Hacker News Reader

"Expected to be" is not the same as "will only be", and that's the sort of thing that gets decided by a judge. (The existence of the additional charges language does weaken that argument a bit since if "expected to be" really was meaning that things could happen outside of those hours, then you wouldn't need to reference those MSA terms.)

IANAL, but have written more than my share of SOWs and contracts of this type. Drafters tend to always default to the position of greatest optionality for them. Hence, "expected to be".

I felt like that was more about billing than limiting the scope, but you're right that there's seemingly a conflict.

Which is interesting since they said that the physical pentesting could be "during day and evening," but you're right. Haven't seen anything affirmatively allowing them to conduct outside of 6am-6pm MST.

They DID have permission to lockpick, and maybe the state asked for testing after 6pm MST but hasn't released the request (per the blurb below)

"Requests for testing outside this time period outside the above may result in additional charges per the terms of the MSA"