For someone who is in such a position in the future, always notify the local police in writing and by phone call, if not also in person, before starting such an exercise. Make sure they have the get-out-of-jail documentation in advance of the exercise. If the police doesn't approve, don't do it. It would be better to get a no-objection letter from the police in advance. Make sure an attorney is aware of the activities and all documentation. Do not take any chances. You don't live in a kind or forgiving world. Handling unknown unknowns is the point.

▲

sehugg 5 hours ago | parent | next [-]

They had written authorization from the state court and verbal confirmation from state court officials. They didn't know there would be a pissing match between the judicial branch and the sheriff.

▲

827a 4 hours ago | parent [-]

But afaik this wasn't a state courthouse; it's a county courthouse. Legally, obviously, the state has authority and they were in the right, but functionally this is really good advice: if you're doing a penetration test of a space, you functionally need to clear it with the people who are responsible for the security of that space, and whom you might encounter defending it.

Frankly, I would not have taken this gig unless you had verbal confirmation that the Sheriff knows about it and has signed off. If you're entering a red team situation where the State wants to assess the security of their county courthouses, but doesn't want the local authorities to know its happening because they don't trust them: That is not a situation you want to be in the middle of, they gotta sort that out.

▲

Kina 14 minutes ago | parent | next [-]

This really depends on how a state structures this, but “county courthouse” is not necessarily a meaningful statement. The judiciary is a state function and it has been delegated to county for purposes of logistics. In larger states, each county gets to set its own court rules, fee schedules, etc. because it would be maddening otherwise. They still ultimately answer to the state judiciary.

Iowa is small enough that it looks like the Iowa Judicial Branch just runs everything directly. Every county seat in Iowa has a courthouse, but the county probably doesn’t really have any control of it.

My guess is that the sheriff had an ego and may not have wanted a finding against him.

▲

jstanley 4 hours ago | parent | prev | next [-]

Easy to say in hindsight.

▲

aksss 4 hours ago | parent | next [-]

Hindsight's how we all learn. Doing it over again, I'm sure those guys would have done things differently. Any team would be crazy today to not be more prudent in how they operate.

	▲	jstanley 2 hours ago \| parent \| next [-]
		Sure, the part I thought was "easy to say in hindsight" was: > I would not have taken this gig unless you had verbal confirmation that the Sheriff knows about it and has signed off. We don't know that! We don't know what we would have done in that scenario, especially in the context of a thread about the very outcome one's supposed foresight would have prevented. From https://en.wikipedia.org/wiki/Hindsight_bias#Attempts_to_red... : > Research suggests that people still exhibit the hindsight bias even when they are aware of it or possess the intention of eradicating it. [...] The only observable way to decrease hindsight bias in testing is to have the participant think about how alternative hypotheses could be correct. So here's an alternative hypothesis: "Hey, do you reckon we should clear this with the county first? The sheriff might come and arrest us on the basis that nobody told him we were going to break into the courthouse" "Nah, don't worry about it, I've done this sort of thing hundreds of times. And besides, the state has superiority over the county anyway, so even if we get caught which let's face it we won't because we're leet hackers and very incognito... the sheriff won't have any power to do anything to us as soon as we tell him it's authorised by the state" "SGTM"
	▲	jrflowers an hour ago \| parent \| prev [-]
		Exactly. If I were in that position I would have simply learned from what happens in the future. In the rare instance that there was a negative outcome, I would just inform my previous self so that I could retroactively ensure that that outcome had not occurred. It is through this simple system that I can confidently say that the content of this article that I am reading today in 2026 had/will have an impact on what I would have done in 2019

▲

OutOfHere 4 hours ago | parent | prev [-]

Considering today's world, they're lucky they didn't get shot dead with an entire clip.

▲

tiahura 2 hours ago | parent | prev [-]

Legally, obviously, the state has authority

That’s not legally obvious. State v county control over courthouses creates fights over everything from Aesbestos to parking to security. The legal answers lie in state constitutional provisions that nobody ever reads and aren’t particularly helpful.

▲

Aurornis 4 hours ago | parent | prev | next [-]

> If the police doesn't approve, don't do it. It would be better to get a no-objection letter from the police in advance.

The article says they did have an authorization letter from the state court officials (the people running the building) and they were released right after the letter was verified with the court officials.

At least from what I can see, the police officers involved were doing the right thing. They detained the suspects, made a proper effort to listen to them and validate their story, and then released them.

It was the Sheriff who showed up and didn't like it who then hassled them further.

They basically had a no-objection letter from the people in charge of the building and the police officers were onboard. It was one person who tried to turn it into something else.

▲

antonymoose 2 hours ago | parent | prev | next [-]

That simply is not how the police work. If they get a call about a break in they’re going to respond and assess.

I bought property with a shooting range years ago from a retired SWAT officer with the county. He mentioned that “he always calls the sheriff’s office to let them know if he was doing anything.” Now I’d never owned a private range and am not from this county.

I called up the sheriff’s office and asked for clarification. I was advised that no such policy / program exists or is required and if the officer must have had is own internal policies and chain o command and that is irrelevant to me as a random citizen. In short, if a call is made about a shooter they will have to respond and so long as I’m not doing anything stupid, dangerous, or outright illegal I have nothing to worry about. The same goes for any other type of call.

▲

xmcp123 4 hours ago | parent | prev | next [-]

Wouldn’t that in a lot of ways invalidate the test?

You’re trying to see what can be done and what the response is from the current security practices and the police showing up seems like an important part of that.

	▲	OutOfHere 3 hours ago \| parent [-]
		It is not clear what as the defined purpose of the test, if it was to measure a successful entry+exit, or measure police response, or both. If measuring the police response was a purpose, the police should still have been notified, just not of the exact date when it would happen. Executing it on a random day should offset the prior awareness of the police. Secondly, it is up to the police leadership to keep it quiet.

▲

giantg2 2 hours ago | parent | prev [-]

If the state wants to verify the counties are doing an adequate job, then tipping them off could result in an invalid assessment. The sheriff's reaction raises suspicion that there are deficiencies he doesn't want found