Two penetration testers hired by the Iowa Judicial Branch to physically test courthouse security were wrongfully arrested by a county sheriff, despite having a valid contract. They faced felony charges, spent a night in jail, and endured a five-year legal battle to clear their names and win a $600,000 settlement. The case highlights the risks security professionals face and the legal obstacles to suing government officials.
Summarized by Podsumo
Two penetration testers were wrongfully arrested for breaking into a courthouse, despite having a signed contract from the state for a security assessment.
They faced felony burglary charges (up to 7 years in prison) and spent a night in jail before charges were dropped after a five-month legal battle.
The testers filed a lawsuit against the county, winning a $600,000 settlement after a five-year fight, setting a rare precedent in the cybersecurity industry.
The case exposed how qualified immunity protects government officials from being sued personally, even when they make egregious errors.
The experience led to the creation of a new penetration testing company, Kaiju Security, and sparked industry-wide awareness about the risks of physical pentesting.
"_"The only thing I can think of is you've been dealing with people and liars for so long, you can no longer tell the difference between somebody who is innocent and telling the truth wholeheartedly and somebody who is a liar."_ — Gary DiMacurio (on the judge's reaction)"
"_"I fought the law and the law won. No, it didn't. The law fought us and we won."_ — Gabby DiMacurio"