Cybersecurity Experts Arrested Despite Legal Permission for Courthouse Test

In 2019, two cybersecurity experts were arrested while conducting an authorized security test at an Iowa courthouse. Gary DeMercurio and Justin Wynn had written permission for their work, yet they faced burglary charges and a lengthy legal battle. The incident sparked widespread concern across the cybersecurity industry.

DeMercurio and Wynn were performing a red-team exercise—a simulated attack designed to expose weaknesses in the Dallas County Courthouse's security. Despite holding official authorization from the Iowa Judicial Branch, they were detained by local law enforcement. Sheriff Chad Leonard maintained that their actions were illegal, even after the experts presented their paperwork.

The arrest led to a lawsuit against Dallas County and Leonard himself. DeMercurio and Wynn accused the authorities of false arrest, malicious prosecution, defamation, and emotional distress. Rather than going to trial, the county settled the case out of court, agreeing to pay the two experts $600,000 in damages.

The fallout from the incident extended beyond the legal dispute. Both professionals suffered reputational harm, and the cybersecurity community questioned the risks of conducting authorized tests. Since then, DeMercurio has moved on to establish his own firm, Kaiju Security.

The settlement marked the end of a contentious legal fight, but the case left lasting questions about how security professionals are treated during legitimate assessments. With $600,000 awarded to DeMercurio and Wynn, the resolution underscored the importance of clear communication between testers and law enforcement. The incident remains a cautionary example for those working in cybersecurity.