Hacker News Reader

Comment by mike_d | Hacker News Reader

Page 3, the scoping section clearly lists the three addresses where physical testing would take place. Page 5 also lists it on the timeline, which based on other notes about not testing specific days - the client would have absolutely reviewed. Page 12 is a client questionnaire where they answer physical security questions.

People do get arrested doing this type of work. It hasn't happened to me, but it has happened to people I know. Usually it is quickly and quietly resolved without the press being involved.

What I believe is at issue here is authority. Can a state entity authorize testing of county buildings? Some people just assume "the government" is one entity. This same type of issue arises in corporate work as well - can a tenant authorize testing against a landlords building? You need to get both to agree.

(Disclaimer: I do this type of work so I might be biased)

View on HN

Pentesters sometimes are leveraged as pawns in political games in organizations - seems similar with government.

I think you are correct, the question is if the right stakeholders authorized this. You can't break into a 7/11 because some person working there authorized it. Authorization needs to be from all proper stakeholders.

If this is true, is it Coalfire's fault for not verifying and are the two testers SOL with the burglary charge?

Then is it also the fault of the two testers in this case that they too did not verify that all the correct stakeholders were brought in?

It would suck to be in the position of the testers having little or no recourse.

I'm very hesitant to blame the two individuals. While you should have basic understanding of the legal circumstances when working this job, you should be able to trust your higher ups that the paperwork is legit and thorough. A company the size of coalfire certainly has dedicated personnel just for dealing with that.

Agreed - very little blame goes to the pentesters, they didn't act with malicious intent as far as described. It's the higher ups on both sides that are accountable for the dilemma.

I am too, but was curious what degree of responsibility is expected of them by the law. i.e., is deferring to whatever sales/legal drafted enough of a defense, or something else.

I work in professional services (although not pentesting), so I curious about what would happen to me if I was in a similar position.

The previous discussion on HN highlighted Mens rea with regards to establishing intent, i.e. they didn't have criminal intent (they went in with the understanding that they had full rights and privileges to be there) and would probably (hopefully) be vindicated in a court of law. There is still a matter of CoalFire vs State / Local govt, where CoalFire might be liable for not confirming that they had the proper authorization to dispatch their testers (which is part of the state vs local issue that's ongoing).

IANAL but I've been tracking this pretty closely since I'm also a pentester; everything seems to reasonably indicate that the two guys should be released, but someone else is likely ending up in a court over this.

>Pentesters sometimes are leveraged as pawns in political games in organizations - seems similar with government.

How?

I've had clients tell me to hit certain known vulnerabilities specifically.

I can see a situation where the decision to stay or swap off a system is being debated. If one party can send in testers and call out some vulns that might play to their hand.

There's kind of a difference between clients and stakeholders gaming a pentest or spinning its results and pentesters not being authorized to test their targets. Even with basic web pentesting, rules of engagement particularly around which targets you're authorized to test is a big deal. This is a hell of a SNAFU.

Absolutely agreed. Especially since, in spite of my disagreement with the handling of things, the sheriff may have a point in the authorization angle.

My initial comment pointed more generally to an example of politics within a company though.

Like: a scenario that comes up all the time in ordinary web application testing: your authorized target interacts with a third-party API, for which you are not authorized to test. Pentesters generally get this right, because if you get it wrong, no matter what your client tells you, you're liable. (Indemnification may come into play here, but it won't matter criminally).

If the county is correct, the Information Security Officer for the Iowa state department payed someone to break into someone else's property. Why isn't there an arrest warrant out for them? If I payed someone to break into a 7/11, I strongly suspect I would get a visit from the police.

Yes, the two employees could be liable for accepting a request from someone who obviously didn't have the authority to give it. But they wouldn't be the only people liable, and it seems silly to claim that they would be the first people liable.

Why is it that the only two people arrested are those who had the least amount of responsibility and ability to check on the authority of the State department?

I tend to agree with your obervation.

>Why is it that the only two people arrested are those who had the least amount of responsibility and ability to check on the authority of the State department?

That outcome is why the word "pawn" is being thrown around.

If the scope of work document is invalid, then the current charges are the least of the involved party’s concerns: the document is proof of conspiracy to commit federal felonies. Many of the pentesting actions would violate hacking laws. The conspirators would include every state official and employee who reviewed and approved the plans, any county employees involved, and anyone else who helped put together the deal.

If the current cases were to actually go to trial, then even the most incompetent attorney would start asking for subpoenas of everyone involved, likely reaching into the highest political and law enforcement offices. These are people who can exert tremendous pressure in order to evade having to give sworn testimony.

I don’t know if the local prosecutors understand the massive political retaliation their are inviting.

Trolling?

> Many of the pentesting actions would violate hacking laws.

No. Just like the physical penetration, if you are authorized by a legal authority to access a computer system then you aren't breaking any law when you penetrate it. The question is whether these parties were in fact a legal authority.

What a bizarre interpretation of my comment.

Reply on news.ycombinator.com