2 hackers are suing an Iowa sheriff for falsely arresting them, after the government hired them to break into a courthouse to test its security

Dallas county courthouse in iowa
The Dallas County Courthouse is seen, Tuesday, Oct. 20, 2020, in Adel, Iowa. Associated Press/Charlie Neibergall
  • The Iowa government hired a cybersecurity firm in 2019 to test security at five courthouses.
  • Two contractors tripped the alarm at one courthouse, and were arrested by the local sheriff.
  • The hackers are suing Sheriff Chad Leonard for refusing to accept a letter authorizing the break-in.
  • Visit Insider’s homepage for more stories.

Two hackers who were hired by Iowa’s judicial branch to break into courthouses to test security measures are suing a sheriff who arrested them on burglary charges, alleging that he ignored their “get out of jail free” letter and wrongfully detained them.

Gary DeMercurio and Justin Wynn were employed by the cybersecurity firm Coalfire in 2019 when the company accepted a contract with the state government to conduct “cybersecurity testing activities, including physical penetration” on five different buildings, according to the lawsuit, which was filed July 30 in Iowa District Court.

The pair were responsible for conducting “physical attacks,” such as lockpicking, on the Dallas County Courthouse on the evening of September 10, 2019, the lawsuit said. So when DeMercurio and Wynn broke in and tripped an alarm, prompting sheriff’s deputies to arrive, they quickly produced an authorization letter from the Iowa government and reassured the deputies they were meant to be there.

The deputies even phoned an Iowa Judicial Branch representative for confirmation and seemed satisfied with the “get out of jail free” letter, but the lawsuit said, “when [Sheriff Chad] Leonard arrived, the situation changed.”

Leonard refused to accept the letter, and ordered his deputies to arrest DeMercurio and Wynn, the lawsuit said. Ultimately, the pair were handcuffed, had their property seized, were held in jail for 20 hours on a $US50,000 ($AU67,651) bond, and were charged with third-degree burglary and possession of burglar tools.

Gary demercurio and justin wynn
These photos provided by the Dallas County Jail show Gary Demercurio and Justin Wynn after being arrested in September 2019. Dallas County Jail via Associated Press

The hackers’ lawyer says they were used as ‘scapegoats’

The charges against DeMercurio and Wynn were downgraded and later dropped entirely.

But their lawyer, Marty Diaz, told Insider that beyond just one uncomfortable night in jail, his clients suffered a violation of their civil rights, humiliation, mental anguish, and emotional distress as a result of the arrests.

Diaz said his clients continue to be affected by the incident two years later. They have missed out on potential job opportunities, he said, because Googling their names shows prospective employers news stories of their arrests paired with their mugshots.

Diaz added that Leonard used his clients as “scapegoats” for his gripe with the state government, which had hired Coalfire for the job.

“The sheriff’s position was that this is a county building, and therefore only the county can authorize the service,” Diaz said. But the courthouse is operated by the state of Iowa, which had the right to authorize the break-in, he argues.

“The sheriff didn’t know that. The sheriff believed only one thing – whether it was genuine or whether it was pride or hubris, that’s something that will have to be ironed out,” Diaz said. “He had an attitude about the fact that the state could do this on what he considered to be county property.”

DeMercurio and Wynn’s lawsuit seeks unspecified damages “in an amount that will deter [Leonard], and others similarly situated, from such conducting the future.”

The Dallas County Sheriff’s Office did not provide Insider with a comment, but told the Des Moines Register in a statement that “we deny the claims made in the petition and stand ready to defend ourselves in court.”