JACK: I just came back from DEFCON,
and it was so wonderful meeting
so many of the listeners there.
Many of you asked how my dad is
doing, and I’ll tell you; he’s
struggling with the modern world.
Let me show you what I mean.
So like, I call my dad a few times a
week just to check in on him, but he only
calls me when he’s got computer problems.
Let me play for you what one
of these calls sounds like.
DAD: Okay, so, anytime I get a photo
or if I want to save it, there’s like
three little dots top-right corner.
JACK: Yeah.
DAD: Like saving a photo.
I hit the dots 'cause I
want it to save a photo.
It used to say Save.
Now it says Save to Account.
So, I’m clicking on that, Save
to Account, but the account
is something called OneDrive.
Oh, it says Add Account.
How do I add an account?
‘Cause OneDrive I don't use.
I don't even know what that is.
This is ridiculous.
JACK: Yeah, where’d you get this tablet?
DAD: You gave it to me.
It’s like, all of a sudden my
photo — Save Image is gone.
JACK: Where did you get the photo?
DAD: Well, I just pulled up any
one so I could explain to you it.
JACK: Okay, so, you took the photo.
DAD: I took it on the tablet.
JACK: [To audience] Did I hear that right?
He took a photo on his iPad of
some rabbits and doesn't know
how to save the photo he took?
It’s always the most mind-boggling
question that he throws at me.
I saw the photo.
It was dark and blurry.
It was not even worth saving,
but he manages to stump me every
time with these tech questions.
I’m just like, uh…
DAD: Oh, wait a minute.
No, I found it pushing buttons.
JACK: Good.
DAD: You did it again.
I’m gonna go to Photos
and see if it’s there.
Yep.
Okay.
JACK: Awesome.
DAD: I’m not really sure what
the sequence is, in a nutshell.
You've figured it out for me.
JACK: Good work.
[To audience] There you go.
He figures it out all on his own
without any help from me at all.
I’m just listening to the problem.
That’s how a lot of these calls go.
He just figures it out over
time and then thanks me.
Now, as much as I hate handling
these calls because they're just so
mind-boggling and frustrating to me,
I told him he can always call me if
he ever needs tech support, because
he paid for my college to get a
computer engineering degree, so he
legit deserves free, unlimited tech
support for life because of that.
There was another call a few days ago
where he got a new doctor, and the doctor
wanted him to fill out a twenty-five-page
form of all his medical history and stuff.
While he was filling it out,
he couldn't figure out how to
send the form to his doctor.
So, he called me up.
DAD: So, do I hit the X and go to Inbox
and then just forward that?
JACK: Yeah, you could send it
to them in an e-mail attachment.
DAD: Okay then.
I’m gonna hit the X on this patient form.
JACK: What patient form
are you looking at?
DAD: The one that they sent me.
JACK: The one you filled out?
DAD: Yeah.
JACK: And it has…?
DAD: Yeah.
[Crosstalk] Now I went to my e-mail.
JACK: Does the patient form have
all the stuff you typed into it?
DAD: The one I typed into; yes.
JACK: Okay, so it’s got your
data on there, and when you hit
X, did it ask you to save it?
DAD: Okay, stop, stop, stop.
I just wanted to — where I sent it
to myself, and there’s nothing on it.
Holy cripes.
No, I’m not
in this…
JACK: Yeah, that’s why I’m
asking you if it saved it.
So, can you open the form again and
see if your stuff is still there?
DAD: No, it’s all gone.
How is it all…?
Oh, you gotta push Save, probably.
All the stuff, you know?
JACK: Yeah, that’s one option.
[To audience] This call
was particularly maddening.
He was so frustrated that he
lost all this data from filling
out a twenty-five-page form.
DAD: It doesn't say anywhere on here Save.
I’m looking at the new form they sent
me, all frickin’ twenty-five pages,
and nowhere does it say Save and Send.
JACK: Okay.
You know the — one option is to just go
down to their office and say, give me
the form; I’ll fill it out right here.
DAD: Oh, now I gotta go get
ink and I gotta print that — I
gotta fill this out here.
I can't do an hour doctor’s office…
JACK: Well, you got nothing
else to do today.
DAD: The prescriptions, when did
you have surgery — oh, my goodness.
Unbelievable.
JACK: Oh, my gosh.
DAD: I know, I should
have called you before.
JACK: As you can see, he’s not
very good at file management, and
I thought I could fix it for him.
So, I started remotely trying
to connect to his computer, his
home PC, to troubleshoot this.
But after like ten minutes of
trying to connect to his home
computer, I finally asked him…
DAD: Modify one item…
JACK: No, you're not — is this all on your
iPad or is this on your home computer?
DAD: No, this is on the iPad.
JACK: Oh, I didn't know that.
I thought I was connecting
to your computer.
That’s why I was using…
DAD: Oh, no.
The big computer doesn't work.
JACK: If I would have known this from
the get go I would have been trying a
whole different set of instructions.
Oi, oi, oi.
Oh, man.
Okay.
DAD: The big computer doesn't work.
JACK: So now his big
computer doesn't work?
Now there’s three problems that
we're trying to fix here, right?
A lost form, a printer that’s out of
ink or something like that; I don't
even know what the problem is there,
and now his main computer doesn't work?
Anyway, for some reason I
couldn't even connect to his iPad
remotely on this one, and I just
couldn't help him find this form.
I thought he might have saved it somewhere
or there might be an old revision of
it somewhere that we could rescue, but
this was one that I could not fix, and
he didn't figure it out on his own, so
he hung up and drove to the doctor’s
office to fill out the form there.
But what is the deal with this?
Why does he struggle so much to
adapt to the modern world like this?
He’s been using a computer every
day of his life since the nineties,
but his brain just can't keep up
with the ever-changing aspect of it.
Is it up to me to keep him afloat or
is ignorance just no excuse anymore?
Intro: [Intro music]
These are true stories from
the dark side of the internet.
I’m Jack Rhysider.
This is Darknet Diaries.
JACK: Okay, this is the epic story of
those penetration testers who broke
into the Iowa County Courthouse.
I first ran this episode
back in February 2020.
It’s Episode 59.
But I’m revisiting it
today for two reasons.
First, it’s just a really good story, and
if you haven't heard it, you definitely
should be listening to it, and if you
already heard it, you should listen
to it again, because it’s that good.
But second, a lot has happened since
I posted that episode originally,
and I caught up with the two people
involved at DEFCON last month to
give us a full update on what has
happened since, and it’s crazy.
So, first I’m gonna replay the
original episode right now, and then
in the last twenty minutes or so of
this episode, we are going to get an
update to this story, and it’s really
interesting, so stick around to the end.
Alright, let’s go.
Alright, so let’s jump in and
meet our guests for this episode.
JUSTIN: My name is Justin Wynn.
I’m a senior security consultant
with Coalfire Systems.
I am an offensive penetration tester who
specializes in physical security, which
often entails social engineering, physical
exploits to gain access to facilities.
GARY: Yeah, my name is Gary DeMercurio,
and pretty much mirror everything Justin
said, except I’m a managing senior and
I run the Bellevue office in Washington.
JACK: I know they said it quickly,
but the important part here is that
they’re both penetration testers.
GARY: I’ve been at Coalfire for
six years and I’ve probably been
in the military another three.
So, I’ve got about nine years of
experience of physical pen testing.
JUSTIN: Right.
I’ve been with Coalfire for over
four years, so physical penetration
testing for over four years.
JACK: They’ve come here today to share
some penetration testing stories with us.
Now, even though these two live on
opposite corners of the US, one Florida,
one Washington State, they team up
together on assignments all over the US.
The assignment is typically like this;
a company will call up Coalfire, the
company that Justin and Gary work for,
and ask for a security assessment.
They might want someone to test their
website to see if it’s secure or do a
password assessment to see how strong
the users’ passwords in the network
are, or conduct some compliance checks.
This is all to make the
company more secure.
[Music] The Iowa Judicial Branch
is a state department of Iowa.
It’s a government facility, and
specifically they handle the court
cases and such within the state of Iowa.
So, it was the Iowa Judicial Branch
that called up Coalfire and asked the
company to come and do a penetration
test on the courthouses themselves.
JUSTIN: It was full-scope
for a team penetration test.
So, it included things l external
pen testing, web application testing,
internal testing, which was to be done
after we had gone on site to see if we
could gain access into their internal
network and kinda do a real-life scenario.
Like, can you gain
access to our facilities?
Can you plug in a — what we call a
drone, a remote device, to be able to
access that network later once we’re
offsite, and then conduct the internal
network penetration test from there?
Throughout the whole time,
we’re contacting with the
guys at iowacourts.gov.
JACK: Justin and Gary get assigned
to conduct the physical penetration
test on the courthouses together.
They’ve been working together for four
years on doing physical penetration
tests just like this, so they’re used
to each other and do good work together.
Actually, I have a copy of the rules
of engagement here in front of me.
So, let’s see.
Okay, yeah, so this is for the
Iowa Judicial Branch, and they’re
specifically asking for a physical
penetration test at five locations.
There’s a judicial branch, the Polk
County Courthouse, the Dallas County
Courthouse, a juvenile justice
center, and the Criminal Court Area.
Five locations, and the window to
test the security on these buildings
is between Sunday, September
8, and Friday, September 13.
So, they had a week to do this assessment,
and this was last year in 2019.
The rules of engagement
list out a ton of things.
Do they have permission to
tailgate behind someone to get in?
Yes.
Do they have permission
to dig in the dumpsters?
Yes.
Does Coalfire have permission
to use lockpicks to get in?
Yes.
Does Coalfire have permission to
plug USB drives into computers
that they get access to?
Yes.
Does Coalfire have
permission to disable alarms?
No.
The goal here looks like they’re
trying to get into the building,
plant rogue devices, look around to
see if there’s any security problems
like unlocked computers, passwords
written down, that kind of thing.
So, okay, the rules of
engagement seem pretty clear.
JUSTIN: So, that gets filled out before
we’re on the call, and then as we’re
going through that with the client, the
project manager is taking notes in there.
So, you may see things like, okay, at
the JB building we discussed with the
client Floors 3 and 4 are specifically
off-limits during daytime hours
because there was gonna be the Supreme
Court convening, and they obviously
didn’t want us interrupting that.
So, part of that — we’re discussing
with the client on the phone,
yeah, during the daytime do not
touch, do not go on Floors 3 and 4.
Then we enumerate with them;
we’re like, okay, well, what
if we’re in there after hours?
What do you want to see from there?
Is that open access?
Like, yeah, that’d be more
acceptable, but you know what?
Let’s play it safe and just show
us to see if you can breach the
doors that enter on that floor.
So, the contract will say something
like, okay, JB building, Floors 3
and 4 are off-limits, and you see how
big those fields are in that table.
So, it’s really like the bare information
that the project manager wants in there.
Then we have a good understanding
what the client — of what
they’re actually looking for.
JACK: So, actually, this rules of
engagement document I’m looking at is
twenty-eight pages long, and this field
he’s talking about is super small.
All these things you cover on
the call in great detail only get
jotted down with a couple words.
It’s not fully documented in the
scope of work or rules of engagement.
GARY: These conversations are so granular.
If we were to take and actually take
the conversation that we had on the
phone and write it out and put it in
a contract, the contract would be…
JUSTIN: This — we couldn’t work.
GARY: A hundred pages long.
The amount of discussion that we have
on what it is exactly they want us to
do, it would be unfeasible as far as a
rules of engagement would be concerned.
So, again, that’s why
we have the phone call.
That’s exactly why we have, so we can
say this is what we understand, what
exactly do you guys want, and then we’re
all on the same page when we show up.
JUSTIN: They’re like, we’re gonna be there
at night, and the client was like, yes, we
want you to focus on after-hours testing.
So, a lot of that stuff unfortunately,
which we never would have predicted
or seen coming at us, we didn’t
capture in that document, which
would have been great if we did, but…
JACK: The Iowa Judicial Branch has
actually worked with Coalfire before
to do other penetration tests.
So, everyone seems to agree on what
should be conducted and what’s expected
here, and an agreement was made.
They create what’s called a
get-out-of-jail-free card.
This is a slip of paper that lists
all the people who hired Coalfire
to do this penetration test.
This is their information security
officer, their chief information
officer, and the infrastructure manager.
These are three people who worked
in Iowa’s Judicial Branch who
contracted Coalfire to do these tests.
This get-out-of-jail-free card
has their names and phone numbers
listed with their signatures.
So, if these guys get caught,
they can ultimately show this
to get out of any real trouble.
JUSTIN: We touched down Sunday night.
We entered in a facility.
So, I don’t want to provide
too many details that haven’t
been already disclosed.
JACK: Alright, fine.
Unfortunately we’re not gonna be
able to go into every detail of what
happened, because I don’t want to
expose any actual vulnerabilities over
there at the Iowa County Courthouses.
But let me give you an idea
of what they’re capable of.
[Music] First of all, these guys
mentioned that they sometimes
use an under-the-door tool.
So, let me tell you what this tool does.
It almost looks like a bent fishing rod.
It’s long, four feet, metal rod,
and it has a string on the end.
This is for doors that have a handle, that
when you push down, it opens the door.
So, you try to slide this tool under the
door, and then you pull it up using that
string to get it close to the handle.
You try to hook it onto the handle
from on the other side of the door,
and when you do get it hooked on
there, you pull down with both the
string and the rod and it pulls the
handle down, and it opens the door.
It’s actually pretty simple.
On top of this, Gary is also
really good at lock-picking.
So, he’ll certainly have these
in his pockets and ready to
use them whenever he needs to.
But with lock-picking, it might take
you a while, maybe ten minutes, maybe
thirty minutes to get a lock open.
So, it just takes more skill and time.
GARY: If you're talking about my
favorite, because I find this a
lot in commercial buildings — is
going to be crash bar doors, right?
Either the ones that come down
like the old high-school gym-type
doors or the ones that you just
push and go into the door itself…
JUSTIN: A Von Duprin.
GARY: Thank you.
They’ll have the latch on
the inside of the door.
So, you can't really use
an under-the-door tool.
They make some tools if you have
doors, double doors that come
together without the — what’s
it called in the middle there?
JUSTIN: The mullion.
GARY: The mullion; is that what it is?
JUSTIN: Yeah.
There’s another term for it, too.
But there’s an — there’s a bar that runs
in-between the doors where you're not
supposed to be able to insert tools.
GARY: Right.
So, you'll see a lot of those
doors that don't have that
bar that separates the doors.
Those are really easy to get into.
You just — you stick a tool inside, you
turn it to the left or the right, and
then you pull and it opens the door.
What we have come up with that we
like to use that’s absolutely my
favorite tool that is literally in my
backpack right now is a cutting board.
It’s a really, really thin, plastic
cutting board that I bought from Amazon,
and I cut a notch in this cutting board.
So, for crash bar doors, especially
the single ones where you can't see
anything, you stick it through the
door, on the edge of the door, and
then once you feed it through the door,
you pull it down until that cutting
board rests on top of the latch.
Then you'll apply pressure down on
that latch and you start pulling the
cutting board towards you outward
from the door until that notch that
you cut falls on top of the latch.
So, now what you've got is you've got
the back-half of that cutting board
on the other side of the latch on
the inside of the door, and you pull.
If that latch doesn't have the
deadlatch latching it properly,
you will open the door every time.
JUSTIN: So, typically when we’re talking
about door bypasses, we're inserting
a tool through whatever method that we
can, whether it’s in the inner-leaving
double-door system, so you can go
in-between the doors, or if there’s a gap
underneath the door, insert a tool there
and start manipulating some mechanisms
on the other side of the door, whether
that’s the Von Duprin crash bar or
the latching mechanism itself or some
peripherals like a request-to-exit sensor.
GARY: But I can, what, 80%, if you had
to put a number on it — 80% of doors
can be bypassed by bypassing the latch.
JUSTIN: Right.
GARY: Just by manipulating
the latch itself, you can
get into 80% of facilities.
JACK: Just coincidentally, can you
tell us where you guys are this — or
what you guys are doing this week?
JUSTIN: This week we're doing three
two-day courses comprised of physical
access control systems, alarm bypass
techniques, and then safe manipulation.
So, really kind of an
action-packed week for us.
That’s all the kinda juicy
James Bond-style stuff.
JACK: So, you can imagine what kind
of bag of tools these guys have
to break into buildings to carry
out assessments like this, right?
I mean, they've got so many
things, I’m surprised that TSA
even allowed them on the plane.
So, even though they can't get into
specifics about what tricks they used
to bypass the doors of these buildings,
you can take a pretty good guess that
they've got many options they can use to
get into each door that they run into.
JUSTIN: So, pretty much we walked
up, assessed the perimeter and kinda
matched up with what we were seeing
on Google Maps, things like that,
and gain entry to that first facility
on Sunday night to Monday morning.
GARY: When we get into a place,
it depends on — it also depends
on who, who is attacking, right?
So, if Justin is attacking, for
instance, and he gets into the door
and he’s able to get in really, really
quick, there is a certain — you know,
he’s your teammate, so you're proud.
You're like, wow, dude,
that was really fast.
Like, that was really, really fast.
Justin and I have been working
together since he’s been here.
So, you get to see this progression
of somebody when he’s on his first
red team or second red team, I think
it was, with a guy, and then when
he’s on his fifteenth red team, and
you're like, dude, you're getting
really, really, really good at this.
JUSTIN: Yeah.
GARY: But you get to see that progression.
So, there’s — it’s a lot more personal,
if you will, when you're on a red team
with somebody that you've been working
with for years and years and years.
JUSTIN: I was gonna say, I’m tearing up
over here, 'cause Gary is honestly — like,
I do need to take a moment to thank him.
He taught me so much of what I know.
Like, yeah, of course Deviant and some
huge stars in the industry — you can learn
so much by watching YouTube and learn how
to assess the security of your facilities.
But Gary was the first guy who handed
me the under-the-door tool and taught me
how to use this when I didn't even know
which end of the stick to be holding
onto, which is a very common thing when
people are given an under-the-door tool.
JACK: So, they get in, they look around
for ways to plug in a drone and to
take any photos of security problems
that they want to put in their report.
They even found the desk of the person
who hired them for this engagement.
So, they leave a little present on
his desk to prove that they got in
overnight and got access to his desk.
JUSTIN: But we had gained access
and we left a calling card.
I just left a business card on one of
the point-of-contact’s desk to the point
where the next day he had e-mailed me and
said, I guess I owe you a congratulations.
We're going back and forth over e-mail.
I’m like, yeah, we found some really
severe vulnerabilities that — minor fixes
that you guys can use to dramatically
improve the security of this facility.
So, going back and forth
through things like that.
So, already in contact with the
client, going through things like that.
Then, yeah, Tuesday rolls around.
JACK: [Music] So, it’s Tuesday night after
the courthouse has closed for the day.
They get up to the building and see it
has two sets of locked doors to get into.
GARY: We make it through the first
door really easy, and then the second
door — we could have used the same
attack, but we were trying other things.
JUSTIN: Right.
GARY: And we weren’t having a lot of
luck with the other things, but we didn't
really want to try the first attack
'cause we wanted to see if we could use
different techniques to get in, right?
We found other areas that we can attack,
so we went around a different area and
we were working on — Justin was working
on one door and I was working on another.
I don't know, did you
ever get that door opened?
JUSTIN: I picked the lock.
GARY: Multiple…
JUSTIN: Yeah, like each way, and
nah, something else was going on.
There was a secondary
latching mechanism there.
GARY: That we couldn't see or something.
I ended up picking two doors in a row to
a courtroom, and then we ended up making
it in, and then we ended up getting in.
We saw the security
cameras.
JACK: Now, when they say they found
the security cameras, what they mean is
they found the room that you can sit in
to watch all the security cameras and
what’s going on in the whole building.
GARY: Guard desk; it wasn't really a room.
It just — they had security cameras
at the guard desk, which was right
— which was actually the sheriff’s
desk during the day that sits there.
So, they've got a sheriff
that — or a deputy sheriff…
JUSTIN: Right.
GARY: That monitor or that’s there
on duty for the courthouse that
sits in this — it’s almost like a…
JUSTIN: Eh, a front desk, almost.
GARY: Yeah, like a front desk-type
thing, where a receptionist
would sit in a company.
So, the deputy sheriff sits there, and it
has access to all these different cameras.
It would show the
courtrooms or office areas.
So, at night when you got your security
guard there who isn't a deputy sheriff,
they will also use those same cameras
that the deputy sheriff normally sits
at to check the different offices
to make sure that nobody’s in there,
the lights aren't on, and so forth.
JACK: So, one of the first things they
do is look at all the cameras to see
if anyone was there, and they did,
in fact, see someone in the building.
Somebody was making their
rounds, checking on the place.
It looked like a security guard.
They made sure to keep a close eye
on him while sneaking around this
building, and at the same time they
took careful notes on what blind
spots there were with the security
cameras so when the guard got back,
they could stay in those blind spots.
As the guard went to a far end of
the building, they started exploring
around, looking for security problems
and being careful to stay very quiet.
As the two of them wandered around
this courthouse, they opened
a door which tripped an alarm.
[Alarm ringing] Suddenly the doors were
buzzing and the alarms were sounding.
GARY: [Music] What had happened is
they have — they basically have a
holding room next to the courtroom,
and both doors lock in that room.
So, whether or not that is for
criminals that are in there to see
if they can get released for jail or
if it’s for somebody that’s accused
of a crime, whatever — not sure what
it’s for, but both doors are locked.
So, because I didn't want to have to
pick the door on the way out in case
it locked behind me, I propped it open.
Because of the — again, an assumption,
because of the people that are [inaudible]
there, they make sure that if that door
is left open, that an alarm sounds.
So, when I made it through both doors
and I went to the next room which
had the guard post in it, that’s
when I heard the alarm, and then
we ended up figuring out, oh, it’s
because we propped the doors open.
Let’s close that; duh.
JACK: They were able to complete their
security assessment and get out of there.
The guard never found them and maybe
didn't even hear that alarm at all.
But another successful
mission for these two.
GARY: But that was fun.
JUSTIN: Oh, it was a great time.
GARY: Yeah.
We were pooping and snooping and we
were dodging the security guards,
and he was looking at the cameras
and we were hiding out and stuff.
It was good stuff.
JACK: They got through the courthouse
pretty quick, and the night was
still young, so they decided to hit
up a second courthouse that night.
This one was actually the Dallas
County Courthouse in Adel, Iowa.
Let me describe the scene to you.
[Music] The town of Adel is small.
It has like, 5,000 people
living there at most.
It’s cute, though.
It has a historic Main Street
USA type of feel to it.
In their downtown area the roads are
covered in a red cobblestone brick,
which gives it a more rustic feel, and
all the buildings downtown look like
they could all be historic buildings.
The most prominent building
in all of Adel is the Dallas
County Courthouse, their target.
It was built in 1902, which absolutely
makes it historic; three stories with
those pointy spires on the top of
each corner, and there’s a large clock
tower on top with a beautiful rotunda
towering way up high over the whole town.
This is their target, to get into that
historic courthouse in this sleepy,
little town in the middle of nowhere.
So, the two head on
over to the courthouse.
GARY: Well, we stopped and got the
Bomb Burrito at the gas station.
That’s important.
JUSTIN: Yeah, that does come up later.
GARY: We did have a snack.
[Laughing] [Crosstalk]
We did have a snack.
We took like a thirty-minute break
and just hung out at the gas station
talking to the clerk that was there.
He was a nice guy.
JUSTIN: He was a nice guy.
He gave us free donuts.
GARY: Yeah, he did give us free donuts.
Instead of throwing them out, he
just gave us some free donuts.
Yeah, so we had our break, which
was literally — I mean, the gas
station was across the street from…
JUSTIN: Just about, yeah.
GARY: Yeah, like, almost across
the street from the courthouse.
We sat there for thirty minutes.
We kind of scoped the place out just
to make sure that they didn’t have
some sort of patrol or something,
city cops or deputy sheriffs that
were patrolling the courthouse.
So, we parked at the courthouse.
JUSTIN: Oh yeah.
GARY: And we — again, we’ve got a
get-out-of-jail-free card, and every
other time – like, we don’t have to be
ultra-sneaky typically in situations
like this where they just want to see
if Joe Public can get in the building.
JUSTIN: Right.
GARY: We don’t have to be super sneaky.
So, this is one of those instances that
if you look at the contract that we have,
it specifically stated we were not allowed
to bypass the alarm on this building.
They did not want us to bypass the alarm.
In the conversation we had on the
phone; hey guys, don’t circumvent
the alarm, don’t bypass it.
Just…
JUSTIN: Right.
Don’t degrade our security.
Like, don’t disable a sensor so that
anybody could go up, bypass the store,
and gain entry without an alarm going off.
So, that’s a pretty common
theme with a lot of our clients.
We’re not trying to degrade the security
of their facility so we can gain access,
because it also allows potential for
other threat actors to gain access
covertly or without setting off alarms.
GARY: Right.
So, in this instance we walked up
to the north door, I think it was.
JUSTIN: [Music]
So, we go up to this courthouse.
We jiggled the door.
There’s a little technique
that you just see
if the latch is engaged,
and pop the door real quick.
Much to my surprise, the door was open.
JACK: At this point it’s like, midnight.
Why in the heck is the front door
open on this historic courthouse
with all the lights off inside?
Freaky for sure, but Justin thought
someone must have tried to close it at
night and it just didn’t shut all the way.
Now, this courthouse has an
alarm system because it’s a
historic courthouse building.
So, yeah, it should, right?
GARY: When he opened the door,
the alarm did not go off.
So, our assumption was there
was a fault setting in this
alarm system for the front door.
They armed it anyway.
Again, this is our professional
guess of what happened.
They armed it anyway even with that fault,
or they armed it, it counts down, they go
out, and they didn’t close the door all
the way and then it armed anyway without
that front door being fully closed.
So, when Justin grabbed that front
door, he opened it, what, two or three
inches and the alarm didn’t go off.
Then I tried a badge we had cloned
from another building just to see
if they had multi-building access.
That didn’t work.
It’s kind of like, well, should
we give them the benefit of the
doubt or should we just use this?
So, we elected to basically
close the front door and say,
okay, well, let’s start over.
JACK: So, they both stepped back outside.
This time, they closed
the door all the way.
It latches shut.
This must have been a fluke for the door
to be accidentally left open or something,
so they wanted to break in properly.
Now the door is locked
and sealed properly.
Okay, so they begin again.
These two being masters at getting
in through these doors, they have no
trouble getting the door back open.
[Alarm beeping] Now, as they get
this door open, they immediately
hear the alarm is beeping.
GARY: Right, just like in your home
security system when you walk through
the door and it starts beeping
to let you know that you’ve got X
amount of seconds to put in your code
before the actual alarm goes off.
So, it was beeping really loud.
JUSTIN: Yeah, and we already
had an idea before that.
We kind of expected that alarm to go off.
So, just, again, a little
bit of precursor to that.
The other locations, nobody had showed up.
Nobody responded, so we had been
gaining access to government facilities
without any alarms going off,
without central dispatch showing up,
without police presence showing up.
So, at this location — we’re kinda coming
up here, and we’ve been there throughout
the day and we had seen the alarm panel.
It said, OK, disabled.
That night it said, OK, armed.
So, we expected it to go off.
We’re going — coming up to this facility
hoping for once, this final facility,
the alarm would go off at this location.
So, it was almost like
bittersweet but good.
Okay, great, the alarm’s going.
It’s beeping at least,
once we go in there.
GARY: At least it’s armed.
JUSTIN: Right?
So, eventually the alarm counts
down and then it starts sounding.
[Alarm ringing] So, very
audible at this point.
The entire downtown of Adel
is going off and you can
hear the sounders going off.
JACK: The sleepy town of Adel is now
being woken by these alarms coming
from their precious, historic, iconic
courthouse building in the middle of town.
JUSTIN: [Music] So, at that point,
alarms are blaring throughout downtown.
We decide to go up to the third floor.
So, we’re very well aware at that point.
It’s very audible that the
alarms have been activated.
They’ve been tripped.
At this point we go up to the third
floor and get a vantage point and
hoping that police presence responds
to the incident, to the alarm going
off, ‘cause it’s not uncommon.
I’ve been in banks in the past
literally a hundred feet from a police
station where they either were not
paying for the service or it wasn’t
connected or configured properly,
where it didn’t dial out and call
police to respond to the incident.
So, yeah, so it’s not terribly
uncommon for that to happen.
So, we go up to the third floor, get a
vantage point, and at this point, for
our reporting purposes, hoping that
police respond to the alarms going off.
At which point within — it was
extremely quick response time.
Within five minutes, I think it was
a sheriff’s deputy had showed up
to the scene, and we see him and
he’s going around the building.
Gary and I are conferring with each other.
Okay, man, what’s the next plan?
What are we doing here?
There are police.
It’s a very – not a high-stress situation,
but you have to handle it professionally
and properly otherwise there always
is risk in those types of situations.
So, we’re discussing our game
plan, what we want to do.
Within a short while, another couple
minutes, we go out on the main floor
and Gary’s calling out commands.
Is there an officer in the building?
Being very verbal, trying to get
in communication with police.
At that point it didn’t sound like
anybody else was in the building.
We didn’t hear any doors
opening or closing, so we
start proceeding downstairs.
JACK: As they go downstairs, they
don’t see anyone in the building.
They don’t hear anyone in the building,
but they can tell there’s a police officer
right outside the door they came in on.
They spot each other, and Justin
and Gary come to the door.
JUSTIN: The officer, he’s on
the other side of the door.
He was actually — we found out
afterwards was not able to gain
access inside the building.
So, we’re communicating with him.
He’s like, so, what’s up, fellas?
We’re like, hey man, we’re
here testing the security.
Do you want to talk?
Can I open this door?
Just keeping my hands
static, not moving anything.
He’s like, yep, go ahead, open the door.
I’m like, okay, I’m gonna
open up the door now.
So, pushed the crash bar, we
walk outside, and we greet him.
At that point just start conversing
with him; officer, we’re here, we
were hired by Iowa State Courts.
We’re assessing the security of
various government facilities
including this courthouse.
We have documentation.
This is all above ground.
Would you like to see our paperwork?
He responds yes.
Say, okay, it’s in my backpack pocket.
Do you mind if I make a move
and pull that out of my pocket?
Sure, go ahead.
Then at that point present our paperwork.
So, from there, he asked for our IDs.
At that point I think somebody else
had shown up right at that point.
So, they were escorting us, they had
hunkered down with us while somebody else
had taken the IDs and the paperwork away
and started verifying our information.
GARY: At some point I think the
sergeant even told us to relax, ‘cause
we were trying to be ultra-careful
and professional, and every time
we wanted to move our hands, we
were like, hey, is it alright?
We okay to get our wallets?
At some point he’s like,
hey man, you guys can relax.
We just want to verify that you’re
doing what you should be doing.
You guys can — you don’t
have to be that paranoid.
We are pretty sure that you’re
not doing anything nefarious here.
They were ultra-professional.
They handled themselves perfectly.
JUSTIN: Yeah, those guys were
great.
GARY: They were nice, they were
professional, they were doing the whole
Ronald Reagan trust-but-verify type thing.
Like, yeah, we’re pretty sure you guys
are on the up-and-up because you came out
to us and you did what you were supposed
to do, but we’re just gonna make sure.
We’re gonna verify that you
are really supposed to be here.
So, we can’t — if nothing else,
we can’t thank the deputies enough
because they were ultra-professional
and just really, really stand-up…
JUSTIN: Agreed.
JACK: They immediately gave the police
their get-out-of-jail-free card.
You don’t want to mess
around and lie to the police.
You want to come clean because this is
not someone you want to try to trick.
This is not part of the scope.
You want to tell them, look,
we’re here on official business.
The paper has the names and phone
numbers of the state employees that hired
Coalfire to do this penetration test.
The police call the first number.
No answer.
They call the second number.
The line was disconnected.
They called the third number.
Someone picks up.
The police ask if they knew
that these guys were trying
to break in the courthouse.
They said…
JUSTIN: Yeah, we’re
doing security testing.
Those guys are supposed to be there.
They’re testing the
security of the courthouse.
This is my story of what happened, ‘cause
I’m not on that call there with them.
They had walk away a little bit from us.
GARY: This is what the
sergeant, the deputy sheriff
who was a sergeant, told us.
He spoke to our contact.
He’s like, well, this is
what your contact said.
JUSTIN: So, they run our
credentials, everything on spec.
We give them our names
and our driver’s license.
They do get ahold of
our point of contacts.
They’d say, yes, these guys
are here testing security.
So, at that point the sergeant, the
guy in charge for — or head in charge…
GARY: The ranking officer on the scene.
JUSTIN: Ranking officer, thank you.
That’s what I was trying to get to — had
come back to us, handed us back our
IDs, and he’s like, yeah, as far as I’m
concerned, you guys should be good to go.
Everything’s all clear here.
So, at that point things
get really jovial.
We’re laughing, joking
around with the officers.
They’re asking us, man, this job’s crazy.
Like, you guys break into buildings.
Like, how does this go?
How’d you get jobs like this?
How can we test security?
How do we get a job like that?
JACK: [Music] Just as Gary and
Justin were about to leave,
another squad car pulls up.
This one has Sheriff written on the side.
The guy gets out and walks up.
GARY: The sheriff shows up.
He’s visibly upset.
From our perspective, the
mood completely changed.
So, prior to him showing up, everybody
was happy and smiling and we were – there
had to be eight deputies that responded,
all of us standing on the courthouse
steps, and then there was one City of
Adel officer there as well, so there was
at least nine people there including us.
JUSTIN: There’s not a lot going on
in Adel, Iowa at 2:00 in the morning.
GARY: Yeah.
So, when the sheriff shows up, all
the smoking and joking stops, right?
This giant fun sponge walks in the
room and everybody just stops talking.
Just — everything just goes silent.
He walks up.
He has some choice words to say to us that
we didn’t necessarily agree with, kinda
talking down to us in a certain respect.
JUSTIN: To put it mildly.
GARY: To put it mildly, and
basically tells us that we don’t
have authorization to do what we’re
doing, and asks us if we knew that.
We told him our perspective which
was, hey, we’re under contract,
we’re working for these people.
[Music] His response to that was, well,
they don’t own this courthouse and I
don’t care if you’re under contract.
They don’t own this courthouse.
JACK: Whoa, what?
The state doesn’t own the courthouse?
Uh, did they get authorization
from someone who didn’t have
authorization to break in the building?
Uh, I would start to get worried at this
point, but Gary wasn’t worried at all.
GARY: Nah, you know?
No, because this has never happened
before in history as far as we know,
or any of the other people that we know
in the industry, it’s never happened.
People get taken away or they get held
until situations resolve themselves.
Not frequently, but it happens.
So, if that happened in this case, we
were fine with it, ‘cause we know that
the truth’s gonna come out, they’re
gonna realize that we’re actually
working for a company and that we
were really contracted by the state.
So, worst case scenario, we gotta
spend an hour or two in a holding cell.
Not that big a deal.
[Music]
The sheriff tells everybody that
was there; says, well, we’re gonna
arrest these guys for trespassing.
Hold them.
I’m gonna go make a phone call.
So, in our minds he’s gonna
go talk to our contacts.
At least in my mind
that’s what he was doing.
In that time that he was gone
— ‘cause he was gone for like, a
good ten minutes, it felt like.
JUSTIN: Yeah, it seemed
like he was, for sure.
GARY: In that time he was gone, the mood
went right back to what it was before he
was there, which was everybody was asking
us questions, asking us how we did stuff.
What’s the craziest thing we’ve ever
seen or heard about in our line of work?
Like, it went right back to that.
One of the officers was super interested
on how we got in, so we showed him our
tools, we showed him how we got in, we
showed him the technique that we used.
We troubleshot how we think
that front door got left open.
They gave us their ideas.
We talked about card entry on why they
originally couldn’t get into the building.
It was — everything was — just
went back to normal.
About ten minutes later, again,
what we’re thinking, he came back
in and he was just like, you need
to arrest these guys for burglary.
All the sheriff’s deputies
kind of looked at each other.
The sheriff turned around and
said, do I need to do it myself?
Or something to that effect.
I don’t remember his exact
words, but he said something
like, do I need to do it myself?
I told you guys to
arrest them for burglary.
I don’t know what Justin’s – who
the sheriff or the deputy sheriff
was that arrested Justin, but the
guy that grabbed me, he puts his
hand on my shoulder and says, hey
man, I’m really sorry about this.
You’re gonna…
JUSTIN: I think something very
similar happened with me, as well.
GARY: Yeah, he goes, you turn around.
I’m gonna have to put these cuffs on you.
JUSTIN: Right, and I totally understand.
Like, okay, man.
I get it.
I see where you’re coming from.
GARY: Yeah, and both our responses
are like, hey man, it’s okay.
You’re just doing your jobs.
It’s not a big deal.
This won’t be the last time
this happens, I’m sure.
JACK: So, both of them get handcuffed.
They had their rights read to them, and
the police started escorting them away.
But still, even though they now
have handcuffs on and the police
are escorting them, they still
weren’t nervous about the situation.
GARY: No.
JUSTIN: ‘Cause think about it from our
perspective; we had done nothing wrong.
We have all the paperwork in the world.
I’m from Florida, Gary’s from Seattle.
It’s not like we flew out to
Adel, Iowa to start breaking into
courthouses on our [inaudible] paths.
We knew we had every shred
of evidence in our favor.
We knew that this was
totally above ground.
It’s not totally uncommon for law
enforcement to respond to an incident.
It does happen.
It is extremely rare, I’d say,
for somebody to get detained
or furthermore arrested.
That’s as far as it had ever
gone, and as far as we’re aware,
nobody’s ever been actually formally
arrested and pressed with charges.
GARY: Yeah, charged, nobody’s
ever been actually charged, yeah.
JUSTIN: Right.
So, we’re thinking, okay, we’re
gonna go down to the station.
We’ll work this out, not a big deal.
JACK: Now, because this is Adel, a
small town, the jailhouse was literally
across the street from the courthouse.
So, they both get walked to the
jailhouse with handcuffs on.
Stay tuned, ‘cause when we come
back from the break, we’ll hear
what happens to Gary and Justin.
Gary and Justin are now both at the
jailhouse, and they have been separated.
The police are questioning them
and processing them separately.
GARY: That’s when the aggravation started
to kick in a little bit, [music] because
we were going through the entire process,
which is empty out all your pockets, give
us all your gear, give us your backpacks.
I don’t know if you ever did,
but I interacted with the
sheriff a couple of times.
JUSTIN: No, I never talked to the sheriff.
GARY: Yeah, yeah.
So, I interacted with the sheriff a
couple of times, and it was like, hey
sheriff, are you just gonna hold us
or are you actually gonna charge us?
It was later discussed or during that
conversation that I won’t really go
into ‘cause it’ll just aggravate me,
was, yes, we’re going to charge you.
There was multiple times I tried to — I
don’t want to say talk my way out of it…
JUSTIN: De-escalate.
GARY: Right.
Yeah, that’s a better term,
de-escalate the situation.
Like, hey, maybe you could
contact one of our contacts.
Talk to somebody at Iowa State
Court and talk to somebody, because
we’re legitimately just working
here, sir. We were ultra-polite.
There’s multiple videos out there
that show that I don’t think
we were ever unprofessional.
We were just like, hey sir,
could you possibly do this
or check with this person?
Or, maybe this is a big misunderstanding.
It was always met with
nope, you’re going to jail.
Nope, you’re getting arrested.
JUSTIN: I mean, at some point along
that process it became very clear
that regardless of any amount of
paperwork that we would have had on us…
GARY: It did not matter.
JUSTIN: …or anything that we could have
said, there was something else going on.
It wasn’t about that.
We had the paperwork.
The deputies already verified, cleared,
identified us but let us go, essentially.
So, despite all that, there was something
else going on that regardless of what we
could have said, done, or shown, there was
no getting out of an arrest at that point.
We’re both being very professional
throughout the entire process.
But I’m a very big privacy advocate,
and as we’re going through this, they’re
asking what’s your marital status?
What’s your highest level of education?
I’m very — understand at this point
we’re being wrongfully arrested
because we’re here for a job.
This isn’t something that needs to be
dragged through a criminal process.
At most, if there’s contract discrepancies
or issues with the state-first
county level, this is something that
gets handled in a civil courtroom.
So, at that point I didn’t want to
provide my social security number.
So, it’s not like we’re resisting arrest
or anything like that, but unwilling
to give up a lot of personal details at
that point, which a lot of people in the
booking or reception room, however you
want to call it, got very upset with that.
So, we have to give up all of
our tools, all of our gear.
We go through the process of explaining
what these tools are, ‘cause we’re
being booked not only for burglary
but possession of burglary tools.
So, they want to have circumstantial
evidence of us having tools that are used
typically in burglary trade but obviously
in a security setting at this point.
JACK: They finally get to make
some phone calls, but at this
point it’s like, 2:00 a.m.
GARY: I had about thirty.
But unfortunately everybody was sleeping
and no one would answer my call.
Like, even my wife slept through
all of the phone calls that I sent.
I sent all sorts of messages to people.
The only person I was able to actually
get ahold of was one of our contacts.
I said, hey, are you aware
that we got arrested?
Yeah, yeah, we’re aware.
Such-and-such told me.
Are you doing anything to get us out?
He said, well, yeah, we’re gonna be
there first thing in the morning.
We’re gonna talk to X, Y, and Z. I don’t
remember who he said we’re gonna talk to.
We’re gonna smooth this all over.
It’s one big misunderstanding.
You’d think — I believe almost verbatim
his thing was, you’d think that
the sheriff would be a little more
understanding of what we’re trying to do.
I said, well, guess what?
He’s not.
He said, yeah, I can see that.
Again, we’ll be there
first thing in the morning.
We’re gonna hammer this out.
There was a lot more to that
conversation, but that’s the gist of it.
JACK: Now, for me, my first
call would have been to my boss.
I would have called Coalfire right away
and told them, hey, get some lawyers.
We’re in jail.
We need help right now, because
they’re operating in capacity
of Coalfire, so Coalfire should
be capable of helping them out.
GARY: Yeah, and we tried
to get ahold of Coalfire.
We just couldn’t get ahold of anybody
just because of the late hour.
I think most people when they
sleep, they put their car — they
put their phone on vibrate.
Because again, we’re talking about a
scenario that has never happened before.
So, maybe you want to say
some complacency, whatever
you want to put in there.
Who knows what it was?
But most people were like, okay,
2:00 or 3:00 in the morning,
not really that big of a deal.
What’s the worst that could happen?
Well, we figured out what the
worst that could happen was.
JACK: By 2:30 a.m. the police finished
processing them and gave them both
orange jumpsuits to change into,
the kind you see prisoners wear.
The police took all their
belongings, even their shoes.
Gary got a pair of Crocs.
Justin got some sandals that were too
small, and they were put in a cell for the
night with other criminals and cell mates.
[Music] They tried to lay down and sleep,
but the beds were really hard and cold,
so they didn’t get much sleep that night.
The
next day they had an appointment
to see the judge in the very
courthouse they broke into.
So, the officers escort
them to the courthouse.
GARY: When we were — when we walked
over there in the morning, although
it was incredibly uncomfortable and
embarrassing that we were over there
in literally shackles, right, the
whole around-your-wrists and then tied
around your waist and then the chain
that goes from your wrist or your waist
all the way to your ankles, and then
you’re attached to the guy in front
of you, and you do the – what is it?
The railroad gang or whatever
across the street with deputies in
front of you, in the back of you.
I was like, you gotta be kidding.
We get over there, and the whole
time I’m thinking we just gotta
make it to 9:00 in the morning.
The state’s gonna be here, they’re
gonna explain everything, and then the
judge is gonna be like, this is silly.
Why are you guys here?
Go ahead, issue on your own recognizance.
You can go home.
JACK: So, they get to the courthouse,
they sit down in the courtroom, and await
their names to be called by the judge.
It boggles my mind still that this is
the very courthouse that they broke into
last night, and now they’re sitting in
the courthouse waiting to see the judge.
GARY: I was first.
JUSTIN: Yes.
GARY: There was a gentleman that
was sitting next to the sheriff.
The sheriff was in the
gallery, I guess you could say.
There was only one man
standing next to him.
So, my thought was, good, that
is the court representative
from the state court, right?
He’s talking to the sheriff, they’ve
talked about this, they realize
this is just a big misunderstanding.
Everything’s gonna be good,
they’re gonna let us go, is
what’s still playing in my mind.
I sit there, I go in front of the judge.
They ask your name.
They say, what’s your name?
Yeah, my name’s Gary DeMercurio.
How much money do you make?
I make X amount of money.
Who do you work for?
I work for a company called Coalfire.
So, at that point they decide whether or
not you can qualify for a public defender.
JUSTIN: Legal representation.
GARY: Right, public defender.
She says, you do not qualify
for a public defender.
Would you like to defend yourself or
would you rather get outside counsel?
I’m like, well, I’m hoping outside counsel
isn’t necessary because, ma’am, I believe
this is just a big misunderstanding.
So, I launch into my reason why I
think this is a misunderstanding.
I explain to her what it is
that we do, what we were doing
that night, who we work for.
She looks at me and she says,
you must think I’m stupid.
[Music]
At that point I’m like, oh, Lord.
You’ve got to be kidding me.
This is not happening.
She launches into this, I don’t know,
diatribe, just like I’m the biggest
idiot that she has ever seen step
in front of her in her entire life.
Like, that is not the
way that things happen.
She is a state employee,
she works for the state.
If the state was doing this, she
would know about it, and this is not
the way that things happen at the
state, etc, etc, etc. I just went
from being hopeful to just seeing red.
I was just irate.
JACK: Keep in mind that both Gary
and Justin barely slept the night
before, and they’re in these
orange jumpsuits with shackles on.
They aren’t presenting themselves as
best they could given the situation,
but when the judge said this to
Gary, he couldn’t believe it.
He stood there totally shocked.
Tons of rebuttals are going
through his head, but he wanted
to be courteous, so all he could
do is stand there and be quiet.
But he was thinking things like…
GARY: You are a judge.
You are — literally the point of your
position is to be able to look at someone
and have some semblance of an idea whether
or not that person is telling the truth
or not, and the only thing I can think
of is you’ve been dealing with people
and liars for so long, you can no longer
tell the difference between somebody
who is innocent and telling the truth
wholeheartedly and somebody who is a liar.
JUSTIN: Which obviously he’s not
saying that to the judge, but
that’s going through both of our…
GARY: Yeah, that’s obviously
what we’re thinking.
JACK: The judge charged him with burglary
and possession of burglary tools, then
went on to say a bail is set for $5,000.
Justin couldn’t believe the
judge was saying this, either.
JUSTIN: Same deal.
I’m like — as not the person on front
stage but obviously still in the same
boat, I’m like, oh no, there’s no way.
This is like a bad joke.
You gotta be kidding me.
Not a chance in hell this
is how this is going down.
So, I’m just kind of like
sitting on the stand in awe.
My jaw has dropped to the floor looking
at the situation transpire in front of us.
GARY: There’s still this gentleman
sitting next to the sheriff.
I’m like, okay.
I’m like, well, again, internal
monologue, well, hah, joke’s on you
judge, this guy’s from the state
and he’s gonna explain everything.
So, this guy walks up next to me
and says, excuse me, ma’am, I’m
the county prosecutor and we think
these guys are a flight risk.
We would like to increase their bail.
I’m like, oh Lord.
Are you kidding me?
I literally start looking around the
courtroom looking for somebody else.
I’m like, where is our
state representation?
They told us they were going to be here.
Where are they?
They were nowhere to be found.
They told us they were gonna show up.
They ghosted us,
100% ghosted us.
JACK: There was nobody there
to defend Justin or Gary.
The three contacts on their
get-out-of-jail-free card did not
come like they said they would.
This was just too soon for
anyone from Coalfire to be able
to come down and help, either.
So, they were just standing
there completely baffled and
irate that this was happening.
JUSTIN: I will say at one point during
this exchange the judge is looking
at Gary and she’s like, you need to
come up with a better story because
nobody here is believing this, to
which Gary retorts, well, you should
talk to the sheriff because the
deputies last night had verified us.
Everyone believed us until we’re here
sitting in front of this courtroom.
He looks over at the sheriff and
the sheriff is just kind of like…
GARY: He just smiled and shrugged.
He didn’t say anything.
Again, in our minds, we’re like, don’t you
have some sort of ethical responsibility
to say, actually ma’am, we did verify
with someone that worked for the state.
However, we haven’t fully confirmed
that, or something of that nature.
JUSTIN: Sure, yeah, anything.
GARY: Not a word.
JUSTIN: Nothing.
JACK: What a frustrating situation.
Yes, they broke into the courthouse, but
they had 100% permission to do so by the
information officer, the director, and
the head of infrastructure for the Iowa
State Judicial Branch, the very state
department that runs these courthouses.
GARY: Then she read the
address of where we broke in.
She realized that it was her courthouse
and her courtroom, and she was mad.
JUSTIN: Irate.
GARY: She was like, how dare
you break into my courthouse and
my courtroom at this address?
She just went off.
Then she’s like, bail is set for $50,000.
Our bail originally was $5,000.
JUSTIN: Ten, ten times
[inaudible] bail for burglary.
GARY: Yeah,
ten times the amount.
JUSTIN: Yeah.
JACK: That’s just how much
bail was set for Gary.
JUSTIN: So, I go up shortly there — that’s
pretty much the end of the exchange.
I go up, and same deal,
I don’t believe this.
I’m like, well, we were authorized
by the state to perform this testing.
After seeing what Gary had gone
through, I’m like, there’s no point.
Don’t open your mouth and
say something that could be
potentially incriminating here.
So, I’m like, okay, we’re
gonna do this, I suppose.
Gary and I again trudged back across the
street, back into our holding cells where
Gary has cell mates of a wide variety.
But one says to him — he’s
like, man, I can’t believe that.
You went up there as professional as
could be and she disrespected you.
Even the inmates just
looked at us.
They were like, man, you
guys are so innocent.
They didn’t even have
to listen to our story.
They were like, just the way you guys
talk and the way you carry yourselves
and the way you look, they’re like, man,
you don’t look like you belong here.
Like, what are you doing here?
JACK: Justin’s bail was
also set for $50,000.
So, the way bail works in the US is that
you can either sit in jail until your
court case or you can pay this amount to
get out of jail and come back for court.
JUSTIN: At that point we’re
facing felony charges.
We’re facing felony burglary charges
and felony possession of burglary tools.
So, we’re in a criminal
trial at that point, so…
GARY: And looking at seven
years in prison as well, seven.
JUSTIN: Right, right.
JACK: Still, they hoped any moment
their point of contacts would
come and sort everything out.
But the situation was becoming less
hopeful, so Gary and Justin got some more
phone calls and eventually got Coalfire
on the phone and tell them everything,
and Coalfire immediately started working
to bail them out and to get help.
So, about twenty hours after going
to jail, the $100,000 in bail money
came through and they were let go.
At this point it’s Thursday and
their return flight is on Saturday.
JUSTIN: Oh yeah, Coalfire
gave us permission.
They’re like, do whatever it takes.
Get out of that state.
Come back home, boys.
GARY: Leave that place.
JUSTIN: Yeah, we booked earlier flights.
JACK: [Music]
Both Gary and Justin go back home and
get lawyers to help them with this.
Something had gone terribly wrong,
but they still weren’t sure what.
Why was nobody listening to reason here?
Why are they even being blamed for this?
This should be a contract dispute,
not fall on these two guys.
Felony charges?
The local news ran a story.
REPORTER: Two men arrested for breaking
into the Dallas County Courthouse say
they were hired to do it by the state.
Justin Wynn and Gary DeMercurio
are both now charged with third-degree
burglary and possession of burglary tools.
They were taken into custody
around 12:30 Wednesday morning.
As KCCI’s Alex Schuman shows
us now, the men say they were
doing cybersecurity work.
ALEX: The state court administration
says they did hire this company to
test the security of their electronic
records but did not intend for them to
physically break into the courthouse.
Not many had yet heard what
happened, but once they learned,
people had plenty of opinion.
BYSTANDER: They need to be arrested.
There’s no trying to break in, period.
Lock ‘em up.
Throw away the key.
I don’t care.
JACK: Well, that bystander
they interviewed I guess didn’t
like them for some reason.
But you might have caught in this news
clip where they said the Judicial Branch
did not intend for these two to break in.
Well, the next few months of
this ordeal were painful and
grueling for many people involved.
The news reports I read said they
interviewed the State Judicial
Branch, who claimed that they didn’t
know a physical assessment was gonna
happen, but then Coalfire outlined
in the contract to show them that
a physical assessment was approved.
So, then the state changed their mind
and said, well, yeah, we knew that was
happening, but this was happening outside
the hours described in the contract.
But then Coalfire said, we left a
calling card on your desk overnight and
you e-mailed us saying congratulations.
Why didn’t you tell us to stop then?
The state went on to say, okay,
sure, but we didn’t know you were
going to break into courthouses.
But yet again Coalfire showed them
the contract and showed them the
exact locations of the addresses of
each building intended to be tested,
which included a few courthouses.
Eventually the State Judicial
Branch ran out of fingers for
pointing at Coalfire as the problem.
But while that certainly fanned
the flames of this problem, it
wasn’t the main fuel source.
See, this was a county courthouse, and it
was a state department that hired them.
State and county are two different things.
So, the sheriff, judge, and county
prosecutor were sticking with
the story that the state had no
authorization to conduct a physical
penetration test on this building.
This was the main crux of the issue, and
if the county was not aware that this was
going on, then they had to assume that
Gary and Justin were actual criminals.
If the state had no authorization
to conduct these tests on this
building, then it would be the same
as if that gas station attendant
across the street sort of paid
them to go break into the building.
So, from the prosecutor’s
perspective, they thought these
two guys were actual criminals.
GARY: Well, so, here’s the caveat,
is after all this was said and
done and we were bailed out,
the state ordered a third-party
investigation into this scenario.
There was a lawyer — well, a law firm
that performed the investigation.
The final findings, which are public — the
very end of those findings, that lawyer is
looking at some sort of precedence, right?
All law is based on a case before, right?
That’s where you get
your legal precedence.
Well, what was — in a similar
scenario, what was the judgment?
So, because this has very little
precedent associated with this, it’s
up for interpretation of the law.
During this third-party investigation,
that lawyer’s interpretation of the
law was the state had legal authority
to authorize a test on county property
because they are tenants of that property.
JUSTIN: Yeah.
It’s their authority to protect that
courthouse and administer security for it.
GARY: Right, and the things
within that courthouse.
JUSTIN: Right.
JACK: But the prosecutors
held their position.
They started looking through the contract
to try to find anything that wasn’t right.
Justin and Gary both went back to work
for Coalfire during all this, but they
weren’t able to really focus that well.
I mean, for one, they had long talks
with lawyers and going over tons of
evidence and documents with them.
This is hard to find time to do when
you’re typically spending a week at a
client’s site doing a penetration test.
This news made its way around, so
if Gary or Justin got on a call
with a client to do a pen test, some
clients wanted to hear the whole
story about what happened in Iowa.
So, it was just really distracting.
Of course, they were arrested with
felony charges, so some clients have
sensitive buildings and they do background
checks on the penetration testers.
But with felony charges, they
weren’t able to do these assignments.
They spent months battling this out with
the prosecutors, and a lot of what I know
about this story was through documents
published by the Iowa State Courts.
There was some great journalism work
by Ars Technica, which got a lot of
the documents and posted them publicly.
Here is where I see the rules of
engagements and the positions that the
state took on various things and how
they broke into different buildings.
In fact, somebody even interviewed
the Iowa senators to see what
they had to say about this.
Senator Amy Sinclair said, quote, “The
hiring of an outside company to break
into the courthouse in September created
significant danger not only to the
contractors but to local law enforcement
and members of the public.” End quote.
Also, Senator Zach Whiting
had something to say.
He said, quote, “Essentially, a branch
of government has contracted with a
company to commit crimes, and this is
very troubling. I want to find out who
needs to be held accountable for this
and how we can do that.” End quote.
So, eventually when the third-party
investigation was complete, which
said that the state had jurisdiction
to hire Coalfire to run these tests
and the state point-of-contacts all
approved that Coalfire was hired to
do it, all this came together and
was given to the county prosecutor.
JUSTIN: So, all that comes to light,
and eventually — I think it was a month
after the county had the opportunity
to either drop charges or to continue
pressing charges, at which point
they decided, okay, felony charges
aren’t really relevant here, but we’re
gonna drop this down to misdemeanor
trespassing charges, which I think they
expected us to immediately say, yep,
yep, we’re guilty, we’ll take that,
which of course from our perspective,
we’re legally hired for this job.
No chance in hell we’re gonna plead
guilty to misdemeanor trespassing
charges even though it’s essentially
a traffic ticket violation or
something similar at that point.
We weren’t going to go along with that.
So, we’re still fighting that.
That fight took place
over the next four months.
GARY: All sorts of fights between
our lawyer and the prosecutor.
JUSTIN: Oh, constantly.
GARY: To even get to the point where the
prosecutor’s like, okay, well, maybe we’ll
drop it down to criminal trespassing.
Our lawyer was like, look, man,
in order for there to be burglary,
they have to have criminal intent
to commit a felony after entry.
These guys were working.
There is no way that you
can prove criminal intent.
So, they did everything in their power.
They’re like, well, if they dropped a
key logger on one of the systems, then
we might be able to – I mean, they
were grasping at straws to do anything
and everything in their power to try
to hopefully make that stick for some
reason, and they knew at that point;
they knew we were under contract.
They knew that we were asked by the
state to be in that courthouse, and
they still were pushing for these
felony charges, these Class C felony
charges with seven years of prison
time behind it for I don’t even – I
still to this day have no idea why they
kept pushing so hard for this stuff.
JACK: Eventually the Dallas County
prosecutors in Iowa came to an
understanding, and on January
30th, 2020 they dropped all
charges against Gary and Justin.
The case is now over and
they’re free men once again.
But what still lingers is their
criminal record still shows that
they were arrested for burglary
and were given felony charges.
JUSTIN: So, that’s kind of why
we’re still so upset at this point.
We’re gonna carry this
for the rest of our lives.
We have felony arrest records.
Even though charges are dismissed,
everything’s been dropped at this point,
anytime we get pulled over, if we ever
try to apply for a job in the future,
security clearances, and any number of
things; volunteer work, it’s gonna show
we’ve been arrested on felony charges.
So, we’ve been stripped of rights with
no due process on wrongful arrest.
JACK: Yeah, it’s a shame.
Any traffic stops these guys get — when
the police look up their record,
it’s gonna show that they were
once arrested with felony charges.
Any time in the future where they’re
on a physical assessment and the
cops come, they’ll see that they have
burglary charges on their record,
which might make the cops think
like, yeah, these are real burglars.
Look, they have real charges.
Any background checks that
someone does on these two is
gonna show their criminal history.
I mean, what do you write when
you’re applying for a job and it asks
you, have you ever been arrested?
What do you put?
Yes, but it was wrongful?
It doesn’t sound fair to me.
GARY: Big things, little things.
It just affected our lives for the
last six months, like all the time.
JUSTIN: And honestly
still will continue to do.
Like yeah, with the arrest charges.
But man, just honestly, I know a lot
of people say a lot stuff; oh, damages,
I’m so stressed out over this, and
they want to do a counter-lawsuit.
Like, no, I think my physical
brain chemistry has changed over
this, being so stressed out.
I sound like a wimp about it, but man,
you wouldn’t believe it until you’re
in it and going through something like
this how stressful and traumatic — I
don’t even want to use that term ‘cause
I don’t think — but it is a traumatic
experience to go through something
like this and have it held over your
head for such a long time when you know
you’re in the right, and then to see
the legal system fail you repeatedly.
There were so many opportunities and
avenues for the county to understand or
get more information and then drop the
charges, and it just never happened.
GARY: I think that was the – that’s
the biggest detractor from all of this,
and the point that was so aggravating
is so many times everybody had every
opportunity to do the right thing,
and they just continually didn’t.
It was just – it was — for the
lack of a better term, it was
like I was flabbergasted, like
totally old school, right?
It’s just, how can you do this to someone?
You know; you know that we weren’t
there doing anything malicious.
You know we weren’t actually breaking
in to do – to create some sort of
crime or to have some sort of crime.
You know we were there doing our job.
Why are you still pushing
seven years of prison time?
Why are you still pushing this on us?
It’s like, they had absolutely no
mindset, for lack of a better term or
maybe it is the best term, destroying
two professionals who have absolutely
sparkling clean records who’ve never even
been in trouble for jaywalking before.
They’re just like, oh,
no, yeah, no big deal.
We’ll just keep throwing these
Class C felony charges at them.
Yeah, you know, if we
drop it later, whatever.
It doesn’t affect us.
It doesn’t harm us.
What do we care?
Just like, the – what do I want to say?
The lack of sympathy or empathy…
JUSTIN: Professionalism, empathy.
GARY: Professional, whatever term you
want to throw there, just for – not
even us, but just another human being…
JUSTIN: For doing what’s right.
If you’re representing the law, it’s
a failure of the legal system, which
I had no idea America worked that way.
It’s just not the America
that I was brought up in.
I thought innocent until proven
guilty, and just to see us stripped
of so many rights and to go through
this, it was just such an awful
experience to be thrown into this mix.
GARY: Oh, it was terrible.
That was the hardest part, was
watching people do the wrong thing
repeatedly and thinking it was not a
big deal, because to them it wasn’t.
The only big deal was to us,
but no one seemed to care.
JACK: And that is where we left off back
in 2020, when this episode first aired.
They were arrested but fought it
and got their charges dropped.
That should be the end
of the story, right?
Well, no.
There’s more, lots more.
First was the response from the
information security community.
[Music] They were outraged from this.
This jeopardizes a whole industry.
People who have gone to college to
get degrees in this are now seeing
like, wait, so you can get arrested
for this, get felony charges and
be facing seven years in prison?
What the heck?
So, a few people from the cybersecurity
community got together and said,
what can we do to support these two?
John Strand came up with a plan.
I interviewed John Strand
for an episode before.
It’s called The Big House,
where he sent his mom to do a
penetration test for him once.
A few weeks ago I ran into
him at DEFCON and asked him
what his response to this was.
Sorry for the background
noise; DEFCON is a busy place.
[To John] After that news
hit, what did you do?
JOHN: Oh, we immediately went to the town
of Adel, Iowa, and we did Awareness Con.
We invited the entire community
to come down and ask the security
community questions about what we do.
JACK: [To audience] Yeah, and because
John Strand is the founder of Black
Hills Infosec, he knows a lot of people
in the industry, and he rounded up
some big names in cybersecurity; Dave
Kennedy, Deviant, Jake Williams, all
of which have been on this show before.
They all went and gave talks
in Iowa, because obviously the
people there had no idea physical
penetration testing was even a thing.
You heard that one guy earlier
in the news interview; he’s like,
these guys should be locked up.
If ignorance of the law is no
excuse, when you're caught breaking
one, then what about the reverse?
If the sheriff, the judge, or the
townspeople are ignorant that this
is a profession, then should that
be no excuse to demonize these two?
But John Strand thought he’s gonna do what
he can to educate the people in that town,
to teach them all of this is legitimate.
There is a whole industry
of people doing this.
There are professional conferences,
degrees, books, certifications
that you can get to do this.
JOHN: It’s absolutely wonderful.
The sheriff, Leonard,
he came and he talked.
JACK: Here’s that clip from Awareness
Con, where the sheriff came to give
his opinion of this whole thing.
JOHN: I’m very, very, happy
Sheriff Leonard has shown up,
and I asked him how he wanted me
to introduce him to the group.
I’m not joking; he said, you
can introduce me as the bad guy.
[Audience laughter] So, he
has a great sense of humor.
So, everybody, could you please give a
round of applause for Sheriff Leonard?
[Applause]
SHERIFF LEONARD: Well,
first off, I’m sorry.
I’m obviously the reason you're all
here, so — but I wanted to stop here
and tell you that I have a lot of
friends that do this for a living,
too, and — with Homeland Security
and all those type of things, and
nothing but supportive of the industry.
That’s not — there’s just a whole lot
of things that went into this that
night that were still in question.
So, you know, like I was talking
earlier; getting a lot of hate mail
and a lot of stuff from the industry
worldwide, I mean London, everywhere,
just getting ‘how dare I do this’.
You know, you gotta look at it
from law enforcement perspective,
for what we're responding to.
You know, if you're telling me that this
is a — we're just checking your response
time — and I had five deputies running 140
miles an hour to get there — that doesn't
work well, because if one of your family
members was t-boned by a deputy, you'd
be mad, especially when you found out it
was a fake call or something like that.
That — common sense, that’s
bad business, you know?
If somebody would have got killed on the
road that night — those type of things.
So, I mean, we just need
to work better together.
I don't know if this is a common thing,
if this is all — you know, but there’s
a lot of things that we gotta look at.
The only reason — and the other thing;
those of you that do the job, I would
never charge you with a crime and let
it continue — I don't have the ability
to dismiss it, but I can work with the
county attorney and those type of things.
But at the end of the day, if
we believe that it truly needs
to go away, it’ll go away.
But I guess I just wanted to stop and
let you guys know that we do appreciate
you and what you're doing, and it is
a needed — what you do is very needed.
I couldn't do it.
I don't know how to do this stuff.
I rely on you folks to help us.
The two gentlemen that night, they're
good guys, but you gotta understand that
when you come here in rural Iowa from
Florida, you're from Seattle, Washington,
chances of you coming back when I ask
you to come back and answer questions
are slim to none, I promise you that.
So, we just — I just met you, so you're
not gonna — there’s a whole lot of
questions that go into these things in
the middle of the night that we have
to — we have to put all that together.
So, I just wanted to stop and tell you
that there is no friction between — as
far as I’m concerned, between us.
Just asking that you kinda wait for it.
We're not out to prosecute anybody.
I would never charge any one of you with
a crime if I didn't think it was valid.
If it’s proven down the road and if we
get through this investigation with all
these other agencies and it needs to go
away, I’ll advocate for it to go away.
I wouldn't want any one of you to have a
criminal history that you didn't deserve.
So, if I could recommend anything,
it would be work with your local law
enforcement when you're doing it.
I would have helped.
If I would have known about it,
I would have helped you do it.
You know, I would have helped
them accomplish their mission
that night, so — and we wouldn't
have any of these problems.
So — but anyway.
JACK: I think Awareness Con did, in
fact, change the hearts and minds of
those living in Iowa, because after that
there was much more support for these
two penetration testers who got arrested.
They were starting to come
around and feel sorry for them.
Some were even saying, please
don't judge Iowa based on this.
So, while I was at DEFCON, I ran into
those two penetration testers from
this Iowa County Courthouse story,
and it’s now been six years since
this happened and we last spoke.
So, I wanted to get together with
them and find a spot at DEFCON
and sit down and hear what’s new.
[To guests] So, you got arrested, got
your charges, got the charges dropped.
Story’s over, right?
Anything else happen since then?
GABBY: A couple things.
JACK: What’s new with you?
GABBY: I mean, so, have you ever
heard that thing where like — you
go to prison and you turn gay?
Yeah, I’m not gay, but
definitely turned into a girl.
JACK: Gary has changed her name to Gabby.
GABBY: Well, it’s my handle.
I just, I guess, absorbed the
handle Gabby, yeah, 'cause I
can — like to be anyone I want to be.
JACK: You got your charges dropped.
So, after charges are dropped,
are you like, I’m good?
Like, I can finally go back to
my life, everything is fine.
GABBY: I don't feel like it was like
that at all because there was so
many things they said that just were
not accurate or just outward lies,
fabrications like changing the narrative
just to say, oh, cool, we're innocent.
Well, no shit.
Obviously we're innocent the entire
time, which is why we never settled
for anything the entire time.
So, them dropping it would
almost be like them doing us a
favor, which was not the case.
They did themselves no favors
by dropping it other than
embarrassing themselves further.
That was for them, definitely not for us.
JACK: Well, what more can you
do after charges are dropped?
GABBY: That’s part of the judicial
system that’s messed up, is you're
guilty until proven innocent.
You spend time in jail, you get
your name dragged through the mud,
they lie about everything, and then
there’s zero repercussions unless you
go after them for a personal suit.
JACK: [Music] A personal
lawsuit, is that possible?
Can you sue for wrongful arrest?
They felt like something seriously
unjust happened to them, and they
wanted to do something to make it right.
JUSTIN: I think Gabby was already
thinking about you looking at
her mugshot, smiling in there.
She was already thinking about the
lawsuit as soon as the cuffs went on.
GABBY: Pretty much.
JACK: You were in the jail cells
saying, as soon as I get outta
here I’m gonna sue these guys.
GABBY: Oh, my — 'cause I knew we had
done — we were the most cooperative — at
least one of us was for 99% of the time.
The other was 100%.
But again, you had nothing
wrong with what you did.
They were being super invasive.
JUSTIN: Oh, I don't trust them
to give me my information.
I saw how they secure things.
GABBY: But that was — it’s a
good learning point, right?
Because we're like, we did nothing wrong.
We're gonna be completely cooperative.
We're gonna do everything, and then
you do everything right, and then they
just lie about stuff to try to cover
their own butt and to try to make it
look like they didn't do anything wrong.
You're like, wait a minute, I was
truthful, I was honest, I cooperated with
you guys and then you turn around and
you completely spin the narrative so you
don't get in trouble or you don't look
bad or to save your job or whatever it is.
So, not cooperating to me sounds like the
right choice after going through that.
JACK: Suing the sheriff felt like
the right choice for them, making
him pay for the wrongs that he’s
caused, expose the errors in his
ways, make him the guilty one.
But to conduct a lawsuit such
as this, it was going to cost a
lot of time and a lot of money.
GABBY: We actually had our
original lawyer and we asked him.
Like, I think we would really like
to go after the county and the state
and the sheriff, because people
need to know that this is not okay.
Like, they just can't get
away with stuff like this.
He had a real — he was afraid to do
it, for lack of a better term, because
he’s like, this is small-town Iowa.
It’s not big.
Everybody knows who I am, and I feel
like if I go after the county and
the state and the sheriff and all
these lawmakers, especially after
they had that investigation — and
he’s like, I don't know that that
would be great for my career at all.
JACK: So, their lawyer made a few phone
calls and found them another lawyer
named Marty who was just about to retire.
GABBY: He’s a civil rights
lawyer and he loved the case.
He’s like, I will take it on.
I’ll do it pro bono.
He’s like, I’ve made my money.
Like, I — he’s literally at
the twilight of his career.
He extended his career
to finish this case.
JACK: So, they got a new lawyer,
and they wanted to sue the sheriff,
the prosecutor, the judge, all
these people who treated them bad.
But this is where Gabby and Justin started
learning some new words, words like…
GABBY: Qualified immunity.
JACK: And sovereign immunity.
See, qualified immunity means you can't
sue government workers, especially
judges, prosecutors, and cops.
They're shielded by the government itself.
So, they can't sue the actual people who
did them wrong, who made these mistakes.
Then there’s sovereign immunity, which
means you can't sue the government
unless the government agrees to be sued.
GABBY: Well, we tried to go after
the state, and it’s very convoluted
because the state is the one that
passes judgment on whether or
not the state is guilty or not.
So, it’s like somebody coming to
you and saying, we're gonna sue you.
Are you guilty?
You're like, of course I’m not.
They're like, oh, sorry, can't
sue you now because you said
I’m — I said I’m not guilty.
So, the state immediately threw it out.
JACK: They tried to make this a
federal case to sue the state.
Since the state wouldn't pick it
up, maybe the federal government
could oversee it and decide.
It got picked up by a federal court,
but then when they looked at it,
they just kicked it back down to the
state, who just closed it right away.
GABBY: So, it’s just like, they tried so
hard to stack the deck against us at the
— at every single turn just to make it where
it was not going to be or didn't
feel like it was impartial at
all through the entire process.
Like, every step they could take to
stack the deck in their favor, they
absolutely tried to do and absolutely did.
JACK: So, this lawsuit they wanted
to wage was dead in the water before
it even got a chance to begin, which
is really frustrating because what
mechanism can you even use here to
bring justice to a situation like this?
GABBY: So, we were left with
the county and the sheriff.
So, even though the sheriff has
qualified immunity — or the prosecutor
is the one; the prosecutor is the
one that has qualified immunity.
The sheriff has some
protections, but not complete.
So, we had to go through the process
of saying, these are all the things
that we think he did wrong, and then
the judge said, yes, yes, no, no, no.
Then we eventually are left with what
the lawsuit ended up — and so, they said
there is enough evidence to show that
the sheriff did do these things wrong.
So, we were able to go after the
sheriff, but we went after the sheriff’s
position, not Chad Leonard the person.
So, we had to go after the actual sheriff,
which means he’s also covered by the
county’s insurance policy, and nothing,
not one cent comes out of his pocket.
He doesn't get reprimand — like, nothing,
absolutely nothing happens to him.
It’s a moral victory at best.
JACK: Okay, so they started a
single lawsuit that got accepted
in the courts against the county
and the sheriff’s position.
Finally this thing was starting to
get some traction, and this felt like
progress since Justin and Gabby really
wanted to use the system to seek
justice of everything that went wrong.
[To guests] Now, my question is, what
were you hoping to get out of the lawsuit?
GABBY: One dollar.
JACK: One dollar?
GABBY: That was all I cared about.
I told… I was like, as long as I can
drag this dude through the mud like he
did with us except with facts instead
of stories, that’s all I care about,
which is — the entire time, which is
why we were like — they were like, you
should just take the trespassing charge,
and — nope, nope, nope, the entire time.
My entire goal was just to show that this
— show this person for who he really was,
which is just a lying, corrupt individual.
JACK: Dang, this is getting pretty good.
They got a lawyer who’s all in, retired,
working for free, doesn't care about
what people think of him anymore, and
Gabby’s just coming out with claws out.
This is gonna be a good fight.
They eventually decided to
ask for more than a dollar.
They wanted this to hurt, and they
also wanted to cause panic and fear
within the county, and they also wanted
the townspeople to see what happens
when you elect a corrupt sheriff.
JUSTIN: We submitted the maximum
amount that the insurance company
would have covered for the county.
So, we didn’t want taxpayers
having to front more money for
having a poorly-elected sheriff.
So, yeah, that’s the
dollar amount that we set.
I think the other part of it, too,
that’s really important, what we
wanted out of the case was to set
new precedent, that this isn't okay.
You can't put hackers in jail and
try to prosecute them when you
hired them to help defend you.
JACK: So, they were now seeking quite
a bit of money from this lawsuit.
I’m not sure exactly how
much; they wouldn't tell me.
My guess is that they
wanted to split $1 million.
Keep in mind, they already paid $50,000
each just to get out on bail, and then
they spent the night in jail, and they
were threatened with seven years of
prison that — they had to fight tooth
and nail to get that charge dropped.
Those lawyer fees added
up, too, of course.
That’s a lot of stress, real costs, and
anguish that they had to go through.
So, to split $1 million, I think
that sounds reasonable for the
amount of hardship they endured.
But Gabby was still furious
from this whole ordeal.
GABBY: Like World War II,
the — what’s the saying?
They woke the sleeping giant.
Japan thought if they came in and they
smashed us that we would back off and
just slink away and not do anything.
Kinda the same thing here where, oh,
if we just throw our weight around and
we threaten these guys with six years
in prison and all this other stuff,
they’ll just take the deal and they’ll
go away, and that was not the case.
We don't fuck up.
Justin and I, we do things by
the letter, by the contract.
Everything we do is meticulously perfect
for that reason, because of what we do.
We don't want to mess up.
I think all that — this whole thing just
showed that and highlighted it, because
if we had done something wrong, they would
have found it, and they were unable to.
So now, five years later, the tables
had turned, and we had all the evidence.
We had all the data.
We had the video cameras and we had
the recordings and we had everything.
[Music] Then it was the exact
opposite, where the county and the
state was like, oh shit, they've
got everything and we literally have
nothing except a really, really bad
arrest from a corrupt individual.
JACK: Together they had collected tons of
evidence supporting their case, and they
were feeding it to the court, and the
county was starting to sweat a little.
Despite how confident Gabby felt that they
would win this case, it’s still a scary
thing to go up against the government.
I mean, they could drag this case
on for years and exhaust you and
run you dry of money and energy,
only to ultimately drop the case or
reject it due to some clerical error,
making the entire process pointless.
Years of your life can be wasted
in a process like this, and the
government just doesn't care.
They do these kind of things
fairly regularly, too.
They use the process as the punishment.
The stress of courts and judges and
charges weighs heavy on a person,
like really heavy, and they know that.
So, even though they knew they probably
couldn’t even win that original criminal
case against them, they still wanted to
use those charges as a form of punishment.
So, fighting back at the government like
this is the story of David and Goliath.
Not only were these two penetration
testers the first ever to be wrongfully
arrested for penetration testing,
but they're also the first two to
ever sue the government to protect
their rights as penetration testers.
This is an epic story.
This case could set a precedent.
JUSTIN: It was just the
right thing to do, I think.
We didn't have a choice, I mean, to
have our counter-sue back at them.
It was the only way to try to
restore any sliver of justice
around our case and that state.
So, in our minds, it didn't even cross it.
Just a no-brainer; had to sue back.
But the funny — like David and
Goliath, I think that’s hackers, right?
It’s like the power that one individual
can hold is why governments can
be so scared of these individuals.
You can do a lot even as a single person.
So, against the government, it is
a mighty entity, but still, again,
that’s kinda for our lawyer to handle.
GABBY: It’s all about the
information, and we have all of it.
JACK: He felt like he had no choice
and that was the right thing to do.
Wow, those are some powerful words.
This is what patriotism looks like in
practice, to put the government in check
when it overreaches and force it back.
So, how does the county react to this?
Of course they delay it.
Their original court date was supposed
to be in 2020, but that got delayed,
cancelled, pushed back again and again.
The county tried to distance themselves
from this in every way possible.
They tried to slither out of it, hoping
that Justin and Gabby would grow tired
or forget about this or just give up.
GABBY: The further they could get away
from the moment, the better for them,
because they wanted it to fall out.
They didn't want people
to bring it back up.
JACK: So, year one goes by.
Very little happens.
Basically, they spent the whole
year just opening the case.
Year two goes by.
Nothing happens at all.
Year three, they just keep delaying
things, keep pushing it back,
and this is really starting to
test Justin and Gabby’s patience.
Like, come on, we’ve presented
all the evidence to you.
Why are you not looking at this
case and trying to get it closed?
Also, at some point during all
that, Chad Leonard, the sheriff
that they were upset with, retired
and moved out of state entirely.
So, whatever outcome this lawsuit’s
gonna have, it’s not gonna bother him
at all because he’s just relaxing in
some Florida community somewhere now.
But their lawsuit was with the
sheriff’s position, not the sheriff
himself, so the case continued.
Around this time, too, Justin
and Gabby’s relationship with
Coalfire started to sour.
They didn't feel like they were getting
paid enough or treated right by them.
GABBY: The first year after we got
arrested, we had over $5 million
come in directly of people saying,
hey, we want to work with Gary and
Justin, and we want to work with
the Iowa team, and blah, blah, blah.
JUSTIN: I think.
GABBY: We don't care.
JUSTIN: Our story was one of the most
valuable things that happened to Coalfire.
Even the CEO recognized, yeah,
the number-one reason Coalfire
is known is because of this case.
It is funny; if we ever talk to anybody
and we mention, oh, we work at Coalfire
— like, oh man, you ever hear that crazy
story of those guys that got arrested?
I’m like, no, tell me about that.
JACK: Gabby quit her job at Coalfire
and went to apply at other places.
[To guests] I didn't quite
get the full picture.
Is Coalfire good or bad?
GABBY: Individuals at
Coalfire are very bad.
I think Coalfire as an entity
during that time was good.
JACK: She was able to quickly get
interviews at other places, but even
though she was the best for her job and
the most qualified, her reputation from
this case alone made people turn her down.
She had a hard time finding another
penetration-testing job because of
this story with the Iowa courthouse.
She took six months off just
to clear her head and relax.
GABBY: Like, really started to come
into question; like, damn, am I
even gonna be able to keep doing
this because of what happened?
JUSTIN: Great opportunity to
start your own business, then,
and do it on your own terms.
GABBY: Right?
Yeah.
JUSTIN: Yeah.
GABBY: Justin and I had actually
talked about it multiple times in
the past about starting something
different and doing things a little
bit differently and treating…
JACK: Starting something new yourself.
GABBY: Yeah, and just building a
company that treats people the way
that we thought they should be treated.
We had a vision of — we wanted to
do things a little bit differently,
and so, we did that with Kaiju.
JACK: Thus, Kaiju Security was born,
a fresh, new penetration-testing
company based near Seattle, Washington.
GABBY: Adversarial simulation
offensive security.
JACK: Gabby started it with another guy
named Marcus, and Justin moved on to
the team shortly after it was formed.
After getting this new company
started up, the lawsuit was finally
making some movement in year five.
JUSTIN: Yeah, recently in
2025 it was about showtime.
So, then we started getting hot and
heavy with it, doing depositions,
getting things on record,
getting prep for the trial case.
So, we were definitely shaping
up — yeah, go show up in court.
Again, going back to the hacker community,
we had some great people like Deviant,
Andrew Porter, that agreed to testify
in our case just as expert witnesses.
So, yeah, we're going through.
We really thought we were
gonna end up in court.
We started getting presented with
options to settle pretty quickly.
I mean, they wait to the last
minute with everything like that.
They were throwing out low-ball numbers.
I think they had like — just about
like our bond or bail is what they
first wanted to offer, like $50k.
GABBY: Yeah, $50,000.
JACK: Okay, so, the county didn't want to
go to trial and did want to settle this,
but their offer was for $50,000 each, the
amount that they paid to get out on bail.
$50,000 each, that doesn't even
cover their lawyer fees that they
spent trying to clear their names.
What an insult.
So, no, of course they
didn't take $50,000 each.
They needed more.
GABBY: So, we ended up going through
arbitration where they take a
former judge and — goes back and
forth and tries to settle the case.
But at that time they were still
being super, super, super stingy.
They were like, oh, we’ll give them fifty.
Then so, the judge, TLDR — the judge
comes by to us, and through the
entire process — it took all day
long — comes to us and goes, I don't
think in my entire career I’ve ever
seen a case so clear cut as this.
This isn't a matter of if you win.
This is a matter of how
much money you're gonna get.
So, I’m gonna go back and I’m gonna beat
these guys up pretty good, and he leaves.
Marty looks at us and is like, I’ve
been doing this for fifty years or
something like that, or forty-two
years, and he’s like, I have never
heard an arbitrator say that ever.
I’ve never — not only had he never heard
it; he’d never heard of anyone else
saying that an arbitrator had said that.
So, that was the point, I think,
that our confidence started to go
like this, 'cause he had seen all of
our — everything that we had, and he
was just like, yeah, no, this isn't — I
don't think this is up for debate.
JACK: But even with that,
the county stayed silent.
Instead, they set a trial date,
which was three months away,
again making them wait more.
So, they prepared for trial.
They spent an enormous amount of time
and energy to gather their materials,
find bodycam footage, get testimonies and
depositions and bring in expert witnesses.
They even took time off work to
go attend this trial, and they
booked their flights and their
tickets, and they were ready to go.
Let me just emphasize what the
odds are in this situation.
Over 95% of wrongful arrest lawsuits are
thrown out due to qualified immunity.
Of the few that make it through,
95% of those usually get closed
with a zero-dollar settlement,
or the government wins at trial.
For them to receive more than $50,000
from this lawsuit is about the
same odds as hitting the lottery.
It’s extremely rare to sue the
government over wrongful arrest and
win a substantial amount of money.
Usually in those situations, it’s
because the person was in jail for weeks
or months under the wrongful arrest.
So, it’s even more rare for someone
to spend just one night in jail
and get a large settlement offer.
In those situations, you would have to
prove without a doubt the government
conducted an egregious violation, which is
what Justin and Gabby was saying happened.
[Music] But then a few days before
the trial was due to begin, in
February 2026, they got a new
settlement offer from the county.
The county was offering them $600,000
total, $300,000 for each of them,
and this was actually the lowest that
they would accept, so they took it.
The lawsuit was closed.
They got paid.
They won.
This allowed them to celebrate.
JUSTIN: Still, I think the biggest
one for the community is now we
have better precedent, right?
So, before, we were just arrested.
Felony charges — okay, cops can just
arrest pen testers doing their job and
try to put them in prison for seven years.
But now we can look back, and if
that’s ever happening in real time
to other testers out there — hey,
sir, let’s just take this slow.
Take your time.
Fully cooperative.
But if you want to research, this has
happened before, and it’s probably
not a good idea to try to prosecute
or put me in jail for doing my job.
Look what happens.
Or the county could have
to pay out or — yeah.
So, really good to have the win
under our belt for the community.
GABBY: Everybody else, yeah.
I’m obviously much more
selfish than Justin is.
JACK: Now, finally they can go
back to their normal lives feeling
like justice has been restored in
the best way it possibly can be.
Now they're focusing on building
Kaiju Security all with a
new feather in their cap.
JUSTIN: I love saying that, too, 'cause
I fought the law and the law won.
No, man, the law fought us and we won.
JACK: [Outro
music] A big thank-you to Justin
Wynn and Gabby DeMercurio for
reaching out and finding the
time to share this story with us.
I really like these two, and I look
forward to the next time I meet them.
Hey, I just launched a new show.
It’s called Low.
It’s a five-part series.
It’s the most crazy story I’ve ever
heard, and right now it’s hidden within
the Darknet Diaries premium feed.
If you want to listen to it early,
please go to plus.darknetdiaries.com.
Otherwise you're gonna have to
wait for the public release,
which is coming later this month.
This show is created by me, pony pie,
Jack Rhysider, mixing by Proximity
Sound, and our theme music is by
the mysterious Breakmaster Cylinder.
There’s an option in WhatsApp,
and I can never figure out; is
it mark as read or mark as read?
This is Darknet Diaries.