'Completely ridiculous': CEO of cybersecurity company contracted by judicial branch admonishes handling of employees' arrests

Anna Spoerre | The Des Moines Register

Show Caption Hide Caption A guide to Iowa's 99-county court system There may come a time when offering court services in all 99 counties could be reconsidered.

The CEO of the cybersecurity company that employs two men who were arrested after breaking into Iowa courthouses while on contract with the judicial branch called his workers pawns in a dispute between state and county officials, adding that their recent reduction of charges was not a win, but rather a failure of Iowa's judicial system.

Justin Wynn, 29, of Naples, Florida, and Gary Demercurio, 43, of Seattle, were charged with third-degree burglary and possession of burglary tools after they tripped the alarm at the Dallas County Courthouse early in the morning on Sept. 11.

Their charges were reduced Friday to trespassing, a simple misdemeanor, after Dallas County Attorney Charles Sinnard requested the men's charges be amended because "the facts and circumstances of the case now better fit the elements of the amended charge," according to court fillings.

The men have since pleaded not guilty to the reduced charges and demanded a jury trial, according to court documents filed Monday. They were released on bond shortly after their arrests.

Coalfire CEO Tom McAndrew in a statement Tuesday called the charges against his emloyees "completely ridiculous" while encouraging Iowans to "push for justice and common sense" in clearing the men's names.

"Our mission is to help our clients secure their environments and protect the people that work for them, their customers, and the confidential information they maintain," McAndrew wrote. "In this case, we were helping to protect the residents of Iowa."

Sinnard on Wednesday declined to comment on the substance of the case because it's pending.

"But if Mr. McAndrew certainly wants to make this a case about professionalism, we are ready to meet that argument in court," Sinnard said.

We've been the news Iowa depends upon since 1849. Help us continue our mission.​​​​​​​

McAndrew said Coalfire employees are often stopped by law enforcement, but he said in the hundreds of assignments they've done, this is the first time his workers weren't immediately released after law enforcement saw their authorization letter and called the judicial branch employees they were working for.

"Frankly this matter is unprecedented within the tight-knit security industry," McAndrew said. "And to our knowledge, no physical security professional has been arrested and officially charged while executing a contract."

He cautioned that this could set a "horrible precedent" for the millions of information security professionals across the country who might now be worried their jobs could land them in jail, which he described as a waste of time and taxpayer dollars.

McAndrew, who said he's retired from a 20-year-long career in the Navy, described Demercurio and Wynn as some of the best physical security testers in the company, adding that one is a former Marine Corps Officer.

He said he's embarrassed by the way his employees have been "vilified" for doing their jobs.

"I’m ashamed that no one has had the courage to step up and do what is right," McAndrew continued. "People appear to be more concerned about their own jobs or the political repercussions."

"Drop the charges, purge their records," he added. "These men are unsung heroes, not criminals."

The judicial branch and Coalfire, headquartered in Colorado, signed a master agreement on Jan. 14, 2015.

McAndrew defended Demercurio and Wynn's use of penetration testing as a common and practical means of risk assessment.

The Coalfire employees prior to entering the Dallas County Courthouse also tested the security of the Judicial Branch Building at night, leaving a business card on an employee's desk to show they made entry.

The next morning the judicial branch employee said "I guess I owe you a congratulations," according to the news release.

The night his employees went to test the Dallas County Courthouse, McAndrew said they found the courthouse door open. They then closed and locked the door to better test the security.

"Our employees, being of the highest caliber and committed to delivering the best results on the project, chose to give the county the benefit of the doubt and test the courthouse as if they had found it in a secure state, which it was not," McAndrew said.

Demercurio and Wynn proceeded to purposefully trip the alarm to test law enforcement's response time. When they arrived, McAndrew said, the deputies seemed delighted to be shown the tools and tactics the Coalfire employees used to enter the building.

McAndrew blamed the men's arrest on the arrival of Dallas County Sheriff Chad Leonard on the men's arrest, saying he failed to "de-escalate" the situation, as the deputies already on site were ready to let the men go.

"Sheriff Leonard failed to exercise common sense and good judgment and turned this engagement into a political battle between the State and the County." McAndrew wrote. "I was stunned that the next morning the issues were not resolved and were actually amplified when bail was set as $100,000."

Leonard on Wednesday said he stands by his decision, but declined to comment further while the case is ongoing.

McAndrew said Coalfire footed the bond bill to get the men out of jail.

It was revealed shortly after that Wynn and Demercurio also broke into the Polk County Courthouse and the Judicial Branch Building.

Outrage followed on all sides.

According to an email obtained by the Des Moines Register, Leonard wrote to other Iowa sheriffs in the hopes of alerting them about the break-ins, detailing his exchange with the Coalfire employees and judicial branch employees.

Iowa's Senate Government Oversight Committee convened to question county and judicial branch officials, often directing questions about safety liabilities affiliated with the operation at judicial branch employees.

Iowa Supreme Court Chief Justice Mark Cady publicly apologized, saying the episode diminished “public trust and confidence in the court system."

The judicial branch later issued new policies requiring that future security tests are done with the knowledge of local law enforcement.

"Yes, occasionally there are dangers associated with that as they must deal with law enforcement that may or may not understand what is happening," McAndrew wrote Tuesday. "However, being the consummate professionals that they are, they are skilled in defusing situations and making them non-confrontational, much like they did on this engagement as no officer pulled a weapon of any sort."

Demercurio and Wynn's attorney, Matthew Lindholm, said in a statement Monday that his clients won't rest until their charges are dropped.

"(Wynn and DeMercurio) find themselves caught at the center of a power struggle in which certain county authorities have felt slighted by the Iowa Judicial Branch," Lindholm wrote in a statement.

"Unfortunately," Lindholm continued, "the county has seized upon these gentlemen’s successful performance of their jobs as an opportunity to settle a score instead of focusing on the clearly deficient security being provided to the courthouse and the confidential and sensitive information therein."

Wynn and Demercurio are set to appear in court next on Nov. 6 for an initial hearing, court records show.

Anna Spoerre covers crime and courts for the Des Moines Register. She can be contacted at aspoerre@dmreg.com, 515-284-8387 or on Twitter at @annaspoerre.

Your subscription makes work like this possible. Subscribe today at DesMoinesRegister.com/Deal.​​​​​​​