After Six Years, Two Pentesters Arrested in Iowa Receive $600,000 Settlement
Source: Slashdot
Incident overview
“They were crouched down like turkeys peeking over the balcony,” the county sheriff told Ars Technica.1
A half hour past midnight on September 11, 2019, deputies spotted two men skulking through the Dallas County Courthouse in Iowa, “carrying backpacks that remind me and several other deputies of maybe the pressure‑cooker bombs.”
Justin Wynn, 29, of Naples, Florida, and Gary De Mercurio, 43, of Seattle, slowly proceeded down the stairs with their hands raised. They presented a letter explaining that they were penetration testers hired by Iowa’s State Court Administration to test the security of the court information system. After deputies contacted the state court officials listed in the letter, the men were deemed authorized to be in the building.
Despite this, Sheriff Chad Leonard arrested the men on felony third‑degree burglary charges (later reduced to misdemeanor trespassing). He told them, “The State of Iowa has no authority to allow you to break into a county building. You’re going to jail.”
Legal aftermath
The men were charged with burglary and possession of burglary tools, but the charges were later dropped. Their attorney noted that the felony arrest record made finding employment difficult.
County Attorney Matt Schultz said the dismissal of the charges was the decision of his predecessor and that he believed the sheriff did nothing wrong. He added, “I am putting the public on notice that if this situation arises again in the future, I will prosecute to the fullest extent of the law.”
Settlement
More than six years later, Dallas County agreed to pay a total of $600,000 to Wynn and De Mercurio as a settlement of their lawsuit. The lawsuit was filed in July 2021 and has moved between state and federal courts.234
The settlement was announced in January 2026, after the case had been scheduled for trial on Jan. 26 but was resolved when the parties notified the court on Jan. 23 of the impending deal.
“The settlement confirms what we have said from the beginning: our work was authorized, professional, and done in the public interest,” De Mercurio said. “What happened to us never should have happened. Being arrested for doing the job we were hired to do turned our lives upside down and damaged reputations we spent years building.”
“This incident didn’t make anyone safer,” Wynn added. “It sent a chilling message to security professionals nationwide that helping government identify real vulnerabilities can lead to arrest, prosecution, and public disgrace. That undermines public safety, not enhances it.”