Why Incompetent Prosecutors Are a Bigger Threat Than Hackers
Here’s a reality most executives, lawmakers, and law-enforcement leaders still refuse to face:
If you can’t tell the difference between an authorized penetration test and a crime, you should not be in charge of security or justice.
That failure is exactly what played out in Dallas County, Iowa. And the response from leadership since then proves the problem was never confusion. It was incompetence.
Two professional penetration testers were hired by the Iowa Judicial Branch to test courthouse security. They were authorized. They were documented. They were operating within scope. [1][2]
They were arrested anyway.
Not because they broke the law, but because people in power didn’t understand what security testing actually looks like and chose prosecution over accountability.
What Happened — And Why This Was Never a Gray Area
In 2019, penetration testers Gary DeMercurio and Justin Wynn, working under contract for security firm Coalfire, were tasked with evaluating physical security at Iowa courthouses, including the Dallas County Courthouse in Adel. [1][2][3]
This wasn’t a paperwork exercise. It was real-world testing; doors, alarms, access controls, and response procedures. The exact same vectors that criminals exploit.
During testing, an alarm was triggered. Law enforcement responded. The testers immediately identified themselves, presented credentials, and produced written authorization from the Iowa Judicial Branch. [1][2]
That should have ended the encounter.
Instead, they were arrested, jailed for nearly 20 hours, and charged with felony burglary. [1][2]
Charges that should never have been filed.
The Arrest Was Bad. The Prosecution Was Unforgivable.
Mistakes happen. Systems fail. Arrests can be corrected.
Prosecutions are a choice.
Rather than acknowledge a breakdown in coordination and authority, the Dallas County Attorney’s office chose to escalate. The testers were prosecuted despite clear authorization and despite the state being the entity that hired them. [1][2][5]
This wasn’t about public safety.
It wasn’t about evidence.
It was about ego and saving face.
Years later, after extensive litigation, Dallas County agreed to a $600,000 settlement just days before trial. [1][2][3]
That settlement wasn’t an apology. It was an admission they couldn’t defend their actions in court.
The Prosecutor Who Still Doesn’t Get It
Here’s where this story crosses from incompetence into something worse.
Following the settlement, Dallas County Attorney Matt Schultz publicly stated that if a similar situation occurred again, he would prosecute “to the fullest extent of the law.” [1][6]
That statement matters.
It tells every security professional, every CISO, and every contractor exactly where they stand: do your job too realistically, and you risk prosecution anyway.
This is not leadership.
This is a threat.
And it proves the lesson was never learned.
This Is What Penetration Testing Looks Like
Penetration testing is not polite.
It is not clean.
It is not comfortable.
It looks like an attack, because attackers don’t announce themselves.
If your security posture only works when everyone behaves predictably and no alarms are triggered, then you don’t have security. You have theater.
When officials treat realistic testing as criminal behavior, they don’t deter crime; they discourage defense. [2]
And the result is simple: vulnerabilities remain untested until someone with malicious intent finds them first.
Fear-Based Leadership Is a Security Liability
Instead of fixing the root cause, lack of coordination, poor legal clarity, and cybersecurity illiteracy, the institutional response in Iowa was to restrict or prohibit realistic “break-in” style testing altogether. [3]
That is not risk reduction.
That is denial.
Banning discovery doesn’t eliminate vulnerabilities.
It just guarantees you won’t find them until it’s too late.
The Real Vulnerability: Ignorance in Positions of Power
The testers lost years of their lives, their reputations damaged by public arrest records and headlines. [2][5]
The officials responsible lost nothing.
This is the most dangerous vulnerability in modern security: people with authority over technical systems who refuse to understand them and refuse to listen to experts.
When prosecutors and policymakers ignore written authorization, treat expertise as threat, and escalate out of fear instead of facts, they become the risk.
Some People Should Not Hold These Roles
This needs to be said plainly:
Anyone who cannot distinguish between authorized security testing and criminal behavior should not hold prosecutorial or security authority.
This isn’t political.
It isn’t ideological.
It’s operational reality.
Cybersecurity and physical security require informed leadership. If someone repeatedly demonstrates they don’t understand the domain and still insist on punishment over learning, retraining is not enough.
They need to be replaced.
A Direct Call to Action
For lawmakers:
Codify legal protections for authorized penetration testing.
Define clear statutory consent standards.
Require cybersecurity literacy training for prosecutors and judges.
For CISOs and executives:
Ensure penetration testers are legally protected, not just contracted.
Coordinate explicitly with legal counsel and law enforcement before testing.
Push back against leadership that prioritizes optics over security.
Because the next time this happens, it may not end in a settlement.
It may end in an unpatched vulnerability being exploited quietly, efficiently, and catastrophically.
Final Thought
The Iowa courthouse case wasn’t a failure of security testing.
It was a failure of leadership.
And until we start holding the right people accountable and removing those who refuse to understand the systems they govern, we will continue arresting defenders while inviting attackers to walk right in.
Author Bio
Len Noe is a Transhuman hacker, international cybersecurity speaker, and technical evangelist with over three decades of enterprise security experience. A retired 1% motorcycle gang member turned ethical hacker, Len now uses his unique perspective, augmented with 11 implanted microchips, to raise awareness on the convergence of human augmentation, cybersecurity, and the future of digital identity.
References
[1] KCRG-TV9 — Cybersecurity testers reach $600,000 settlement after wrongful arrest
https://www.kcrg.com/2026/01/30/cybersecurity-testers-reach-600000-settlement-after-wrongful-arrest/
[2] Ars Technica — County pays $600,000 to pentesters it arrested for assessing courthouse security
https://arstechnica.com/security/2026/01/county-pays-600000-to-pentesters-it-arrested-for-assessing-courthouse-security/
[3] KCCI Des Moines — Coalfire contractors settle Dallas County lawsuit
https://www.kcci.com/article/coalfire-contractors-settle-dallas-county-lawsuit/70179636
[4] LinkedIn — Dave A. Schroeder, County pays $600,000 to pentesters it arrested
https://www.linkedin.com/posts/daveaschroeder_county-pays-600000-to-pentesters-it-arrested-activity-7422969879265398784/
[5] CourtListener — DeMercurio v. Dallas County, Iowa (public court records)
https://www.courtlistener.com/docket/18529503/demercurio-v-dallas-county-iowa/
[6] Statements by Dallas County Attorney Matt Schultz, as reported by KCRG-TV9
https://www.kcrg.com/2026/01/30/cybersecurity-testers-reach-600000-settlement-after-wrongful-arrest/