Case Dropped Against Coalfire Pen Testers Accused of Burglary

Written by

Two employees of cybersecurity firm Coalfire who were arrested for an alleged burglary of an Iowa courthouse have had all charges against them dismissed. 

Gary Edward Demercurio, of Seattle, Wash., and Justin Lawson Wynn, of Naples, Fla., were arrested in September 2019 after being found inside the Dallas County Courthouse in possession of burglary tools. 

The two Colorado company employees were mistaken for criminals while conducting what a Coalfire spokesperson described as "a standard penetration test to protect Iowa citizens" for their client, the State of Iowa, on September 11.

Demercurio and Wynn, who were 43 and 29, respectively, at the time of the arrest, were both charged with felony burglary and the possession of burglary tools, which could have seen them jailed for a total of seven years each. 

Following discussions between representatives of Coalfire, the Dallas County Sheriff, and the Dallas County Attorney, the Dallas County Attorney decided to dismiss trespass charges against the duo.

Senior security consultant Wynn said: "It was a red team engagement with physical penetration included as part of it. It wasn't the first physical breach that we did during that assessment. There were multiple facilities that we had already assessed, and it was the last one that we were coming around to. 

"They specifically requested that they wanted 'after hours' testing at these locations. The client said they wanted to see how their facilities could be breached and what the security vulnerabilities are that we're working with."

Demercurio said: "The original arrest was supposed to be for trespassing but that changed to felony burglary. From that point, we were arrested and taken to jail. We were there for about 24 hours."

Wynn said that bail was set at $50,000 each for both him and Demercurio after the local prosecutor deemed them "a flight risk." The standard rate at which bail is set in Iowa is $5,000 per person. 

Coalfire CEO Tom McAndrew said: "We are pleased that all charges are dropped in the Iowa incident. With positive lessons learned, a new dialogue now begins with a focus on improving best practices and elevating the alignment between security professionals and law enforcement.

"We’re grateful to the global security community for their support throughout this experience."

What’s hot on Infosecurity Magazine?