Comment by OutOfHere

Comment by OutOfHere 3 days ago

For someone who is in such a position in the future, always notify the local police in writing and by phone call, if not also in person, before starting such an exercise. Make sure they have the get-out-of-jail documentation in advance of the exercise. If the police doesn't approve, don't do it. It would be better to get a no-objection letter from the police in advance. Make sure an attorney is aware of the activities and all documentation. Do not take any chances. You don't live in a kind or forgiving world. Handling unknown unknowns is the point.

sehugg 3 days ago

They had written authorization from the state court and verbal confirmation from state court officials. They didn't know there would be a pissing match between the judicial branch and the sheriff.

Reply View 10 replies

827a 3 days ago

But afaik this wasn't a state courthouse; it's a county courthouse. Legally, obviously, the state has authority and they were in the right, but functionally this is really good advice: if you're doing a penetration test of a space, you functionally need to clear it with the people who are responsible for the security of that space, and whom you might encounter defending it.
Frankly, I would not have taken this gig unless you had verbal confirmation that the Sheriff knows about it and has signed off. If you're entering a red team situation where the State wants to assess the security of their county courthouses, but doesn't want the local authorities to know its happening because they don't trust them: That is not a situation you want to be in the middle of, they gotta sort that out.

Reply View | 9 replies
- Kina 3 days ago
  
  This really depends on how a state structures this, but “county courthouse” is not necessarily a meaningful statement. The judiciary is a state function and it has been delegated to county for purposes of logistics. In larger states, each county gets to set its own court rules, fee schedules, etc. because it would be maddening otherwise. They still ultimately answer to the state judiciary.
  Iowa is small enough that it looks like the Iowa Judicial Branch just runs everything directly. Every county seat in Iowa has a courthouse, but the county probably doesn’t really have any control of it.
  My guess is that the sheriff had an ego and may not have wanted a finding against him.
  
  Reply View | 0 replies
- tiahura 3 days ago
  
  Legally, obviously, the state has authority
  That’s not legally obvious. State v county control over courthouses creates fights over everything from Aesbestos to parking to security. The legal answers lie in state constitutional provisions that nobody ever reads and aren’t particularly helpful.
  
  Reply View | 0 replies
- jstanley 3 days ago
  
  Easy to say in hindsight.
  
  Reply View | 5 replies
  
  aksss 3 days ago
  
  Hindsight's how we all learn. Doing it over again, I'm sure those guys would have done things differently. Any team would be crazy today to not be more prudent in how they operate.
  
  Reply View | 3 replies
  
  OutOfHere 3 days ago
  
  Considering today's world, they're lucky they didn't get shot dead with an entire clip.
  
  Reply View | 0 replies
- TurdF3rguson 3 days ago
  
  If the goal is to test for vulnerabilities under real-world conditions, they probably should have bribed the sheriff to stay away.
  
  Reply View | 0 replies

Aurornis 3 days ago

> If the police doesn't approve, don't do it. It would be better to get a no-objection letter from the police in advance.

The article says they did have an authorization letter from the state court officials (the people running the building) and they were released right after the letter was verified with the court officials.

At least from what I can see, the police officers involved were doing the right thing. They detained the suspects, made a proper effort to listen to them and validate their story, and then released them.

It was the Sheriff who showed up and didn't like it who then hassled them further.

They basically had a no-objection letter from the people in charge of the building and the police officers were onboard. It was one person who tried to turn it into something else.

Reply View 0 replies

xmcp123 3 days ago

Wouldn’t that in a lot of ways invalidate the test?

You’re trying to see what can be done and what the response is from the current security practices and the police showing up seems like an important part of that.

Reply View 1 reply

OutOfHere 3 days ago

It is not clear what as the defined purpose of the test, if it was to measure a successful entry+exit, or measure police response, or both. If measuring the police response was a purpose, the police should still have been notified, just not of the exact date when it would happen. Executing it on a random day should offset the prior awareness of the police. Secondly, it is up to the police leadership to keep it quiet.

Reply View | 0 replies

antonymoose 3 days ago

That simply is not how the police work. If they get a call about a break in they’re going to respond and assess.

I bought property with a shooting range years ago from a retired SWAT officer with the county. He mentioned that “he always calls the sheriff’s office to let them know if he was doing anything.” Now I’d never owned a private range and am not from this county.

I called up the sheriff’s office and asked for clarification. I was advised that no such policy / program exists or is required and if the officer must have had is own internal policies and chain o command and that is irrelevant to me as a random citizen. In short, if a call is made about a shooter they will have to respond and so long as I’m not doing anything stupid, dangerous, or outright illegal I have nothing to worry about. The same goes for any other type of call.

Reply View 0 replies

giantg2 3 days ago

If the state wants to verify the counties are doing an adequate job, then tipping them off could result in an invalid assessment. The sheriff's reaction raises suspicion that there are deficiencies he doesn't want found

Reply View 0 replies