Summary of 179: The Courthouse - Revisited

Overview of Darknet Diaries Episode 179: "The Courthouse - Revisited"

This episode revisits one of Darknet Diaries’ most infamous stories: two physical penetration testers were hired to assess security at Iowa courthouses, but after breaking into a county courthouse as part of the agreed test, they were arrested, jailed, and charged with burglary and possession of burglary tools. What follows is a long fight over whether they were criminals or contractors, a breakdown in communication between state and county authorities, and—years later—a major legal and personal reckoning that ultimately ended in a settlement.

The Original Courthouse Pen Test

What the testers were hired to do

• Justin and Gary were physical penetration testers working for Coalfire.
• The Iowa Judicial Branch contracted them to test multiple courthouse sites.
• Their rules of engagement allowed:
  • Tailgating
  • Dumpster diving
  • Lock picking
  • USB drops / rogue device placement
• They were explicitly not allowed to disable alarms.

How the assessment unfolded

• They successfully breached one courthouse using common physical bypass techniques.
• They left a “calling card” on a point of contact’s desk, which confirmed they had gained access.
• At the Dallas County Courthouse in Adel, Iowa, they entered after hours and triggered the alarm as expected.
• They were spotted by law enforcement, identified themselves, and showed their paperwork and authorization.
• Initially, officers were uncertain but largely professional and seemed to verify their story.

The Arrest and Criminal Charges

Why everything escalated

• The county sheriff arrived and did not accept the state authorization as valid for county property.
• Despite the testers’ documentation and the officers’ initial verification, the sheriff insisted they be arrested.
• They were charged with:
  • Third-degree burglary
  • Possession of burglary tools

Jail and court

• They spent the night in jail in orange jumpsuits and shackles.
• The next morning, they were taken to court—inside the very courthouse they had tested.
• The judge and prosecutor treated the situation as a criminal matter, not a contract misunderstanding.
• Bail was set extremely high, and they remained in custody until Coalfire posted bond and secured legal help.

Why the Case Was So Controversial

The core dispute

• The state argued that it had authorized the testing.
• The county argued that the state did not have authority to authorize a physical break-in on county property.
• That legal gray area became the heart of the case.

What the third-party review found

• A later independent investigation concluded the state did have authority to authorize the test.
• Even so, county prosecutors continued pushing the criminal case for months.
• Eventually, the charges were reduced, then later fully dropped.

The lasting damage

Even after the case was dismissed:

• Their arrest records still existed.
• They were worried about future employment, background checks, and security clearances.
• The incident affected their careers and personal lives for years.

Community Backlash and Support

Industry reaction

• The cybersecurity community was alarmed that legitimate physical pen testing could lead to felony charges.
• John Strand and others organized an awareness event in Adel to educate locals on physical security testing.
• The local sheriff later publicly acknowledged that the testers’ work was legitimate and that law enforcement and security professionals need better coordination.

Public education angle

• One major theme of the story is that ignorance of physical security testing worked both ways:
  • The testers had a contract and authorization.
  • The county and locals didn’t fully understand the profession.
• The episode argues that this misunderstanding created the perfect storm for a legal disaster.

The Lawsuit and Final Resolution

Why they sued

• Justin and Gary felt they had been wrongfully arrested and publicly smeared.
• They wanted more than a dismissal—they wanted accountability and legal precedent.
• They also wanted to prove that security professionals should not be treated as criminals for doing authorized work.

Legal obstacles

• Government immunity doctrines made the case difficult:
  • Qualified immunity
  • Sovereign immunity
• The lawsuit had to be narrowed and fought through delays, procedural barriers, and pushback.
• The sheriff retired during the long legal process.

What they asked for

• They initially said they wanted at least symbolic justice, even joking that they’d take “one dollar.”
• Eventually, the case turned into a serious civil-rights fight aimed at setting precedent.

The final settlement

• After years of delays, arbitration, and preparations for trial, the county offered $600,000 total.
• Justin and Gary accepted the settlement.
• The case ended with a meaningful win for them and for the wider security-testing community.

What Happened Afterward

Career and company changes

• The ordeal changed both testers personally and professionally.
• Gary/Gabby and Justin eventually left Coalfire and founded Kaiju Security, a new penetration testing company.
• Their case became a landmark story in offensive security circles.

Broader impact

• The settlement and the publicity helped validate physical penetration testing as a real profession.
• The case also highlighted:
  • The need for clearer authorization language
  • Better coordination between state and local authorities
  • The risk of “process as punishment” in the legal system

Key Takeaways

• Authorization must be crystal clear when testing government or multi-jurisdiction facilities.
• Physical security assessments can be legally risky if county/state authority isn’t aligned.
• Government systems can punish first and clarify later, which is especially dangerous for contractors.
• The cybersecurity community rallied hard behind the testers, turning the case into a broader advocacy moment.
• The final win was civil, not criminal: the charges were dropped, and years later the civil case produced a substantial settlement.

Notable Theme

The episode is ultimately about more than a courthouse break-in—it’s about what happens when legitimate security work collides with bureaucracy, fear, and a legal system that can take years to correct its own mistakes.