Hacker News Reader

Comment by arcticfox | Hacker News Reader

This is such an absurd case on so many levels. This miscommunication should have never happened, obviously.

Even if they turn out to be the criminally incompetent party in this relationship, I feel kind of bad for the contractors. They're facing felony charges for making what was clearly a mistake. I can't imagine they're consistently this incompetent - surely one of their previous clients would have noticed if they were physically broken into and didn't anticipate it. So either they've never done this before, or they messed up their contract.

I've seen plenty of similarly boneheaded, incompetent things in Big Tech (losing massive amounts of data, getting systematically defrauded in pretty stupid ways, etc) that resulted in getting fired at worst and a reprimand at best, so I feel kind of bad that these guys face felonies for being bad at their job.

View on HN

Amazed they are charged. Any good lawyer should be able to get them off on mistake of fact, of simply lacking the elements of the crime.

Yeah, not a lawyer outside of my armchair, but I don't really see how they could ever be convicted of any of this. It sounds like there's a very good chance they were contracted by a legitimate security auditing firm to do a job of a nature they had no reason to believe was not already outlined some statement of work agreed upon by all parties. Even if there was some misunderstanding, it sounds like the fault lies with the firm rather than with the contractors themselves. Obviously there are more facts that would need to be reviewed to come to definitively arrive at a conclusion like this, but at a glance this whole thing seems ridiculous.

Probably a bad comparison to make, however in construction if something is built according to the plans from the engineering firm, and somehow those plans were not up to snuff and voided a warranty or worst case could be illegal and not up to code, it will NOT fall on the welders and workers who created the project (Unless they didn't perform job i.e. welds not up to par). Failure would be on the engineering firm who was supposed to ensure all plans were created according to the specifications.

If the company these two were working for had a "plan" much like building documents, or a scope of work document/contract then there should be no reason for these guys to get in trouble as physical penetration testing would be listed.

I see two possibilities.

1) Company did not have a good scope of work, which at the end of it all this should fall on them and not the employees in charge of performing their work. These guys should be let go, compensation to them paid from the employer for their error, and said employer has to pay everything, including fees and having their reputation tarnished.

2) There was bad miscommunication. There was physical penetration listed in the scope of work, however the police were not informed and acted as they would with anyone breaking into a courthouse. This would then fall on the department who hired them, which should pay the employees for their time/trauma and make an apology exonerating the company who was hired to pen test.

It's feasible that the charges will go through but the defendants can sue the employer who holds the contract for damages related to any fines or jail time.

A mistake or incompetence is no excuse for breaking the law. This was a courthouse. There is either CYA in writing they can request in discovery for that lawsuit or as evidence against the charges they face to demonstrate to a jury that they should be innocent or that an experienced prosecutor will see then look to drop charges.

But unless the charges are dropped, the jury favors the contractors, or the judge halts proceeding until a determination can be made, they may be SOL on the charges.

You don't need to be convinced for the court to ruin your life, and/or business.

Well, as long as there was an agreement to do pen testing, the criminal portion should be pretty much dropped.

Caveat emptor

Reply on news.ycombinator.com