Courthouse break-ins appear part of Iowa security contract

The state of Iowa released documents Wednesday that appear to support the claims of two men who said they were just doing their job testing security when they were arrested on suspicion of breaking into a courthouse this month.

The men were working for Colorado-based cybersecurity company Coalfire when they were arrested after being found on the third floor of the Dallas County Courthouse just after midnight Sept. 10. The state has said it hired Coalfire to test only the security of electronic access to court records and not to force "entry into a building," and the two workers still faced criminal charges Wednesday.

Yet the $75,000 contract between Coalfire and the state says that a "physical penetration test targets your facilities/buildings/locations" and notes that the company planned to "attempt to collect physical documentation" at the Polk County Courthouse in Des Moines, the Dallas County Courthouse in Adel and the Judicial Branch Building in Des Moines, which is part of the State Capitol complex and houses the Iowa Supreme Court and Iowa Court of Appeals. The court administration's head of information technology signed the contract on May 28.

Even as the state released the security contract publicly, the Iowa court administration and Coalfire put out nearly identical statements Wednesday reiterating confusion about what actions it covered.

"Coalfire and State Court Administration had different interpretations of the scope of the agreement," the statement from the court agency said, adding that the Iowa Judicial Branch and Coalfire will each be conducting independent reviews of the process.

The two security workers who were arrested told deputies they were working for Coalfire to test the Dallas County Courthouse's alarm system and law enforcement response time.

Polk County investigators have said they believe the same workers entered that county's courthouse on the night of Sept. 9, based on surveillance footage. Investigators also say a small electronic device bearing the Coalfire logo was found in the Polk County Courthouse. No charges have been filed against the men in that county.

There have been no reports that the Judicial Branch Building was breached.

The arrested workers — Justin Wynn of Naples, Florida, and Gary Demercurio of Seattle — face charges of third-degree burglary and having burglary tools. They've been released on $50,000 bond apiece and have since returned to their home states, their attorney, Matthew Lindholm of Des Moines, said.

Lindholm said he hopes prosecutors review the contract with Coalfire "to see if these gentlemen were operating under the terms of the agreement. I think it's pretty clear they were."

Dallas County prosecutor Chuck Sinnard said his office has the security contract documents in its possession. He declined to comment further.