Importantly, in this story it's confirmed that the pen testers were carrying documentation and phone numbers of people in the State department who could (and did) confirm their stories.

When this story first broke, there was speculation that, "this is why you carry a get out of jail free card." But if this story is true, the testers did everything right, and the deputy just decided to jail them anyway.

I know physical testers who will carry a fake "get out of jail free card" that lists their own people as the point-of-contact so they can highlight the lack of verification as a weakness. If it does get verified they have a "backup" real one.

It is possible they attempted this and the police were none too happy being lied to.

It's not possible in this case, unless the news source above is misreporting the story.

> "I advised them that this building belonged to the taxpayers of Dallas County and the State had no authority to authorize a break-in of this building," Leonard wrote in the email.

> Leonard wrote that he then called the state employee to tell him his contractors had been arrested and that he didn't have the authority to authorize this.

If Leonard had called their point-of-contact and it had been fake, it would be weird for him not to lead with that detail.

Unsurprisingly, cops are assholes

It isn't only that - there are both good and a$$hole cops...But, it seems in the U.S. there isn't a consistent governance of law enforcement across all levels of government, nor across the whole geography of the nation...leading to some (many?) cops abusing their power.

It's not good enough to have an authorization- you need to have authorization from the proper stakeholder!

That is the dispute here.

The downside of having such balkanised (in that some many individual entities have their own police force) police service I suspect.

There is going to be a lawsuit and Iowa is going to settle.

> One man told a deputy that they were conducting a vulnerability study and handed the deputy a piece of paper, which he described as his "get out of jail free card," containing the names and contact information for three state employees, [Dallas County Sheriff Chad Leonard] wrote.

> A police sergeant called one of the state employees, who confirmed what the men said: that this was a legitimate contract and that the men should be let go, according to the email.

> "I advised them that this building belonged to the taxpayers of Dallas County and the State had no authority to authorize a break-in of this building," Leonard wrote in the email.

> Leonard wrote that he then called the state employee to tell him his contractors had been arrested and that he didn't have the authority to authorize this.

> The state employee disagreed and asked Leonard not to tell other sheriffs, wrote Leonard, who said he responded by saying he was going to tell every sheriff.

It's not just an implication, the police just decided to arrest them anyway.

People keep saying it's the sheriff's fault for not listening, or being on a power trip or something and referencing this article. But this quote from the article is pretty important and implies that Coalfire exceeded what was allowed in the contract.

"According to the agreement, all Coalfire tests were to be conducted between 7 a.m. and 7 p.m. Monday through Friday. But tests could be carried out outside that range if requested through a change order.

The break-ins in Adel and Des Moines were investigated around midnight on separate days.

No change order was released that would have indicated the judicial branch wished the tests be carried out at night."

Except the sheriff didn't make the argument that it was outside the time window, he said the state did not have the right to authorize a break-in attempt on a county courthouse.

My guess is the state will shortly remind the county about government hierarchy.

State government agencies can only override county governments when there is specific state law allowing them to do so. State bureaucrats can't legally just order a sheriff to do whatever they want.

It's the other way around: US counties have any legal authority only at the pleasure of their state government, as expressed in its constitution or by statute. They are only immune from state government overrides of their authority to the extent there is a specific law prohibiting the state from overriding their authority.

That is incorrect. States do have the power of preemption, but state officials can only issue directives to local government officials when there is a specific enabling state law. They don't have dictatorial powers.

> State government agencies can only override county governments when there is specific state law allowing them to do so.

I think that's only true for a few old states with some oddities dating back to grants from The Crown.

For everybody else, I'm pretty sure the local government is mostly at the whim of the state government.

Now most states don't do that because it screws things up badly. However, there have been some high profile cases in Texas, for example, where a state judge comes with the Rangers, displaces the local judge and starts arresting everybody.

That is an entirely different and irrelevant example. The Rangers are specifically authorised to arrest people throughout Texas under state law. However they generally cannot issue a legally valid order preventing a county sheriff from arresting a suspect.

Perhaps not, though I am unfamiliar with Ohio's state constitution.

Sure, but it’s not a cut and dry full exoneration of Coalfire, like everybody is claiming. They clearly exceeded the bounds of their contract if this is true.

The scoping doc link in this thread pretty clearly indicates the address where this happened.

The fault seems to be with the person who authorized the physical portion in the contract not actually having the authority. And unfortunately that means Coalfire employees are caught in the crossfire.