Iowa County Pays $600K After Wrongly Arresting Security Testers

Gary DeMercurio and Justin Wynn thought they were doing exactly what they were hired to do when they tested security at an Iowa courthouse in 2019. Instead, they spent 20 hours in jail and faced years of public accusations that nearly destroyed their careers.

The two penetration testers worked for Colorado-based Coalfire Labs and had written authorization from the Iowa Judicial Branch to conduct "red-team" exercises. These are simulated break-ins that help organizations find security weaknesses before real criminals do.

Their contract explicitly permitted physical attacks like lockpicking on judicial buildings. On September 11, 2019, a little after midnight, they slipped a tool through a door crack and tripped the lock at the Dallas County Courthouse, triggering an alarm as expected.

When deputies arrived, DeMercurio and Wynn showed their authorization letter. A deputy called the state court officials listed and confirmed everything was legitimate. The deputies seemed satisfied and even asked the testers to share stories about their work.

Then Sheriff Chad Leonard arrived and everything changed. He said the courthouse was under his jurisdiction and he hadn't authorized any intrusion, despite the valid state contract.

Leonard arrested both men on felony burglary charges with $50,000 bail each. Even after charges were reduced to misdemeanor trespassing and eventually dismissed, the sheriff continued publicly claiming they had acted illegally.

For security professionals, reputational damage like this can be career-ending. The incident sent shockwaves through the industry because if you can be arrested for authorized security work, who would take those contracts?

"This incident didn't make anyone safer," Wynn said. "It sent a chilling message to security professionals nationwide that helping government identify real vulnerabilities can lead to arrest, prosecution, and public disgrace."

The Bright Side

Last week, five days before their trial was scheduled to begin, Dallas County agreed to pay $600,000 to settle the lawsuit. The settlement validates what DeMercurio and Wynn maintained from day one: their work was authorized, professional, and done in the public interest.

DeMercurio has since started his own security firm, Kaiju Security. "What happened to us never should have happened," he said. "Being arrested for doing the job we were hired to do turned our lives upside down and damaged reputations we spent years building."

The settlement sends an important message back to the security community: doing legitimate security work to protect the public shouldn't land you in handcuffs, and when it does, there are consequences for those who ignore valid authorization.