TrustedSec - A Message of Support: Coalfire Consultants Charged

If you haven’t been following recent news, two Coalfire employees, Gary DeMercurio and Justin Wynn, were performing a Physical Penetration Test against a Judicial Branch Building, the Dallas County Courthouse in the state of Iowa. The two employees were engaged by the Iowa State Judicial Branch to conduct the Physical Penetration Test, which is an authorized attempt to identify weaknesses and exposures through physical security controls to gain access to a facility. These types of tests are conducted regularly by organizations and are focused on enhancing physical security for buildings all around the globe.

During the physical break-in, the two consultants intentionally triggered the alarm to test the response time for law enforcement. They intentionally waited for law enforcement to arrive and were subsequently arrested and charged with felonies. The argument that the state of Iowa is making is that the buildings are public and that the Iowa State Judicial Branch didn’t have the authorization to give to the consultants, yet the consultants are being held legally liable. The charges have since been reduced to third-degree and possession of burglary tools to criminally trespass.

At TrustedSec, we have dedicated physical security personnel that perform the same type of work that the Coalfire employees were conducting. This is an extremely concerning development for our consultants and consultants in similar situations in other organizations. Coalfire employees appear to be caught in a political battle between the county and the state who authorized the tests.

At TrustedSec, we want to show support for the two consultants, Gary DeMercurio and Justin Wynn, and call for the charges to be immediately dropped. These types of actions call into question countless years of authorized testing on behalf of organizations and the industry’s ability to identify flaws and protect organizations within the United States. It’s clear that the state believed they had full rights to conduct these types of tests against their facilities, authorizing the consultants to perform a specific job simulating a break-in to the building. The consultants, their lives, and their families should not be used as leverage points between the state and county.

We will be drafting a letter to both the state of Iowa and Dallas County calling for the immediate charges to be dropped as a sign of support for the Coalfire employees. At a time where threats continue to rise and organizations experience breaches from not only a technology perspective, but also a physical standpoint, this type of work is paramount for improving safety and security. We’re deeply saddened that two consultants are in a mix of a battle between the state and county as their careers and livelihoods are placed in jeopardy.

It’s always important to verify scope and ensure that you have the proper authorization to conduct such activities. Breaking into the wrong building or not having proper authorization are scenarios that may have legal implications. In this case, it appears that Coalfire and its employees had every assurance from the state that they were fully authorized to conduct this work on the facility in question.

If you are interested in reading more about this case and the statement from Coalfire’s CEO Tom McAndrew, you can view it here.

The post A Message of Support: Coalfire Consultants Charged appeared first on TrustedSec.

from TrustedSec https://www.trustedsec.com/blog/a-message-of-support-coalfire-consultants-charged/