179: The Courthouse - Revisited

In this episode we follow up with Gabby and Justin from Episode 59 - two seasoned penetration testers who tell us a story about the time when they tried to break into a courthouse but it went all wrong, and what happened in the aftermath. SponsorsThis show is brought to you by Doppel https://doppel.com/. Doppel stops AI attacks with digital risk protection, human risk management, and email security on a unified social engineering defense platform. doppel.com http://doppel.com/ This show is brought to you by Sinch https://s.sinch.com/4xc8dnz. Sinch is the cloud communications platform businesses build on to send SMS, make calls, and verify identity at scale — including the one-time codes and two-factor prompts that stand between an account and whoever's trying to get into it. Learn more at https://s.sinch.com/4xc8dnz Support for this show comes from ThreatLocker https://threatlocker.com/Darknet. ThreatLocker is a Zero Trust Platform that gives organizations control over what can run and what users and devices can access. It combines prevention with real time detection and automated response, helping security teams stop unauthorized activity and quickly contain compromised machines. Learn how ThreatLocker can strengthen your defenses at threatlocker.com/Darknet https://threatlocker.com/Darknet. View all active sponsors. https://darknetdiaries.com/sponsors/ SourcesFull list of sources on the show page: https://darknetdiaries.com/episode/179/

• 0:00Speaker 00

  I just came back from DEF CON and it was so wonderful meeting so many of the listeners there. Many of you asked how my dad is doing. I'll tell you, he's struggling with the modern world. Let me show you what I mean. So like, I call my dad a few times a week just to check in on him, but um, he only calls me when he's got computer problems. Let me play for you what one of these calls sounds like.

• 0:22Speaker 01

  Okay, so anytime I get a photo, or if I wanna save it, there's like uh, three little dots, top right corner. Yeah. Saving a photo. And I hit the dots because I wanna save a photo. It used to say,

• 0:43Speaker 01

  "Save." Now it says, "Save to account." So I'm clicking on that, "Save to account." But the account is something called OneDrive.

• 0:58Speaker 01

  Oh, it says add account. How do I add an account? Because OneDrive, I don't use. I don't even know what that is.

• 1:06Speaker 01

  This is ridiculous. Yeah, where'd you get this tablet? You gave it to me. For Christ's sake. It's like, all of a sudden, my photo, save image, is gone. Where did you get the photo?

• 1:20Speaker 01

  Well, I just pulled up any one so I could explain to you. Okay, so you took the photo? I took it on the tablet.

• 1:29Speaker 00

  Did I hear that right? He took a photo on his iPad of some rabbits? And doesn't know how to save the photo he took? It's always the most mind-boggling question that he throws at me. I saw the photo. It was dark and blurry. It was not even worth saving. But he manages to stump me every time with these tech questions. I'm just like, uh...

• 1:53Speaker 01

  Oh, wait a minute. No, I found it. I found it. Pushing buttons. Good. You did it again. I'm gonna go to Photos and see if it's there. Yep.

• 2:07Speaker 01

  Okay, I'm not really sure what the sequence is. In a nutshell, you figured it out for me. Good work.

• 2:13Speaker 00

  And there you go. He figures it out all on his own, without any help from me at all. I'm just listening to the problem. And that's how a lot of these calls go. He just figures it out over time and then thanks me. Now, as much as I hate handling these calls because it's just so mind-boggling and frustrating to me, I told him, he can always call me if he ever needs tech support because he paid for my college to get a computer engineering degree. So he legit deserves free unlimited tech support for life because of that. And there was another call a few days ago where he um, he got a new doctor and the doctor wanted him to fill out like a 25-page form of all his medical history and stuff. While he was filling it out, he couldn't figure out how to send the form to his doctor. So he called me up.

• 2:57Speaker 01

  So do I hit the X and go to inbox?

• 3:02Speaker 01

  And then just forward that?

• 3:06Speaker 00

  Um, yeah, you can send it to them in an email attachment.

• 3:11Speaker 01

  Okay, then I'm gonna, I'm gonna hit the X on this patient form.

• 3:15Speaker 00

  What patient form are you looking at?

• 3:17Speaker 01

  The one that they sent me.

• 3:19Speaker 00

  The one that you filled out?

• 3:21Speaker 01

  Yep.

• 3:22Speaker 00

  And it has all...

• 3:23Speaker 01

  Yeah. It has everything typed. Now, I went to my email.

• 3:27Speaker 00

  Does the patient form have all the stuff you typed into it?

• 3:31Speaker 01

  The one I typed into, yeah.

• 3:33Speaker 00

  Okay, so it's got your data on there? And when you hit X, did it ask you to save it?

• 3:37Speaker 01

  Stop, stop, stop, stop. I just, I just went to where I sent it to myself and there's nothing on it. Holy Christ. No, none of this worked.

• 3:49Speaker 00

  Yeah, that's, I'm asking you if it saved it. So um, can you open the form again and see if your stuff is still there?

• 3:55Speaker 01

  No, it's all gone. How is it all... Oh, you gotta push "Save," probably. All the stuff, you know?

• 4:03Speaker 00

  Yeah, that's one option. This call was particularly maddening and he was so frustrated that he lost all this data from filling out a 25-page form.

• 4:13Speaker 01

  It doesn't say anywhere on here, "Save." I'm looking at the new form they sent me, all freaking 25 pages, and nowhere does it say, "Save and send."

• 4:23Speaker 00

  Okay, you know, the one option is just go down to their office and say, "Give me the form, I'll fill it out right here."

• 4:29Speaker 01

  Oh, really? Now I gotta go get ink and I gotta print that. I gotta fill this out here. I can't do an hour in the doctor's office.

• 4:37Speaker 00

  You got nothing else to do today?

• 4:39Speaker 01

  Prescription, when did you have surgery? Oh my goodness. That's unbelievable.

• 4:45Speaker 00

  Oh my gosh, um...

• 4:47Speaker 01

  Oh, I know, I should've called you before.

• 4:49Speaker 00

  As you can see, he's not very good at file management. And I thought I could fix it for him, so I started remotely trying to connect to his computer, his home PC, to troubleshoot this. But after like 10 minutes of trying to connect to his home computer, I finally asked him.

• 5:05Speaker 01

  Spotify, one item.

• 5:07Speaker 00

  No, you're not, is this all on your iPad? Or is this on your home computer?

• 5:11Speaker 01

  No, this is on the iPad.

• 5:12Speaker 00

  Oh, I didn't know that. I thought I was connecting to your computer. That's why I was using...

• 5:16Speaker 01

  Oh, no. Big computer.

• 5:17Speaker 00

  If I would've known this from the get-go, I would've been trying a whole different set of instructions. Oh, yai, yai. Oh, man. Okay.

• 5:26Speaker 01

  Big, big computer doesn't work.

• 5:30Speaker 00

  So now his big computer doesn't work? Like, now there's three problems that we're trying to fix here, right? A lost form, a printer that's out of ink or something like that. I don't even know what the problem is there. And now his main computer doesn't work? Anyway, for some reason, I couldn't even connect to his iPad remotely on this one. And I just couldn't help him find this form. I thought he might have saved it somewhere or there might be an old revision of it somewhere that we could rescue, but this was one that I could not fix and he didn't figure it out on his own. So he hung up and drove to the doctor's office to fill out the form there. But what is the deal with this? Why does he struggle so much to adapt to the modern world like this? He's been using a computer every day of his life since the 90s, but his brain just can't keep up with the ever-changing aspect of it?

• 6:15Speaker 00

  Is it up to me to keep him afloat? Or is ignorance just no excuse anymore?

• 6:25Speaker 00

  These are true stories from the dark side of the internet.

• 6:32Speaker 00

  I'm Jack Reisider. This is Darknet Diaries.

• 6:52Speaker 00

  This episode is sponsored by ThreatLocker. The weird part about modern cyber attacks is how normal they look. The attacker logs in from Chrome, uses PowerShell, runs a remote admin tool your IT team already trusts. There's no custom malware, no dramatic movie hacker moment, just normal tools used in the wrong way. That's part of why ThreatLocker exists. ThreatLocker helps organizations control what software can run, what it can do, and how systems communicate. If attackers get credentials or land on a machine, they'll have a much harder time moving through the environment because security teams are realizing something important. The problem isn't always unknown software anymore. Sometimes it's trusted software being used by the wrong person. If you wanna see how ThreatLocker works,

• 7:37Speaker 00

  go to threatlocker.com/darknet and book a demo today. That's threatlocker.com/darknet to book a demo.

• 7:50Speaker 00

  This episode is sponsored by Doppel. Protecting yourself from attackers used to be as simple as deleting dodgy-looking emails. But with AI, the attack surface has outgrown the defense that legacy vendors provide. Doppel was founded in 2022 to give companies back control. Doppel is an AI-native, social engineering defense platform. Doppel strengthens human risk management by training employees to recognize deception and provides digital risk protections across every channel. It even delivers agentic email security that doesn't just score the inbox, but takes down the attack infrastructure behind the message. Those dodgy-looking emails have been replaced by bespoke and personalized texts, URLs, ads, and even social media connections. But Doppel can then turn these attacks your business receives

• 8:34Speaker 00

  to inform campaigns and security awareness training for your employees so they know what to look out for. Doppel, outpacing what's next in social engineering. Learn more at doppel.com. That's spelled D-O-P-P-E-L. Doppel.com.

• 8:52Speaker 00

  Okay, this is the epic story of those penetration testers who broke into the Iowa County courthouse. I first ran this episode back in February 2020. It's episode 59, but I'm revisiting it today for two reasons. First, it's just a really good story. And if you haven't heard it, you definitely should be listening to it. And if you already heard it, you should listen to it again because it's that good. But second, a lot has happened since I posted that episode originally. And I caught up with the two people involved at DEF CON last month to give us a full update on what has happened since. And it's crazy. So first, I'm going to replay the original episode right now. And then in the last 20 minutes or so of this episode, we are going to get an update

• 9:33Speaker 00

  to this story. And it's really interesting. So stick around to the end. All right, let's go. All right, so let's jump in and meet our guests for this episode.

• 9:41Speaker 02

  My name is Justin Nguyen. I'm a senior security consultant with Coal Fire Systems. I am an offensive penetration tester who specializes in physical security, which often entails social engineering, physicalized exploits to gain access to facilities.

• 9:55Speaker 03

  Yeah, my name is Gary DiMccarrio and pretty much mirror everything Justin said, except I'm a managing senior and I run the Bellevue office in Washington.

• 10:04Speaker 00

  I know they said it quickly, but the important part here is that they're both penetration testers.

• 10:09Speaker 03

  Been at Coal Fire for six years and I've probably been in the military another three. So I've got about nine years of experience on physical pen testing.

• 10:17Speaker 02

  Right. And I've been with Coal Fire for over four years, so physical penetration testing for over four years.

• 10:22Speaker 00

  And they've come here today to share some penetration testing stories with us. Now, even though these two live on opposite corners of the US, one Florida, one Washington state, they team up together on assignments all over the US. And the assignment is typically like this. A company will call up Coal Fire, the company that Justin and Gary work for, and ask for a security assessment. And they might want someone to test their website to see if it's secure, or do a password assessment to see how strong the user's passwords in the network are, or conduct some compliance checks. And this is all to make the company more secure. The Iowa Judicial Branch is the State Department of Iowa. It's a government facility.

• 11:03Speaker 00

  And specifically, they handle the court cases and such within the state of Iowa. So it was the Iowa Judicial Branch that called up Coal Fire and asked the company to come and do a penetration test on the courthouses themselves.

• 11:18Speaker 02

  It was full scope, red scene penetration test. So it included things like external pen testing, web application testing, internal testing, which was to be done after we'd gone onsite to see if we could gain access into their internal network. And they kind of like do like a real life scenario, like, can you gain access to our facilities? Can you plug in a, what we call a drone, a remote device to be able to access that network later once we're offsite? And then conduct the internal network penetration test from there. And throughout the whole time, we're contacting with the guys at IowaCourts.gov.

• 11:50Speaker 00

  Justin and Gary get assigned to conduct the physical penetration test on the courthouses together. They've been working together for four years on doing physical penetration tests just like this. So they're used to each other and do good work together. And actually, I have a copy of the rules of engagement here in front of me. So let's see. Okay, yeah. So this is for the Iowa Judicial Branch, and they're specifically asking for a physical penetration test at five locations. There's a judicial branch, the Polk County Courthouse, the Dallas County Courthouse, a juvenile justice center, and the criminal court area. Five locations, and the window to test the security on these buildings is between Sunday, September 8th and Friday, September 13th. So they had a week to do this assessment,

• 12:33Speaker 00

  and this was last year in 2019. The rules of engagement list out a ton of things. Do they have permission to tailgate behind someone to get in? Yes. Do they have permission to dig in the dumpsters? Yes. Does Coal Fire have permission to use lockpicks to get in? Yes. Does Coal Fire have permission to plug USB drives into computers that they get access to? Yes. Does Coal Fire have permission to disable alarms? No. And the goal here, it looks like they're trying to get into the building, plant rogue devices, look around to see if there's any security problems, like unlocked computers, passwords written down, that kind of thing. So, okay, the rules of engagement seem pretty clear.

• 13:10Speaker 02

  So that gets filled out before we're on the call. And then as we're going through that with the client, the project manager is taking notes in there. So you may see things like, okay, at the JB building, we discussed with the client, floors three and four are specifically off limits during daytime hours because there was going to be the Supreme Court convening, and they obviously didn't want us interrupting that. So part of that, we're discussing with the client on the phone, yeah, during the daytime, do not touch, do not go on floors three and four. And then we enumerated with them, we're like, okay, well, like, what if we're in there after hours? Like, what do you want to see from there? Is that open access? And like, uh, yeah, that'd be more acceptable, but you know what? Let's, let's play it safe and just show us to see if you can breach the, the doors that enter on that floor. So the contract will say something like, okay, JB building,

• 13:54Speaker 02

  floors three and four are off limits. And like, you see how big those fields are in that table. So it's, it's really like the bare information that the project manager wants in there. And we have a good understanding with the client of what they're actually looking for.

• 14:08Speaker 00

  So actually, this rules of engagement document I'm looking at is 28 pages long. And this field he's talking about is super small. All these things you cover on the call in great detail only get jotted down with a couple words. It's not fully documented in the scope of work or rules of engagement.

• 14:25Speaker 03

  And these conversations are so granular. If we were to take and actually take the conversation that we had on the phone and write it out and put it in a contract, the contract would be

• 14:36Speaker 02

  There's

• 14:37Speaker 03

  100 pages long. The amount of, the amount of discussion that we have on what it is exactly they want us to do, it would, it would be unfeasible as far as a rules of engagement would be concerned.

• 14:50Speaker 02

  Right.

• 14:50Speaker 03

  And so, again, that's why we have phone call. That's exactly why we have. So we can say, this is what we understand, what exactly you guys want. And then we're all on the same page when we show up.

• 15:00Speaker 02

  But like, we're going to be there at night. And the client was like, yes, we want you to focus on after hours testing. So a lot of that stuff, unfortunately, which we never would have predicted or seen, seen coming at us, we didn't capture in that document, which would have been great if we did, but.

• 15:15Speaker 00

  The Iowa Judicial Branch has actually worked with Coal Fire before to do other penetration tests. So everyone seems to agree on what should be conducted and what's expected here. And an agreement was made. And they create what's called a get out of jail free card. This is a slip of paper that lists all the people who hired Coal Fire to do this penetration test. This is their information security officer, their chief information officer, and the infrastructure manager. These are three people who worked in Iowa's Judicial Branch, who contracted Coal Fire to do these tests. And this get out of jail free card has their names and phone numbers listed with their signatures. So if these guys get caught, they can ultimately show this to get out of any real trouble.

• 15:59Speaker 02

  We touched down Sunday night. We were, we entered in a facility. So I don't want to provide too many details that hadn't been already disclosed.

• 16:07Speaker 00

  All right, fine. Unfortunately, we're not going to be able to go into every detail of what happened because I don't want to expose any actual vulnerabilities over there at the Iowa County courthouses. But let me give you an idea of what they're capable of. First of all, these guys mentioned that they sometimes use an under the door tool. So let me tell you what this tool does. It almost looks like a bent fishing rod. It's long, four feet, metal rod, and it has a string on the end. And this is for doors that have a handle that when you push down, it opens a door. So you try to slide this tool under the door, and then you pull it up using that string to get it close to the handle. You try to hook it onto the handle from on the other side of the door.

• 16:49Speaker 00

  And when you do get it hooked on there, you pull down with both the string and the rod, and it pulls the handle down and it opens the door. It's actually pretty simple. And on top of this, Gary is also really good at lockpicking. So he'll certainly have these in his pockets and ready to use them whenever he needs to. But with lockpicking, it might take you a while, maybe 10 minutes, maybe 30 minutes to get a lock open. So it just takes more skill and time.

• 17:16Speaker 03

  If you're talking about my favorite, because I find this a lot in commercial buildings, is going to be crash bar doors, right? Either the ones that come down like the old high school gym type doors, or the ones that you just push and go into the door itself.

• 17:32Speaker 02

  A Von DePret.

• 17:33Speaker 03

  Thank you. They'll have, they'll have the latch on the inside of the door. So you can't really use an under the door tool. They make some tools if you have doors, double doors that come together without the, what's it called in the middle there?

• 17:46Speaker 02

  The mullion.

• 17:48Speaker 03

  The mullion, is that what it is?

• 17:49Speaker 02

  Yeah, there's another term for it too. But there's an, there's a bar that runs in between the doors where you're not supposed to be able to insert tools. So.

• 17:55Speaker 03

  So you'll, you'll see a lot of those doors that don't have that bar that separates the doors. Those are really easy to get into. You just, you stick a tool inside, you turn it to the left or the right, and then you pull and it opens the door. What we've come up with that, that we like to use, that's absolutely my favorite tool that is literally in my backpack right now, is a cutting board. It's a really, really thin plastic cutting board that I bought from Amazon. And I, I cut a notch in this, in this cutting board. And so for crash bar doors, especially the single ones where you can't see anything, you stick it through the, the door, on the edge of the door. And then, and once you, you feed it through the door, you pull it down until that cutting board rests on top of the latch. And then you'll, you'll apply pressure down on that latch, and you start pulling the cutting board

• 18:40Speaker 03

  toward you outward from the door until that notch that you cut falls on top of the latch. So now what you've got is you've got the back half of that cutting board on the other side of the latch, on the inside of the door, and you pull. And if that latch doesn't have the dead latch, latching it properly, you will open the door every time.

• 19:01Speaker 02

  So typically, when we're talking about door bypasses, we're inserting a tool through whatever method that we can, whether it's in the interleaving double door system. So you can go in between the doors. Or if there's a gap underneath the door, insert a tool there and start manipulating some mechanisms on the other side of the door, whether that's the Von De Prin crash bar or the latching mechanism itself, or some peripherals like a requested exit sensor.

• 19:25Speaker 03

  But I can, what, 80%? If you had to put a number on it, 80% of doors can be bypassed by bypassing the latch.

• 19:33Speaker 02

  Right.

• 19:34Speaker 03

  Just manipulating the latch itself, you can get into 80% of facilities.

• 19:38Speaker 00

  And just coincidentally, can you tell us where you guys are or what you guys are doing this week?

• 19:43Speaker 02

  This week, we're doing three two-day courses comprised of physical access control systems, alarm bypass techniques, and then safe manipulation. So really kind of an action-packed week for us. That's all the kind of juicy James Bond-style stuff.

• 19:57Speaker 00

  So you can imagine what kind of bag of tools these guys have to break into buildings, to carry out assessments like this, right? I mean, they've got so many things. I'm surprised the TSA even allowed them on the plane. So even though they can't get into specifics about what tricks they use to bypass the doors of these buildings, you can take a pretty good guess that they've got many options they can use to get into each door that they've run into.

• 20:19Speaker 02

  So it's pretty much we walked up, assessed the perimeter and like kind of matched up with what we were seeing on Google Maps, things like that, and gained entry to that first facility on Sunday nights, Monday morning.

• 20:30Speaker 03

  When we get into a place, it depends on, it also depends on who is attacking, right? So if Justin is attacking, for instance, and he gets into the door and he's able to get in really, really quick, there's a certain like, you know, like he's your teammate. So you're proud, you're like, wow, dude, that was really fast. Like, that was really, really fast. Justin and I have been working together since he's been here. So you get to see this progression of somebody when he's on his first red team or second red team, I think it was, you know, with the guy. And then when he's on his, you know, 15th red team and you're like, dude, you're getting really, really, really good. But you're going to see that progression. So there's, it's a lot more personal, if you will, when you're, when you're on a red team with somebody that you've been working with for years and years and years.

• 21:13Speaker 02

  I was gonna say, I'm tearing up over here because Gary, honestly, like I do need to take a moment to thank him. Like Tommy so much of what I know. Like, yeah, of course, like Deviant and like some huge stars in the industry that you can learn so much by watching YouTube and like learn how to assess security of your facilities. But Gary was like the first guy who handed me the under-the-door tool and taught me how to use this one. I didn't even know which end of the stick to be holding on to, which is a very common thing when people are giving him the under-the-door tool.

• 21:38Speaker 00

  So they get in, they look around for ways to plug in a drone and to take any photos of security problems that they want to put in their report. They even found the desk of the person who hired them for this engagement. So they leave a little present on his desk to prove that they got in overnight and got access to his desk.

• 21:56Speaker 02

  But we had gained access and we left a calling card. I just left the business card on where the point of contact desk. To the point where the next day, he had emailed me and said, I guess I do congratulations. And we're going back and forth over email. I'm like, yeah, I mean, we found some really severe vulnerabilities that, you know, minor fixes that you guys can use to dramatically improve the security of this facility. So going back and forth through things like that. So already in contact with the client, going through things like that. And then, yeah, Tuesday rolls around.

• 22:27Speaker 00

  So it's Tuesday night. After the courthouse has closed for the day, they get up to the building and see it has two sets of locked doors to get into.

• 22:36Speaker 03

  We make it to the first door really easy. And then the second door, we could have used the same attack, but we were trying other things.

• 22:42Speaker 02

  Right.

• 22:43Speaker 03

  And we weren't having a lot of luck with the other things, but we didn't really want to try the first attack because we wanted to see if we could use different techniques to get in, right? We found other areas that we could attack. So we went around a different area and we were working on, Justin was working on one door and I was working on another. I don't know, did you ever get that door open?

• 23:00Speaker 02

  Pick the lock and like all sorts of, yeah, like each way. And like, no, something else was going on. There's a secondary latching.

• 23:07Speaker 03

  That we couldn't see or something.

• 23:10Speaker 03

  I ended up picking two doors in a row to a courtroom. And then we ended up making it, making in. And then we ended up, we ended up getting in. We saw the security, the security, uh, security cameras.

• 23:24Speaker 00

  Now, when they say they found the security cameras, what they mean is they found the room that you can sit in to watch all the security cameras and what's going on in the whole building.

• 23:33Speaker 03

  Guard desk. It wasn't really a room. It's just they had security cameras at the guard desk, which was right, which was actually the sheriff's desk during the day that sits there. So they've got a sheriff that, or a deputy sheriff.

• 23:45Speaker 02

  Right.

• 23:45Speaker 03

  That monitor that's there on duty for the courthouse that sits in this, uh, it's almost like a.

• 23:52Speaker 02

  Eh, front desk.

• 23:53Speaker 03

  Yeah, like front desk type thing. Where a receptionist would sit in a company. So the deputy sheriff sits there. They has access to all these different cameras which show the courtrooms or office areas. And so at night, when you've got your security guard there who isn't a deputy sheriff, they will also use those same cameras that the deputy sheriff, at least it's, to check the different offices to make sure that nobody's in there, the lights aren't on and stuff.

• 24:17Speaker 00

  So one of the first things they do is look at all the cameras to see if anyone was there. And they did, in fact, see someone in the building. Somebody was making their rounds, checking on the place. It looked like a security guard. They made sure to keep a close eye on him while sneaking around this building. And at the same time, they took careful notes on what blind spots there were with the security cameras. So when the guard got back, they could stay in those blind spots. As the guard went to a far end of the building, they started exploring around, looking for security problems and being careful to stay very quiet. And as the two of them wandered around this courthouse, they opened a door which tripped an alarm. Suddenly, the doors were buzzing and the alarms were sounding.

• 25:03Speaker 03

  What had happened is they have, they basically have a holding room next to the courtroom and both doors lock in that room. So whether or not that is for criminals that are in to see if they can get released from jail or if it's for somebody that's accused of a crime, whatever, not sure what it's for, but both doors are locked. So because I didn't want to have to pick the door on the way, on the way out, in case it locked behind me, I propped it open. And because of the, again, an assumption, because of the people that are carried there, they make sure that if that door is left open, that an alarm sounds. So when I made it through both doors and I went to the next room, which had the guard post in it, that's when I heard the alarm. And then we ended up figuring out, oh, it's because we brought the doors open. Let's close that duck.

• 25:45Speaker 00

  They were able to complete their security assessment and get out of there. The guard never found them and maybe didn't even hear that alarm at all. But another successful mission for these two.

• 25:55Speaker 03

  But that was fun.

• 25:56Speaker 02

  That was great, man.

• 25:57Speaker 03

  We were, we were pooping and snooping and we were dodging the security guards. And he was looking at the cameras and we were hiding up and stuff. And that was good stuff.

• 26:05Speaker 00

  They got through the courthouse pretty quick and the night was still young. So they decided to hit up a second courthouse that night. This one was actually the Dallas County Courthouse in Adele, Iowa. Let me describe the scene to you. The town of Adele is small. It has like 5,000 people living there at most. It's cute, though. It has like a historic Main Street, USA type of feel to it. In their downtown area, the roads are covered in like a red cobblestone brick, which gives it a more rustic feel. And all the buildings downtown look like they could all be historic buildings. And the most prominent building in all of Adele is the Dallas County Courthouse, their target. And it was built in 1902, which absolutely makes it historic. Three stories with those pointy spires on the top of each corner.

• 26:50Speaker 00

  And there's a large clock tower on top with a beautiful rotunda towering way up high over the whole town. This is their target. To get into that historic courthouse in this sleepy little town in the middle of nowhere. So the two head on over to the courthouse.

• 27:08Speaker 03

  Well, we stopped and got the bomb burrito at the gas station.

• 27:11Speaker 02

  That is important.

• 27:11Speaker 00

  Yeah, that does come up.

• 27:13Speaker 03

  We did have a snack. It's physically. We did have our snack. We took like a 30-minute break and just hung out at the gas station talking to the clerk that was there.

• 27:23Speaker 02

  He has free donuts.

• 27:24Speaker 03

  Yeah, he did have free donuts. Said, throw them out. He just gave us some free donuts. Yeah, so we had our break, which was literally, I mean, the gas station was across the street. Just, yeah, just like almost across the street from the courthouse. So we sat there for 30 minutes. We kind of, you know, scoped the place out just to make sure that they, they didn't have some sort of patrol or something, you know, city cops or deputy sheriffs that were controlling the courthouse. So we, uh, we parked at, at the courthouse.

• 27:50Speaker 02

  Oh, yeah.

• 27:51Speaker 03

  And we, I, again, we've got to get out of jail free card. And every other time, like, we don't have to be ultra sneaky typically in situations like this where they just want to see if Joe Public can get in the building, right? We, we don't have to be super sneaky. So this is one of those instances that if you look at the contract that we have, it specifically stated we were not allowed to bypass the alarm on this building. They did not want us to bypass the alarm. In the conversation we had on the phone, hey, guys, don't circumvent the alarm. Don't bypass it, just.

• 28:23Speaker 02

  Right. Don't degrade our security. Like, don't disable a sensor. Bet anybody could go up, bypass the storing and entry without alarm going off. Like, so that's a pretty common theme with a lot of our clients. Like, we're not trying to degrade the security of their facility so we can gain access because it also allows potential for, for other threat actors to, to gain access covertly or without setting off alarms.

• 28:44Speaker 03

  Right. So in this instance, we walked up to the, the north door, I think it was.

• 28:52Speaker 02

  So we go up to this courthouse. We, we jiggle the door. Like, there's a real little technique that you just see to like, if latch doesn't engage and pop, pop the door real quick. And much to my surprise, the door was open.

• 29:06Speaker 00

  At this point, it's like midnight. Why in the heck is the front door open on this historic courthouse with all the lights off inside? Freaky, for sure. But Justin thought, someone must have tried to close it at night and it just didn't shut all the way. Now, this courthouse has an alarm system because it's a historic courthouse building. So yeah, it should, right?

• 29:30Speaker 03

  When he opened the door, the alarm did not go off. So our, our assumption was there was a fault setting in this alarm system, the front door. They armed it anyway. Again, this is our, our professional guess of what happened.

• 29:45Speaker 03

  They armed it anyway, even with that fault or they armed it, it counts down. They go out and they didn't close the door all the way. And then it armed anyway without that front door being fully closed. So when Justin grabbed that front door, he opened it, what, two or three inches? And the alarm didn't go off. And then I tried the back, get clone from another building just to see if they had multi-building access. That didn't work. And it's kind of like, well, should we give it the benefit of the doubt? Or should we just use this? And so we elected to basically close the front door and say, okay, well, let's start over.

• 30:24Speaker 00

  So they both stepped back outside. This time they closed the door all the way. It latches shut. This must have been a fluke for the door to be accidentally left open or something. So they wanted to break in properly. Now, the door is locked and sealed properly. Okay. So they begin again. These two being masters at getting into these doors. They have no trouble getting the door back open. Now, as they get this door open, they immediately hear the alarm is beeping.

• 30:53Speaker 03

  Right, just like in your, your home security system where you walk through the door and it starts beeping to let you know that you've got X amount of seconds to put in your code. Uh, but the alarm goes off, so it was beeping really loud.

• 31:04Speaker 02

  Yeah, and we already had an idea before that. We kind of expected that alarm to go off. So just again, a little bit of a precursor to that. The other locations, nobody had showed up, nobody responded. We've been gaining access to government facilities without any alarms going off, without central dispatch showing up, without police presence showing up. So at this location, we're kind of coming up here and we've been there throughout the day. And we had seen like the alarm panel said, okay, disabled. That night it said, okay, armed. So we would expect it to go off. We're going, coming up to this facility, hoping for once, this final facility, the alarm would go off at this location. So it was always like, you know, bittersweet, but like, good. Okay, great. The alarm's going, like it's beeping at least, once we, once we go in there.

• 31:47Speaker 03

  At least it's armed.

• 31:48Speaker 02

  Right? Um, so, so eventually the alarm counts down. Um, and then it, it starts sounding. So very audible at this point. The entire downtown of Adele is going off and you can hear the sounders going off.

• 32:03Speaker 00

  The sleepy town of Adele is now being woken by these alarms coming from their precious, historic, iconic courthouse building in the middle of town.

• 32:13Speaker 02

  So, so at, at that point, alarms are blaring throughout downtown. We decide to go up to the third floor. Um, so we're, we're very well aware at that point, it's very audible that the alarms have been activated. They've been tripped. At this point, we go up to the third floor, get a vantage point and hoping that police presence responds to, to the incident, to the alarm going off. Cause it's not uncommon. I've, um, been in banks in the past, literally a hundred feet from a police station where they, you know, were not paying for the service or it wasn't connected or configured properly, where it didn't dial out and, and call police to respond to the incident. So, so yeah, so, so it's not terribly uncommon for that to happen. So we go out to the third floor, get a vantage point.

• 32:53Speaker 02

  And at this point, for reporting purposes, um, hoping that police, uh, respond to, to the alarms going off. At which point, you know, within, it was extremely response time, within five minutes. Um, I think it was a sheriff's deputy had showed up to the scene and we, we see him and he's going around the building. Gary and I are conversing with each other. Okay, man, what's, what's the next plan? What are we doing here? Like there are police, like it's a very, um, not a high stress situation, but you have to handle it professionally and properly. Otherwise there, there always is risk in those types of situations. So we're discussing our game plan, what we want to do. Um, with, within a short while, another couple of minutes, we go out on the main floor and Gary's calling out commands. He's like, is there an officer in the building? Being very verbal, um, trying, trying to get in communication with police.

• 33:38Speaker 02

  Um, at, at that point, it didn't sound like anybody else was in the building. We didn't hear any doors opening or closing. So we start proceeding downstairs.

• 33:46Speaker 00

  As they go downstairs, they don't see anyone in the building. They don't hear anyone in the building, but they can tell there's a police officer right outside the door they came in on. They spot each other and Justin and Gary come to the door.

• 33:59Speaker 02

  The officer, he's on the other side of the door. He was actually, we found out afterwards, was not able to gain access inside the building. Uh, so we're communicating with him. He's like, so, so what's up fellas? And we're like, hey man, like we're, we're here testing the security. Um, do you, do you want to talk? Like, can I, can I open this door? Like just keeping my hands static, not moving anything. He's like, yep, go ahead, open the door. I'm like, okay, I'm, I'm going to open up the door now. And so push the crash bar, we walk outside and we greet him. Um, at that point, just start conversing with them. Officer, we're here, we were hired by, um, Iowa State Courts. We're assessing, uh, security of, uh, various government facilities, including this courthouse. We have documentation, this is all above ground. Would you like to see our paperwork? He responds, yes. Say, okay, it's, it's in my back, back pocket. Do you mind if I make a move and, and, and pull that out of my pocket?

• 34:44Speaker 02

  Sure, go ahead. And then at that point, present our paperwork. Um, so from there, he asked for our IDs. Um, and, and at that point, I think somebody else had shown up right at that point. So they, they were escorting us, they had hunkered down with us while somebody else had taken the IDs and the paperwork away and started verifying our information.

• 35:01Speaker 03

  Yeah. And, and at some point, I think the sergeant even told us to relax. Cause we were, we were trying to be ultra careful and professional. And every time we wanted to move our hands, we're like, hey, is it all right? You, we okay to get our wallets? And at some point he's like, hey man, you guys can relax. We just want to verify that you're, you're doing what you should be doing. You know, you guys can, you guys can, you, you don't, you don't have to be that paranoid. We, we, we are pretty sure that, you know, you're, you're not doing anything nefarious here. And, and they were ultra professional, like they, yeah, this guy sounds perfect. Uh, they were, they were nice, they were professional, like they were doing the whole, you know, Ronald Reagan, trust but verify type thing. Like, yeah, we're pretty sure you guys are on the up and up because you came out to us and, and you did what you were supposed to do, but we're just going to make sure we're going to verify that you are really supposed to be.

• 35:45Speaker 02

  Right.

• 35:45Speaker 03

  And so we, we can't, you know, if nothing else, we can't thank the deputies enough because they were ultra professional and just really, really stand up.

• 35:55Speaker 02

  Agreed, yeah.

• 35:56Speaker 00

  They immediately give the police their get out of jail free card. You don't want to mess around and lie to the police. You want to come clean because this is not someone you want to try to trick. This is not part of the scope. You want to tell them, look, we're here on official business. The paper has the names and phone numbers of the state employees that hired Cold Fire to do this penetration test. The police call the first number, no answer. They call the second number, that line was disconnected. They called the third number, someone picks up. The police ask if they knew that these guys were trying to break in the courthouse. And they said.

• 36:34Speaker 02

  Yeah, we're doing security testing. Those guys supposed to be there, they're, they're testing the security of the courthouse. And this is, you know, my, my story of what happened, cause I'm not on that call there with them. They walked away a little bit from us.

• 36:43Speaker 03

  This is what the, the sergeant, the deputy sheriff, who was a sergeant, told us. He spoke to our contact. He's like, well, this is what your contact said.

• 36:53Speaker 02

  Um, so they, they run our credentials, you know, everything comes back here from our names, our driver's license. They do get ahold of our point of contact and they say, yes, these guys are here testing security. So at that point, um, the sergeant, the, the guy in charge, um, for, or head, head, head in charge.

• 37:07Speaker 03

  The ranking officer.

• 37:08Speaker 02

  Ranking officer, thank you. That's what I'm trying to get to. I come back to us, hand us back our IDs and he's like, guys, as far as I'm concerned, you guys should be good to go. Like everything's, everything's all clear here. Uh, so at that point, like things get really jovial. We're, we're laughing, joking around with the officers. They're asking us, man, this job's crazy. Like you guys break into buildings. Like how, how does this go? Like, how'd you get jobs like this? Like, how, how can we like test security? Like, you know, how do we get a job like that?

• 37:32Speaker 00

  Just as Gary and Justin were about to leave, another squad car pulls up. This one has sheriff written on the side. And the guy gets out and walks up.

• 37:45Speaker 03

  Uh, the, the sheriff shows up, he's visibly upset. Uh, from our perspective, the mood completely changed. So prior to him showing up, everybody was happy and smiling and we were, there had to be eight deputies that responded. All of us standing on the courthouse steps. And then there was one city, city of Adele officer there as well. So there was at least nine people there, including us.

• 38:11Speaker 02

  It's not a lot going on in Adele, Iowa.

• 38:13Speaker 03

  So when the sheriff shows up, all the smoking and joking stops, right? Like just giant fun sponge walks in the room and everybody just stops talking. Just everything just goes silent. And he walks up and he has some choice words to say to us that we didn't necessarily agree with. Kind of talking down to us in a certain.

• 38:36Speaker 02

  To put it back, to put mildly.

• 38:37Speaker 03

  To put it mildly. Um, and basically tells us that we don't have authorization to do what we're doing. And asks us if we do that. And then we told him our perspective, which was they were under contract, we're working for these people. Uh, his response to that was, well, they don't own this courthouse. And I don't care if you're under contract, they don't own this courthouse.

• 38:57Speaker 00

  Whoa, what? The state doesn't own the courthouse? Uh, did they get authorization from someone who didn't have authorization to break in the building? Uh, I would start to get worried at this point, but Gary wasn't worried at all.

• 39:14Speaker 03

  Not, you don't know, because this has never happened before in history, as far as we know, or any of the other people that we know in the industry, it's never happened. Uh, people get taken away or they get held and until situations resolve themselves. Not frequently, but it happens. So if that happened in this case, we were fine with that, you know? Cause we, we know this, the, the truth's going to come out. They're going to realize that we're actually working for a company and that we were really, uh, contracted by the state. So, you know, worst case scenario, we got to spend an hour or two in a holding cell, not that big a deal.

• 39:50Speaker 03

  The sheriff tells everybody that was there says, well, we're going to arrest these guys for trespassing, hold them, I'm going to go make a phone call. And so in our minds, he's going to go talk to our contacts, at least in my mind, that's what he was doing. And in that time that he was gone, because he was gone for like a good 10 minutes, it felt like.

• 40:10Speaker 02

  Yeah, it seemed like it, yeah, sure.

• 40:12Speaker 03

  And that time he was gone, the mood went right back to what it was before he was there, which was everybody was asking us questions, asking us how we did stuff, what's the craziest thing we've ever seen or heard about in our line of work. Like, it went right back to that. One of the officers was super interested in how we got in, so we showed him our tools, we showed him how we got in, we showed him the technique that we use. We troubleshoot how we think that front door got left open, they gave us their ideas, we talked about card entry, on why they originally couldn't get into the building, and it was, everything was, just went back to normal. About 10 minutes later, again, we're thinking, he came back in and he was just like, you need to arrest these guys for burglary. And all the sheriff or sheriff's deputies kind of just looked at each other.

• 40:57Speaker 03

  And the sheriff turned around and said, do I need to do it myself? Or something to that effect. I don't remember his exact words, but he said something like, do I need to do it myself? I told you guys to arrest them for burglary. And I don't, I don't know what Justin's, what, like, who the sheriff or the deputy sheriff was arresting Justin, but he puts his hand on my shoulder and says, hey, man, I'm really sorry about this, you're gonna, you're gonna...

• 41:19Speaker 02

  I think something varies.

• 41:20Speaker 03

  Yeah, so he goes, turn around, I'm gonna have to put these cuffs on, and he's like, essentially, understandably, okay, man, like, I get it, like, see where you're coming. And both the responses were like, hey, man, it's okay, you're just doing your job. It's not a big deal. This won't be the last time this happens.

• 41:33Speaker 00

  And so both of them get handcuffed. They had their rights read to them, and the police started escorting them away. But still, even though they now have handcuffs on, and the police are escorting them, they still weren't nervous about the situation.

• 41:47Speaker 02

  No. I mean, because, think about it from our perspective, like, we had done nothing wrong. We have all the paper, all the paperwork in the world, like, I'm from Florida, Gary's from Seattle, it's not like we flew out to Adele, Iowa, to start breaking into courthouses on our own behalf. Like, we knew we had every shred of evidence in our favor, we knew that this is totally above ground. It's, it's not totally uncommon for law enforcement to respond to an incident, it does happen. It is extremely rare, I'd say, for somebody to get detained or furthermore arrested. And that's as far as it had ever gone. And as far as we're aware, nobody's ever been actually formally arrested and pressed with troops.

• 42:26Speaker 03

  So has ever been actually charged.

• 42:27Speaker 02

  Right. So, I mean, we're thinking, okay, we're gonna go to this, down to the station, we'll perk this out, not a big deal.

• 42:33Speaker 00

  Now, because this is Adele, a small town, the jailhouse was literally across the street from the courthouse. So they both get walked to the jailhouse with handcuffs on. Stay tuned, because when we come back from the break, we'll hear what happens to Gary and Justin.

• 42:51Speaker 00

  This episode is brought to you by Cinch. Two F A, verification codes, fraud alerts. They're all vital tools that businesses use to validate who we are. But who makes it all happen? Cinch. Cinch is one of those businesses that you just don't know about until you know about it. They power messaging, voice, and email infrastructure for over 200,000 businesses worldwide. Over a trillion interactions pass through their hands each year, and fraud prevention is built into the network itself. So those calls to verify, is this really you? Before you do a big transaction? That's Cinch, making sure that you're not exposed to the kinds of attacks that I cover in this show. The technical complexity required to deliver these messages at scale across 100 different carriers and countries is why Cinch is at the heart of the communication infrastructure the AI era is running on.

• 43:36Speaker 00

  So the next time a message just works, there's a good chance it's powered by Cinch. Learn more at cinch.com, that's spelled S-I-N-C-H, cinch.com.

• 43:50Speaker 00

  Gary and Justin are now both at the jailhouse, and they have been separated, and the police are questioning them and processing them separately.

• 43:58Speaker 03

  And that's when the aggravation started to kick in a little bit. Because we were going through the entire process, which is, empty out all your pockets, give us all your gear, give us your backpacks. I don't know if you ever did, but I interacted with the sheriff a couple of times.

• 44:16Speaker 02

  I know, I never talked to the sheriff.

• 44:17Speaker 03

  Yeah, so I interacted with the sheriff a couple of times. And, and it was like, hey, sheriff, are you just gonna hold us? Or are you actually gonna charge us? And it was later discussed, or during that conversation, that I won't really go into, because it'll just aggravate me, was, yes, we're going to charge you. There was multiple times I tried to, I don't want to say talk my way out of it.

• 44:40Speaker 02

  Escalate.

• 44:41Speaker 03

  Right? Yeah, but yeah, that's a better term. Escalate the situation, like, hey, maybe, maybe you could contact one of our, you know, one of our contacts, talk to somebody at Iowa State Court, you know, talk to somebody, because we're legitimately just working here, sir, like, like, and, and we were ultra polite. There's multiple videos out there that show that I don't think we were ever unprofessional. We were just like, hey, sir, you know, could you possibly do this, or check with this person, or maybe this is a big misunderstanding? And it was always met with, nope, you're going to jail, and nope, you're getting arrested.

• 45:15Speaker 02

  I mean, at some point along that process, it became very clear that regardless of any amount of paperwork that we would have had on us, or anything that we could have said, there was something else going on. It wasn't about that. We had the paperwork, he had, like, the deputy has already verified, cleared, identified us, let us go, essentially. So despite all that, there were, there was something else going on that regardless of what we could have said, done, or shown, there was, there was no getting out of an arrest at that point. Like, we're both being very professional throughout the entire process. But I'm a very big privacy advocate, and as we're going through this, they're asking, what's your marital status? What's your highest level of education? And I'm very understanding at this point, we're being wrongfully arrested because we're

• 45:59Speaker 02

  here for a job, this is something that needs to be trucked through a criminal process. At most, if there's contract discrepancies, or issues with the state first county level, this is something that gets handled in a civil courtroom. So at that point, I didn't want to provide my social security number, so it's not like we're resisting arrest or anything like that, but we're unwilling to give up a lot of personal details at that point. Which a lot of people in the, in the, in the booking reception room, however you want to call it, got very upset with that. So, so we get, you know, we have to give up all of, all of our tools, all of our gear, we go through the process explaining what these tools are, because we're being booked not only for burglary, but possession of burglary tools. So they want to have substantial evidence of us having tools that are used typically

• 46:42Speaker 02

  in burglary trade, obviously, in a security setting at this point.

• 46:46Speaker 00

  They finally get to make some phone calls, but at this point, it's like 2:00 AM.

• 46:49Speaker 03

  I had about 30. But unfortunately, everybody was sleeping and no one would answer my call. Even my wife slept through all of the phone calls that I sent, all sorts of messages to people. The only person I was able to actually get ahold of was one of our contacts. And I said, hey, are you aware that we're, where you got arrested? Yeah, yeah, we're aware, such and such told me. Are you doing anything to get us out? And he said, he said, well, yeah, we're gonna be there first thing in the morning, we're gonna talk to X, Y, and Z, I don't remember who said, we're gonna talk to, and we're gonna, we're gonna smooth this all over, it's one big misunderstanding, you know, you'd think that, and I believe, almost verbatim, this thing was, you think that the sheriff would be a little more understanding of what we're trying to do? And I said, well, guess what? He's not.

• 47:34Speaker 03

  And he said, yeah, I can see that, again, we'll be there first thing in the morning, we're gonna hammer this out. There was a lot more to that conversation, but that's the gist of it.

• 47:42Speaker 00

  Now, for me, my first call would have been to my boss. I would have called coal fire right away and told them, hey, get some lawyers, we're in jail, we need help right now. Because they're operating in capacity of coal fire, so coal fire should be capable of helping them out.

• 47:57Speaker 03

  Yeah, and we tried to get ahold of coal fire, we just couldn't get ahold of anybody just because of the late hour. And I think most people, when they sleep, they put their car, you know, they, they put their phone on vibrate, because, again, we're talking about a scenario that has never happened before. So, maybe you want to say some complacency, whatever you want to put in there, who knows what it was, but most people were like, okay, you know, 2:00 or 3:00 in the morning, not really, nothing of the deal. You know, what's the worst that could happen? Well, we figured out what the worst that could happen was...

• 48:26Speaker 00

  By 2:30 AM, the police finish processing them and give them both orange jumpsuits to change into, the kind you see prisoners wear. And the police took all their belongings, even their shoes. Gary got a pair of Crocs, Justin got some sandals that were too small, and they were put in a cell for the night with other criminals and cellmates. They tried to lay down and sleep, but the beds were really hard and cold, so they didn't get much sleep that night.

• 49:02Speaker 00

  The next day, they had an appointment to see the judge in the very courthouse they broke into. So the officers escort them to the courthouse.

• 49:10Speaker 03

  When we walked over there in the morning, although it was incredibly uncomfortable and embarrassing that we were over there, literally shackles around, you know, the whole around your wrists and then tied around your waist and then the chain that goes from your wrists through your waist, all the way to your ankles. And then you're attached to the guy in front of you, you know, and you do the, you do the, what is it, railroad gay or whatever across the street with deputies in front of you and back of you. And I was like, you gotta be kidding me. We get over there and, and the whole time I'm thinking, we just gotta make it to nine in the morning. The state's gonna be here. They're gonna explain everything. And then the judge is gonna be like, this is silly. Like, why are you guys, go ahead, show on your own recognizance, you can go home.

• 49:54Speaker 00

  So they get to the courthouse, they sit down in the courtroom and await their names to be called by the judge. And it boggles my mind still that this is the very courthouse that they broke into last night. And now they're sitting in the courthouse waiting to see the judge.

• 50:09Speaker 03

  I was first.

• 50:10Speaker 02

  Yes.

• 50:11Speaker 03

  And there was, there was a gentleman that was sitting next to the sheriff. The sheriff was in the gallantry, I guess you could say. And there was only one man standing next to him. And so my thought was, good, that is the court representative from the state court, right? He's talking to the sheriff. They've talked about this. They realize this is just a big misunderstanding. Everything's gonna be good. They're gonna let us go, is what's still playing in my mind. I sit there, I go in front of the judge and they ask your name and say, what's your name? Ma'am, my name's Gary DiMccarrio. You know, how much money you make? I make X amount of money. Who do you work for? I work for a company called Coal Fire. And so at that point, they decide whether or not you can qualify for

• 50:49Speaker 02

  The York.

• 50:49Speaker 03

  Defenders, right? Public defenders. She says, you do not qualify for a public defender. You know, would you like to defend yourself or would you rather get outside counsel? I'm like, I'm like, well, I'm hoping outside counsel isn't necessary because ma'am, I believe this is just a big misunderstanding. So I launch into my reason why I think this is a misunderstanding. I explained to her what it is that we do, what we were doing that night, who we work for. And she looks at me and she says, you must think I'm stupid.

• 51:18Speaker 03

  And at that point, I'm like, oh, Lord, you've gotta be kidding me. This is not happening. And she launches into this, I don't know, diatribe, like, just like, I'm the biggest idiot that she has ever seen step in front of her in her entire life. Like, that is not the way that things happen. She is a state employee. She works for the state. If the state was doing this, she would know about it. And this is not the way that things happen at the state, et cetera, et cetera, et cetera. And I, I just went from being hopeful to just seeing red. I was just irate.

• 51:55Speaker 00

  Keep in mind that both Gary and Justin barely slept the night before. And they're in these orange jumpsuits with shackles on. They aren't presenting themselves as best they could, given the situation. But when the judge said this to Gary, he couldn't believe it. He stood there totally shocked. Tons of rebuttals are going through his head, but he wanted to be courteous. So all he could do is stand there and be quiet. But he was thinking things like,

• 52:19Speaker 03

  You are a judge. You're literally, the, the point of your position is to be able to look at someone and have some semblance of an idea, whether or not that person is telling the truth or not. And the only thing I can think of is, you've been dealing with people and liars for so long, you can no longer tell the difference between somebody who is innocent and telling the truth, wholeheartedly, and somebody who is a liar.

• 52:47Speaker 02

  Which obviously, he's not saying that to the judge, but that's going through

• 52:50Speaker 03

  No, yeah. Obviously what we're thinking.

• 52:53Speaker 00

  The judge charged him with burglary and possession of burglary tools, then went on to say, a bail is set for $5,000. Justin couldn't believe the judge was saying this either.

• 53:05Speaker 02

  Same, yeah. I'm like, like, as not the person on front stage, but obviously still in the same boat. I'm like, oh, no, there's no way. Like, this is like a bad joke. You gotta be kidding me. Not, not a chance in hell this is how this is going down. So I'm, I'm just kinda like sitting on, on the stand in awe. Like, my jaw is dropped to the floor looking, looking at the situation transpire in front of us.

• 53:27Speaker 03

  So there's still this gentleman sitting next to the sheriff. I'm like, okay. And I'm like, well, again, internal monologue, well, ha, Joe, you judge, this guy's from the state and he's gonna explain everything. So this guy walks up to me and says, excuse me, ma'am, I'm the county prosecutor and we think these guys are a flight risk. We would like to increase their bail. And I'm like, oh, Lord. Like, are you kidding me?

• 53:52Speaker 03

  I literally start looking around the courtroom, looking for somebody else. I'm like, where is our state representation? They told us they were going to be here. Where are they? They were nowhere to be found. They told us they were gonna show up. They ghosted us. 100% ghosted us.

• 54:10Speaker 00

  There was nobody there to defend Justin or Gary. The three contacts on their get out of jail free card did not come like they said they would. And this was just too soon for anyone from Coal Fire to be able to come down and help either. So they were just standing there, completely baffled and irate that this was happening.

• 54:29Speaker 02

  And I will say, at one point during this exchange, the judge is looking at Gary and she's like, you need to come up with a better story because nobody here is believing this. To which Gary retorts, well, you should talk to the sheriff because the deputies last night had verified us. Everyone believed us until we're here sitting in front of this courtroom. He looks over at the sheriff and the sheriff is just kinda like,

• 54:49Speaker 03

  Just, he just smiled and shrugged. He didn't say anything.

• 54:55Speaker 03

  Again, in our minds, we're like, don't you have some sort of ethical responsibility to say, actually, ma'am, we did verify with someone that worked for the state. However, we haven't fully confirmed that. Or something of that.

• 55:07Speaker 02

  Age, anything.

• 55:07Speaker 03

  Not a word.

• 55:08Speaker 02

  Nothing.

• 55:11Speaker 00

  What a frustrating situation. Yes, they broke into the courthouse, but they had 100% permission to do so by the information officer, the director and the head of infrastructure for the Iowa State Judicial Branch, the very state department that runs these courthouses.

• 55:26Speaker 03

  And then she read the address of where we broke in. And she realized that it was her courthouse in her courtroom. And she was mad.

• 55:33Speaker 02

  Irate.

• 55:34Speaker 03

  She was like, how dare you break into my courthouse and my courtroom at this address? And she just went off. And then she's like, bail is set for $50,000. And our bail originally was a $5,000.

• 55:46Speaker 02

  Ten, 10 times typical.

• 55:47Speaker 03

  Hailed for burglary.

• 55:49Speaker 02

  Yep.

• 55:51Speaker 00

  And that's just how much bail was set for Gary.

• 55:53Speaker 02

  So I, I go up shortly there. I mean, that's pretty much the end of the exchange. I go up and same deal. I don't believe this. I'm like, well, we were authorized by the state for this testing. Like, after seeing what Gary had gone through, I'm like, there's, there's no point. Like, don't, don't open your mouth and, and say something that could be potentially incriminating here. So I'm like, oh, okay. Like, we're, we're gonna, we're gonna do this, I suppose.

• 56:13Speaker 02

  Gary and I, again, trudge back across the street, back in our holding cells, where Gary has cellmates of a wide variety. But one says to him, he's like, man, I can't believe that. You went up there as professional as could be and she disrespected you.

• 56:32Speaker 03

  Yeah. Like, even the inmates just looked at us. So they were like, man, you guys are so innocent. Like, they, they didn't, they didn't even have to listen to our story. They're like, just the way you guys talk and the way you carry yourselves and the way you look. They're like, man, you don't look like you belong here. Like, what are you doing here?

• 56:48Speaker 00

  Justin's bail was also set for $50,000. So the way bail works in the US is that you can either sit in jail until your court case, or you can pay this amount to get out of jail and come back for court.

• 56:59Speaker 02

  At that point, we're facing felony charges. Like, we're facing felony burglary charges and felony possession of burglary tools. So we're, we're in a criminal trial at that point. So.

• 57:09Speaker 03

  And looking at seven years in prison as well.

• 57:12Speaker 02

  Right.

• 57:12Speaker 03

  Seven.

• 57:13Speaker 02

  Right.

• 57:14Speaker 00

  Still, they hoped any moment their point of contact would come and sort everything out. But the situation was becoming less hopeful. So Gary and Justin got some more phone calls and eventually got Coal Fire on the phone and tell them everything. And Coal Fire immediately started working to bail them out and to get help. And so about 20 hours after going to jail, the $100,000 in bail money came through and they were let go. At this point, it's Thursday and the return flight is on Saturday.

• 57:43Speaker 02

  Oh, yeah. Coal Fire gave us permission. They're like, do whatever it takes. Get, get out of that state. Like, come back home, boys. Oh, yeah, we booked earlier flights.

• 57:55Speaker 00

  Both Gary and Justin go back home and get lawyers to help them with this. Something had gone terribly wrong, but they still weren't sure what. Why was nobody listening to reason here? Why are they even being blamed for this? This should be a contract dispute, not fall on these two guys. Felony charges? The local news ran a story.

• 58:14Speaker 04

  Two men arrested for breaking into the Dallas County courthouse say they were hired to do it by the state. Justin Nguyen and Gary DiMurkrio are both now charged with third-degree burglary and possession of burglary tools. They were taken into custody around 12:30 Wednesday morning. As KCCI's Alex Schuman shows us now, the men say they were doing cybersecurity work.

• 58:38Speaker 05

  The state court administration says they did hire this company to test the security of their electronic records, but did not intend for them to physically break into the courthouse.

• 58:47Speaker 00

  Not many had yet heard what happened, but once they learned, people had plenty of opinion.

• 58:52Speaker 05

  They needed to be arrested. They're gonna try to break in. Period. Lock them up. They're way key, I don't care.

• 59:00Speaker 00

  Well, that bystander they interviewed, I guess, didn't like them for some reason. But you might have caught in this news clip where they said the judicial branch did not intend for these two to break in. Well, the next few months of this ordeal were painful and grueling for many people involved. The news reports I read said they interviewed the state judicial branch, who claimed that they didn't know a physical assessment was gonna happen. But then CoalFire outlined in the contract to show them that a physical assessment was approved. So then the state changed their mind and said, well, yeah, we knew that was happening, but this was happening outside the hours described in the contract. But then CoalFire said, we left a calling card on your desk overnight, and you emailed us saying, congratulations. Why didn't you tell us to stop then?

• 59:45Speaker 00

  The state went on to say, okay, sure, but we didn't know you were gonna break into courthouses. But yet again, CoalFire showed them the contract and showed them the exact locations of the addresses of each building intended to be tested, which included a few courthouses. Eventually, the state judicial branch ran out of fingers for pointing at CoalFire as the problem. But while that certainly fanned the flames of this problem, it wasn't the main fuel source. See, this was a county courthouse, and it was a state department that hired them. State and county are two different things. So the sheriff, judge, and county prosecutor were sticking with the story that the state had no authorization

• 1:00:29Speaker 00

  to conduct a physical penetration test on this building. This was the main crux of the issue. And if the county was not aware that this was going on, then they had to assume that Gary and Justin were actual criminals. If the state had no authorization to conduct these tests on this building, then it would be the same as if that gas station attendant across the street sort of paid them to go break in the building. So from the prosecutor's perspective, they thought these two guys were actual criminals.

• 1:00:58Speaker 03

  Well, here's the caveat. After all this was said and done and we were bailed out, the state ordered a third-party investigation into this scenario. There was a lawyer, well, a law firm, that performed the investigation. The final findings, which are public, the very end of those findings, that lawyer is looking at some sort of precedence, right? All laws based on a case before, right? That's where you get your legal precedents. Well, what was, in a similar scenario, what was the judgment? So because this has very little precedent associated with this, it's up for interpretation of the law.

• 1:01:39Speaker 03

  During this third-party investigation, that lawyer's interpretation of the law was the state had legal authority to authorize a test on county property because they are tenants of that property.

• 1:01:52Speaker 02

  It's their authority to protect that courthouse and administer security for it.

• 1:01:56Speaker 03

  Right, and the things within that courthouse.

• 1:02:00Speaker 00

  The prosecutors held their position. They started looking through the contracts to try to find anything that wasn't right. Justin and Gary both went back to work for CoalFire during all this, but they weren't able to really focus that well. I mean, for one, they had long talks with lawyers and going over tons of evidence and documents with them. And this is hard to find time to do when you're typically spending a week at a client's site doing a penetration test. And this news made its way around. So if Gary or Justin got on a call with a client to do a pen test, some clients wanted to hear the whole story about what happened in Iowa. And so it was just really distracting. And of course, they were arrested with felony charges. So like, some clients have sensitive buildings,

• 1:02:45Speaker 00

  and they do background checks on the penetration testers. But with felony charges, they weren't able to do these assignments. So they spent months battling this out with the prosecutors. And a lot of what I know about this story was through documents published by the Iowa State Courts. There was some great journalism work by Ars Technica, which got a lot of the documents and posted them publicly. And here is where I see the rules of engagements and the positions that the state took on various things and how they broke into different buildings. In fact, somebody even interviewed the Iowa senators to see what they had to say about this. Senator Amy Sinclair said, quote, "The hiring of an outside company to break into the courthouse in September created significant danger, not only to the contractors,

• 1:03:29Speaker 00

  but to local law enforcement and members of the public," end quote. And also Senator Zach Whiting had something to say. He said, quote, "Essentially, a branch of government has contracted with a company to commit crimes, and this is very troubling. I want to find out who needs to be held accountable for this and how we can do that," end quote. So eventually, when the third-party investigation was complete, which said that the state had jurisdiction to hire CoalFire to run these tests, and the state point of contact all approved that CoalFire was hired to do it, all this came together and was given to the county prosecutor.

• 1:04:02Speaker 02

  So all that comes to light, and eventually, I think it was a month after, the county had the opportunity to either drop charges or to continue pressing charges, at which point they decided, okay, felony charges aren't really relevant here, but we're gonna drop this down to misdemeanor trespassing charges, which I think they expected us to immediately say, yep, yep, we're guilty, we'll take that. Which, of course, from our perspective, we're legally hired for this job. Like, no chance in hell we're gonna plead guilty to misdemeanor trespassing charges, even though it's essentially a traffic ticket violation or something similar at that point. We weren't gonna go along with that, so we're still fighting that. And that fight took place over the next four months.

• 1:04:45Speaker 03

  All sorts of fights between our lawyer and the prosecutor.

• 1:04:48Speaker 02

  Oh, constant.

• 1:04:48Speaker 03

  To even get to the point where the prosecutor is like, okay, well, maybe we'll maybe we'll drop it down to criminal trespass. Our lawyer was like, look, man, in order for there to be burglary, they have to have criminal intent to commit a felony after entry. These guys were working. There is no way that you can prove criminal intent. And so they did everything in their power, like, well, if they dropped a keylogger on one of those systems, then we might be able to prove. I mean, they were grasping at straws to do anything and everything in their power to try to hopefully make that stick for some reason. And they knew at that point, they knew we were under contract.

• 1:05:31Speaker 03

  They knew that we were asked by the state to be in that courthouse. And they still were pushing for these felony charges. And these classy felony charges with seven years of prison time behind it for, I don't even, I still to this day have no idea why they kept pushing so hard for this stuff.

• 1:05:53Speaker 00

  Eventually, the Dallas County prosecutors in Iowa came to an understanding, and on January 30th, 2020, they dropped all charges against Gary and Justin. The case is now over, and they're free men once again. But what still lingers is their criminal record still shows that they were arrested for burglary and were given felony charges.

• 1:06:15Speaker 02

  So that's kind of like why we're so upset at this point. Like, we're gonna kick the rest of our lives. Like, we have felony arrest records. Like, even though charges are dismissed, like, everything's been dropped at this point, anytime we get pulled over, if we ever try to apply for a job in the future, security clearances, any number of things, volunteer work, it's gonna show we've been arrested on felony charges, so we've been stripped of rights with no due process on wrongful arrests.

• 1:06:41Speaker 00

  Yeah, it's a shame. Like, any traffic stops these guys get, when the police look up their record, it's gonna show that they were once arrested with felony charges. And anytime in the future where they're on a physical assessment and the cops come, they'll see that they have burglary charges on their record, which might make the cops think like, yeah, these are real burglars. Look it, they have real charges. And any background checks that someone does on these two is gonna show their criminal history. And I mean, what do you write when you're applying for a job and it asks you, have you ever been arrested? Like, what do you put? Yes, but it was wrongful? It doesn't sound fair to me.

• 1:07:16Speaker 03

  Big things, little things, like, just, it just... Affected our lives for the last six months, like.

• 1:07:23Speaker 02

  And honestly, like, still will continue to do, like, yeah, with the arrest charges. But man, just like, honestly, I know, I know a lot of people, like, say a lot of stuff. Oh, you know, damages, I'm so stressed out over this and they want to do like a counter lawsuit. Like, no, like, I think my physical brain chemistry has changed over this, being so stressed out. And like, I sound like a wimp about it, but man, like, you wouldn't believe it until you're in it and going through something like this, how stressful and traumatic. I don't even want to use that term, so I don't feel like, but, but it is like a traumatic experience to go through something like this and have it held over your head for such a long time when you know you're in the right. And then to see the legal system fail you repeatedly. There were so many opportunities and avenues for the county to understand or get more information and then drop the charges and it just never happened.

• 1:08:08Speaker 03

  And, and I think that was the, that's the biggest detractor from all of this. And the point that was so aggravating is so many times, everybody had every opportunity to do the right thing and they just continually didn't. It, it was just, it was like, for lack of a better term, it was like, I was flabbergasted, like, totally old school, right? It is just, how can you, how can you do this to someone? You know, you know that we weren't there doing anything malicious. You know, we weren't actually breaking in to do, to, to like, create some sort of crime or, or to have some sort of crime. Like, you know, we were there doing our job. Why are you still pushing seven years of prison time?

• 1:08:52Speaker 03

  Why are you still pushing this on us? And, and it's like, they had absolutely no mindset for, like, lack of a better term, or maybe it is the best term, like, destroying two professionals who have absolutely sparkling clean records, who've never even been in trouble for jaywalking before. And they're just like, oh, no, yeah, no, no big deal. You know, we'll just, we'll just keep throwing these, these, these class C felony charges at them. Yeah, you know, if we drop it later, you know, whatever. It doesn't, it doesn't affect us, it doesn't harm us, what do we care? And just, just like, the, the, what do I want to say? Uh, the, like, the lack of, of sympathy or.

• 1:09:32Speaker 02

  Professional.

• 1:09:33Speaker 03

  Or whatever, whatever term you want to throw there, just for like, just, and not even us, but just another human being.

• 1:09:39Speaker 02

  You're doing what's right. Like, if you're representing the law, it's a failure of the legal system, which I had no idea America worked that way. It's like, just not the America that I was brought up in. I thought like innocent until proven guilty and just to see us stripped of some of your rights and to go through this, it was just such an off experience to be like thrown into this mix.

• 1:09:57Speaker 03

  It was terrible. And that, that was the hardest part, was watching people do the wrong thing repeatedly and thinking it was not a big deal. Because to them, it wasn't. The only big deal was to us, but no one seemed to care.

• 1:10:09Speaker 00

  And that is where we left off back in 2020, when this episode first aired. They were arrested, but fought it and got their charges dropped. That should be the end of the story, right? Well, no, there's more, lots more. First was the response from the information security community. They were outraged from this. This jeopardizes a whole industry. People who have gone to college to get degrees in this are now seeing like, wait, you can get arrested for this, get felony charges and be facing seven years in prison? What the heck? So a few people from the cybersecurity community got together and said, what can we do to support these two? John Strand came up with a plan. I interviewed John Strand for an episode before. It's called The Big House, where he sent his mom to do a penetration test for him once.

• 1:10:54Speaker 00

  And a few weeks ago, I ran into him at DEFCON and asked him what his response to this was. Sorry for the background noise, DEFCON is a busy place. After that news hit, um, what did you do?

• 1:11:06Speaker 06

  Uh, we immediately went to the town of Adel, Iowa, and we did Awareness Con. And we invited the entire community to come down and ask the security community questions about what we did.

• 1:11:18Speaker 00

  Yeah, and because John Strand is the founder of Black Hills InfoSec, he knows a lot of people in the industry and he rounded up some big names in cybersecurity. Dave Kennedy, Deviant, Jake Williams, all of which have been on this show before. They all went and gave talks in Iowa because obviously the people there had no idea physical penetration testing was even a thing. And you heard that one guy earlier in the news interview, he's like, these guys should be locked up. If ignorance of the law is no excuse, when you're caught breaking one, then what about the reverse? If the sheriff, the judge, or the townspeople are ignorant that this is a profession? Then should that be no excuse to demonize these two?

• 1:12:00Speaker 00

  But John Strand thought, he's going to do what he can to educate the people in that town, to teach them all of this is legitimate. There is a whole industry of people doing this. There are professional conferences, degrees, books, certifications that you can get to do this.

• 1:12:17Speaker 06

  It's absolutely wonderful. The Sheriff Leonard, he came and he talked.

• 1:12:21Speaker 00

  Here's that clip from Awareness Con, where the sheriff came to give his opinion of this whole thing.

• 1:12:25Speaker 07

  I, I, uh, I'm very, very happy, um, Sheriff Leonard has shown up. And I asked him how he wanted me to introduce him to the group, and I'm not joking. He said, you can introduce me as the bad guy. And, uh, so, um, he has a great sense of humor. Um, so everybody, could you please give a round of applause for Sheriff Leonard?

• 1:12:46Speaker 08

  Well, first off, I'm sorry, I'm obviously the reason you're all here, so, but, uh, I wanted to stop here and tell you that I have a lot of friends that do this for a living too, and, uh, with Homeland Security and all those type of things and nothing but supportive of the industry. And it's not, there's just a whole lot of things that went into this that night that, uh, we're still in question. So, you know, and I think I was talking earlier, getting a lot of hate mail and a lot of, a lot of stuff from the industry worldwide. I mean, London, everywhere, just getting of how dare I do this? And, uh, you know, you gotta look at it from law enforcement perspective for what we're responding to.

• 1:13:29Speaker 08

  You know, if you're telling me that this is a, we're just checking your response time and I had five deputies running 140 miles an hour to get there, that, that doesn't, that doesn't work well, because if one of your family members was T-boned by a deputy, you'd be mad, especially when you found out it was a fake call or something like that. That common sense, that's bad business, you know? If somebody would have got killed on the road that night, those type of things. So, I mean, we just need to work better together. I don't know if this is a common thing, if this is all, you know, but there's a lot of things that we gotta look at. The only reason, and, and the other thing, those of you that do the job, I would never charge you with the crime and let it continue. I, I don't have the ability to dismiss it, but I can work with the county attorney and those type of things.

• 1:14:10Speaker 08

  But at the end of the day, if we choose, or if we believe that it truly needs to go away, it'll go away. But I guess I just wanted to stop and let you guys know that we do appreciate you and what you're doing. And it is a needed, what you do is very needed. I couldn't do it, I don't know how to do this stuff, and, uh, I rely on you folks to help us. And, uh, the two gentlemen that night, they're good guys, but you gotta understand that when you come here in rural Iowa, from Florida, you're from Seattle, Washington, chances of you coming back when I ask you to come back to answer questions are slim to none, I promise you that. So, uh, we just, you know, I just met you, so you're not gonna, there's a whole lot of

• 1:14:51Speaker 08

  questions that go into these things in the middle of the night that, uh, we have to, we have to put all that together. So, I just wanted to stop and tell you that there is no friction between, as far as I'm concerned, between us. Just asking that you kind of wait for it, we're not out to prosecute anybody. I would never charge any one of you with the crime if I didn't think it was valid. And, uh, and if it's proven down the road and if we get through this investigation with all these other agencies and it needs to go away, I'll advocate for it to go away. I wouldn't want any one of you to have a criminal history that, uh, you didn't deserve. So, if I could recommend anything, it would be work with your local law enforcement when you're doing it. I would have helped, if I would have known about it, I'd have helped you do it.

• 1:15:34Speaker 08

  You know, I would have helped them, uh, accomplish their mission, you know, that night. So, and, uh, we wouldn't have any of this problems, so, but, uh, anyway.

• 1:15:46Speaker 00

  I think Awareness Con did in fact change the hearts and minds of those living in Iowa, because after that, there was much more support for these two penetration testers who got arrested. They were starting to come around and feel sorry for them. Some were even saying, please don't judge Iowa based on this. And so, while I was at DEFCON, I ran into those two penetration testers from this Iowa County Courthouse story. And it's now been six years since this happened and we last spoke. So I wanted to get together with them and find a spot at DEFCON and sit down and hear what's new. So you got arrested, filed your charges, got the charges dropped. Story's over, right?

• 1:16:26Speaker 00

  There's not, anything else happen since then?

• 1:16:28Speaker 09

  Couple things.

• 1:16:30Speaker 00

  What's new with you?

• 1:16:31Speaker 09

  Um, I mean, so, have you ever heard that thing where you're like, you go to prison and you turn gay? Yeah, no, I'm not gay, but definitely turned into a girl.

• 1:16:41Speaker 00

  Gary has changed her name to Gabby.

• 1:16:44Speaker 09

  Well, it's my handle, I just, I guess, absorbed the handle, Gabby, yeah? Cause I can like to be anyone I want to be.

• 1:16:50Speaker 00

  You got your charges dropped. So after charges are dropped, are you like, I'm good? Like, I'm fine, like, I can finally go back to my life, everything is fine?

• 1:16:59Speaker 09

  I don't feel like it was like that at all, because there was so many things that said that just were not accurate or just outward lies, um, fabrications, like, changing the narrative. And it, just to say like, oh, cool, we're innocent, well, no shit. Like, obviously we're innocent the entire time, which is why we never settled for anything the entire time. And, and so them dropping it would almost be like them doing us a favor, which was not the case. And they did themselves no favors by dropping it other than embarrassing themselves further. Like, that was for them, definitely not for us.

• 1:17:38Speaker 00

  But what more can you do after charges are dropped?

• 1:17:41Speaker 09

  Like, that's part of the judicial system that's messed up, is you're guilty until proven innocent, you spend time in jail, you get your name dragged through the mud, they lie about everything, and then there's zero repercussions unless you go after them, like, for a personal suit.

• 1:17:56Speaker 00

  A personal lawsuit? Is that possible? Can, can you sue for wrongful arrest? They felt like something seriously unjust happened to them and they wanted to do something to make it right.

• 1:18:10Speaker 10

  I think Gabby was already thinking about it. You look at her mugshot, smiling in there. She was already thinking about the lawsuit as soon as the cuffs went on.

• 1:18:17Speaker 09

  Pretty much.

• 1:18:19Speaker 10

  You were in the jail cells saying, as soon as I get out of here, I'm gonna sue these guys.

• 1:18:22Speaker 09

  Cause I knew we had done enough. We were the most cooperative, at least one of us was for 99% of the time. The other was 100%. But like, again, like you had nothing, nothing wrong with what you did. Like they were being super invasive.

• 1:18:39Speaker 10

  No, I don't trust them. Given my information, I saw how they secure things.

• 1:18:42Speaker 09

  But that was like, it's a good learning point, right? Because we're like, we did nothing wrong. We're gonna be completely cooperative. We're gonna do everything and then you do everything right? And then they just lie about stuff to try to cover their own butt and try to make it look like they didn't do anything wrong. And you're like, wait a minute, like, I was truthful, I was honest, I cooperated with you guys. And then you turn around and you completely spin the narrative so you don't get in trouble or you don't look bad or to save your job or whatever it is. And so like not cooperating to me like, sounds like the right choice after going through that.

• 1:19:14Speaker 00

  Suing the sheriff felt like the right choice for them. Making him pay for the wrongs that he's caused, expose the errors in his ways, make him the guilty one. But to conduct a lawsuit such as this, it was going to cost a lot of time and a lot of money.

• 1:19:30Speaker 09

  We, we actually had our original lawyer and we asked him, like, we, I think we would really like to go after the county and the state and the sheriff because like, people need to know that this is not okay. Like they just can't get away with stuff like this. And he had a real, like, he was afraid to do it, like, for lack of a better term. Because he's like, this is a small town. Iowa's not big. Everybody knows who I am. And I feel like if I go after the county and the state and the sheriff and all these lawmakers, especially after they had that investigation and he's like, I don't know that that would be great for my career at all.

• 1:20:07Speaker 00

  So their lawyer made a few phone calls and found them another lawyer named Marty, who was just about to retire.

• 1:20:13Speaker 09

  And he's a civil rights lawyer and he loved the case and he's like, I will take it on. I'll do it pro bono. He's like, I've made my money. Like I'm literally, he's literally at the twilight of his career. He extended his career to finish this, to finish this case.

• 1:20:28Speaker 00

  So they got a new lawyer and they wanted to sue the sheriff, the prosecutor, the judge, all these people who treated them bad. But this is where Gabby and Justin started learning some new words, words like.

• 1:20:38Speaker 09

  Qualified immunity?

• 1:20:39Speaker 00

  And sovereign immunity. See, qualified immunity means you can't sue government workers, especially judges, prosecutors and cops. They're shielded by the government itself. So they can't sue the actual people who did them wrong, who made these mistakes. And then there's sovereign immunity, which means you can't sue the government unless the government agrees to be sued.

• 1:21:06Speaker 09

  Well, we, we tried to go after the state and it's very convoluted because the state is the one that passes judgment on whether or not the state is guilty or not. So it's like somebody coming to you and saying, we're gonna sue you. Are you guilty? And you're like, of course I'm not. They're like, oh, sorry, I can't sue you now because you said I'm, you know, I said I'm not guilty. So the state immediately threw it out.

• 1:21:34Speaker 00

  They tried to make this a federal case to sue the state. Since the state wouldn't pick it up, maybe the federal government could oversee it and decide. It got picked up by a federal court, but then when they looked at it, they just kicked it back down to the state, who just closed it right away.

• 1:21:48Speaker 09

  So it's just like, they tried so hard to stack the deck against us at the, like, at every single turn, just to make it where it was not going to be, or didn't feel like it was impartial at all through the entire process. Like every step that they could take to stack the deck in their favor, they absolutely tried to do and absolutely did.

• 1:22:10Speaker 00

  So this lawsuit they wanted to wage was dead in the water before it even got a chance to begin, which is really frustrating because what mechanism can you even use here to bring justice to a situation like this?

• 1:22:23Speaker 09

  So we were left with the county and the sheriff. And so even though the sheriff has qualified immunity, or the prosecutor is the one, the prosecutor is the one that has qualified immunity. The sheriff has some protections, but not complete. And so we had to go through the process of saying, these are all the things that we think he did wrong. And then the judge said, yes, yes, no, no, no. And then we eventually are left with what the lawsuit ended up. And so they said, there is enough evidence to show that the sheriff did do these things wrong. So we were able to go after the sheriff, but we went after, we went after the sheriff's position, not Chad Leonard, the person. So we had to go after the actual sheriff, which means he's also covered by the county's insurance policy.

• 1:23:06Speaker 09

  And nothing, like not one cent comes out of his pocket. He doesn't get reprimand, like nothing. Absolutely nothing happens to him. It's a moral victory at best.

• 1:23:16Speaker 00

  Okay, so they started a single lawsuit that got accepted in the courts against the county and the sheriff's position. Finally, this thing was starting to get some traction. And this felt like progress since Justin and Gabby really wanted to use the system to seek justice of everything that went wrong.

• 1:23:32Speaker 10

  Now, my question is, what were you hoping to get out of the lawsuit?

• 1:23:35Speaker 09

  One dollar.

• 1:23:36Speaker 10

  One, on one dollar?

• 1:23:37Speaker 09

  That was all I cared about. I told Marty, I was like, as long as I can drag this dude through the mud like he did with us, except with facts instead of stories, like that's all I care about, which is the entire time. Which is why we were like, they were like, you should, you should just take the trespassing charge. And nope, nope, nope, like the entire time. My entire goal was just to, was just to show that this, like, show this person for who he really was, which is just a lying corrupt individual.

• 1:24:06Speaker 00

  Dang, this is getting pretty good. They got a lawyer who's all in, retired, working for free, doesn't care about what people think of him anymore and Gabby's just coming out with claws out. This is gonna be a good fight. And they eventually decided to ask for more than a dollar. They wanted this to hurt. And they also wanted to cause panic and fear within the county. And they also wanted the townspeople to see what happens when you elect a corrupt sheriff.

• 1:24:30Speaker 10

  We submitted the maximum amount that the insurance company would have covered for the county. So we didn't want taxpayers having to front more money for having a poorly elected sheriff. So yeah, that's, that's the dollar amount that we set. And I think the other part of it too, that's really important, what we wanted out of the case was to set new precedent. That this is okay. You can't, you can't put hackers in jail and try to prosecute them when you hire them to help defend you.

• 1:24:52Speaker 00

  So they were now seeking quite a bit of money from this lawsuit. I'm not sure exactly how much. They wouldn't tell me. My guess is that they wanted to split a million dollars. Keep in mind, they already paid $50,000 each just to get out on bail. And then they spent the night in jail and they were threatened with seven years of prison that they had to fight tooth and nail to get that charge dropped. And those lawyer fees added up too, of course, that's a lot of stress, real costs and anguish that they had to go through. So to split a million dollars, I think that sounds reasonable for the amount of hardship they endured. But Gabby was still furious from this whole ordeal.

• 1:25:26Speaker 09

  Like World War II, the, what's the saying? They woke the sleeping giant? Like Japan thought if they came in and they smashed us, that we would back off and just slink away and not do anything? Kind of the same thing here where, well, we just throw a weight around and we threaten these guys with six, six years in prison and all this other stuff. They'll just take the deal and they'll go away. And that was not the case. Like, we don't fuck up. Like Justin and I, we do things by the letter, by the contract, like everything we do is meticulously perfect for that reason. Because like of what we do, we don't want to mess up. And I think all that, this whole thing just showed that and highlighted it. Because if we had done something wrong, they would have found it and they were unable to.

• 1:26:07Speaker 09

  And so now, five years later, the tables had turned and we had all the evidence. We had all the data. We had the video cameras and we had the recordings and we had everything. And then it was the exact opposite where the county and the state was like, oh shit, they've got everything and we literally have nothing except a really, really bad arrest from a corrupt individual.

• 1:26:30Speaker 00

  Together, they had collected tons of evidence supporting their case and they were feeding it to the court. And the county was starting to sweat a little. And despite how confident Gabby felt that they would win this case, it's still a scary thing to go up against the government. I mean, they could drag this case on for years and exhaust you and run you dry of money and energy, only to ultimately drop the case or reject it due to some clerical error, making the entire process pointless. Years of your life can be wasted in a process like this and the government just doesn't care. And they do these kind of things fairly regularly too. They use the process as the punishment.

• 1:27:11Speaker 00

  The stress of courts and judges and charges weighs heavy on a person, like really heavy. And they know that. So even though they knew, they probably couldn't even win that original criminal case against them, they still wanted to use those charges as a form of punishment. So fighting back at the government like this is the story of David and Goliath. Not only were these two penetration testers the first ever to be wrongfully arrested for penetration testing, but they're also the first two to ever sue the government to protect their rights as penetration testers. This is an epic story. This case could set a precedent.

• 1:27:50Speaker 10

  It was just the right thing to do. I think we didn't have a choice. I mean, to have our counter suit back at them. I mean, that was the only way to try to restore any sliver of justice around our case in that state. So in our minds, didn't cross it, just no brainer, had to sue back. But the funny, David and Goliath, I think that's hackers, right? Is like the power that one individual can hold. That's why governments can be so scared of these individuals. You know, you can do a lot even as a single person. So against the government, it is a mighty entity. But still, again, that's kind of for our lawyer to handle.

• 1:28:21Speaker 09

  It's all about the information and we had all of it.

• 1:28:24Speaker 00

  He felt like he had no choice and that was the right thing to do. Wow, those are some powerful words. This is what patriotism looks like in practice, to put the government in check when it overreaches and force it back. So how does the county react to this? Of course, they delay it. Their original court date was supposed to be in 2020, but that got delayed, canceled, pushed back again and again. The county tried to distance themselves from this in every way possible. They tried to slither out of it, hoping that Justin and Gabby would grow tired or forget about this or just give up.

• 1:29:00Speaker 09

  The further they could get away from the moment, the better for them because they wanted it to fall out. They didn't want people to bring it back up.

• 1:29:08Speaker 00

  So year one goes by, very little happens. Basically, they spent the whole year just opening the case. Year two goes by, nothing happens at all. Year three, they just keep delaying things, keep pushing it back. And this is really starting to test Justin and Gabby's patience. Like, come on, we've presented all the evidence to you. Why are you not looking at this case and trying to get it closed? Also, at some point during all that, Chad Leonard, the sheriff that they were upset with, retired and moved out of state entirely. So whatever outcome this lawsuit is going to have, it's not going to bother him at all. Because he's just relaxing in some Florida community somewhere now. But their lawsuit was with the sheriff's position, not the sheriff himself. So the case continued.

• 1:29:49Speaker 00

  Around this time too, Justin and Gabby's relationship with Coal Fire started to sour. They didn't feel like they were getting paid enough or treated right by them.

• 1:29:57Speaker 09

  The first year after we got arrested, we had over $5 million come in directly. People saying, hey, we want to work with Gary and Justin and we want to work with the Iowa team and blah, blah, blah. And I don't care.

• 1:30:10Speaker 10

  Our story was one of the most valuable things that happened to Coal Fire. Even the CEO recognizes like, yeah, the number one reason Coal Fire is known is because of this case. And it is funny, if we ever talked to anybody and we mentioned, oh, you work at Coal Fire. Like, oh man, you ever hear that crazy story of those guys that got arrested? I'm like, no, tell me about that.

• 1:30:27Speaker 00

  Gabby quit her job at Coal Fire and went to apply at other places. I didn't quite get the full picture. Is Coal Fire good or bad?

• 1:30:36Speaker 09

  Individuals at Coal Fire are very bad. I think Coal Fire as an entity during that time was good.

• 1:30:45Speaker 00

  She was able to quickly get interviews at other places. But even though she was the best for her job and the most qualified, her reputation from this case alone made people turn her down. She had a hard time finding another penetration testing job because of this story with the Iowa courthouse. She took six months off just to clear her head and relax.

• 1:31:05Speaker 09

  Like really started coming in question like, damn, am I even going to be able to keep doing this because of what happened?

• 1:31:11Speaker 10

  Great opportunity to start your own business then and do it on your own terms.

• 1:31:15Speaker 09

  Justin and I had actually talked about it multiple times in the past about starting something different and doing things a little bit differently and treating.

• 1:31:22Speaker 10

  Starting something new yourself.

• 1:31:24Speaker 09

  Yeah, and just building a company that treats people the way that we thought they should be treated. We had a vision of we wanted to do things a little bit differently. And so we did that with Kaiju.

• 1:31:35Speaker 00

  And thus, Kaiju Security was born. A fresh new penetration testing company based near Seattle, Washington.

• 1:31:42Speaker 09

  Adversarial Simulation Offensive Security, yeah.

• 1:31:44Speaker 00

  Gabby started it with another guy named Marcus and Justin moved onto the team shortly after it was formed. And after getting this new company started up, the lawsuit was finally making some movement in year five.

• 1:31:56Speaker 10

  Here recently in 2025, you know, is about showtime. So then we started getting hot and heavy with it, doing depositions, getting things on record, getting prepped for the trial case. So we were definitely shaping up. You had to go show up in court and was, again, going back to the hacker community. We had some great people like Deviant and Drew Porter that agreed to testify in our case just as expert witnesses. So yeah, we're going through, we really thought we were going to end up in court. We started getting presented with options to settle pretty quickly. Like, I mean, they wait till the last minute with everything like that. And they were throwing out lowball numbers. I think they had like, just about like our bond or bail is what they first wanted to offer.

• 1:32:38Speaker 00

  Okay, so the county didn't want to go to trial and did want to settle this, but their offer was for $50,000 each. The amount that they paid to get out on bail. $50,000 each, that doesn't even cover their lawyer fees that they spent trying to clear their names. What an insult. So no, of course, they didn't take $50,000 each. They needed more.

• 1:33:01Speaker 09

  So we ended up going through arbitration where they take a former judge and goes back and forth and tries to settle the case. But at that time, they were still being super, super, super stingy and they were like, oh, we'll give them 50. And then, so the judge, TLDR, the judge comes by to us and through the entire process that took all day long, comes to us and goes, I don't think in my entire career I've ever seen a case so clear cut as this. This isn't a matter of if you win, this is a matter of how much money you're going to get. So I'm going to go back and I'm going to beat these guys up pretty good. And he leaves and Marty looks at us and is like, I've been doing this for 50 years or something like that, or 42 years. He's like, I've never heard an arbitrator say that ever.

• 1:33:44Speaker 09

  I've never, not only had he never heard it, he'd never heard of anyone else saying that an arbitrator had said that. So that was the point, I think, that our confidence started to go like this. Cause he had seen, he had seen all of our, everything that we had. And he was just like, yeah, no, this isn't, I don't think this is up for debate.

• 1:34:04Speaker 00

  But even with that, the county stayed silent. Instead, they set a trial date, which was three months away, again, making them wait more. So they prepared for trial. They spent an enormous amount of time and energy to gather their materials, find body cam footage, get testimonies and depositions and, and bring in expert witnesses. They even took time off work to go attend this trial and they booked their flights and their tickets and they were ready to go. And let me just emphasize what the odds are in this situation. Over 95% of wrongful arrest lawsuits are thrown out due to qualified immunity.

• 1:34:42Speaker 00

  Of the few that make it through, 95% of those usually get closed with a $0 settlement or the government wins at trial. For them to receive more than $50,000 from this lawsuit, it's about the same odds as hitting the lottery. It's extremely rare to sue the government over wrongful arrest and win a substantial amount of money. And usually in those situations, it's because the person was in jail for weeks or months under the wrongful arrest. So it's even more rare for someone to spend just one night in jail and get a large settlement offer. In those situations, you would have to prove without a doubt, the government conducted an egregious violation, which is what Justin and Gabby was saying happened.

• 1:35:25Speaker 00

  But then, a few days before the trial was due to begin in February 2026, they got a new settlement offer from the county. The county was offering them $600,000 total, $300,000 for each of them. And this was actually the lowest that they would accept. So they took it and the lawsuit was closed. They got paid, they won, and this allowed them to celebrate.

• 1:35:55Speaker 10

  Still, I think the biggest one for the community is now we have better precedent, right? So before we were just arrested, felony charges, okay, cops can just arrest pen testers doing their job and try to put them in prison for seven years. But now we can look back and if that's ever happening in real time to other testers out there. Hey, sir, let's just take this slow, take your time, fully cooperative. But if you want to research, this has happened before and it's probably not a good idea to try to prosecute or put me in jail for doing my job. Look what happens or, you know, the county could have to pay out or, yeah. So really good to have the win under our belt for the community.

• 1:36:28Speaker 09

  Everybody else, yeah. I'm obviously much more selfish than Justin is.

• 1:36:32Speaker 00

  And now finally, they can go back to their normal lives, feeling like justice has been restored in the best way it possibly can be. And now they're focusing on building Kaiju Security, all with a new feather in their cap.

• 1:36:45Speaker 10

  I love, I love saying that too, because I fought the law and the law won. No, the law fought us and we won.

• 1:37:01Speaker 00

  A big thank you to Justin Wayne and Gabby Di Macario for reaching out and finding the time to share this story with us. I really like these two and I look forward to the next time I meet them. This show is brought to you by the lovely people who support the show. If you find this show valuable, please consider supporting it too. As a premium listener, you'll not only show a new ethic for directly supporting the people that you appreciate, but you'll also get bonus episodes of this show and an ad free version too. Just visit plus.darknetdiaries.com and become a premium subscriber today. Thank you. This show is created by me, Pony Pie, Jack Rees Cider, mixing by Proximity Sound, and our theme music is by the mysterious Breakmaster Cylinder.

• 1:37:43Speaker 00

  There's an option in WhatsApp and I can never figure out, is it Mark as Red or Mark as Reed? This is Darknet Diaries.