County pays $600,000 to pentesters it arrested for assessing courthouse security

Two security professionals, Gary DeMercurio and Justin Wynn, who were arrested in 2019 for conducting an authorized security assessment of an Iowa county courthouse, will receive $600,000 to settle a lawsuit alleging wrongful arrest and defamation. Despite having written authorization for the assessment, they were arrested on felony charges, which were later reduced to misdemeanors. The incident raised concerns among security professionals about the potential consequences of performing authorized security assessments. The case highlighted the challenges faced by penetration testers in conducting their work and the importance of clarifying rules of engagement for such exercises.