What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Two employees of cybersecurity firm Coalfire were arrested at the Dallas County Courthouse in Iowa on September 11, 2019, while conducting physical security testing for the Iowa Judicial Branch’s State Court Administration. They had been hired to test courthouse security, but the state administration and Coalfire disagreed over what the engagement authorized. An independent investigation later found unclear documents, inadequate oversight, and a failure to notify county sheriffs. In January 2020, Coalfire announced that the Dallas County Attorney had decided to dismiss the trespass charges; that announcement does not establish a court finding of innocence or the final disposition of every related matter.
Why were the testers arrested if they had been hired?
The testers were working under a professional security-testing engagement, not acting as unaffiliated intruders. The Iowa Judicial Branch’s State Court Administration (SCA) had engaged Coalfire to assess security at three locations, including the Polk County Courthouse. But authorization to perform a security assessment did not translate into a shared understanding of exactly what physical actions were permitted, when testing could occur, or how local officials would be informed.
In a September 18, 2019 statement, the SCA acknowledged the disagreement: “Coalfire and State Court Administration believed they were in agreement regarding the physical security assessments for the locations included in the scope of work. Yet, recent events have shown that Coalfire and State Court Administration had different interpretations of the scope of the agreement.” The Iowa Supreme Court’s later independent investigation examined the contract documents and the events surrounding the arrests (investigation report and supervisory order).
What happened at the two courthouses?
The investigation covered two events: an alleged break-in at the Polk County Courthouse on September 9, 2019, and the arrest of two Coalfire employees at the Dallas County Courthouse two days later. The Iowa Judicial Branch’s announcement identified both events while describing the dispute over the testing scope (September 20, 2019 announcement). The Polk event should be understood as an allegation described in the announcement and investigation, not as a finding established here.
PC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minute#1 Best Overall
The arrests took place during the contracted engagement, but that fact alone did not settle whether each action at each courthouse had been authorized or whether the relevant local authorities had been properly informed. The investigation’s central concern was a gap between the written scope, the participants’ understandings, and the way local law enforcement was prepared—or not prepared—for physical testing.
What was unclear in the testing authorization?
The engagement used multiple documents, including a service order, rules of engagement, and a social-engineering authorization letter. The independent report found that their language did not consistently define the practical boundaries of physical testing.
| Scope issue | What the investigation described |
|---|---|
| Locations | The April 17, 2019 service order described physical testing at three locations, including the Polk County Courthouse. The report identifies a scope dispute involving the courthouse events. |
| Permitted techniques | Broad terms such as “social engineering” and “penetration testing” did not clearly communicate the risks of physical entry or contact with police. |
| Testing hours | The rules of engagement said testing was expected during weekday business hours; the physical-assessment scope also contemplated activity during the day and evening; the authorization letter did not specify a time. |
| Local notification | The report found that the Polk and Dallas County sheriffs had not been notified. |
| Document review and oversight | The investigation found differing understandings among key staff, no attorney review of the documents before testing, and inadequate oversight. |
The overall testing period was scheduled for August 19 through September 27, 2019, with physical testing scheduled for September 9–13, according to the report. A broad project window, however, is not a substitute for specifying which site may be tested, which actions are allowed there, the approved hours, and who has authority to approve them.
What did Iowa change after the investigation?
On October 10, 2019, the Iowa Supreme Court issued a supervisory order directing that future state information-security contracts receive legal review. The order responded to the investigation’s findings; it does not establish that every alleged action was authorized by every government entity that might have been affected.
Rank #3
The SCA also apologized to the county sheriffs and boards of supervisors, saying: “State Court Administration apologizes to the sheriffs and boards of supervisors of Dallas County and Polk County for the confusion and impact these incidents have caused.”
Were the charges dropped?
Coalfire said on October 29, 2019, that the charges had been reduced from felony burglary accusations to criminal trespass (Coalfire’s October 2019 statement). On January 30, 2020, the company announced that the Dallas County Attorney had decided to dismiss the trespass charges after discussions involving Coalfire and the sheriff (Coalfire’s January 2020 announcement). Coalfire CEO Tom McAndrew said, “We are pleased that all charges are dropped in the Iowa incident.” That is the company’s characterization; the release specifically describes the Dallas County Attorney’s decision to dismiss trespass charges.
The cited announcement does not establish the final disposition of the Polk County allegation, any later civil litigation, or developments after January 2020. It should not be treated as a court ruling that the testers were innocent.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.What should a physical security-testing authorization spell out?
The failures documented in this case point to a practical checklist for organizations commissioning physical security assessments. This is a planning lesson drawn from the investigation, not a statement of a universal legal rule.
Quick Recap
Best Value
- Exact sites: Name each building and the areas that may be tested; identify who can authorize testing at each location.
- Allowed actions: State whether testing may involve physical entry, social engineering, interaction with staff, or actions likely to trigger a police response.
- Dates and hours: Set specific approved windows and resolve any differences among the service order, rules of engagement, and authorization letters.
- Local notification: Establish who will notify the relevant sheriff or police department, what they will be told, and when notification must occur.
- Escalation and stop-work: Provide reachable contacts for the client, tester, and local authorities, along with clear instructions for pausing or ending a test if responders arrive.
- Review and sign-off: Have the responsible legal and operational stakeholders review one consistent authorization before field work starts.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
