Comment Re: Prosecute what? (Score 4, Interesting) 58
And it's actually more straightforward with courts. The systems for courts are regulated at the state level, even for county and municipal courts, at least in my state. That means pretty strict compliance with state-level rules and regulations and authorization by state-level officials for things like auditing and inspection. If a lower court fails to comply, that state entity can compel that lower level jurisdiction to install an entirely segregated computer network entirely air-gapped to the local entity's LAN, meaning that court employees would have to shuttle data between their local org's PC and the court PC, with the court PC connected to a court access switch and court firewalling router with a court private network link back to state resources. And historically they've been very behind the times, still using friggin' T1 lines in the 2020s, where 1.544Mb will cost as much as a 10Gb metro ethernet circuit.
State courts allow local entities to have court PCs that can be on the local org's network with connectivity back to court resources without that special air-gapped network only if the local org accepts auditing and building that connection out to specifications. Pen testing is not an unreasonable thing to do, and if it's too easy to break into the building to gain access to PCs or network equipment and too easy to get onto the court's network then there's going to be a problem.