The state of Iowa has released documents that appear to support the claims of two men who said they were just doing their job testing security when they were arrested on suspicion of breaking into a courthouse this month. The men were working for Colorado-based cybersecurity company Coalfire when they were arrested after being found on the third floor of the Dallas County Courthouse just after midnight Sept. 10.

The state has said it hired Coalfire to test only the security of electronic access to court records and not to force “entry into a building.” The two workers still face criminal charges. Yet the contract between Coalfire and the state says that a “physical penetration test targets your facilities/buildings/locations” and notes that the company planned to “attempt to collect physical documentation” at the courthouse where the men were arrested.