News for hackers. Stuff that matters.
Re:Coalfire Comments on Penetration Tests for Iowa Judicial ... by jtbayly on Thursday September 19, 2019 @12:56PM (#21018091)
People keep saying it's the sheriff's fault for not listening, or being on a power trip or something and referencing this article. But this quote from the article is pretty important and implies that Coalfire exceeded what was allowed in the contract.

"According to the agreement, all Coalfire tests were to be conducted between 7 a.m. and 7 p.m. Monday through Friday. But tests could be carried out outside that range if requested through a change order.

The break-ins in Adel and Des Moines were investigated around midnight on separate days.

No change order was released that would have indicated the judicial branch wished the tests be carried out at night."

Re:Coalfire Comments on Penetration Tests for Iowa Judicial ... by rootusrootus on Thursday September 19, 2019 @02:32PM (#21019107)
Except the sheriff didn't make the argument that it was outside the time window, he said the state did not have the right to authorize a break-in attempt on a county courthouse.

My guess is the state will shortly remind the county about government hierarchy.

Re:Coalfire Comments on Penetration Tests for Iowa Judicial ... by nradov on Thursday September 19, 2019 @04:51PM (#21020630)
State government agencies can only override county governments when there is specific state law allowing them to do so. State bureaucrats can't legally just order a sheriff to do whatever they want.
Re:Coalfire Comments on Penetration Tests for Iowa Judicial ... by pjlegato on Thursday September 19, 2019 @05:25PM (#21020910)
It's the other way around: US counties have any legal authority only at the pleasure of their state government, as expressed in its constitution or by statute. They are only immune from state government overrides of their authority to the extent there is a specific law prohibiting the state from overriding their authority.
Re:Coalfire Comments on Penetration Tests for Iowa Judicial ... by nradov on Thursday September 19, 2019 @07:30PM (#21021775)
That is incorrect. States do have the power of preemption, but state officials can only issue directives to local government officials when there is a specific enabling state law. They don't have dictatorial powers.
Re:Coalfire Comments on Penetration Tests for Iowa Judicial ... by bsder on Thursday September 19, 2019 @07:36PM (#21021816)
> State government agencies can only override county governments when there is specific state law allowing them to do so.

I think that's only true for a few old states with some oddities dating back to grants from The Crown.

For everybody else, I'm pretty sure the local government is mostly at the whim of the state government.

Now most states don't do that because it screws things up badly. However, there have been some high profile cases in Texas, for example, where a state judge comes with the Rangers, displaces the local judge and starts arresting everybody.

Re:Coalfire Comments on Penetration Tests for Iowa Judicial ... by nradov on Thursday September 19, 2019 @07:51PM (#21021931)
That is an entirely different and irrelevant example. The Rangers are specifically authorised to arrest people throughout Texas under state law. However they generally cannot issue a legally valid order preventing a county sheriff from arresting a suspect.
Re:Coalfire Comments on Penetration Tests for Iowa Judicial ... by rootusrootus on Thursday September 19, 2019 @05:22PM (#21020885)
Perhaps not, though I am unfamiliar with Ohio's state constitution.
Re:Coalfire Comments on Penetration Tests for Iowa Judicial ... by jtbayly on Thursday September 19, 2019 @07:36PM (#21021813)
Sure, but it’s not a cut and dry full exoneration of Coalfire, like everybody is claiming. They clearly exceeded the bounds of their contract if this is true.
Re:Coalfire Comments on Penetration Tests for Iowa Judicial ... by 0xDEFC0DE on Thursday September 19, 2019 @01:09PM (#21018250)
The scoping doc link in this thread pretty clearly indicates the address where this happened.

The fault seems to be with the person who authorized the physical portion in the contract not actually having the authority. And unfortunately that means Coalfire employees are caught in the crossfire.