State employees authorized courthouse 'penetration,' records show
 ..<p>PenTesters for the state&#x2F;government cybersecurity require a special designation #red_team that allows for incursion and flag dropping;  &#x27;tracepoints&#x27;  -- public disclosure. There are a lot of steps and often it involves writing out a clear mission scope&#x2F;goals to avoid this type of circumstance.<p>This includes progress reports to their organizational handler announcing the intentions&#x2F;progress .. progressive research. Introductions by state employees, informing the law enforcement.<p>OFTEN ..<p>I find myself informing the officials &amp; administrators during normal business hours, etc. &quot;people who may be affected&quot; that could be conducting an exercise that involves your building in [timeframe] you have until then to prepare; readiness drills etc.  bring it.<p>Afaik getting caught is part of the fun (how far can I get before you catch me?) but there&#x27;s always a point of no return where it&#x27;s not fair; never typing the rm -Rf or &quot;encrypt *&quot; commands but you never actually do if you&#x27;re a good person;  I know I had a lot of interesting &quot;oops&quot; moments in my early career where I accidentally embarrassed somebody and made an enemy.<p>IT Departments are run by normal people who have limited budgets and time; and I like to point out that a failure usually means a better budget justification to fix it; and assurance that anything we break we&#x27;ll fix; but how confident are they in their backups and how easily I can get to them.<p>So fuck that cowboy pen testing bullshit, a great hacker will only use that as a last resort and then EVERYBODY should know it&#x27;s happening so there is less risk.  This is why &quot;this is a test&quot; is played during military exercises; because it&#x27;s about the readiness drill.  I will take your system down; with or without you -- do you want to watch?<p>I&#x27;ve had new guys on teams suggest cutting primary wires; to trigger failures i.e. &quot;video camera feeds&quot; etc to demonstrate coverage lapses in physical security. if they did any property damage; they are liable for that.<p>If the building administrators decline the #red_team audit; then we submit that back into the report and put them on our &quot;naughty list&quot;; which means well try 2x harder to embarrass that particular person; shame on them.... it needs to be clear that a failure does not necessarily reflect badly on them in our report; unless they were blocking the audit; that is bad.  that&#x27;s all you can do; they don&#x27;t want to engage -- forward it to the foreign upper bureaus who don&#x27;t need to follow the same disclosure rules as a good place to train recruits.<p>As a hacker; pen-tester #red_team
I make it clear that&#x27;s exactly what I&#x27;m going to do if they don&#x27;t personally cooperate; usually they&#x27;d rather be helpful than risk pissing me off and being the subject of my wrath - we work together to fix it.  It&#x27;s a bit heavy handed; .. 2020 election security is going to suck donkey balls btw.<p>&#x2F; #red_team