Hired to break in, then jailed for it: the Iowa courthouse pen test

In September 2019 two security consultants hired by Iowa's own court system to test courthouse security spent the night in jail, charged with felony burglary for doing the job they were paid to do.^[1] This case file covers how a physical security test went wrong, what it cost everyone involved, and the one control that would have kept it from happening.

What happened

How it went wrong

A physical penetration test is a legitimate, common service. A business or agency pays a firm to try to get past its locks, alarms and front desk, so weaknesses are found by friends instead of burglars. What makes it legal is permission from whoever has the right to grant it, written down in a scope document that says which buildings, which hours and which methods are allowed.^[2]

That is where this test failed. The court administration signed the contract, but the Dallas County courthouse was a county building. The county, and its sheriff, had not agreed to anyone breaking in. Coverage of the case pointed to real uncertainty over who controlled the building, the state's courts or the county, and Coalfire's chief executive later said his firm had not understood that split.^[1]

The paperwork was also vague on the details that mattered in the moment. The court administration and Coalfire disagreed about what the agreement allowed, including whether after-hours entry and opening locked doors were in bounds.^[2] When the people with guns and handcuffs arrived, the letter in the testers' pocket came from a party the sheriff did not answer to.

What it cost

The felony charges were later reduced to misdemeanor trespass.^[1][5] On January 30, 2020, the Dallas County prosecutor dropped the remaining charges, saying the long-term interests of justice were better served by cooperation than by prosecution.^[1]

That was not the end. The two testers sued the county and the sheriff, and in January 2026 the case was settled for $600,000, just before it was due to go to trial.^[6][7] The whole episode took more than 6 years to resolve.

The missing control

The missing control: a written scope approved by every owner of the thing being tested. The contract had one signature from the courts, but the building, the alarm and the police response belonged to the county, and nobody got its sign-off.

A properly approved scope would have named each building, confirmed who owned and secured it, listed the allowed methods in plain words, and carried signatures from each of those owners, plus a contact who could be called at 1 a.m. to vouch for the testers. With the county on board, the sheriff would have known about the test, or could have confirmed it with one phone call, and a routine alarm response would have ended with a handshake instead of handcuffs.^[1][2]

What to do in your business

• Check who owns what before any test. If you rent your office, share a building, or use a managed IT provider or cloud service, the landlord or provider may need to approve a security test too.
• Put the scope in writing, in plain words. List the exact locations, systems, dates, hours and methods allowed, and what is off limits, so there is no room for two readings.
• Get every owner to sign. Collect signatures from each party that controls a building, network or account in scope, not just the person paying.
• Give testers a 24-hour contact. Provide a named person with a phone number who can confirm the work at any hour, and tell your alarm company in advance.
• Apply the same rule to any outside access. Contractors, cleaners and IT vendors entering after hours should carry written approval from someone with authority over that space.

Facts are drawn from court records, government reports, company statements and reputable reporting, listed below. People are named only where they were convicted, pleaded guilty or spoke publicly in an official role.