Charges were dismissed Thursday against the two cybersecurity burglars who penetrated the Dallas County Courthouse after hours last September as part of a secret contract with the Iowa Fifth Judicial District Administration.
“We are pleased that all charges are dropped in the Iowa incident,” said Tom McAndrew, CEO of the Colorado cybersecurity firm Coalfire, in a statement published Thursday on the Coalfire website. “With positive lessons learned, a new dialogue now begins with a focus on improving best practices and elevating the alignment between security professionals and law enforcement. We’re grateful to the global security community for their support throughout this experience.”
“Ultimately, the long term interests of justice and protection of the public are not best served by continued prosecution of the trespass charges,” said Dallas County Attorney Chuck Sinnard in a statement released Thursday. Sinnard said he hoped all future security operations would include “clear communication on the actions to be taken to secure the sensitive information maintained by the Judicial Branch, without endangering the life or property of the citizens of Iowa, law enforcement or the persons carrying out the testing.”
The case first attracted attention when Gary DeMercurio, 43, of Seattle, Wash., and Justin Wynn, 29, of Naples, Fla., were each arrested Sept. 11, 2019, on charges of third-degree burglary and possession of burglary tools after allegedly tripping a burglar alarm in the courthouse at 908 Court St. in Adel shortly after midnight.
When officers of the Adel Police Department and Dallas County Sheriff’s office responded to the alarm activation, they encountered the cyber-penetrators, who said “they were contracted to break into the building for Iowa courts to check the security of the building,” according to court records.
DeMercurio and Wynn were arrested and later released from the Dallas County Jail after each posting a $100,000 bond.
Three weeks later, the Iowa Senate Government Oversight Committee convened a “fact-finding meeting” at the state capitol in order to inquire into the unusual incidents. At the meeting, Iowa Supreme Court Chief Justice Mark Cady apologized to the committee “for diminishing public trust and confidence in the court system.”
Cady said mistakes were made, and he accepted responsibility.
“As the leader of the judicial branch,” Cady said, “I take full responsibility just as I now take responsibility to repair the damage and rebuild trust. In our efforts to fulfill our duty to protect confidential information of Iowans from cyber attack, mistakes were made. We are doing everything possible to understand and correct those mistakes, to be accountable for those mistakes and to make sure that they never, ever occur again.”
Sinnard asked the court in October to reduce the third-degree burglary charges against DeMercurio and Wynn to criminal trespass. Sinnard said he sought the reduced charges “pursuant to newly discovered evidence and for the reason that the facts and circumstances of the case now better fit the elements of the amended charge,” according to court records.
The charges were duly reduced, and a jury trial was scheduled for April 20, 2020. DeMercurio and Wynn’s West Des Moines attorney, Matthew T. Lindholm, filed a motion to dismiss the charges Dec. 5, 2019, and Dallas County District Court Judge Thomas P. Murphy dismissed the case Thursday.
“In the end,” said Chief Justice Cady, who died Nov. 15, 2019, “I hope we will not be judged as much by the mistakes made but by the character that we displayed by accepting responsibility and correcting them.”
