It’s “completely ridiculous” that pentesters are still facing criminal charges in Iowa for doing what they were hired to do.

If Iowa doesn’t get its act together, businesses and government will have trouble getting security firms to analyze and test their security. Even after law enforcement was told that Justin Wynn and Gary DeMercurio were Coalfire employees just doing what Coalfire had been hired to do by the judicial branch, the men are still facing criminal charges. The charges were reduced from third-degree burglary (a felony) to trespass (a misdemeanor), but even that is totally absurd.

Tim McAndrew, Coalfire’s CEO has issued a strong statement this week. It is reproduced below. I think everyone in infosec should help spread the word that security testers who are testing as part of a contract to test security should not be criminally charged.