 --> 00:24:32.650
JUSTIN: They’re like, we’re gonna be there at night and the client was like yes, we want

00:24:32.650 --> 00:24:35.490
you to focus on after-hours testing.

00:24:35.490 --> 00:24:39.720
A lot of that stuff unfortunately, which we never would have predicted or seen coming

00:24:39.720 --> 00:24:45.059
at us, we didn’t capture in that document which would have been great if we did, but.

00:24:45.059 --> 00:24:49.530
JACK: The Iowa Judicial Branch has actually worked with Coalfire before to do other penetration

00:24:49.530 --> 00:24:54.799
tests so everyone seems to agree on what should be conducted and what’s expected here, and

00:24:54.799 --> 00:24:56.380
an agreement was made.

00:24:56.380 --> 00:24:59.549
They create what’s called a get-out-of-jail-free card.

00:24:59.549 --> 00:25:04.850
This is a slip of paper that lists all the people who hired Coalfire to do this penetration

00:25:04.850 --> 00:25:05.850
test.

00:25:05.850 --> 00:25:11.110
This is their information security officer, their chief information officer, and the infrastructure

00:25:11.110 --> 00:25:12.110
manager.

00:25:12.110 --> 00:25:16.150
These are three people who worked in Iowa’s Judicial Branch who contracted Coalfire to

00:25:16.150 --> 00:25:17.770
do these tests.

00:25:17.770 --> 00:25:23.920
This get-out-of-jail-free card has their names and phone numbers listed with their signatures.

00:25:23.920 --> 00:25:28.840
If these guys get caught, they can ultimately show this to get out of any real trouble.

00:25:28.840 --> 00:25:31.320
JUSTIN: We touched down Sunday night.

00:25:31.320 --> 00:25:32.789
We entered in a facility.

00:25:32.789 --> 00:25:36.539
I don’t want to provide too many details that haven’t been already disclosed.

00:25:36.539 --> 00:25:37.679
JACK: Alright, fine.

00:25:37.679 --> 00:25:41.309
Unfortunately, we’re not going to be able to go into every detail of what happened because

00:25:41.309 --> 00:25:46.340
I don’t want to expose any actual vulnerabilities over there at the Iowa County Courthouses.

00:25:46.340 --> 00:25:49.680
But let me give you an idea of what they’re capable of.

00:25:49.680 --> 00:25:53.940
[MUSIC] First of all, these guys mentioned that they sometimes use an under-the-door

00:25:53.940 --> 00:25:54.940
tool.

00:25:54.940 --> 00:25:59.240
Let me tell you what this tool does; it almost looks like a bent fishing rod.

00:25:59.240 --> 00:26:03.640
It’s long, four feet, metal rod, and it has a string on the end.

00:26:03.640 --> 00:26:08.410
This is for doors that have a handle that when you push down, it opens the door.

00:26:08.410 --> 00:26:14.010
You try to slide this tool under the door and then you pull it up using that string

00:26:14.010 --> 00:26:15.700
to get it close to the handle.

00:26:15.700 --> 00:26:19.549
You try to hook it onto the handle from on the other side of the door.

00:26:19.549 --> 00:26:24.610
When you do get it hooked on there, you pull down with both the string and the rod, and

00:26:24.610 --> 00:26:27.160
it pulls the handle down and it opens the door.

00:26:27.160 --> 00:26:28.280
It’s actually pretty simple.

00:26:28.280 --> 00:26:34.330
On top of this, Gary is also really good at lockpicking so he’ll certainly have these

00:26:34.330 --> 00:26:37.230
in his pockets and ready to use them whenever he needs to.

00:26:37.230 --> 00:26:41.870
But with lockpicking, it might take you a while, maybe ten minutes, maybe thirty minutes

00:26:41.870 --> 00:26:43.120
to get a lock open.

00:26:43.120 --> 00:26:45.460
It just takes more skill and time.

00:26:45.460 --> 00:26:51.950
GARY: If you’re talking about my favorite, because I find this a lot in commercial buildings,

00:26:51.950 --> 00:26:55.679
is going to be crash bar doors, right?

00:26:55.679 --> 00:26:59.539
Either the ones that come down like the old high school gym-type doors or the ones that

00:26:59.539 --> 00:27:01.770
you just push and go into the door itself.

00:27:01.770 --> 00:27:03.420
JUSTIN: A Von Duprin.

00:27:03.420 --> 00:27:04.650
GARY: Thank you.

00:27:04.650 --> 00:27:08.649
They’ll have the latch on the inside of the door so you can’t really use an under-the-door

00:27:08.649 --> 00:27:09.649
tool.

00:27:09.649 --> 00:27:14.409
They make some tools if you have double doors that come together without the – what’s

00:27:14.409 --> 00:27:16.340
it called in the middle there?

00:27:16.340 --> 00:27:17.419
JUSTIN: The mullion.

00:27:17.419 --> 00:27:18.740
GARY: Mullion, is that what it is?

00:27:18.740 --> 00:27:22.399
JUSTIN: Yeah, there’s another term for it too, but there’s a bar that runs in-between

00:27:22.399 --> 00:27:25.090
the doors where you’re not supposed to be able to insert tools.

00:27:25.090 --> 00:27:30.130
GARY: You’ll see a lot of those doors that don’t have that bar that separates the doors.

00:27:30.130 --> 00:27:31.320
Those are really easy to get into.

00:27:31.320 --> 00:27:35.559
You stick a tool inside, you turn it to the left or the right, and then you pull and it

00:27:35.559 --> 00:27:36.559
opens the door.

00:27:36.559 --> 00:27:40.919
What we’ve come up with that we like to [00:30:00] use that’s absolutely my favorite

00:27:40.919 --> 00:27:44.790
tool that is literally in my backpack right now, is a cutting board.

00:27:44.790 --> 00:27:48.380
It’s a really, really thin, plastic cutting board that I bought from Amazon.

00:27:48.380 --> 00:27:51.909
I cut a notch in this cutting board.

00:27:51.909 --> 00:27:57.181
For crash bar doors especially, the single ones where you can’t see anything, you stick

00:27:57.181 --> 00:28:05.160
it through the door, on the edge of the door, and then once you feed it through the door,

00:28:05.160 --> 00:28:09.870
you pull it down until that cutting board rests on top of the latch.

00:28:09.870 --> 00:28:13.659
Then you’ll apply pressure down on that latch and you start pulling the cutting board

00:28:13.659 --> 00:28:20.370
towards you outward from the door until that notch that you cut falls on top of the latch.

00:28:20.370 --> 00:28:24.240
Now what you’ve got is you’ve got the back half of that cutting board on the other

00:28:24.240 --> 00:28:27.899
side of the latch, on the inside of the door and you pull.

00:28:27.899 --> 00:28:33.120
If that latch doesn’t have the deadlatch latching it properly, you will open the door

00:28:33.120 --> 00:28:34.120
every time.

00:28:34.120 --> 00:28:38.929
JUSTIN: Typically, when we’re talking about door bypasses, we’re inserting a tool through

00:28:38.929 --> 00:28:42.779
whatever method that we can, whether it’s in the interleaving double door system so

00:28:42.779 --> 00:28:47.180
you can go in-between the doors, or if there’s a gap underneath the door, insert a tool there

00:28:47.180 --> 00:28:50.520
and start manipulating some mechanisms on the other side of the door.

00:28:50.520 --> 00:28:56.050
Whether that’s the Von Duprin crash bar or the latching mechanism itself or some peripherals

00:28:56.050 --> 00:28:58.049
like a request-to-exit sensor.

00:28:58.049 --> 00:29:05.240
GARY: I can what, 80%, if you had to put a number on it, 80% of doors can be bypassed

00:29:05.240 --> 00:29:06.429
by bypassing the latch.

00:29:06.429 --> 00:29:07.429
JUSTIN: Right.

00:29:07.429 --> 00:29:11.460
GARY: Just by manipulating the latch itself you can get into 80% of facilities.

00:29:11.460 --> 00:29:15.539
JACK: Just coincidentally, can you tell us where you guys are – or what you guys are

00:29:15.539 --> 00:29:16.539
doing this week?

00:29:16.539 --> 00:29:21.519
JUSTIN: This week we’re doing three two-day courses comprised of physical access control

00:29:21.519 --> 00:29:25.750
systems, alarm bypass techniques, and then safe manipulation.

00:29:25.750 --> 00:29:27.620
Really an action-packed week for us.

00:29:27.620 --> 00:29:30.299
That’s all the juicy James Bond-style stuff.

00:29:30.299 --> 00:29:34.269
JACK: You can imagine what kind of bag of tools these guys have to break into buildings

00:29:34.269 --> 00:29:36.340
to carry out assessments like this, right?

00:29:36.340 --> 00:29:40.370
I mean, they’ve got so many things, I’m surprised the TSA even allowed them on the

00:29:40.370 --> 00:29:41.370
plane.

00:29:41.370 --> 00:29:44.730
Even though they can’t get into specifics about what tricks they used to bypass the

00:29:44.730 --> 00:29:49.299
doors of these buildings, you can take a pretty good guess that they’ve got many options

00:29:49.299 --> 00:29:51.929
they can use to get into each door that they run into.

00:29:51.929 --> 00:29:56.470
JUSTIN: It’s pretty much we walked up, assessed the perimeter and matched it up with what

00:29:56.470 --> 00:30:00.929
we were seeing on Google Maps, things like that, and gain entry to that first facility

00:30:00.929 --> 00:30:03.029
on Sunday night to Monday morning.

00:30:03.029 --> 00:30:09.399
GARY: When we get into a place, it also depends on who is attacking, right?

00:30:09.399 --> 00:30:14.100
If Justin is attacking, for instance, and he gets into the door and he’s able to get

00:30:14.100 --> 00:30:18.909
in really, really quick, there’s a certain like, you know, he’s your team mate so you’re

00:30:18.909 --> 00:30:19.909
proud.

00:30:19.909 --> 00:30:20.909
You’re like wow, that was really fast.

00:30:20.909 --> 00:30:23.650
Like, that was really, really fast.

00:30:23.650 --> 00:30:27.120
Justin and I have been working together since he’s been here so you get to see this progression

00:30:27.120 --> 00:30:31.169
of somebody when he’s on his first Red Team or second Red Team I think it was, with the

00:30:31.169 --> 00:30:35.500
guy and then when he’s on his fifteenth Red Team and you’re like dude, you’re

00:30:35.500 --> 00:30:37.940
getting really, really, really good at this.

00:30:37.940 --> 00:30:39.520
But you get to see that progression.

00:30:39.520 --> 00:30:44.420
It’s a lot more personal, if you will, when you’re on a Red Team with somebody that

00:30:44.420 --> 00:30:46.399
you’ve been working with for years and years and years.

00:30:46.399 --> 00:30:50.100
JUSTIN: I was gonna say I’m tearing up over here ‘cause Gary, honestly, I do need to

00:30:50.100 --> 00:30:51.399
take a moment to thank him.

00:30:51.399 --> 00:30:53.340
He taught me so much of what I know.

00:30:53.340 --> 00:30:57.179
Yeah, of course Deviant and some huge stars in the industry that you can learn so much

00:30:57.179 --> 00:31:02.190
by watching YouTube and learn how to assess the security of your facilities, but Gary

00:31:02.190 --> 00:31:05.990
was the first guy who handed me the under-the-door tool and taught me how to use this when I

00:31:05.990 --> 00:31:09.100
didn’t even know which end of the stick to be holding onto which is a very common

00:31:09.100 --> 00:31:11.480
thing when people are given an under-the-door tool.

00:31:11.480 --> 00:31:16.400
JACK: So, they get in, they look around for ways to plug in a drone and to take any photos

00:31:16.400 --> 00:31:19.130
of security problems that they want to put in their report.

00:31:19.130 --> 00:31:23.710
They even found the desk of the person who hired them for this engagement, so they leave

00:31:23.710 --> 00:31:28.770
a little present on his desk to prove that they got in overnight and got access to his

00:31:28.770 --> 00:31:29.770
desk.

00:31:29.770 --> 00:31:31.720
JUSTIN: But we gained access and we left a calling card.

00:31:31.720 --> 00:31:35.350
I just left a business card on one of the point-of-contact’s desks, to the point where

00:31:35.350 --> 00:31:38.530
the next day he had e-mailed me and said I guess I owe you a congratulations.

00:31:38.530 --> 00:31:40.730
We’re going back and forth over e-mail.

00:31:40.730 --> 00:31:46.190
I’m like yeah, we found some really severe vulnerabilities that, you know, minor fixes

00:31:46.190 --> 00:31:50.250
that you guys can use to dramatically improve the security of this facility.

00:31:50.250 --> 00:31:54.710
So, going back and forth through things like that; already in contact with the client going

00:31:54.710 --> 00:31:56.360
through things like that.

00:31:56.360 --> 00:31:58.720
Then yeah, Tuesday rolls around.

00:31:58.720 --> 00:32:03.840
JACK: [MUSIC] So, it’s Tuesday night after the courthouse has closed for the day.

00:32:03.840 --> 00:32:08.600
They get up to the building and see it has two sets of locked doors to get into.

00:32:08.600 --> 00:32:13.019
GARY: We make it through the first door really easy and then the second door, we could have

00:32:13.019 --> 00:32:16.500
used the same attack but we were trying other things.

00:32:16.500 --> 00:32:19.460
We weren’t having a lot of luck with the other things but we didn’t really want to

00:32:19.460 --> 00:32:23.580
try the first attack ‘cause we wanted to see if we could use different techniques to

00:32:23.580 --> 00:32:24.580
get in.

00:32:24.580 --> 00:32:28.389
We found other areas that we could attack so we went around a different area and we

00:32:28.389 --> 00:32:31.600
were working on – Justin was working on one door and I was working on another.

00:32:31.600 --> 00:32:33.090
I don’t know, did you ever get that door open?

00:32:33.090 --> 00:32:37.929
JUSTIN: I picked the lock each way and no, just something else was going on.

00:32:37.929 --> 00:32:41.090
There was a [00:35:00] secondary latching mechanism that…

00:32:41.090 --> 00:32:43.870
GARY: That we couldn’t see or something.

00:32:43.870 --> 00:32:48.659
I ended up picking two doors in a row to a court room and then we ended up making it

00:32:48.659 --> 00:32:50.970
in.

00:32:50.970 --> 00:32:55.380
We ended up getting in, we saw the security cameras.

00:32:55.380 --> 00:33:00.920
JACK: Now, when they say they found the security cameras, what they mean is they found the

00:33:00.920 --> 00:33:05.029
room that you can sit in to watch all the security cameras and what’s going on in

00:33:05.029 --> 00:33:06.029
the whole building.

00:33:06.029 --> 00:33:07.669
GARY: Guard desk; it wasn’t really a room.

00:33:07.669 --> 00:33:12.159
It’s just, they had all the security cameras at the guard desk which was right – which

00:33:12.159 --> 00:33:15.710
was actually the sheriff’s desk during the day that sits there.

00:33:15.710 --> 00:33:21.120
They’ve got a sheriff or a deputy sheriff that monitors, or that’s there on duty for

00:33:21.120 --> 00:33:25.679
the courthouse that sits in this, it’s almost like a…

00:33:25.679 --> 00:33:27.120
JUSTIN: Front desk, almost.

00:33:27.120 --> 00:33:33.240
GARY: Yeah, front desk type thing where a receptionist would sit in a company.

00:33:33.240 --> 00:33:36.370
The deputy sheriff sits there that has access to all these different cameras which show

00:33:36.370 --> 00:33:39.539
the courtrooms, their office areas.

00:33:39.539 --> 00:33:43.470
At night when you’ve got your security guard there who isn’t a deputy sheriff, they will

00:33:43.470 --> 00:33:47.840
also use those same cameras that the deputy sheriff normally sits at to check the different

00:33:47.840 --> 00:33:49.460
offices to make sure that nobody’s in there, the lights aren’t on, and stuff.

00:33:49.460 --> 00:33:54.409
JACK: One of the first things they do is look at all the cameras to see if anyone was there.

00:33:54.409 --> 00:33:59.029
They did in fact see someone in the building; somebody was making the rounds, checking on

00:33:59.029 --> 00:34:00.029
the place.

00:34:00.029 --> 00:34:02.269
It looked like a security guard.

00:34:02.269 --> 00:34:06.549
They made sure to keep a close eye on him while sneaking around this building and at

00:34:06.549 --> 00:34:11.139
the same time, they took careful notes on what blind spots there were with the security

00:34:11.139 --> 00:34:15.900
cameras so when the guard got back, they could stay in those blind spots.

00:34:15.900 --> 00:34:20.409
As the guard went to a far end of the building, they started exploring around, looking for

00:34:20.409 --> 00:34:25.220
security problems and being careful to stay very quiet.

00:34:25.220 --> 00:34:31.429
As the two of them wandered around this courthouse, they opened a door which tripped an alarm.

00:34:31.429 --> 00:34:35.179
[ALARM RINGING] Suddenly, the doors were buzzing and the alarms were sounding.

00:34:35.179 --> 00:34:40.139
GARY: [MUSIC] What had happened is they basically have a holding room next to the court room

00:34:40.139 --> 00:34:45.899
and both doors lock in that room so whether or not that is for criminals that are in there

00:34:45.899 --> 00:34:49.909
to see if they can get released for jail or if it’s for somebody that’s accused of

00:34:49.909 --> 00:34:51.620
a crime, whatever, not sure what it’s for.

00:34:51.620 --> 00:34:52.950
But both doors are locked.

00:34:52.950 --> 00:34:58.140
So, because I didn’t want to have to pick the door on the way out in case it locked

00:34:58.140 --> 00:35:00.660
behind me, I propped it open.

00:35:00.660 --> 00:35:05.079
Because of the again, an assumption, because the people that work there, they make sure

00:35:05.079 --> 00:35:07.290
that that if door’s left open, that an alarm sounds.

00:35:07.290 --> 00:35:11.970
When I made it through both doors and I went to the next room which had the guard post

00:35:11.970 --> 00:35:14.359
in it, that’s when I heard the alarm and then we ended up figuring out oh, it’s because

00:35:14.359 --> 00:35:15.500
we propped the doors open.

00:35:15.500 --> 00:35:17.690
Let’s close that; duh.

00:35:17.690 --> 00:35:21.470
JACK: They were able to complete their security assessment and get out of there.

00:35:21.470 --> 00:35:25.599
The guard never found them and maybe didn’t even hear that alarm at all.

00:35:25.599 --> 00:35:27.950
But another successful mission for these two.

00:35:27.950 --> 00:35:28.950
GARY: That was fun.

00:35:28.950 --> 00:35:30.030
JUSTIN: Oh, it was a great time.

00:35:30.030 --> 00:35:34.240
GARY: We were poopin’ and snoopin’ and we were dodging the security guards and he

00:35:34.240 --> 00:35:35.722
was looking at the cameras and we were hiding under stuff.

00:35:35.722 --> 00:35:37.910
That was good stuff.

00:35:37.910 --> 00:35:41.631
JACK: They got through the courthouse pretty quick and the night was still young so they

00:35:41.631 --> 00:35:44.220
decided to hit up a second courthouse that night.

00:35:44.220 --> 00:35:48.500
This one was actually the Dallas County Courthouse in Adel, Iowa.

00:35:48.500 --> 00:35:50.000
Let me describe the scene to you.

00:35:50.000 --> 00:35:51.580
[MUSIC] The town of Adel is small.

00:35:51.580 --> 00:35:54.470
It has like, five thousand people living there at most.

00:35:54.470 --> 00:35:55.990
It’s cute, though.

00:35:55.990 --> 00:36:01.760
It has a historic main street USA type of feel to it and their downtown area, the roads

00:36:01.760 --> 00:36:06.349
are covered in a red cobblestone brick which gives it a more rustic feel.

00:36:06.349 --> 00:36:10.300
All the buildings downtown look like they could all be historic buildings.

00:36:10.300 --> 00:36:15.720
The most prominent building in all of Adel is the Dallas County Courthouse, their target.

00:36:15.720 --> 00:36:19.869
It was a built in 1902 which absolutely makes it historic.

00:36:19.869 --> 00:36:24.150
Three stories with those pointy spires on the top of each corner, and there’s a large

00:36:24.150 --> 00:36:30.230
clock tower on top with a beautiful rotunda towering way up high over the whole town.

00:36:30.230 --> 00:36:36.960
This is their target; to get into that historic courthouse in this sleepy little town in the

00:36:36.960 --> 00:36:38.920
middle of nowhere.

00:36:38.920 --> 00:36:41.109
The two head on over to the courthouse.

00:36:41.109 --> 00:36:43.690
GARY: Well, we stopped and got the Bomb Burrito at the gas station.

00:36:43.690 --> 00:36:44.690
That’s important.

00:36:44.690 --> 00:36:45.990
JUSTIN: Yeah, that does come up later.

00:36:45.990 --> 00:36:47.830
GARY: We did have a snack.

00:36:47.830 --> 00:36:50.030
[LAUGHING] We did have a snack.

00:36:50.030 --> 00:36:54.980
We took like, a thirty-minute break and just hung out at the gas station talking to the

00:36:54.980 --> 00:36:56.099
clerk that was there.

00:36:56.099 --> 00:36:57.510
He was a nice guy.

00:36:57.510 --> 00:36:59.190
JUSTIN: He was a nice guy.

00:36:59.190 --> 00:37:00.190
He gave us free donuts.

00:37:00.190 --> 00:37:01.190
GARY: Yeah, he did give us free donuts.

00:37:01.190 --> 00:37:02.190
Instead of throwing them out, he just gave us some free donuts.

00:37:02.190 --> 00:37:04.589
Yeah, so we had our break which was literally, I mean, the gas station was across the street

00:37:04.589 --> 00:37:05.589
from…

00:37:05.589 --> 00:37:06.589
JUSTIN: Just about, yeah.

00:37:06.589 --> 00:37:07.829
GARY: Yeah, like, almost across the street from the courthouse.

00:37:07.829 --> 00:37:12.369
We sat there for thirty minutes, we kind of scoped the place out just to make sure that

00:37:12.369 --> 00:37:18.140
they didn’t have some sort of patrol or something, city cops or deputy sheriffs that

00:37:18.140 --> 00:37:20.510
were patrolling the courthouse.

00:37:20.510 --> 00:37:29.160
We parked at the courthouse and again, we’ve got a get-out-of-jail-free card and every

00:37:29.160 --> 00:37:34.470
other time – we don’t have to be ultra-sneaky typically in situations like this where they

00:37:34.470 --> 00:37:37.420
just want to see if Joe Public can get in the building.

00:37:37.420 --> 00:37:41.829
We don’t have to be super sneaky. [00:40:00] So, this is one of those instances that if

00:37:41.829 --> 00:37:46.770
you look at the contract that we have, it specifically stated we were not allowed to

00:37:46.770 --> 00:37:48.800
bypass the alarm on this building.

00:37:48.800 --> 00:37:50.950
They did not want us to bypass the alarm.

00:37:50.950 --> 00:37:55.470
In the conversation we had on the phone; hey guys, don’t circumvent the alarm, don’t

00:37:55.470 --> 00:37:57.470
bypass it. Just…

00:37:57.470 --> 00:37:58.470
JUSTIN: Right.

00:37:58.470 --> 00:37:59.470
Don’t degrade our security.

00:37:59.470 --> 00:38:02.020
Like, don’t disable a sensor so that anybody could go up, bypass the store, and gain entry

00:38:02.020 --> 00:38:03.020
without an alarm going off.

00:38:03.020 --> 00:38:05.869
That’s a pretty common theme with a lot of our clients.

00:38:05.869 --> 00:38:10.840
We’re not trying to degrade the security of their facility so we can gain access because

00:38:10.840 --> 00:38:16.540
it also allows potential for other threat actors to gain access covertly or without

00:38:16.540 --> 00:38:17.540
setting off alarms.

00:38:17.540 --> 00:38:24.609
GARY: Right, so in this instance we walked up to the north door, I think it was.

00:38:24.609 --> 00:38:26.940
JUSTIN: [MUSIC] We go up to this courthouse.

00:38:26.940 --> 00:38:31.220
We jiggled the door; there’s a little technique that you just see if the latch is engaged,

00:38:31.220 --> 00:38:34.190
and pop the door real quick.

00:38:34.190 --> 00:38:37.940
Much to my surprise, the door was open.

00:38:37.940 --> 00:38:41.380
JACK: At this point it’s like, midnight.

00:38:41.380 --> 00:38:46.109
Why in the heck is the front door open on this historic courthouse with all the lights

00:38:46.109 --> 00:38:47.410
off inside?

00:38:47.410 --> 00:38:54.390
Freaky for sure, but Justin thought someone must have tried to close it at night and it

00:38:54.390 --> 00:38:56.040
just didn’t shut all the way.

00:38:56.040 --> 00:39:02.359
Now, this courthouse has an alarm system because it’s a historic courthouse building so yeah,

00:39:02.359 --> 00:39:03.359
it should, right?

00:39:03.359 --> 00:39:06.329
GARY: When he opened the door, the alarm did not go off.

00:39:06.329 --> 00:39:12.340
Our assumption was there was a fault setting in this alarm system for the front door.

00:39:12.340 --> 00:39:13.859
They armed it anyway.

00:39:13.859 --> 00:39:18.250
Again, this is our professional guess of what happened.

00:39:18.250 --> 00:39:23.000
They armed it anyway even with that fault or they armed it, it counts down, they go

00:39:23.000 --> 00:39:28.450
out, and they didn’t close the door all the way and then it armed anyway without that

00:39:28.450 --> 00:39:32.190
front door being fully closed.

00:39:32.190 --> 00:39:36.690
When Justin grabbed that front door, he opened it, what, two or three inches and the alarm

00:39:36.690 --> 00:39:38.050
didn’t go off.

00:39:38.050 --> 00:39:42.630
Then I tried a badge we had cloned from another building just to see if they had multi-building

00:39:42.630 --> 00:39:43.630
access.

00:39:43.630 --> 00:39:47.910
That didn’t work; it’s kind of like well, should we give them the benefit of the doubt

00:39:47.910 --> 00:39:49.410
or should we just use this?

00:39:49.410 --> 00:39:55.430
So, we elected to basically close the front door and say okay, well, let’s start over.

00:39:55.430 --> 00:39:59.089
JACK: They both stepped back outside.

00:39:59.089 --> 00:40:01.330
This time, they closed the door all the way.

00:40:01.330 --> 00:40:02.550
It latches shut.

00:40:02.550 --> 00:40:07.020
This must have been a fluke for the door to be accidentally left open or something so

00:40:07.020 --> 00:40:08.670
they wanted to break in properly.

00:40:08.670 --> 00:40:12.270
Now the door is locked and sealed properly.

00:40:12.270 --> 00:40:14.740
Okay, so they begin again.

00:40:14.740 --> 00:40:18.760
These two being masters at getting in through these doors, they have no trouble getting

00:40:18.760 --> 00:40:20.270
the door back open.

00:40:20.270 --> 00:40:26.250
[BEEPING] Now, as they get this door open, they immediately hear the alarm is beeping.

00:40:26.250 --> 00:40:30.450
GARY: Just like in your home security system when you walk through the door and it starts

00:40:30.450 --> 00:40:34.810
beeping to let you know that you’ve got X amount of seconds to put in your code before

00:40:34.810 --> 00:40:36.180
the actual alarm goes off.

00:40:36.180 --> 00:40:37.569
It was beeping really loud.

00:40:37.569 --> 00:40:39.290
JUSTIN: Yeah, and we already had an idea before that.

00:40:39.290 --> 00:40:45.160
We kind of expected that alarm to go off so just, again, a little bit of precursor to

00:40:45.160 --> 00:40:46.160
that.

00:40:46.160 --> 00:40:48.380
The other locations, nobody had showed up.

00:40:48.380 --> 00:40:53.160
Nobody responded so we’d been gaining access to government facilities without any alarms

00:40:53.160 --> 00:40:57.210
going off, without central dispatch showing up, without police presence showing up.

00:40:57.210 --> 00:40:59.900
This location, we’re coming up here and we’ve been there throughout the day and

00:40:59.900 --> 00:41:01.450
we had seen the alarm panel.

00:41:01.450 --> 00:41:02.570
It said OK, disabled.

00:41:02.570 --> 00:41:04.240
That night it said OK, armed.

00:41:04.240 --> 00:41:05.910
We expected it to go off.

00:41:05.910 --> 00:41:10.839
We’re coming up to this facility hoping for once, this final facility, the alarm would

00:41:10.839 --> 00:41:13.680
go off at this location.

00:41:13.680 --> 00:41:15.930
It was almost like bittersweet but good.

00:41:15.930 --> 00:41:17.780
Okay, great, the alarm’s going.

00:41:17.780 --> 00:41:20.490
It’s beeping at least, once we go in there.

00:41:20.490 --> 00:41:22.270
GARY: At least it’s armed.

00:41:22.270 --> 00:41:23.270
JUSTIN: Right?

00:41:23.270 --> 00:41:27.609
So, eventually the alarm counts down and then it starts sounding.

00:41:27.609 --> 00:41:30.800
[LOUD ALARM RINGING] Very audible at this point.

00:41:30.800 --> 00:41:35.530
The entire downtown of Adel is going off and you can hear the sounders going off.

00:41:35.530 --> 00:41:42.390
JACK: The sleepy town of Adel is now being woken by these alarms coming from their precious,

00:41:42.390 --> 00:41:46.690
historic, iconic courthouse building in the middle of town.

00:41:46.690 --> 00:41:50.630
JUSTIN: [MUSIC] At that point, alarms are blaring throughout downtown.

00:41:50.630 --> 00:41:52.380
We decide to go up to the third floor.

00:41:52.380 --> 00:41:56.740
We’re very well aware at that point; it’s very audible that the alarms have been activated.

00:41:56.740 --> 00:41:57.760
They’ve been tripped.

00:41:57.760 --> 00:42:01.290
At this point we go up to the third floor and get a vantage point and hoping that police

00:42:01.290 --> 00:42:06.339
presence responds to the incident, to the alarm going off ‘cause it’s not uncommon;

00:42:06.339 --> 00:42:12.100
I’ve been in banks in the past literally a hundred feet from a police station where

00:42:12.100 --> 00:42:16.140
they either were not paying for the service or it wasn’t connected or configured properly,

00:42:16.140 --> 00:42:20.000
where it didn’t dial out and call police to respond to the incident.

00:42:20.000 --> 00:42:23.720
Yeah, so it’s not terribly uncommon for that to happen.

00:42:23.720 --> 00:42:27.630
We go up to the third floor, get a vantage point, and at this point for our reporting

00:42:27.630 --> 00:42:35.470
purposes hoping that police respond to the alarms going off.

00:42:35.470 --> 00:42:37.520
It was extremely quick response time.

00:42:37.520 --> 00:42:41.109
[00:45:00] Within five minutes, I think it was a sheriff’s deputy had showed up to

00:42:41.109 --> 00:42:44.020
the scene and we see him and he’s going around the building.

00:42:44.020 --> 00:42:45.820
Gary and I are conferring with each other.

00:42:45.820 --> 00:42:47.590
Okay man, what’s the next plan?

00:42:47.590 --> 00:42:48.590
What are we doing here?

00:42:48.590 --> 00:42:53.170
There are police; it’s a very – not a high-stress situation but you have to handle

00:42:53.170 --> 00:42:58.230
it professionally and properly otherwise there always is risk in those types of situations.

00:42:58.230 --> 00:43:00.850
We’re discussing our game plan, what we want to do.

00:43:00.850 --> 00:43:05.100
Within a short while, another couple minutes, we go out on the main floor and Gary’s calling

00:43:05.100 --> 00:43:07.920
out commands; is there an officer in the building?

00:43:07.920 --> 00:43:12.599
Being very verbal, trying to get in communication with police.

00:43:12.599 --> 00:43:15.119
At that point it didn’t sound like anybody else was in the building.

00:43:15.119 --> 00:43:19.020
We didn’t hear any doors opening or closing so we start proceeding downstairs.

00:43:19.020 --> 00:43:22.510
JACK: As they go downstairs, they don’t see anyone in the building.

00:43:22.510 --> 00:43:26.210
They don’t hear anyone in the building, but they can tell there’s a police officer

00:43:26.210 --> 00:43:28.960
right outside the door they came in on.

00:43:28.960 --> 00:43:32.640
They spot each other and Justin and Gary come to the door.

00:43:32.640 --> 00:43:34.710
JUSTIN: The officer, he’s on the other side of the door.

00:43:34.710 --> 00:43:39.620
He was actually, we found out afterwards, was not able to gain access inside the building.

00:43:39.620 --> 00:43:40.940
We’re communicating with him.

00:43:40.940 --> 00:43:42.910
He’s like so, what’s up, fellas?

00:43:42.910 --> 00:43:46.730
We’re like, hey man, we’re here testing the security.

00:43:46.730 --> 00:43:47.930
Do you want to talk?

00:43:47.930 --> 00:43:48.930
Can I open this door?

00:43:48.930 --> 00:43:51.119
Just keeping my hands static, not moving anything.

00:43:51.119 --> 00:43:53.030
He’s like yep, go ahead, open the door.

00:43:53.030 --> 00:43:56.900
I’m like okay, I’m gonna open up the door now, so pushed the crash bar, we walk outside,

00:43:56.900 --> 00:43:58.380
and we greet him.

00:43:58.380 --> 00:44:02.020
At that point, just start conversing with him; officer, we’re here, we were hired

00:44:02.020 --> 00:44:03.349
by Iowa State Courts.

00:44:03.349 --> 00:44:08.120
We’re assessing the security of various government facilities including this courthouse.

00:44:08.120 --> 00:44:10.400
We have documentation, this is all above-ground.

00:44:10.400 --> 00:44:11.829
Would you like to see our paperwork?

00:44:11.829 --> 00:44:16.650
He responds yes, say okay, it’s in my back pocket, do you mind if I make a move and pull

00:44:16.650 --> 00:44:17.780
that out of my pocket?

00:44:17.780 --> 00:44:18.780
Sure, go ahead.

00:44:18.780 --> 00:44:21.250
Then at that point, present our paperwork.

00:44:21.250 --> 00:44:23.990
From there, he asked for our IDs.

00:44:23.990 --> 00:44:28.020
At that point I think somebody else had shown up right at that point so they were escorting

00:44:28.020 --> 00:44:32.150
us, they had hunkered down with us while somebody else had taken the IDs and the paperwork away

00:44:32.150 --> 00:44:33.960
and started verifying our information.

00:44:33.960 --> 00:44:38.540
GARY: At some point I think the sergeant even told us to relax ‘cause we were trying to

00:44:38.540 --> 00:44:42.450
be ultra-careful and professional and every time we wanted to move our hands, we were

00:44:42.450 --> 00:44:43.839
like hey, is it alright?

00:44:43.839 --> 00:44:45.310
We okay to get our wallets?

00:44:45.310 --> 00:44:46.849
At some point he’s like hey man, you guys can relax.

00:44:46.849 --> 00:44:49.710
We just want to verify that you’re doing what you should be doing.

00:44:49.710 --> 00:44:53.200
You don’t have to be that paranoid.

00:44:53.200 --> 00:44:58.220
We are pretty sure that you’re not doing anything nefarious here.

00:44:58.220 --> 00:45:00.230
They were ultra-professional.

00:45:00.230 --> 00:45:01.829
They handled themselves perfectly.

00:45:01.829 --> 00:45:03.890
JUSTIN: Yeah, those guys were great.

00:45:03.890 --> 00:45:08.610
GARY: They were nice, they were professional, they were doing the whole Ronald Regan trust-but-verify

00:45:08.610 --> 00:45:09.610
type thing.

00:45:09.610 --> 00:45:12.790
Yeah, we’re pretty sure you guys are on the up-and-up because you came out to us and

00:45:12.790 --> 00:45:15.550
you did what you were supposed to do but we’re just gonna make sure.

00:45:15.550 --> 00:45:17.920
We’re gonna verify that you are really supposed to be here.

00:45:17.920 --> 00:45:26.609
If nothing else, we can’t thank the deputies enough because they were ultra-professional

00:45:26.609 --> 00:45:27.980
and just really, really standup people.

00:45:27.980 --> 00:45:28.980
JUSTIN: Agreed.

00:45:28.980 --> 00:45:32.220
JACK: They immediately gave the police their get-out-of-jail-free card.

00:45:32.220 --> 00:45:34.240
You don’t want to mess around and lie to the police.

00:45:34.240 --> 00:45:38.020
You want to come clean because this is not someone you want to try to trick.

00:45:38.020 --> 00:45:39.720
This is not part of the scope.

00:45:39.720 --> 00:45:43.700
You want to tell them look, we’re here on official business.

00:45:43.700 --> 00:45:48.480
The paper has the names and phone numbers of the state employees that hired Coalfire

00:45:48.480 --> 00:45:50.819
to do this penetration test.

00:45:50.819 --> 00:45:53.290
The police call the first number.

00:45:53.290 --> 00:45:54.650
No answer.

00:45:54.650 --> 00:45:56.040
They called the second number.

00:45:56.040 --> 00:45:58.700
The line was disconnected.

00:45:58.700 --> 00:46:01.400
They called the third number.

00:46:01.400 --> 00:46:02.609
Someone picks up.

00:46:02.609 --> 00:46:06.210
The police ask if they knew that these guys were trying to break into the courthouse.

00:46:06.210 --> 00:46:07.210
They said…

00:46:07.210 --> 00:46:08.390
JUSTIN: Yeah, we’re doing security testing.

00:46:08.390 --> 00:46:09.859
Those guys are supposed to be there.

00:46:09.859 --> 00:46:11.300
They’re testing the security of the courthouse.

00:46:11.300 --> 00:46:15.470
This is my story of what happened ‘cause I’m not on that call there with them.

00:46:15.470 --> 00:46:16.680
They’d walk away a little bit from us.

00:46:16.680 --> 00:46:22.520
GARY: This is what the sergeant, the deputy sheriff who was a sergeant, told us.

00:46:22.520 --> 00:46:24.109
He spoke to our contact.

00:46:24.109 --> 00:46:26.240
He’s like well, this is what your contact said.

00:46:26.240 --> 00:46:28.080
JUSTIN: They run our credentials, everything on spec.

00:46:28.080 --> 00:46:30.300
They have our names and our driver’s license.

00:46:30.300 --> 00:46:32.069
They do get ahold of our point of contacts.

00:46:32.069 --> 00:46:34.980
They’d say yes, these guys are here testing security.

00:46:34.980 --> 00:46:38.430
At that point the sergeant, the guy in charge or head in charge…

00:46:38.430 --> 00:46:40.560
GARY: The ranking officer on the scene.

00:46:40.560 --> 00:46:41.750
JUSTIN: Ranking officer, thank you.

00:46:41.750 --> 00:46:43.510
That’s what I was trying to get to.

00:46:43.510 --> 00:46:47.790
Had come back to us, handed us back our IDs and he’s like yeah, as far as I’m concerned,

00:46:47.790 --> 00:46:49.680
you guys should be good to go.

00:46:49.680 --> 00:46:50.819
Everything’s all clear here.

00:46:50.819 --> 00:46:53.030
At that point things get really jovial.

00:46:53.030 --> 00:46:55.000
We’re laughing, joking around with the officers.

00:46:55.000 --> 00:46:56.970
They’re asking us man, this job’s crazy.

00:46:56.970 --> 00:46:58.470
Like, you guys break into buildings.

00:46:58.470 --> 00:46:59.920
How does this go?

00:46:59.920 --> 00:47:02.220
How’d you get jobs like this?

00:47:02.220 --> 00:47:03.660
How can we test security?

00:47:03.660 --> 00:47:05.520
How do we get a job like that?

00:47:05.520 --> 00:47:10.670
JACK: [MUSIC] Just as Gary and Justin were about to leave another squad car pulls up.

00:47:10.670 --> 00:47:14.460
This one has Sheriff written on the side.

00:47:14.460 --> 00:47:18.059
The guy gets out and walks up.

00:47:18.059 --> 00:47:24.510
GARY: The sheriff shows up; he’s visibly upset.

00:47:24.510 --> 00:47:27.700
From our perspective the mood completely changed.

00:47:27.700 --> 00:47:34.010
Prior to him showing up, everybody was happy and smiling and we were – there had to be

00:47:34.010 --> 00:47:36.300
eight deputies that responded.

00:47:36.300 --> 00:47:39.960
All of us standing on the courthouse steps and then there was one [00:50:00] City of

00:47:39.960 --> 00:47:43.530
Adel officer there as well, so there was at least nine people there including us.

00:47:43.530 --> 00:47:46.780
JUSTIN: There’s not a lot going on in Adel, Iowa at 2:00 in the morning.

00:47:46.780 --> 00:47:51.470
GARY: When the sheriff shows up, all the smoking and joking stops.

00:47:51.470 --> 00:47:57.500
This giant fun-sponge walks in the room and everybody just stops talking.

00:47:57.500 --> 00:48:00.510
Everything just goes silent.

00:48:00.510 --> 00:48:05.940
He walks up, he has some choice words to say to us that we didn’t necessarily agree with,

00:48:05.940 --> 00:48:08.330
kinda talking down to us in a certain respect.

00:48:08.330 --> 00:48:10.220
JUSTIN: To put it mildly.

00:48:10.220 --> 00:48:15.710
GARY: To put it mildly, and basically tells us that we don’t have authorization to do

00:48:15.710 --> 00:48:18.400
what we’re doing and asks us if we knew that.

00:48:18.400 --> 00:48:21.610
We told him our perspective which was hey, we’re under contract, we’re working for

00:48:21.610 --> 00:48:22.780
these people.

00:48:22.780 --> 00:48:28.200
His response to that was well, they don’t own this courthouse and I don’t care if

00:48:28.200 --> 00:48:31.740
you’re under contract; they don’t own this courthouse.

00:48:31.740 --> 00:48:32.740
JACK: Whoa, what?

00:48:32.740 --> 00:48:34.820
The state doesn’t own the courthouse?

00:48:34.820 --> 00:48:40.010
Uh, did they get authorization from someone who didn’t have authorization to break in

00:48:40.010 --> 00:48:41.420
the building?

00:48:41.420 --> 00:48:47.599
Uh, I would start to get worried at this point but Gary wasn’t worried at all.

00:48:47.599 --> 00:48:48.680
GARY: Nah, you know?

00:48:48.680 --> 00:48:53.520
No, because this has never happened before in history as far as we know or any of the

00:48:53.520 --> 00:48:56.559
other people that we know in the industry, it’s never happened.

00:48:56.559 --> 00:49:01.420
People get taken away or they get held until situations resolve themselves.

00:49:01.420 --> 00:49:04.109
Not frequently, but it happens.

00:49:04.109 --> 00:49:07.579
If that happened in this case, we were fine with it ‘cause we know that the truth’s

00:49:07.579 --> 00:49:11.200
gonna come out, they’re gonna realize we’re actually working for a company and that we

00:49:11.200 --> 00:49:16.970
were really contracted by the state so worst case scenario, we got to spend an hour or

00:49:16.970 --> 00:49:17.970
two in a holding cell.

00:49:17.970 --> 00:49:22.299
Not that big a deal.

00:49:22.299 --> 00:49:27.960
[MUSIC] The sheriff tells everybody that was there and says well, we’re gonna arrest

00:49:27.960 --> 00:49:29.110
these guys for trespassing.

00:49:29.110 --> 00:49:32.880
Hold them; I’m gonna go make a phone call.

00:49:32.880 --> 00:49:36.790
So, in our minds he’s gonna go talk to our contacts.

00:49:36.790 --> 00:49:39.840
At least in my mind that’s what he was doing.

00:49:39.840 --> 00:49:43.349
In that time that he was gone, ‘cause he was gone for like, a good ten minutes it felt

00:49:43.349 --> 00:49:44.349
like.

00:49:44.349 --> 00:49:45.349
JUSTIN: Yeah, it seemed like he was, for sure.

00:49:45.349 --> 00:49:48.700
GARY: In that time he was gone, the mood went right back to what it was before he was there

00:49:48.700 --> 00:49:51.890
which was everybody was asking us questions, asking us how we did stuff.

00:49:51.890 --> 00:49:55.369
What’s the craziest thing we’ve ever seen or heard about in our line of work?

00:49:55.369 --> 00:49:56.780
It went right back to that.

00:49:56.780 --> 00:50:00.970
One of the officers was super interested on how we got in, so we showed him our tools,

00:50:00.970 --> 00:50:04.621
we showed him how we got in, we showed him the technique that we used.

00:50:04.621 --> 00:50:07.780
We troubleshot how we think that front door got left open.

00:50:07.780 --> 00:50:09.109
They gave us their ideas.

00:50:09.109 --> 00:50:15.720
We talked about card entry on why they originally couldn’t get into the building.

00:50:15.720 --> 00:50:17.660
Everything just went back to normal.

00:50:17.660 --> 00:50:22.760
About ten minutes later, again, what we’re thinking, he came back in and he was just

00:50:22.760 --> 00:50:27.290
like, you need to arrest these guys for burglary.

00:50:27.290 --> 00:50:30.819
All the sheriff’s deputies kind of looked at each other.

00:50:30.819 --> 00:50:33.809
The sheriff turned around and said do I need to do it myself?

00:50:33.809 --> 00:50:34.920
Or something to that effect.

00:50:34.920 --> 00:50:39.590
I don’t remember his exact words but he said something like do I need to do it myself?

00:50:39.590 --> 00:50:42.120
I told you guys to arrest them for burglary.

00:50:42.120 --> 00:50:47.369
I don’t know what Justin’s – who the sheriff or the deputy sheriff was that arrested

00:50:47.369 --> 00:50:50.490
Justin, but the guy that grabbed me, he puts his hand on my shoulder and says hey man,

00:50:50.490 --> 00:50:51.660
I’m really sorry about this.

00:50:51.660 --> 00:50:52.660
You’re gonna…

00:50:52.660 --> 00:50:53.680
JUSTIN: I think something very similar happened with me, as well.

00:50:53.680 --> 00:50:54.680
GARY: Yeah, he goes, you turn around.

00:50:54.680 --> 00:50:55.880
I’m gonna have to put these cuffs on you.

00:50:55.880 --> 00:50:57.329
JUSTIN: Right, and I totally understand.

00:50:57.329 --> 00:50:58.329
Like, okay, man.

00:50:58.329 --> 00:50:59.329
I get it.

00:50:59.329 --> 00:51:00.329
I see where you’re coming from.

00:51:00.329 --> 00:51:01.329
GARY: Yeah, and both our responses are like hey man, it’s okay.

00:51:01.329 --> 00:51:02.329
You’re just doing your jobs.

00:51:02.329 --> 00:51:03.870
It’s not a big deal.

00:51:03.870 --> 00:51:07.230
This won’t be the last time this happens, I’m sure.

00:51:07.230 --> 00:51:09.780
JACK: So, both of them get handcuffed.

00:51:09.780 --> 00:51:13.600
They had their rights read to them and the police started escorting them away.

00:51:13.600 --> 00:51:18.760
But still, even though they now have handcuffs on and the police are escorting them, they

00:51:18.760 --> 00:51:20.180
still weren’t nervous about the situation.

00:51:20.180 --> 00:51:21.180
GARY: No.

00:51:21.180 --> 00:51:25.290
JUSTIN: ‘Cause think about it from our perspective; we had done nothing wrong.

00:51:25.290 --> 00:51:27.470
We have all the paperwork in the world.

00:51:27.470 --> 00:51:29.380
I’m from Florida, Gary’s from Seattle.

00:51:29.380 --> 00:51:34.109
It’s not like we flew out to Adel Iowa to start breaking into courthouses on our [inaudible]

00:51:34.109 --> 00:51:35.109
paths.

00:51:35.109 --> 00:51:36.890
We knew we had every shred of evidence in our favor.

00:51:36.890 --> 00:51:37.990
We knew that this was totally above-ground.

00:51:37.990 --> 00:51:43.840
It’s not totally uncommon for law enforcement to respond to an incident.

00:51:43.840 --> 00:51:44.860
It does happen.

00:51:44.860 --> 00:51:50.920
It is extremely rare, I’d say, for somebody to get detained or furthermore arrested.

00:51:50.920 --> 00:51:56.299
That’s as far as it had ever got and as far as we’re aware, nobody’s ever been

00:51:56.299 --> 00:51:59.089
actually formally arrested and pressed with charges.

00:51:59.089 --> 00:52:01.049
GARY: Charged, nobody’s ever been actually charged, yeah.

00:52:01.049 --> 00:52:04.320
JUSTIN: Right, so we’re thinking okay, we’re gonna go down to the station.

00:52:04.320 --> 00:52:06.490
We’ll work this out, not a big deal.

00:52:06.490 --> 00:52:11.880
JACK: Now, because this is Adel, a small town, the jailhouse was literally across the street

00:52:11.880 --> 00:52:13.410
from the courthouse.

00:52:13.410 --> 00:52:17.770
They both get walked to the jailhouse with handcuffs on.

00:52:17.770 --> 00:52:20.920
Stay tuned ‘cause when we come back from the break, we’ll hear what happens to Gary

00:52:20.920 --> 00:52:23.010
and Justin.

00:52:23.010 --> 00:52:27.400
Gary and Justin are now both at the jailhouse and they have been separated.

00:52:27.400 --> 00:52:31.319
The police are questioning them and processing them separately.

00:52:31.319 --> 00:52:36.940
GARY: That’s when the aggravation started to kick in a little bit [MUSIC] because we

00:52:36.940 --> 00:52:41.240
were going through the entire process [00:55:00] which is empty out all your pockets, give

00:52:41.240 --> 00:52:44.130
us all your gear, give us your backpacks.

00:52:44.130 --> 00:52:48.840
I don’t know if you ever did, but I interacted with the sheriff a couple of times.

00:52:48.840 --> 00:52:49.869
JUSTIN: No, I never talked to the sheriff.

00:52:49.869 --> 00:52:55.670
GARY: Yeah, so I interacted with the sheriff a couple of times and it was like hey sheriff,

00:52:55.670 --> 00:53:00.299
are you just gonna hold us or are you actually gonna charge us?

00:53:00.299 --> 00:53:05.430
It was later discussed during that conversation that I won’t really go into ‘cause it’ll

00:53:05.430 --> 00:53:09.369
just aggravate me, was yes, we’re going to charge you.

00:53:09.369 --> 00:53:14.109
There was multiple times I tried to – I don’t want to say talk my way out of it…

00:53:14.109 --> 00:53:15.109
JUSTIN: De-escalate.

00:53:15.109 --> 00:53:17.099
GARY: Yeah, that’s a better term, de-escalate the situation.

00:53:17.099 --> 00:53:22.450
Like hey, maybe you could contact one of our contacts.

00:53:22.450 --> 00:53:26.569
Talk to somebody at Iowa State Court and talk to somebody because we’re legitimately just

00:53:26.569 --> 00:53:28.350
working here, sir.

00:53:28.350 --> 00:53:29.910
We were ultra-polite.

00:53:29.910 --> 00:53:35.819
There’s multiple videos out there that show that I don’t think we were ever unprofessional.

00:53:35.819 --> 00:53:40.369
We were just like hey sir, could you possibly do this or check with this person?

00:53:40.369 --> 00:53:42.770
Maybe this is a big misunderstanding.

00:53:42.770 --> 00:53:45.800
It was always met with nope; you’re going to jail.

00:53:45.800 --> 00:53:47.240
Nope, you’re getting arrested.

00:53:47.240 --> 00:53:52.790
JUSTIN: I mean, at some point along that process it became very clear that regardless of any

00:53:52.790 --> 00:53:54.870
amount of paperwork that we would have had on us…

00:53:54.870 --> 00:53:55.870
GARY: It did not matter, yeah.

00:53:55.870 --> 00:53:58.099
JUSTIN: …or anything that we could have said, there was something else going on.

00:53:58.099 --> 00:54:00.569
It wasn’t about that.

00:54:00.569 --> 00:54:05.680
We had the paperwork; the deputies already verified, cleared, identified us but let us

00:54:05.680 --> 00:54:08.250
go, essentially.

00:54:08.250 --> 00:54:12.770
Despite all that, there was something else going on that regardless of what we could

00:54:12.770 --> 00:54:17.610
have said, done, or shown, there was no getting out of an arrest at that point.

00:54:17.610 --> 00:54:20.369
We’re both being very professional throughout the entire process.

00:54:20.369 --> 00:54:24.770
But I’m a very big privacy advocate and as we’re going through this, they’re asking

00:54:24.770 --> 00:54:25.809
what’s your marital status?

00:54:25.809 --> 00:54:28.050
What’s your highest level of education?

00:54:28.050 --> 00:54:32.140
I’m very understanding at this point, we’re being wrongfully arrested because we’re

00:54:32.140 --> 00:54:33.140
here for a job.

00:54:33.140 --> 00:54:35.930
This isn’t something that needs to be dragged through a criminal process.

00:54:35.930 --> 00:54:41.710
At most, if there’s contract discrepancies or issues with the state-first county level,

00:54:41.710 --> 00:54:44.400
this is something that gets handled in a civil courtroom.

00:54:44.400 --> 00:54:47.650
At that point I didn’t want to provide my social security number.

00:54:47.650 --> 00:54:51.690
It’s not like we’re resisting arrest or anything like that, but unwilling to give

00:54:51.690 --> 00:54:58.160
up a lot of personal details at that point which a lot of people in the booking or reception

00:54:58.160 --> 00:55:00.890
room, however you want to call it, got very upset with that.

00:55:00.890 --> 00:55:04.839
We have to give up all of our tools, all of our gear.

00:55:04.839 --> 00:55:08.099
We go through the process of explaining what these tools are ‘cause we’re being booked

00:55:08.099 --> 00:55:10.540
not only for burglary but possession of burglary tools.

00:55:10.540 --> 00:55:15.430
They want to have circumstantial evidence of us having tools that are used typically

00:55:15.430 --> 00:55:18.810
in burglary trade but obviously in a security setting at this point.

00:55:18.810 --> 00:55:22.410
JACK: They finally get to make some phone calls but at this point it’s like, 2:00

00:55:22.410 --> 00:55:23.410
a.m.

00:55:23.410 --> 00:55:27.630
GARY: I had about thirty but unfortunately everybody was sleeping and no one would answer

00:55:27.630 --> 00:55:32.250
my call, even my wife slept through all of the phone calls that I sent her.

00:55:32.250 --> 00:55:34.390
I sent all sorts of messages to people.

00:55:34.390 --> 00:55:38.960
The only person I was able to actually get ahold of was one of our contacts and I said

00:55:38.960 --> 00:55:40.849
hey, are you aware that we got arrested?

00:55:40.849 --> 00:55:41.890
Yeah, yeah, we’re aware.

00:55:41.890 --> 00:55:42.950
Such-and-such told me.

00:55:42.950 --> 00:55:46.089
Are you doing anything to get us out?

00:55:46.089 --> 00:55:49.140
He said well, yeah, we’re gonna be there first thing in the morning.

00:55:49.140 --> 00:55:51.460
We’re gonna talk to X, Y, and Z.

00:55:51.460 --> 00:55:54.180
I don’t remember who he said we’re gonna talk to.

00:55:54.180 --> 00:55:57.970
We’re gonna smooth this all over; it’s one big misunderstanding.

00:55:57.970 --> 00:56:02.869
I believe almost verbatim his thing was you’d think that the sheriff would be a little more

00:56:02.869 --> 00:56:05.310
understanding of what we’re trying to do.

00:56:05.310 --> 00:56:06.740
I said well, guess what?

00:56:06.740 --> 00:56:07.740
He’s not.

00:56:07.740 --> 00:56:09.720
He said yeah, I can see that.

00:56:09.720 --> 00:56:11.530
Again, we’ll be there first thing in the morning.

00:56:11.530 --> 00:56:12.530
We’re gonna hammer this out.

00:56:12.530 --> 00:56:15.090
There was a lot more to that conversation but that’s the gist of it.

00:56:15.090 --> 00:56:17.829
JACK: Now, for me, my first call would have been to my boss.

00:56:17.829 --> 00:56:21.560
I would have called Coalfire right away and told them hey, get some lawyers.

00:56:21.560 --> 00:56:22.600
We’re in jail.

00:56:22.600 --> 00:56:28.349
We need help right now because they’re operating in capacity of Coalfire, so Coalfire should

00:56:28.349 --> 00:56:29.789
be capable of helping them out.

00:56:29.789 --> 00:56:32.099
GARY: Yeah, and we tried to get ahold of Coalfire.

00:56:32.099 --> 00:56:35.270
We just couldn’t get ahold of anybody just because of the late hour.

00:56:35.270 --> 00:56:39.640
I think most people when they sleep, they put their phone on vibrate.

00:56:39.640 --> 00:56:45.559
Because again, we’re talking about a scenario that has never happened before.

00:56:45.559 --> 00:56:48.290
Maybe you want to say some complacency, whatever you want to put in there.

00:56:48.290 --> 00:56:49.630
Who knows what it was?

00:56:49.630 --> 00:56:53.600
But most people were like okay, two or three in the morning, not really that big of a deal.

00:56:53.600 --> 00:56:55.580
What’s the worst that could happen?

00:56:55.580 --> 00:56:58.860
Well, we figured out what the worst that could happen was.

00:56:58.860 --> 00:57:04.099
JACK: By 2:30 a.m. the police finished processing them and gave them both orange jumpsuits to

00:57:04.099 --> 00:57:06.770
change into, the kind you see prisoners wear.

00:57:06.770 --> 00:57:09.829
The police took all their belongings, even their shoes.

00:57:09.829 --> 00:57:11.920
Gary got a pair of Crocs.

00:57:11.920 --> 00:57:16.210
Justin got some sandals that were too small and they were put in a cell for the night

00:57:16.210 --> 00:57:18.260
with other criminals and cell mates.

00:57:18.260 --> 00:57:24.390
They tried to lay down and sleep but the beds were really hard and cold, so they didn’t

00:57:24.390 --> 00:57:28.710
get much sleep that night.

00:57:28.710 --> 00:57:38.941
[MUSIC] The next day they had an appointment to see the judge in the very courthouse [01:00:00]

00:57:38.941 --> 00:57:40.150
they broke into.

00:57:40.150 --> 00:57:43.380
The officers escort them to the courthouse.

00:57:43.380 --> 00:57:47.060
GARY: When we walked over there in the morning, although it was incredibly uncomfortable and

00:57:47.060 --> 00:57:52.710
embarrassing that we were over there in literally shackles, right, the whole around-your-wrists

00:57:52.710 --> 00:57:56.790
and then tied around your waist and then the chain that goes from your wrist through your

00:57:56.790 --> 00:57:58.470
waist all the way to your ankles.

00:57:58.470 --> 00:58:02.890
Then you’re attached to the guy in front of you, and you do the – what is it?

00:58:02.890 --> 00:58:08.511
The railroad gang or whatever, across the street with deputies in front of you, in the

00:58:08.511 --> 00:58:12.280
back of you, and I was like you gotta be kidding.

00:58:12.280 --> 00:58:16.890
We get over there and the whole time I’m thinking we just gotta make it to nine in

00:58:16.890 --> 00:58:17.890
the morning.

00:58:17.890 --> 00:58:20.359
The state’s gonna be here, they’re gonna explain everything, and then the judge is

00:58:20.359 --> 00:58:22.130
gonna be like, this is silly.

00:58:22.130 --> 00:58:23.170
Why are you guys here?

00:58:23.170 --> 00:58:26.500
Go ahead, issue[LH1] on your own recognizance, you can go home.

00:58:26.500 --> 00:58:30.140
JACK: They get to the courthouse, they sit down in the courtroom, and await their names

00:58:30.140 --> 00:58:31.730
to be called by the judge.

00:58:31.730 --> 00:58:37.180
It boggles my mind still that this is the very courthouse that they broke into last

00:58:37.180 --> 00:58:41.680
night and now they’re sitting in the courthouse waiting to see the judge.

00:58:41.680 --> 00:58:44.700
GARY: I was first.

00:58:44.700 --> 00:58:47.280
There was a gentleman that was sitting next to the sheriff.

00:58:47.280 --> 00:58:49.970
The sheriff was in the gallery, I guess you could say.

00:58:49.970 --> 00:58:52.560
There was only one man standing next to him.

00:58:52.560 --> 00:58:57.210
My thought was good, that is the court representative from the state court, right?

00:58:57.210 --> 00:59:01.030
He’s talking to the sheriff, they’ve talked about this, they realize this is just a big

00:59:01.030 --> 00:59:02.030
misunderstanding.

00:59:02.030 --> 00:59:05.610
Everything’s gonna be good, they’re gonna let us go, is what’s still playing in my

00:59:05.610 --> 00:59:06.610
mind.

00:59:06.610 --> 00:59:08.660
I sit there, I go in front of the judge.

00:59:08.660 --> 00:59:10.039
They ask your name; they say what’s your name?

00:59:10.039 --> 00:59:11.299
Yeah, my name’s Gary De Mercurio.

00:59:11.299 --> 00:59:12.299
How much money do you make?

00:59:12.299 --> 00:59:13.410
I make X amount of money.

00:59:13.410 --> 00:59:14.630
Who do you work for?

00:59:14.630 --> 00:59:18.200
I work for a company called Coalfire.

00:59:18.200 --> 00:59:22.099
At that point, they decide whether or not you can qualify for a public defender.

00:59:22.099 --> 00:59:23.099
JUSTIN: Legal representation.

00:59:23.099 --> 00:59:24.099
GARY: Right, public defender.

00:59:24.099 --> 00:59:26.680
She says you do not qualify for a public defender.

00:59:26.680 --> 00:59:29.440
Would you like to defend yourself or would you rather get outside counsel?

00:59:29.440 --> 00:59:34.359
I’m like well, I’m hoping outside counsel isn’t necessary because ma’am, I believe

00:59:34.359 --> 00:59:35.789
this is just a big misunderstanding.

00:59:35.789 --> 00:59:39.470
I launch into my reason why I think this is a misunderstanding.

00:59:39.470 --> 00:59:44.390
I explain to her what it is that we do, what we were doing that night, who we work for.

00:59:44.390 --> 00:59:50.160
She looks at me and she says you must think I’m stupid.

00:59:50.160 --> 00:59:52.950
[MUSIC] At that point I’m like, oh, Lord.

00:59:52.950 --> 00:59:54.300
You’ve got to be kidding me.

00:59:54.300 --> 00:59:56.800
This is not happening.

00:59:56.800 --> 01:00:03.740
She launches into this, I don’t know, diatribe, just like I’m the biggest idiot that she

01:00:03.740 --> 01:00:07.109
has ever seen step in front of her in her entire life.

01:00:07.109 --> 01:00:09.089
That is not the way that things happen.

01:00:09.089 --> 01:00:11.589
She is a state employee, she works for the state.

01:00:11.589 --> 01:00:15.960
If the state was doing this, she would know about it and this is not the way that things

01:00:15.960 --> 01:00:19.380
happen at the state, etc, etc, etc.

01:00:19.380 --> 01:00:22.650
I just went from being hopeful to just seeing red.

01:00:22.650 --> 01:00:24.540
I was just irate.

01:00:24.540 --> 01:00:31.770
JACK: Keep in mind that both Gary and Justin barely slept the night before and they’re

01:00:31.770 --> 01:00:34.390
in these orange jumpsuits with shackles on.

01:00:34.390 --> 01:00:38.630
They aren’t presenting themselves as best they could given the situation but when the

01:00:38.630 --> 01:00:41.990
judge said this to Gary, he couldn’t believe it.

01:00:41.990 --> 01:00:44.289
He stood there totally shocked.

01:00:44.289 --> 01:00:48.549
Tons of rebuttals are going through his head but he wanted to be courteous so all he could

01:00:48.549 --> 01:00:50.470
do is stand there and be quiet.

01:00:50.470 --> 01:00:51.940
But he was thinking things like…

01:00:51.940 --> 01:00:54.190
GARY: You are a judge.

01:00:54.190 --> 01:01:01.380
You are literally – the point of your position is to be able to look at someone and have

01:01:01.380 --> 01:01:06.810
some semblance of an idea whether or not that person is telling the truth or not and the

01:01:06.810 --> 01:01:11.650
only thing I can think of is you’ve been dealing with people and liars for so long,

01:01:11.650 --> 01:01:18.130
you can no longer tell the difference between somebody who is innocent and telling the truth

01:01:18.130 --> 01:01:20.710
wholeheartedly and somebody who is a liar.

01:01:20.710 --> 01:01:23.650
JUSTIN: Which obviously, he’s not saying that to the judge but that’s going through

01:01:23.650 --> 01:01:24.650
both of our…

01:01:24.650 --> 01:01:25.720
GARY: Yeah, that’s obviously what we’re thinking.

01:01:25.720 --> 01:01:31.420
JACK: The judge charged him with burglary and possession of burglary tools, then went

01:01:31.420 --> 01:01:35.020
on to say a bail is set for $5,000.

01:01:35.020 --> 01:01:37.859
Justin couldn’t believe the judge was saying this, either.

01:01:37.859 --> 01:01:42.810
JUSTIN: Same deal; I’m like, as not the person on front stage but obviously still

01:01:42.810 --> 01:01:45.349
in the same boat, I’m like oh no, there’s no way.

01:01:45.349 --> 01:01:46.910
This is like a bad joke.

01:01:46.910 --> 01:01:48.530
You gotta be kidding me.

01:01:48.530 --> 01:01:51.540
Not a chance in hell this is how this is going down.

01:01:51.540 --> 01:01:55.829
I’m just kind of like sitting on the stand in awe.

01:01:55.829 --> 01:02:00.609
My jaw has dropped to the floor looking at the situation transpire in front of us.

01:02:00.609 --> 01:02:02.880
GARY: There’s still this gentleman sitting next to the sheriff.

01:02:02.880 --> 01:02:07.910
I’m like, okay; I’m like well, again, internal monologue, well hah, joke’s on

01:02:07.910 --> 01:02:11.890
you judge, this guy’s from the state and he’s gonna explain everything.

01:02:11.890 --> 01:02:16.200
This guy walks up next to me and says excuse me ma’am, I’m the county prosecutor and

01:02:16.200 --> 01:02:18.150
we think these guys are a flight risk.

01:02:18.150 --> 01:02:20.010
We would like to increase their bail.

01:02:20.010 --> 01:02:22.430
I’m like, oh Lord.

01:02:22.430 --> 01:02:25.119
Are you kidding me?

01:02:25.119 --> 01:02:27.750
I literally start looking around the courtroom looking for somebody else.

01:02:27.750 --> 01:02:30.310
I’m like where is our state representation?

01:02:30.310 --> 01:02:32.539
They told us they were going to be here.

01:02:32.539 --> 01:02:34.549
Where are they?

01:02:34.549 --> 01:02:35.930
They were nowhere to be found.

01:02:35.930 --> 01:02:37.690
They told us they were gonna show up.

01:02:37.690 --> 01:02:39.309
They ghosted us.

01:02:39.309 --> 01:02:42.430
[01:05:00] 100% ghosted us.

01:02:42.430 --> 01:02:46.900
JACK: There was nobody there to defend Justin or Gary.

01:02:46.900 --> 01:02:52.710
The three contacts on their get-out-of-jail-free card did not come like they said they would.

01:02:52.710 --> 01:02:56.990
This was just too soon for anyone from Coalfire to be able to come down and help, either.

01:02:56.990 --> 01:03:02.279
So, they were just standing there completely baffled and irate that this was happening.

01:03:02.279 --> 01:03:06.119
JUSTIN: I will say at one point during this exchange, the judge is looking at Gary and

01:03:06.119 --> 01:03:10.700
she’s like, you need to come up with a better story because nobody here is believing this,

01:03:10.700 --> 01:03:15.460
to which Gary retorts well, you should talk to the sheriff because the deputies last night

01:03:15.460 --> 01:03:17.109
had verified us.

01:03:17.109 --> 01:03:20.030
Everyone believed us until we’re here sitting in front of this courtroom.

01:03:20.030 --> 01:03:22.710
He looks over at the sheriff and the sheriff is just kind of like…

01:03:22.710 --> 01:03:25.210
GARY: He just smiled and shrugged.

01:03:25.210 --> 01:03:27.920
He didn’t say anything.

01:03:27.920 --> 01:03:31.829
Again, in our minds, we’re like don’t you have some sort of ethical responsibility

01:03:31.829 --> 01:03:36.480
to say actually ma’am, we did verify with someone that worked for the state.

01:03:36.480 --> 01:03:40.680
However, we haven’t fully confirmed that or something of that nature.

01:03:40.680 --> 01:03:41.859
JUSTIN: Sure, yeah, anything.

01:03:41.859 --> 01:03:43.050
GARY: Not a word.

01:03:43.050 --> 01:03:44.050
JUSTIN: Nothing.

01:03:44.050 --> 01:03:45.790
JACK: What a frustrating situation.

01:03:45.790 --> 01:03:51.790
Yes, they broke into the courthouse but they had 100% permission to do so by the information

01:03:51.790 --> 01:03:56.940
officer, the director, and the head of infrastructure for the Iowa State Judicial Branch, the very

01:03:56.940 --> 01:03:59.210
state department that runs these courthouses.

01:03:59.210 --> 01:04:01.920
GARY: Then she read the address of where we broke in.

01:04:01.920 --> 01:04:06.390
She realized that it was her courthouse and her courtroom and she was mad.

01:04:06.390 --> 01:04:07.390
JUSTIN: Irate.

01:04:07.390 --> 01:04:12.740
GARY: She was like, how dare you break into my courthouse and my courtroom at this address?

01:04:12.740 --> 01:04:14.130
She just went off.

01:04:14.130 --> 01:04:17.539
Then she’s like, bail is set for $50,000.

01:04:17.539 --> 01:04:18.630
Our bail originally was $5,000.

01:04:18.630 --> 01:04:21.329
JUSTIN: Ten, ten times [inaudible] bail for burglary.

01:04:21.329 --> 01:04:23.119
GARY: Yeah, ten times the amount.

01:04:23.119 --> 01:04:24.119
JUSTIN: Yeah.

01:04:24.119 --> 01:04:25.809
JACK: That’s just how much bail was set for Gary.

01:04:25.809 --> 01:04:27.589
JUSTIN: I go up shortly thereafter.

01:04:27.589 --> 01:04:29.039
That’s pretty much the end of the exchange.

01:04:29.039 --> 01:04:31.289
I go up and same deal, I don’t believe this.

01:04:31.289 --> 01:04:34.339
I’m like well, we were authorized by the state to perform this testing.

01:04:34.339 --> 01:04:37.390
After seeing what Gary had gone through, I’m like, there’s no point.

01:04:37.390 --> 01:04:41.869
Don’t open your mouth and say something that could be potentially incriminating here.

01:04:41.869 --> 01:04:46.780
I’m like okay, we’re gonna do this, I suppose.

01:04:46.780 --> 01:04:51.369
Gary and I again trudged back across the street, back into our holding cells where Gary has

01:04:51.369 --> 01:04:53.809
cell mates of a wide variety.

01:04:53.809 --> 01:04:59.069
But one says to him, he’s like man, I can’t believe that.

01:04:59.069 --> 01:05:04.390
You went up there as professional as could be and she disrespected you.

01:05:04.390 --> 01:05:08.059
Even the inmates just looked at us.

01:05:08.059 --> 01:05:11.369
They were like man, you guys are so innocent.

01:05:11.369 --> 01:05:13.819
They didn’t even have to listen to our story.

01:05:13.819 --> 01:05:17.310
They were like, just the way you guys talk and the way you carry yourselves and the way

01:05:17.310 --> 01:05:19.940
you look, they’re like man, you don’t look like you belong here.

01:05:19.940 --> 01:05:21.309
What are you doing here?

01:05:21.309 --> 01:05:25.559
JACK: Justin’s bail was also set for $50,000.

01:05:25.559 --> 01:05:29.820
The way bail works in the US is that you can either sit in jail until your court case or

01:05:29.820 --> 01:05:32.640
you can pay this amount to get out of jail and come back for court.

01:05:32.640 --> 01:05:34.640
JUSTIN: At that point we’re facing felony charges.

01:05:34.640 --> 01:05:39.920
We’re facing felony burglary charges and felony possession of burglary tools.

01:05:39.920 --> 01:05:42.180
We’re in a criminal trial at that point.

01:05:42.180 --> 01:05:46.180
GARY: And looking at seven years in prison as well, seven.

01:05:46.180 --> 01:05:51.049
JACK: Still, they hoped any moment their point of contacts would come and sort everything

01:05:51.049 --> 01:05:52.049
out.

01:05:52.049 --> 01:05:56.369
But the situation was becoming less hopeful so Gary and Justin got some more phone calls

01:05:56.369 --> 01:05:59.839
and eventually got Coalfire on the phone and tell them everything.

01:05:59.839 --> 01:06:03.680
Coalfire immediately started working to bail them out and to get help.

01:06:03.680 --> 01:06:10.569
So, about twenty hours after going to jail, the $100,000 in bail money came through and

01:06:10.569 --> 01:06:12.089
they were let go.

01:06:12.089 --> 01:06:15.369
At this point it’s Thursday and their return flight is on Saturday.

01:06:15.369 --> 01:06:17.490
JUSTIN: Yeah, Coalfire gave us permission.

01:06:17.490 --> 01:06:19.200
They’re like, do whatever it takes.

01:06:19.200 --> 01:06:20.250
Get out of that state.

01:06:20.250 --> 01:06:21.250
Come back home, boys.

01:06:21.250 --> 01:06:22.250
GARY: Leave that place.

01:06:22.250 --> 01:06:25.520
JUSTIN: We booked earlier flights.

01:06:25.520 --> 01:06:31.460
JACK: [MUSIC] Both Gary and Justin go back home and get individual lawyers to help them

01:06:31.460 --> 01:06:32.510
with this.

01:06:32.510 --> 01:06:35.549
Something had gone terribly wrong but they still weren’t sure what.

01:06:35.549 --> 01:06:38.000
Why was nobody listening to reason here?

01:06:38.000 --> 01:06:40.770
Why are they even being blamed for this?

01:06:40.770 --> 01:06:44.550
This should be a contract dispute, not fall on these two guys.

01:06:44.550 --> 01:06:45.550
Felony charges?

01:06:45.550 --> 01:06:47.510
The local news ran a story.

01:06:47.510 --> 01:06:51.730
REPORTER: Two men arrested for breaking into the Dallas County Courthouse say they were

01:06:51.730 --> 01:06:54.380
hired to do it by the state.

01:06:54.380 --> 01:07:01.160
Justin Wynn and Gary De Mercurio are both now charged with third-degree burglary and

01:07:01.160 --> 01:07:03.060
possession of burglary tools.

01:07:03.060 --> 01:07:06.460
They were taken into custody around 12:30 Wednesday morning.

01:07:06.460 --> 01:07:11.950
As KCCI’s Alex Schuman shows us now, the men say they were doing cyber-security work.

01:07:11.950 --> 01:07:15.420
ALEX: The state court administration says they did hire this company to test the security

01:07:15.420 --> 01:07:20.660
of their electronic records but did not intend for them to physically break into the courthouse.

01:07:20.660 --> 01:07:25.020
Not many have yet heard what happened but once they learned, people had plenty of opinion.

01:07:25.020 --> 01:07:26.559
INTVW: They need to be arrested.

01:07:26.559 --> 01:07:29.049
There’s no trying to break in, period.

01:07:29.049 --> 01:07:30.410
Lock ‘em up.

01:07:30.410 --> 01:07:31.940
Throw away the key.

01:07:31.940 --> 01:07:33.390
I don’t care.

01:07:33.390 --> 01:07:37.869
JACK: Well, that bystander they interviewed, I guess didn’t like them for some reason.

01:07:37.869 --> 01:07:40.750
But you might have caught in this [01:10:00] news clip where they said the Judicial Branch

01:07:40.750 --> 01:07:44.520
did not intend for these two to break in.

01:07:44.520 --> 01:07:50.270
Well, the next few months of this ordeal were painful and grueling for many people involved.

01:07:50.270 --> 01:07:54.599
The news reports I read said they interviewed the State Judicial Branch who claimed that

01:07:54.599 --> 01:07:59.240
they didn’t know a physical assessment was gonna happen, but then Coalfire outlined in

01:07:59.240 --> 01:08:03.200
the contract to show them that a physical assessment was approved.

01:08:03.200 --> 01:08:06.750
Then the state changed their mind and said well yeah, we knew that was happening but

01:08:06.750 --> 01:08:10.420
this was happening outside the hours described in the contract.

01:08:10.420 --> 01:08:14.990
But then Coalfire said we left a calling card on your desk overnight and you e-mailed us

01:08:14.990 --> 01:08:15.990
saying congratulations.

01:08:15.990 --> 01:08:18.890
Why didn’t you tell us to stop then?

01:08:18.890 --> 01:08:22.770
The state went on to say okay, sure, but we didn’t know you were going to break into

01:08:22.770 --> 01:08:23.770
courthouses.

01:08:23.770 --> 01:08:28.510
But yet again, Coalfire showed them the contract and showed them the exact locations of the

01:08:28.510 --> 01:08:34.359
addresses of each building intended to be tested which included a few courthouses.

01:08:34.359 --> 01:08:40.299
Eventually the State Judicial Branch ran out of fingers for pointing at Coalfire as the

01:08:40.299 --> 01:08:41.299
problem.

01:08:41.299 --> 01:08:46.339
But while that certainly fanned the flames of this problem, it wasn’t the main fuel

01:08:46.339 --> 01:08:47.339
source.

01:08:47.339 --> 01:08:54.420
See, this was a county courthouse and it was a state department that hired them.

01:08:54.420 --> 01:08:59.640
State and county are two different things so the sheriff, judge, and county prosecutor

01:08:59.640 --> 01:09:03.980
were sticking with the story that the state had no authorization to conduct a physical

01:09:03.980 --> 01:09:06.810
penetration test on this building.

01:09:06.810 --> 01:09:11.969
This was the main crux of the issue and if the county was not aware that this was going

01:09:11.969 --> 01:09:17.170
on, then they had to assume that Gary and Justin were actual criminals.

01:09:17.170 --> 01:09:20.710
If the state had no authorization to conduct these tests on this building, then it would

01:09:20.710 --> 01:09:25.250
be the same as if that gas station attendant across the street sort of paid them to go

01:09:25.250 --> 01:09:27.200
break into the building.

01:09:27.200 --> 01:09:31.690
From the prosecutor’s perspective, they thought these two guys were actual criminals.

01:09:31.690 --> 01:09:37.069
GARY: Well, so, here’s the caveat; is after all this was said and done and we were bailed

01:09:37.069 --> 01:09:44.210
out, the state ordered a third-party investigation into this scenario.

01:09:44.210 --> 01:09:49.679
There was a lawyer, well, a law firm that performed the investigation.

01:09:49.679 --> 01:09:55.850
The final findings which are public, the very end of those findings, that lawyer is looking

01:09:55.850 --> 01:10:00.070
at some sort of precedence, right, all law is based on a case before.

01:10:00.070 --> 01:10:03.150
That’s where you get your legal precedence.

01:10:03.150 --> 01:10:07.489
Well, in a similar scenario, what was the judge?

01:10:07.489 --> 01:10:12.490
Because this has very little precedent associated with this, it’s up for interpretation of

01:10:12.490 --> 01:10:13.490
the law.

01:10:13.490 --> 01:10:19.570
During this third-party investigation, that lawyer’s interpretation of the law was the

01:10:19.570 --> 01:10:25.360
state had legal authority to authorize a test on county property because they are technically

01:10:25.360 --> 01:10:26.580
the tenants of that property.

01:10:26.580 --> 01:10:30.970
JUSTIN: It’s their authority to protect that courthouse and administer security for

01:10:30.970 --> 01:10:31.970
it.

01:10:31.970 --> 01:10:33.170
GARY: Right, and the things within that courthouse.

01:10:33.170 --> 01:10:36.830
JACK: But the prosecutors held their position.

01:10:36.830 --> 01:10:41.429
They started looking through the contract to try to find anything that wasn’t right.

01:10:41.429 --> 01:10:46.510
Justin and Gary both went back to work for Coalfire during all this but they weren’t

01:10:46.510 --> 01:10:48.620
able to really focus that well.

01:10:48.620 --> 01:10:54.260
I mean for one, they had long talks with lawyers and going over tons of evidence and documents

01:10:54.260 --> 01:10:55.400
with them.

01:10:55.400 --> 01:11:00.210
This is hard to find time to do when you’re typically spending a week at a client’s

01:11:00.210 --> 01:11:02.700
site doing a penetration test.

01:11:02.700 --> 01:11:07.040
This news made its way around, so if Gary or Justin got on a call with a client to do

01:11:07.040 --> 01:11:12.760
a pen test, some clients wanted to hear the whole story about what happened in Iowa.

01:11:12.760 --> 01:11:15.000
It was just really distracting.

01:11:15.000 --> 01:11:19.810
Of course, they were arrested with felony charges, so some clients have sensitive buildings

01:11:19.810 --> 01:11:23.070
and they do background checks on the penetration testers.

01:11:23.070 --> 01:11:26.469
But with felony charges, they weren’t able to do these assignments.

01:11:26.469 --> 01:11:31.239
They spent months battling this out with the prosecutors and a lot of what I know about

01:11:31.239 --> 01:11:35.810
this story was through documents published by the Iowa State Courts.

01:11:35.810 --> 01:11:39.860
There was some great journalism work by Ars Technica which got a lot of the documents

01:11:39.860 --> 01:11:41.940
and posted them publically.

01:11:41.940 --> 01:11:46.060
Here is where I see the rules of engagements and the positions that the state took on various

01:11:46.060 --> 01:11:48.489
things and how they broke into different buildings.

01:11:48.489 --> 01:11:52.750
In fact, somebody even interviewed the Iowa senators to see what they had to say about

01:11:52.750 --> 01:11:53.800
this.

01:11:53.800 --> 01:11:59.020
Senator Amy Sinclair said quote, “The hiring of an outside company to break into the courthouse

01:11:59.020 --> 01:12:04.770
in September created significant danger not only to the contractors but to local law enforcement

01:12:04.770 --> 01:12:06.050
and members of the public.”

01:12:06.050 --> 01:12:07.610
End quote.

01:12:07.610 --> 01:12:10.110
Also, Senator Zach Whiting had something to say.

01:12:10.110 --> 01:12:14.389
He said quote, “Essentially, a branch of government has contracted with a company to

01:12:14.389 --> 01:12:17.360
commit crimes and this is very troubling.

01:12:17.360 --> 01:12:21.280
I want to find out who needs to be held accountable for this and how we can do that.”

01:12:21.280 --> 01:12:22.810
End quote.

01:12:22.810 --> 01:12:27.040
Eventually when the third-party investigation was complete which said that the state had

01:12:27.040 --> 01:12:31.190
jurisdiction to hire Coalfire to run these tests and the state point-of-contacts all

01:12:31.190 --> 01:12:35.890
approved that Coalfire was hired to do it, all this came together and was given to the

01:12:35.890 --> 01:12:36.890
county prosecutor.

01:12:36.890 --> 01:12:40.969
JUSTIN: All that comes to light and [01:15:00] eventually, I think it was a month after the

01:12:40.969 --> 01:12:46.920
state had, or sorry, the county had the opportunity to either drop charges or to continue pressing

01:12:46.920 --> 01:12:53.650
charges; at which point they decided okay, felony charges aren’t really relevant here

01:12:53.650 --> 01:12:58.159
but we’re gonna drop this down to misdemeanor trespassing charges which I think they expected

01:12:58.159 --> 01:13:02.880
us to immediately say yep, yep, we’re guilty, we’ll take that, which of course from our

01:13:02.880 --> 01:13:05.110
perspective, we’re legally hired for this job.

01:13:05.110 --> 01:13:10.179
No chance in hell we’re gonna plead guilty to misdemeanor trespassing charges even though

01:13:10.179 --> 01:13:14.490
it’s essentially a traffic ticket violation or something similar at that point.

01:13:14.490 --> 01:13:17.570
We weren’t going to go along with that so we’re still fighting that.

01:13:17.570 --> 01:13:20.929
That fight took place over the next four months.

01:13:20.929 --> 01:13:23.600
GARY: All sorts of fights between our lawyer and the prosecutor.

01:13:23.600 --> 01:13:24.600
JUSTIN: Oh, constantly.

01:13:24.600 --> 01:13:29.980
GARY: To even get to the point where the prosecutor’s like okay, well, maybe we’ll drop it down

01:13:29.980 --> 01:13:31.370
to criminal trespassing.

01:13:31.370 --> 01:13:36.700
Our lawyer was like look, man, in order for there to be burglary, they have to have criminal

01:13:36.700 --> 01:13:40.340
intent to commit a felony after entry.

01:13:40.340 --> 01:13:41.630
These guys were working.

01:13:41.630 --> 01:13:46.060
There is no way that you can prove criminal intent.

01:13:46.060 --> 01:13:48.690
So, they did everything in their power.

01:13:48.690 --> 01:13:52.860
They’re like well, if they dropped a key logger on one of the systems, then we might

01:13:52.860 --> 01:13:58.110
be able to prove – I mean, they were grasping at straws to do anything and everything in

01:13:58.110 --> 01:14:04.380
their power to try to hopefully make that stick for some reason, and they knew at that

01:14:04.380 --> 01:14:07.210
point; they knew we were under contract.

01:14:07.210 --> 01:14:13.380
They knew that we were asked by the state to be in that courthouse and they still were

01:14:13.380 --> 01:14:20.880
pushing for these felony charges, these Class C felony charges with seven years of prison

01:14:20.880 --> 01:14:27.020
time behind it for I don’t even – I still to this day have no idea why they kept pushing

01:14:27.020 --> 01:14:28.920
so hard for this stuff.

01:14:28.920 --> 01:14:33.980
JACK: Eventually the Dallas County prosecutors in Iowa came to an understanding and on January

01:14:33.980 --> 01:14:39.159
30th, 2020 they dropped all charges against Gary and Justin.

01:14:39.159 --> 01:14:43.560
The case is now over and they’re free men once again.

01:14:43.560 --> 01:14:49.570
But what still lingers is their criminal record still shows that they were arrested for burglary

01:14:49.570 --> 01:14:51.210
and were given felony charges.

01:14:51.210 --> 01:14:54.900
JUSTIN: That’s kind of like why we’re still so upset at this point.

01:14:54.900 --> 01:14:56.920
We’re gonna carry this for the rest of our lives.

01:14:56.920 --> 01:14:58.659
We have felony arrest records.

01:14:58.659 --> 01:15:02.510
Even though charges are dismissed, everything’s been dropped at this point, anytime we get

01:15:02.510 --> 01:15:07.460
pulled over, if we ever try to apply for a job in the future, security clearances, and

01:15:07.460 --> 01:15:12.350
any number of things; volunteer work, it’s gonna show we’ve been arrested on felony

01:15:12.350 --> 01:15:13.350
charges.

01:15:13.350 --> 01:15:17.030
We’ve been stripped of rights with no due process on wrongful arrest.

01:15:17.030 --> 01:15:19.449
JACK: Yeah, it’s a shame.

01:15:19.449 --> 01:15:22.739
Any traffic stops these guys get; when the police look up their record, it’s gonna

01:15:22.739 --> 01:15:26.239
show that they were once arrested with felony charges.

01:15:26.239 --> 01:15:30.500
Any time in the future where they’re on a physical assessment and the cops come, they’ll

01:15:30.500 --> 01:15:34.420
see that they have burglary charges on their record which might make the cops think like

01:15:34.420 --> 01:15:36.120
yeah, these are real burglars.

01:15:36.120 --> 01:15:38.179
Look, they have real charges.

01:15:38.179 --> 01:15:41.679
Any background checks that someone does on these two is gonna show their criminal history.

01:15:41.679 --> 01:15:46.469
I mean, what do you write when you’re applying for a job and it asks you have you ever been

01:15:46.469 --> 01:15:47.469
arrested?

01:15:47.469 --> 01:15:48.530
What do you put?

01:15:48.530 --> 01:15:51.170
Yes, but it was wrongful?

01:15:51.170 --> 01:15:52.719
It doesn’t sound fair to me.

01:15:52.719 --> 01:15:54.550
GARY: Big things, little things.

01:15:54.550 --> 01:15:58.590
It just affected our lives for the last six months.

01:15:58.590 --> 01:15:59.590
All the time.

01:15:59.590 --> 01:16:01.200
JUSTIN: And honestly, will still continue to do.

01:16:01.200 --> 01:16:05.320
Like yeah, with the arrest charges but man, just honestly, I know a lot of people that

01:16:05.320 --> 01:16:09.540
say a lot stuff; oh, damages, I’m so stressed out over this and they want to do a counter-lawsuit.

01:16:09.540 --> 01:16:14.070
No, I think my physical brain chemistry has changed over this, being so stressed out.

01:16:14.070 --> 01:16:18.620
I sound like a wimp about it but man, you wouldn’t believe it until you’re in it

01:16:18.620 --> 01:16:22.400
and going through something like this how stressful and traumatic.

01:16:22.400 --> 01:16:27.320
I don’t even want to use that term but it is a traumatic experience to go through something

01:16:27.320 --> 01:16:31.850
like this and have it held over your head for such a long time when you know you’re

01:16:31.850 --> 01:16:35.449
in the right, and then to see the legal system fail you repeatedly.

01:16:35.449 --> 01:16:41.250
There were so many opportunities and avenues for the county to understand or get more information

01:16:41.250 --> 01:16:43.860
and then drop the charges and it just never happened.

01:16:43.860 --> 01:16:48.140
GARY: I think that was the – that’s the biggest detractor from all of this and the

01:16:48.140 --> 01:16:54.530
point that was so aggravating is so many times, everybody had every opportunity to do the

01:16:54.530 --> 01:16:58.520
right thing and they just continually didn’t.

01:16:58.520 --> 01:17:04.560
It was just – for the lack of a better term, it was like I was flabbergasted, like totally

01:17:04.560 --> 01:17:06.230
old school, right?

01:17:06.230 --> 01:17:10.480
It’s just, how can you do this to someone?

01:17:10.480 --> 01:17:14.600
You know, you know that we weren’t there doing anything malicious.

01:17:14.600 --> 01:17:20.730
You know we weren’t actually breaking in to do – to create some sort of crime or

01:17:20.730 --> 01:17:21.910
to have some sort of crime.

01:17:21.910 --> 01:17:24.580
You know we were there doing our job.

01:17:24.580 --> 01:17:28.070
Why are you still pushing seven years of prison time?

01:17:28.070 --> 01:17:30.420
Why are you still pushing this on us?

01:17:30.420 --> 01:17:37.810
It’s like, they had absolutely no mindset, for lack of a better term or maybe it is the

01:17:37.810 --> 01:17:43.590
best term, destroying [01:20:00] two professionals who have absolutely sparkling clean records

01:17:43.590 --> 01:17:47.340
who’ve never even been in trouble for jay-walking before.

01:17:47.340 --> 01:17:49.630
They’re just like oh, no, yeah, no big deal.

01:17:49.630 --> 01:17:54.860
We’ll just keep throwing these Class C felony charges at them.

01:17:54.860 --> 01:17:57.080
Yeah, you know, if we drop it later, whatever.

01:17:57.080 --> 01:17:58.110
It doesn’t affect us.

01:17:58.110 --> 01:18:00.850
It doesn’t harm us, what do we care?

01:18:00.850 --> 01:18:05.110
Just like, the – what do I want to say?

01:18:05.110 --> 01:18:07.420
The lack of sympathy or empathy…

01:18:07.420 --> 01:18:08.840
JUSTIN: Professionalism, empathy.

01:18:08.840 --> 01:18:13.350
GARY: Professional, whatever term you want to throw there, just for – not even for

01:18:13.350 --> 01:18:15.090
us, but just another human being.

01:18:15.090 --> 01:18:16.429
JUSTIN: For doing what’s right.

01:18:16.429 --> 01:18:19.710
If you’re representing the law, it’s a failure of the legal system which I had no

01:18:19.710 --> 01:18:21.270
idea America worked that way.

01:18:21.270 --> 01:18:23.820
It’s just not the America that I was brought up in.

01:18:23.820 --> 01:18:27.300
I thought innocent until proven guilty and just to see us stripped of so many rights

01:18:27.300 --> 01:18:32.880
and to go through this, it was just such an awful experience, to be thrown into this mix.

01:18:32.880 --> 01:18:34.150
GARY: It was terrible.

01:18:34.150 --> 01:18:39.310
That was the hardest part, was watching people do the wrong thing repeatedly and thinking

01:18:39.310 --> 01:18:42.320
it was not a big deal because to them, it wasn’t.

01:18:42.320 --> 01:18:45.350
The only big deal was to us but no one seemed to care.

01:18:45.350 --> 01:18:49.070
JACK: Even though the charges was dropped and they’re free, there’s no legal way

01:18:49.070 --> 01:18:53.120
for them to get a wrongful arrest removed from their records entirely.

01:18:53.120 --> 01:18:57.960
Their mugshots will forever be out there with arrest records and all.

01:18:57.960 --> 01:19:02.550
I think what baffles me the most still is that these two guys were the ones who faced

01:19:02.550 --> 01:19:04.650
the most trouble, not Coalfire.

01:19:04.650 --> 01:19:09.230
I’ve said this before how I always find it strange when the FBI charges individual

01:19:09.230 --> 01:19:13.040
hackers who conduct a hack on behalf of another country.

01:19:13.040 --> 01:19:17.770
Like, hackers working for the Russian government or the Chinese government have been indicted.

01:19:17.770 --> 01:19:18.770
Why?

01:19:18.770 --> 01:19:22.500
They were just doing what they’re told by their commanders, their generals, their leaders.

01:19:22.500 --> 01:19:27.230
Why not indict the commanders and generals or leaders or even the president?

01:19:27.230 --> 01:19:32.340
This is a glaring example of why it makes no sense to go after the little foot soldiers

01:19:32.340 --> 01:19:34.449
who are just doing what they’re told.

01:19:34.449 --> 01:19:39.790
This really should have been a matter for Coalfire, the company, to deal with but instead

01:19:39.790 --> 01:20:00.690
Gary and Justin got hit

01:20:00.690 --> 01:20:08.270
with the worst of it.

01:20:08.270 --> 01:20:40.550
JACK (OUTRO): [OUTRO MUSIC] A big thanks to

01:20:40.550 --> 01:21:22.880
our guests Gary De Mercurio and Justin Wynn for sharing this story.

01:21:22.880 --> 01:21:32.610
You guys aren’t strangers to trouble so you’ll probably get in trouble again but

01:21:32.610 --> 01:21:34.710
better luck next time, eh?

01:21:34.710 --> 01:21:45.650
Hey, have you checked out the Darknet Diaries shop lately?

01:21:45.650 --> 01:21:50.170
New shirts keep coming in periodically and they look sick.

01:21:50.170 --> 01:22:04.889
You have to take a look

01:22:04.889 --> 01:22:24.050
at these shirts and stickers.

01:22:24.050 --> 01:22:43.620
There’re hats that are

01:22:43.620 --> 01:23:02.900
gonna be in there soon.

01:23:02.900 --> 01:23:57.560
Visit shop.darknetdiaries.com and yes, I do ship worldwide.

01:23:57.560 --> 01:25:16.119
This

01:25:16.119 --> 01:25:20.940
show is made by me, the local ghost, Jack Rhysider, and our theme music is by the chromatic

01:25:20.940 --> 01:25:22.710
Breakmaster Cylinder.

01:25:22.710 --> 01:25:29.679
Even though I have to re-update the keys on my license to hack every time I say it, this

01:25:29.679 --> 01:25:33.570
is Darknet Diaries.