‘They became the scapegoats’: Security contractors arrested at Dallas County Courthouse
Dallas County IA August 6 2021 Two men arrested in 2019 while testing courthouse security for Iowa’s Judicial Branch have sued Dallas County and its sheriff.
Gary DeMercurio and Justin Wynn were charged with burglary and possession of burglary tools after their arrests on Sept. 11, 2019, at the Dallas County Courthouse.
The men were employees of Colorado-based cybersecurity firm Coalfire Labs, with whom state judicial officials had contracted to perform an analysis of the state court system’s security, including at five court buildings in the Des Moines metro area.
Their arrest and subsequent charges drew outrage from state legislators, who accused judicial officials of hiring a private company to commit crimes, and apologies from then-Chief Justice Mark Cady.
“In our efforts to fulfill our duty to protect confidential information of Iowans from cyberattacks, mistakes were made,” Cady told legislators. “We are doing everything possible to correct those mistakes, be accountable for the mistakes and to make sure they never, ever occur again.”
Judicial officials said after the arrests that they had not intended to authorize Coalfire to physically break into buildings, or to enter them outside normal hours. Wynn and DeMercurio contest that, arguing in their lawsuit that the contract included “rules of engagement” that specified “physical attacks,” including “lockpicking” as part of their security penetration tests.
In their lawsuit, the men describe speaking with responding officers after triggering an alarm at the Dallas County Courthouse and explaining why they were there, showing a letter of authorization provided by judicial officials to authenticate themselves.
Although the first officers on scene were satisfied by this, Sheriff Chad Leonard was not, according to the lawsuit.
“Leonard refused to recognize the authority of the Iowa Judicial Branch to permit plaintiffs to perform testing on the Dallas County Courthouse,” the complaint states. “Leonard ordered his deputies to arrest both plaintiffs.”
The lawsuit seeks unspecified damages for claims including false arrest, defamation and malicious prosecution, as well as several constitutional claims. Informed of the lawsuit Friday, Leonard defended the county’s response.
“We deny the claims made in the petition and stand ready to defend ourselves in court,” he said in an email.
The two men spent about 20 hours in jail. Although the charges were eventually dropped, having a felony arrest on their records remains a significant obstacle, said Marty Diaz, their attorney.
“It clearly has hampered their ability to consider if they were interested in going someplace else to work. That creates a problem,” Diaz said Friday. “It has a significant impact on the value of their service.”
In previous interviews, Wynn and DeMercurio mentioned the possibility of also filing a lawsuit against Iowa Judicial Branch officials for putting them in harm’s way without ensuring the legality of their actions. Diaz would only say “that’s certainly something we’ve considered.”
Such a case would have to be brought by Sept. 11, the end of Iowa’s two-year statute of limitations for such cases, and follow the procedural requirements of the Iowa Tort Claims Act. A spokesperson for the Iowa Judicial Branch declined to comment.
DeMercurio and Wynn are suing as individuals, and Coalfire is not a party to the suit.
Judicial Branch officials had not communicated to county officials that they had hired contractors to test their security, and Diaz thinks the resulting bureaucratic showdown left his clients out to dry.
“It got into an argument between the sheriff’s office and the Iowa Judicial Branch, and it became a territorial dispute between the two of them, and all of the sudden the state started backing down,” Diaz said. “That, of course, put my clients in a position where it starts to look like they did something wrong, which they didn’t. That’s where any potential exposure on the part of the state exists.”
“It’s like two people fighting over somebody, and that somebody’s getting stomped on,” he added. “That’s exactly what happened to my clients. They become the scapegoats.”
