15 ms·

A physical breach is a nightmare scenario for Capitol IT

316 points by rmason 6y ago

nosmokewhereiam 6y ago
They can't sign emails without PKI right?
- sybercecurity 6y ago
  Officially yes, but the use of S/MIME signed email in the federal government is minimal/non-existent beyond a few instances.
  - unixhero 6y ago
    Hey! They used it on The X-Files. I've got proof. (Joke)
  - blabitty 6y ago
    Not exactly true I've worked for several very large agencies that use encrypted and/or signed email extensively
jaywalk 6y ago
The one person who almost got into an area where they really didn't want people was shot dead. This guy's acting like the rioters breached a SCIF or something. The Capitol building is (was, normally) open to the public.
- saargrin 6y ago
  not sure the office computers are typically accessible to public now they gonna check everything for possible keyloggers or whatnot and theres no way of knowing if any computer was left unlocked and might have had something installed on it
  - NortySpock 6y ago
    At least one protestor claimed he found an unlocked computer. Up to others to verify if that claim is accurate. https://arstechnica.com/tech-policy/2021/01/pro-trump-reporter-gloats-over-access-to-fleeing-hill-staffers-computer/ https://arstechnica.com/tech-policy/2021/01/pro-trump-report... Windows-L is the keyboard command to lock on Windows. I strike it by habit every time I get up from my chair.
    - mkl95 6y ago
      Super-L is the keyboard command to lock on Gnome. The super key is called the windows key on Windows :-)
    - raverbashing 6y ago
      Best way I found is to set a "hot corner" that will lock the computer once the cursor is moved there Easier than typing a key combination
      - InitialLastName 6y ago
        I had that at one point, but on Windows, with a high resolution screen and maximized windows there are too many useful operations dangerously close to every corner. Some folks at my office have ID cards that need to be inserted to operate the computer (it locks when the card is removed from the reader). The smart ones have attached the card to their belt so that when they walk away, the card goes with them and the computer locks.
    - kevin_thibedeau 6y ago
      He can explain it himself when he's trying to bargain a shorter prison sentence with prosecutors.
  - jedberg 6y ago
    "Hi Representative Foo, I have a presentation on the USB stick here I'd like to show you, mind if I plug it in?" "I just need to download the presentation from my website, can I use your computer real quick?" Do you really think an 80 year old anti-tech representative would even consider that a problem? I'd have to assume the computers are already protected from that attack vector. Edit: I'm getting a lot of downvotes without replies, which makes me thing people don't agree with this. I wonder, how many have actually worked in corporate IT security for a non-tech company with older employees? Because things like this definitely happen on a daily basis. Case in point: Pelosi's screen was unlocked when that guy sat down, which was at least 20 minutes after she left. That means that not only does she not lock her screen when she gets up, but the screen saver doesn't even auto-lock after 20 minutes.
- paxys 6y ago
  Multiple computers belonging to congressmen/their aides have been reported accessed or stolen (https://thehill.com/homenews/senate/533162-merkley-says-capitol-rioters-stole-laptop-from-his-office https://thehill.com/homenews/senate/533162-merkley-says-capi...). Someone posted a picture of Nancy Pelosi's email client, stole mail and left a threatening note in her office. Other private chambers were vandalized (https://twitter.com/SenJeffMerkley/status/1347039504528498688 https://twitter.com/SenJeffMerkley/status/134703950452849868...). Can anyone really confirm that there were zero foreign agents among the thousands of rioters who accessed the building? Let's not pretend what happened was normal.
  - jaywalk 6y ago
    Not normal, not good. Will cause issues for sure. But those computers did not have access to classified information.
    - paxys 6y ago
      > But those computers did not have access to classified information. Got a source for that? You really think a sitting Senator's laptop has zero useful data for a foreign government, or even the opposition party? Heck his browser history or synced texts could have enough blackmail material.
      - deleted 6y ago
        [deleted]
      - Jtsummers 6y ago
        Useful data != Secret/TS data. If there is any Secret/TS data on these systems, there's already been a security breach and yesterday wasn't special. Unclassified systems are often assumed unsafe/breached to begin with.
        randylahey 6y ago
        I don't disagree, however... human beings can be lazy, short-sighted or take short-cuts. I wouldn't put it past someone to keep something where it shouldn't be, intentionally or by accident.
- thinkmassive 6y ago
  Yep, the important rooms would not accidentally be left accessible, even in a situation like what happened yesterday. https://en.wikipedia.org/wiki/Sensitive_Compartmented_Information_Facility https://en.wikipedia.org/wiki/Sensitive_Compartmented_Inform...
- meragrin_ 6y ago
  > The one person who almost got into an area where they really didn't want people was shot dead. The videos showing her get shot had several police in the area and they never looked like they were very interested in protecting that area before she was shot.
  - c_r_w 6y ago
    Difference between the Secret Service and Capitol PD.
    - meragrin_ 6y ago
      Last I heard, it still had not been determined who shot her. What makes you think the Secret Service was involved? They don't typically protect Congress.
      - huntermeyer 6y ago
        The guy that shot her was wearing a suit without any clear badging. This looks like Secret Service who may have been on VP Pence detail. [Viewer discretion advised] Screenshot: https://i.imgur.com/vHvvkHQ.png https://i.imgur.com/vHvvkHQ.png Video: https://worldstar.com/video.php?v=wshh17cIq2bB6L71wx1q https://worldstar.com/video.php?v=wshh17cIq2bB6L71wx1q
      - the__alchemist 6y ago
        Secret Service protect high-profile Congressmen and Senators. For example: Former first-ladies, presidential candidates, and others as appropriate. Hillary Clinton, for example, had an entourage of secret service agents wherever she went, including in the Capitol. Same with Obama leading up to the election. TLDR: It's likely there are secret service members in the Captiol at any given time.
      - c_r_w 6y ago
        It does seem to have been a plainclothes USCP officer per new reporting. I had read possibly erroneous reports that he was part of Pence's detail.
- orblivion 6y ago
  This is something that surprises me about the whole thing. Wouldn't the chambers full of Very Important People who are presumably targets of many an angry/deranged person be among those highly sensitive areas? When I heard that these people were breaking down barriers and potentially storming the Capitol building, I thought surely they would stop as soon as they foolishly approached the chambers and started getting shot dead. When I was so much as standing across the street from the White House, where all the protesters hang out, I assumed I basically had a red dot on my head, so I should be careful what I do.
  - deleted 6y ago
    [deleted]
  - Spooky23 6y ago
    They are representatives to people and basically shake hands and kiss babies for a living. They can’t be isolated. Obviously, the security services stood back and had high level direction to do nothing. They left a few capitol police flapping in the breeze and the cavalry (national guard, other law enforcement) never showed up. I work near a VA hospital, and a few years ago a deranged man was running around the grounds with a machete and what looked to be a rifle. They activated their protocol and within 10 minutes mutual aid (Federal Protective Service police, State Troopers, local PD were on site. That didn’t happen. I hope Biden purges the top layers of career management in those police agencies as well as the commanders of the National Guard. They failed the nation.
    - herewulf 6y ago
      The leadership of the police agencies involved should absolutely be investigated. The National Guard, on the other hand, you seem to be misinformed about its status. Most of us work regular ass jobs full time just like everyone else here and we're lucky to get 1/3 of our unit strength to report within a few hours. Plenty of service members don't even live in the same state where they are in the Guard, especially on the East Coast. Then it takes time to make a plan, organize, issue equipment, load/prep vehicles, and roll out. Finally, NG commanders can't just choose to deploy somewhere on their own because there's an emergency. It has to be authorized by the state governor. I don't know how it works exactly for DC though. The Secretary of the Army was part of a press briefing Wednesday announcing NG deployment, but the NGs for the 50 states aren't part of the Department of the Army, but rather the states and the National Guard Bureau until mobilized under Title 10 authority (not a drop of the hat thing). Maybe the DC Guard is under some direct Executive Branch control which in this case would be bad news, because look who was more than happy to have the Capitol overrun.
- tunesmith 6y ago
  > The one person who almost got into an area where they really didn't want people was shot dead. Wait, what is the context on this? I saw the footage once before I knew she died. It honestly looked like law enforcement with guns coming up the stairs, and it looked like a crowd of people, not a woman acting alone. What area of the building was that that was extra-sensitive? EDIT: I see now, other angles are easy to find. Trying to climb through a blockaded entry point as guns were already pointed at her...
  - harshreality 6y ago
    It was at the locked corridor barrier to the Speakers Lobby which adjoins the House Chamber. Rumors that Pence was there and it was Secret Service haven't been confirmed; he had been in the Senate chamber and Secret Service had evacuated him, so it's unlikely he would end up on the House side in a poorly secured area. News reports indicate it was simply Capitol Police, possibly someone associated with the House Sgt at Arms since they have an office somewhere around there. I guess the woman, despite being a veteran (Air Force... why is it the Air Force has so many crazy people?), was so caught up in LARPing that she couldn't rationally evaluate that this was the last meaningful barrier to the House chamber and they might have more liberal rules of engagement or someone might panic and overstep their RoE to prevent an unauthorized mob from entering. If she'd climbed through, she could have opened the door to the mob. On the other hand, I can see the argument that shooting her was an absurd overreaction. There were armed capitol police who had just come up the stairs behind her and that group of protesters, and they were doing nothing. The news reports that the justification for the shooting was that she might have been armed, but if that's really their rationale, it's a bad one. They should have retreated to the main chamber, because they weren't in a good tactical position, trying to defend a barrier with windows large enough for people to climb through. In addition, no such resistance was offered on the Senate side. When you're outnumbered that badly, unless you have special training like the Secret Service would, and plenty of ammo, you're not going to accomplish anything by shooting anyone, unless they are overtly threatening people such that you think you're going to die or be taken captive anyway. I don't think Capitol Police are legally at fault in any way for her death, but I think they did the wrong thing there.
- deleted 6y ago
  [deleted]
- mcintyre1994 6y ago
  In the video I saw of the person who got shot, it looked like she was climbing into a room that already had both police and other rioters inside - is that incorrect? I’ve also seen pictures of people inside Pelosi’s office, including on her unlocked computer with emails displayed (albeit I assume these weren’t confidential - the only one mentioned was about the security breach).
jedberg 6y ago
Is it though? I was having this discussion with a friend last night. If I were IT for the Capitol, I would already be operating under the assumption that all the clients are hostile. There are constantly visitors to the Capitol, including foreign visitors who could easily be spies. Also, the Members themselves are often old, anti-tech, and not the kind of people who will remember to lock their screen when they get up. I would already assume Member computers are a huge attack vector, and act accordingly.
- watwut 6y ago
  Random visitors don't go into offices. They don't look into cupboards. They don't sit behind desk with computer.
  - generalizations 6y ago
    And yet you still have to assume they might.
    - lumost 6y ago
      Authorized individuals have classified documents on Capitol hill computers, there have been many options available to support breaching a workstation given physical access for years. In this event you don't even know if such authorized persons had time to lock their computers.
  - AnimalMuppet 6y ago
    How about staffers working for members from the other party? Yes, you'd expect a "gentlemen's agreement" not to do such things. You might not be wise to trust it, though...
    - watwut 6y ago
      I doubt there is anything like gentlemens agreement last 8 year's. Everyone was aware it is sociopaths run the place. So I think other party stsffers are not trusted to be left alone.
cpascal 6y ago
The author of the Twitter thread links to another thread towards the end that notes the risk of a classified information breach isn't too high. https://twitter.com/ericgeller/status/1347226499930230785 https://twitter.com/ericgeller/status/1347226499930230785 Obviously that doesn't change the fact that the entire building should be considered compromised and scrubbed.
- slg 6y ago
  The last 5+ years of leaks from politicians should have taught us that something doesn't need to be classified to be highly damaging to both the individual and the nation.
jmiter 6y ago
Maybe someone can answer this for me: having worked for the US gvt, though not in legislature or dept of state, PIV cards were always required to access a gvt machine, and leaving your PIV inserted while absent from the room was, in theory, a serious offense. Are congress critters and others not required to use ID cards when accessing gvt networks?
- Jtsummers 6y ago
  Different agencies have different IT systems at the federal level. The PIV cards used by the DOD and some other departments are not universal within the executive branch, and the legislative and judicial branches manage their own IT systems (sometimes still managing it locally rather than having any kind of centralized system). Government IT is very much a set of feudal territories still and many of them are not well or consistently managed.
- chefkoch 6y ago
  I'm not sure you can say no to senator who wants stuff changed?
- jnwatson 6y ago
  The rules for the executive branch are fairly rigorous. The legislative branch, not so much. There's a huge difference in scale: the executive branch employs some 4 million folks, the legislative branch just 35K. Just the picture of Pelosi's desktop indicates there's no automatic screenlock, which is a fairly low bar as controls go.
  - fl0wenol 6y ago
    It wasn't Pelosi's desktop, it was her scheduling assistant's. You can clearly see his name on the Outlook inbox. Not that it's much better, but it is still an important clarification.
- SolarNet 6y ago
  My understanding is that each legislator is like an independent client and is able to run basically whatever IT they want as far as the unclassified (yet still sensitive of course) stuff goes. Given that, I'm betting the shared IT group is basically just recommending best practices and hoping people are listening.
anovikov 6y ago
On the other hand, there are for sure plenty of cameras out there. Why not just find everyone who participated and make sure no one sees them again? Just make them disappear.
- riversflow 6y ago
  Seriously? You are really asking the government to disappear people?
  - anovikov 6y ago
    Just do the trial and sentencing in a manner as obscure as possible to avoid any publicity because it will only add to the hype. I think we are fast approaching the point where the whole concept of "society" will have to be abandoned...
dillondoyle 6y ago
Another thread that I think offers some context a bit less 'scary' than this [1]. Most of the stuff the invaders could of had easy access to - eg in a Member's office - is not that important, consider what is leaked to the press strategically for politics every day. I'd be more concerned about listening devices especially key committee Members and staff e.g. foreign relations LAs I don't have firsthand knowledge of the non-classified working computers of Congress but maybe someone can confirm if IT used SolarWinds and their network is already compromised. * also individual Member offices are treated basically like businesses in a lot of ways. e.g. the Member can contract/share hire their own IT helpers too. i can't find a source quickly but a few years ago remember the article about some guy working for a few Dems being a dumb ass * * I'll also add that almost any US citizen can get a meeting inside a Member's office. A house member directly or with a staffer. I'm sure there are a ton of listening devices that metal detectors wouldn't find and that are quick to place surreptitiously https://twitter.com/ericgeller/status/1347226499930230785 https://twitter.com/ericgeller/status/1347226499930230785
- rootusrootus 6y ago
  > almost any US citizen can get a meeting inside a Member's office Indeed, most days you can just walk directly into any senator's or member's office. Maybe leadership has different rules, I haven't tested that, but I had no trouble strolling into Ron Wyden's office. So anything you can get through the building metal detectors (which really aren't very sensitive, they're just looking for weapons) you could take in and surreptitiously drop off.
  - cheeze 6y ago
    That's terrifying, knowing just how bad some of these people are with technology....
    - deleted 6y ago
      [deleted]
    - zionic 6y ago
      Yeah but how do you get your listening device to work over all the interference from the CIA listening devices?
ufmace 6y ago
Does anybody remember when Bradley/Chelsea Manning released ~hundreds of thousands of classified diplomatic cables? I seem to remember that most of the tech world at the time thought that was awesome. I wonder why this time they're clutching pearls about how scary and terrible this could be.
- randylahey 6y ago
  Your recollection does not comport with my own. A lot of sensitive classified information was leaked, a good deal of it having nothing to do with warrant-less wire-tapping, etc.
- mjburgess 6y ago
  Four 5seconds until their contents was clear. It was initally assumed to be a leak on moral grounds. And ended up just putting a lot of people in danger, and disrupting international diplomacy. I dont think many who know the details support the leak.
  - jessaustin 6y ago
    No human was physically harmed as a result of Manning's leaks. If there had been, such a person would have been mourned in the USA war media for months.
- Sebb767 6y ago
  > I wonder why this time they're clutching pearls about how scary and terrible this could be. Most of the readers here know quite a few things about system administration and/or IT security. As I read this thread, most comments only discuss the IT security implication or express sympathy for the poor souls that will need to clean up this mess; there's hardly any discussion about the morality of possible leaks.
- deleted 6y ago
  [deleted]
- fl0wenol 6y ago
  Since you're bringing up Manning but not mentioning Snowden, and also helpfully dead naming her in case we were confused, we can assume you're not bringing this up in good faith but as a slanted whataboutism.
TT3351 6y ago
Access to the Capitol isn't very restricted. People who are handling top secret information know that very well; that said, plenty of personally compromising information can usually be found on any given personal computer.
psychlops 6y ago
Heaven forbid someone front runs the trades of Congress.
adrianmonk 6y ago
Are there security cameras? If so (assuming footage wasn't tampered with), then you can maybe narrow down the locations where people actually did have physical access.
deleted 6y ago
[deleted]
moonbug 6y ago
They need to toss everything and start again. Safer, and probably faster. But I expect they'll just turn back on and resume using everything not ruined by piss.
qwantim1 6y ago
I’d assume they were already bugged. Also, whose to say all of the new equipment they replace it with won’t be bugged? And why do they even need offices in the capitol building at this point? Everything could be done online.
Ericson2314 6y ago
I think the thread model is a bit off, in that all the "real secrets" are sadly with the executive branch. However, if congress can learn a bit about the pitfalls of commonplace devices, that would be nice.
m3kw9 6y ago
Not as bad as he says. https://twitter.com/ericgeller/status/1347226499930230785?s=21 https://twitter.com/ericgeller/status/1347226499930230785?s=...
nabla9 6y ago
Obviously all computers left around in offices should be considered unsafe. Confidential information may have been leaked. But Capitol has SCIF's for storing top secret information and committee meetings that deal with classified information. You can't bring your own laptops or even phones to them.
tareqak 6y ago
Doesn’t the Capitol have those controlled access rooms that Congress had to use to access evidence concerning Trump’s impeachment (I forget the exact name of the rooms)? Given that Congress was recently sworn in, there probably was nothing just lying around, but that is the sort of physical evidence that would be especially sensitive and embarrassing to leak.
deleted 6y ago
[deleted]
enw 6y ago
Is it just me, or do some people have a fetish for catastrophe? Greatly overestimating security impacts, the impacts of COVID, aggressive "new normal" lockdown proponents, militant preppers, etc. Paradoxically, I think some might feel more secure when they are the messengers of chaos. I wonder if there's a psychological reasoning underneath.
- Razengan 6y ago
  > I wonder if there's a psychological reasoning underneath. boredom A safe, regulated, mechanically functioning society day after day is boring as hell†. Catastrophe is one of the easiest changes to imagine and fantasize about. Which is probably also why dystopian cyberpunk is more popular than utopian sci-fi. † If you don't get enough leisure time or have enough activities to fill it with.
  - ehnto 6y ago
    I think what's truly missing is purpose and community, not leisure time although you may have left that implied. Many want their life to be special, to be part of something bigger. Modern life can lack a sense of purpose and community, so even with infinite entertainment at our fingertips we still yearn for something deeper. Like you said, conspiracy or chaos can fill those desires. You get to be part of an "in-group" and be part of something bigger. Life just gets a bit more dramatic and interesting. Probably why cults can exist at all as well. I used to wonder how anyone could be stupid enough to fall in with a cult, but after living a traditional modern 9-5 for a while I can totally see the hole that was missing that a cult, religion, conspiracy or commune would fill.
- smt88 6y ago
  Humans are special because of our ability to forecast and run scenarios. You can "practice" dangerous situations in your mind -- a great tool to mitigate them if they arise! This can go to an extreme, of course. People seek security by modeling everything, playing it all out, and trying to prevent bad things from happening. It's normal human behavior that is supercharged by modern information overload.
- 6y ago
fareesh 6y ago
The previous non-violent protests over the last few years that took place in the Capitol also had protesters present in all of the same places, including the chambers. As such this is not a new situation, but it's interesting that devious motives are attributed when the protester has a particular set of politics, or because they were successful in breaking past security whereas previous protesters attempted and failed.
- deleted 6y ago
  [deleted]
idlewords 6y ago
I've seen a lot of this kind of concern, but people should keep in mind that the capitol is already a semi-public space, and is treated as such. The devices I'd really worry about if they were compromised are people's personal phones, which presumably they had on their person. A note for context: a friend of mine who works in the capitol brought me along one day and asked me to wait in the minority leader's antechamber (a large room like a hotel conference room) for a few minutes while a vote was called. There were various bits of CAT-5 sticking out of the wall and I was unsupervised for nearly a half hour. Various people came and went and paid me no heed. I can't imagine I'm the first or last person to have been in that situation. TL;DR special secure facilities exist for a reason. The Capitol is used to randos.
curiousgal 6y ago
This is a tad ironic. It's like backhandedly saying "we're so great that foreign nations wouldn't miss a chance to spy on us" but at the same time this great nation allowed its Capitol building to be ravished by a group of citizens. There are infinitely bigger concerns about this event than what this thread presents.
alkonaut 6y ago
This is a nightmare no doubt, but the IT security angle is so far down the list of concerns it's not even visible. If every machine, piece of infrastructure and password has to be changed, every log audited by a hundred people for a year? Tiny damage in comparison in context.
sample2448 6y ago
Why worry about some potential foreign asset implanted in capitol if one is already about to get office of the president :D
DoreenMichele 6y ago
I am reminded of Watergate, which I think a lot of people don't realize was about planting wiretaps in the Democratic National Committee headquarters. It led to Nixon's resignation and it has left us with a legacy of adding "-gate" onto the end of all kinds of things (a la "GamerGate"). As a child, I knew Watergate was a scandal that impacted the presidency. I think I was an adult before I learned it involved wiretapping. I remember being rather surprised to learn some of the details as an adult. https://en.wikipedia.org/wiki/Watergate_scandal https://en.wikipedia.org/wiki/Watergate_scandal
madengr 6y ago
If they had been this thorough with voting me hone security.....

316 points by rmason 6y ago

nosmokewhereiam 6y ago

They can't sign emails without PKI right?

sybercecurity 6y ago
Officially yes, but the use of S/MIME signed email in the federal government is minimal/non-existent beyond a few instances.
- unixhero 6y ago
  Hey! They used it on The X-Files. I've got proof. (Joke)
- blabitty 6y ago
  Not exactly true I've worked for several very large agencies that use encrypted and/or signed email extensively

jaywalk 6y ago

The one person who almost got into an area where they really didn't want people was shot dead. This guy's acting like the rioters breached a SCIF or something. The Capitol building is (was, normally) open to the public.

saargrin 6y ago
not sure the office computers are typically accessible to public now they gonna check everything for possible keyloggers or whatnot and theres no way of knowing if any computer was left unlocked and might have had something installed on it
- NortySpock 6y ago
  At least one protestor claimed he found an unlocked computer. Up to others to verify if that claim is accurate. https://arstechnica.com/tech-policy/2021/01/pro-trump-reporter-gloats-over-access-to-fleeing-hill-staffers-computer/ https://arstechnica.com/tech-policy/2021/01/pro-trump-report... Windows-L is the keyboard command to lock on Windows. I strike it by habit every time I get up from my chair.
  - mkl95 6y ago
    Super-L is the keyboard command to lock on Gnome. The super key is called the windows key on Windows :-)
  - raverbashing 6y ago
    Best way I found is to set a "hot corner" that will lock the computer once the cursor is moved there Easier than typing a key combination
    - InitialLastName 6y ago
      I had that at one point, but on Windows, with a high resolution screen and maximized windows there are too many useful operations dangerously close to every corner. Some folks at my office have ID cards that need to be inserted to operate the computer (it locks when the card is removed from the reader). The smart ones have attached the card to their belt so that when they walk away, the card goes with them and the computer locks.
  - kevin_thibedeau 6y ago
    He can explain it himself when he's trying to bargain a shorter prison sentence with prosecutors.
- jedberg 6y ago
  "Hi Representative Foo, I have a presentation on the USB stick here I'd like to show you, mind if I plug it in?" "I just need to download the presentation from my website, can I use your computer real quick?" Do you really think an 80 year old anti-tech representative would even consider that a problem? I'd have to assume the computers are already protected from that attack vector. Edit: I'm getting a lot of downvotes without replies, which makes me thing people don't agree with this. I wonder, how many have actually worked in corporate IT security for a non-tech company with older employees? Because things like this definitely happen on a daily basis. Case in point: Pelosi's screen was unlocked when that guy sat down, which was at least 20 minutes after she left. That means that not only does she not lock her screen when she gets up, but the screen saver doesn't even auto-lock after 20 minutes.
paxys 6y ago
Multiple computers belonging to congressmen/their aides have been reported accessed or stolen (https://thehill.com/homenews/senate/533162-merkley-says-capitol-rioters-stole-laptop-from-his-office https://thehill.com/homenews/senate/533162-merkley-says-capi...). Someone posted a picture of Nancy Pelosi's email client, stole mail and left a threatening note in her office. Other private chambers were vandalized (https://twitter.com/SenJeffMerkley/status/1347039504528498688 https://twitter.com/SenJeffMerkley/status/134703950452849868...). Can anyone really confirm that there were zero foreign agents among the thousands of rioters who accessed the building? Let's not pretend what happened was normal.
- jaywalk 6y ago
  Not normal, not good. Will cause issues for sure. But those computers did not have access to classified information.
  - paxys 6y ago
    > But those computers did not have access to classified information. Got a source for that? You really think a sitting Senator's laptop has zero useful data for a foreign government, or even the opposition party? Heck his browser history or synced texts could have enough blackmail material.
    - deleted 6y ago
      [deleted]
    - Jtsummers 6y ago
      Useful data != Secret/TS data. If there is any Secret/TS data on these systems, there's already been a security breach and yesterday wasn't special. Unclassified systems are often assumed unsafe/breached to begin with.
      - randylahey 6y ago
        I don't disagree, however... human beings can be lazy, short-sighted or take short-cuts. I wouldn't put it past someone to keep something where it shouldn't be, intentionally or by accident.
thinkmassive 6y ago
Yep, the important rooms would not accidentally be left accessible, even in a situation like what happened yesterday. https://en.wikipedia.org/wiki/Sensitive_Compartmented_Information_Facility https://en.wikipedia.org/wiki/Sensitive_Compartmented_Inform...
meragrin_ 6y ago
> The one person who almost got into an area where they really didn't want people was shot dead. The videos showing her get shot had several police in the area and they never looked like they were very interested in protecting that area before she was shot.
- c_r_w 6y ago
  Difference between the Secret Service and Capitol PD.
  - meragrin_ 6y ago
    Last I heard, it still had not been determined who shot her. What makes you think the Secret Service was involved? They don't typically protect Congress.
    - huntermeyer 6y ago
      The guy that shot her was wearing a suit without any clear badging. This looks like Secret Service who may have been on VP Pence detail. [Viewer discretion advised] Screenshot: https://i.imgur.com/vHvvkHQ.png https://i.imgur.com/vHvvkHQ.png Video: https://worldstar.com/video.php?v=wshh17cIq2bB6L71wx1q https://worldstar.com/video.php?v=wshh17cIq2bB6L71wx1q
    - the__alchemist 6y ago
      Secret Service protect high-profile Congressmen and Senators. For example: Former first-ladies, presidential candidates, and others as appropriate. Hillary Clinton, for example, had an entourage of secret service agents wherever she went, including in the Capitol. Same with Obama leading up to the election. TLDR: It's likely there are secret service members in the Captiol at any given time.
    - c_r_w 6y ago
      It does seem to have been a plainclothes USCP officer per new reporting. I had read possibly erroneous reports that he was part of Pence's detail.
orblivion 6y ago
This is something that surprises me about the whole thing. Wouldn't the chambers full of Very Important People who are presumably targets of many an angry/deranged person be among those highly sensitive areas? When I heard that these people were breaking down barriers and potentially storming the Capitol building, I thought surely they would stop as soon as they foolishly approached the chambers and started getting shot dead. When I was so much as standing across the street from the White House, where all the protesters hang out, I assumed I basically had a red dot on my head, so I should be careful what I do.
- deleted 6y ago
  [deleted]
- Spooky23 6y ago
  They are representatives to people and basically shake hands and kiss babies for a living. They can’t be isolated. Obviously, the security services stood back and had high level direction to do nothing. They left a few capitol police flapping in the breeze and the cavalry (national guard, other law enforcement) never showed up. I work near a VA hospital, and a few years ago a deranged man was running around the grounds with a machete and what looked to be a rifle. They activated their protocol and within 10 minutes mutual aid (Federal Protective Service police, State Troopers, local PD were on site. That didn’t happen. I hope Biden purges the top layers of career management in those police agencies as well as the commanders of the National Guard. They failed the nation.
  - herewulf 6y ago
    The leadership of the police agencies involved should absolutely be investigated. The National Guard, on the other hand, you seem to be misinformed about its status. Most of us work regular ass jobs full time just like everyone else here and we're lucky to get 1/3 of our unit strength to report within a few hours. Plenty of service members don't even live in the same state where they are in the Guard, especially on the East Coast. Then it takes time to make a plan, organize, issue equipment, load/prep vehicles, and roll out. Finally, NG commanders can't just choose to deploy somewhere on their own because there's an emergency. It has to be authorized by the state governor. I don't know how it works exactly for DC though. The Secretary of the Army was part of a press briefing Wednesday announcing NG deployment, but the NGs for the 50 states aren't part of the Department of the Army, but rather the states and the National Guard Bureau until mobilized under Title 10 authority (not a drop of the hat thing). Maybe the DC Guard is under some direct Executive Branch control which in this case would be bad news, because look who was more than happy to have the Capitol overrun.
tunesmith 6y ago
> The one person who almost got into an area where they really didn't want people was shot dead. Wait, what is the context on this? I saw the footage once before I knew she died. It honestly looked like law enforcement with guns coming up the stairs, and it looked like a crowd of people, not a woman acting alone. What area of the building was that that was extra-sensitive? EDIT: I see now, other angles are easy to find. Trying to climb through a blockaded entry point as guns were already pointed at her...
- harshreality 6y ago
  It was at the locked corridor barrier to the Speakers Lobby which adjoins the House Chamber. Rumors that Pence was there and it was Secret Service haven't been confirmed; he had been in the Senate chamber and Secret Service had evacuated him, so it's unlikely he would end up on the House side in a poorly secured area. News reports indicate it was simply Capitol Police, possibly someone associated with the House Sgt at Arms since they have an office somewhere around there. I guess the woman, despite being a veteran (Air Force... why is it the Air Force has so many crazy people?), was so caught up in LARPing that she couldn't rationally evaluate that this was the last meaningful barrier to the House chamber and they might have more liberal rules of engagement or someone might panic and overstep their RoE to prevent an unauthorized mob from entering. If she'd climbed through, she could have opened the door to the mob. On the other hand, I can see the argument that shooting her was an absurd overreaction. There were armed capitol police who had just come up the stairs behind her and that group of protesters, and they were doing nothing. The news reports that the justification for the shooting was that she might have been armed, but if that's really their rationale, it's a bad one. They should have retreated to the main chamber, because they weren't in a good tactical position, trying to defend a barrier with windows large enough for people to climb through. In addition, no such resistance was offered on the Senate side. When you're outnumbered that badly, unless you have special training like the Secret Service would, and plenty of ammo, you're not going to accomplish anything by shooting anyone, unless they are overtly threatening people such that you think you're going to die or be taken captive anyway. I don't think Capitol Police are legally at fault in any way for her death, but I think they did the wrong thing there.
deleted 6y ago
[deleted]
mcintyre1994 6y ago
In the video I saw of the person who got shot, it looked like she was climbing into a room that already had both police and other rioters inside - is that incorrect? I’ve also seen pictures of people inside Pelosi’s office, including on her unlocked computer with emails displayed (albeit I assume these weren’t confidential - the only one mentioned was about the security breach).

jedberg 6y ago

Is it though? I was having this discussion with a friend last night. If I were IT for the Capitol, I would already be operating under the assumption that all the clients are hostile. There are constantly visitors to the Capitol, including foreign visitors who could easily be spies. Also, the Members themselves are often old, anti-tech, and not the kind of people who will remember to lock their screen when they get up. I would already assume Member computers are a huge attack vector, and act accordingly.

watwut 6y ago
Random visitors don't go into offices. They don't look into cupboards. They don't sit behind desk with computer.
- generalizations 6y ago
  And yet you still have to assume they might.
  - lumost 6y ago
    Authorized individuals have classified documents on Capitol hill computers, there have been many options available to support breaching a workstation given physical access for years. In this event you don't even know if such authorized persons had time to lock their computers.
- AnimalMuppet 6y ago
  How about staffers working for members from the other party? Yes, you'd expect a "gentlemen's agreement" not to do such things. You might not be wise to trust it, though...
  - watwut 6y ago
    I doubt there is anything like gentlemens agreement last 8 year's. Everyone was aware it is sociopaths run the place. So I think other party stsffers are not trusted to be left alone.

cpascal 6y ago

The author of the Twitter thread links to another thread towards the end that notes the risk of a classified information breach isn't too high. https://twitter.com/ericgeller/status/1347226499930230785 https://twitter.com/ericgeller/status/1347226499930230785 Obviously that doesn't change the fact that the entire building should be considered compromised and scrubbed.

slg 6y ago
The last 5+ years of leaks from politicians should have taught us that something doesn't need to be classified to be highly damaging to both the individual and the nation.

jmiter 6y ago

Maybe someone can answer this for me: having worked for the US gvt, though not in legislature or dept of state, PIV cards were always required to access a gvt machine, and leaving your PIV inserted while absent from the room was, in theory, a serious offense. Are congress critters and others not required to use ID cards when accessing gvt networks?

Jtsummers 6y ago
Different agencies have different IT systems at the federal level. The PIV cards used by the DOD and some other departments are not universal within the executive branch, and the legislative and judicial branches manage their own IT systems (sometimes still managing it locally rather than having any kind of centralized system). Government IT is very much a set of feudal territories still and many of them are not well or consistently managed.
chefkoch 6y ago
I'm not sure you can say no to senator who wants stuff changed?
jnwatson 6y ago
The rules for the executive branch are fairly rigorous. The legislative branch, not so much. There's a huge difference in scale: the executive branch employs some 4 million folks, the legislative branch just 35K. Just the picture of Pelosi's desktop indicates there's no automatic screenlock, which is a fairly low bar as controls go.
- fl0wenol 6y ago
  It wasn't Pelosi's desktop, it was her scheduling assistant's. You can clearly see his name on the Outlook inbox. Not that it's much better, but it is still an important clarification.
SolarNet 6y ago
My understanding is that each legislator is like an independent client and is able to run basically whatever IT they want as far as the unclassified (yet still sensitive of course) stuff goes. Given that, I'm betting the shared IT group is basically just recommending best practices and hoping people are listening.

anovikov 6y ago

On the other hand, there are for sure plenty of cameras out there. Why not just find everyone who participated and make sure no one sees them again? Just make them disappear.

riversflow 6y ago
Seriously? You are really asking the government to disappear people?
- anovikov 6y ago
  Just do the trial and sentencing in a manner as obscure as possible to avoid any publicity because it will only add to the hype. I think we are fast approaching the point where the whole concept of "society" will have to be abandoned...

dillondoyle 6y ago

Another thread that I think offers some context a bit less 'scary' than this [1]. Most of the stuff the invaders could of had easy access to - eg in a Member's office - is not that important, consider what is leaked to the press strategically for politics every day. I'd be more concerned about listening devices especially key committee Members and staff e.g. foreign relations LAs I don't have firsthand knowledge of the non-classified working computers of Congress but maybe someone can confirm if IT used SolarWinds and their network is already compromised. * also individual Member offices are treated basically like businesses in a lot of ways. e.g. the Member can contract/share hire their own IT helpers too. i can't find a source quickly but a few years ago remember the article about some guy working for a few Dems being a dumb ass * * I'll also add that almost any US citizen can get a meeting inside a Member's office. A house member directly or with a staffer. I'm sure there are a ton of listening devices that metal detectors wouldn't find and that are quick to place surreptitiously https://twitter.com/ericgeller/status/1347226499930230785 https://twitter.com/ericgeller/status/1347226499930230785

rootusrootus 6y ago
> almost any US citizen can get a meeting inside a Member's office Indeed, most days you can just walk directly into any senator's or member's office. Maybe leadership has different rules, I haven't tested that, but I had no trouble strolling into Ron Wyden's office. So anything you can get through the building metal detectors (which really aren't very sensitive, they're just looking for weapons) you could take in and surreptitiously drop off.
- cheeze 6y ago
  That's terrifying, knowing just how bad some of these people are with technology....
  - deleted 6y ago
    [deleted]
  - zionic 6y ago
    Yeah but how do you get your listening device to work over all the interference from the CIA listening devices?

ufmace 6y ago

Does anybody remember when Bradley/Chelsea Manning released ~hundreds of thousands of classified diplomatic cables? I seem to remember that most of the tech world at the time thought that was awesome. I wonder why this time they're clutching pearls about how scary and terrible this could be.

randylahey 6y ago
Your recollection does not comport with my own. A lot of sensitive classified information was leaked, a good deal of it having nothing to do with warrant-less wire-tapping, etc.
mjburgess 6y ago
Four 5seconds until their contents was clear. It was initally assumed to be a leak on moral grounds. And ended up just putting a lot of people in danger, and disrupting international diplomacy. I dont think many who know the details support the leak.
- jessaustin 6y ago
  No human was physically harmed as a result of Manning's leaks. If there had been, such a person would have been mourned in the USA war media for months.
Sebb767 6y ago
> I wonder why this time they're clutching pearls about how scary and terrible this could be. Most of the readers here know quite a few things about system administration and/or IT security. As I read this thread, most comments only discuss the IT security implication or express sympathy for the poor souls that will need to clean up this mess; there's hardly any discussion about the morality of possible leaks.
deleted 6y ago
[deleted]
fl0wenol 6y ago
Since you're bringing up Manning but not mentioning Snowden, and also helpfully dead naming her in case we were confused, we can assume you're not bringing this up in good faith but as a slanted whataboutism.

TT3351 6y ago

Access to the Capitol isn't very restricted. People who are handling top secret information know that very well; that said, plenty of personally compromising information can usually be found on any given personal computer.

psychlops 6y ago

Heaven forbid someone front runs the trades of Congress.

adrianmonk 6y ago

Are there security cameras? If so (assuming footage wasn't tampered with), then you can maybe narrow down the locations where people actually did have physical access.

deleted 6y ago

[deleted]

moonbug 6y ago

They need to toss everything and start again. Safer, and probably faster. But I expect they'll just turn back on and resume using everything not ruined by piss.

qwantim1 6y ago

I’d assume they were already bugged. Also, whose to say all of the new equipment they replace it with won’t be bugged? And why do they even need offices in the capitol building at this point? Everything could be done online.

Ericson2314 6y ago

I think the thread model is a bit off, in that all the "real secrets" are sadly with the executive branch. However, if congress can learn a bit about the pitfalls of commonplace devices, that would be nice.

m3kw9 6y ago

Not as bad as he says. https://twitter.com/ericgeller/status/1347226499930230785?s=21 https://twitter.com/ericgeller/status/1347226499930230785?s=...

nabla9 6y ago

Obviously all computers left around in offices should be considered unsafe. Confidential information may have been leaked. But Capitol has SCIF's for storing top secret information and committee meetings that deal with classified information. You can't bring your own laptops or even phones to them.

tareqak 6y ago

Doesn’t the Capitol have those controlled access rooms that Congress had to use to access evidence concerning Trump’s impeachment (I forget the exact name of the rooms)? Given that Congress was recently sworn in, there probably was nothing just lying around, but that is the sort of physical evidence that would be especially sensitive and embarrassing to leak.

deleted 6y ago

[deleted]

enw 6y ago

Is it just me, or do some people have a fetish for catastrophe? Greatly overestimating security impacts, the impacts of COVID, aggressive "new normal" lockdown proponents, militant preppers, etc. Paradoxically, I think some might feel more secure when they are the messengers of chaos. I wonder if there's a psychological reasoning underneath.

Razengan 6y ago
> I wonder if there's a psychological reasoning underneath. boredom A safe, regulated, mechanically functioning society day after day is boring as hell†. Catastrophe is one of the easiest changes to imagine and fantasize about. Which is probably also why dystopian cyberpunk is more popular than utopian sci-fi. † If you don't get enough leisure time or have enough activities to fill it with.
- ehnto 6y ago
  I think what's truly missing is purpose and community, not leisure time although you may have left that implied. Many want their life to be special, to be part of something bigger. Modern life can lack a sense of purpose and community, so even with infinite entertainment at our fingertips we still yearn for something deeper. Like you said, conspiracy or chaos can fill those desires. You get to be part of an "in-group" and be part of something bigger. Life just gets a bit more dramatic and interesting. Probably why cults can exist at all as well. I used to wonder how anyone could be stupid enough to fall in with a cult, but after living a traditional modern 9-5 for a while I can totally see the hole that was missing that a cult, religion, conspiracy or commune would fill.
smt88 6y ago
Humans are special because of our ability to forecast and run scenarios. You can "practice" dangerous situations in your mind -- a great tool to mitigate them if they arise! This can go to an extreme, of course. People seek security by modeling everything, playing it all out, and trying to prevent bad things from happening. It's normal human behavior that is supercharged by modern information overload.
6y ago

fareesh 6y ago

The previous non-violent protests over the last few years that took place in the Capitol also had protesters present in all of the same places, including the chambers. As such this is not a new situation, but it's interesting that devious motives are attributed when the protester has a particular set of politics, or because they were successful in breaking past security whereas previous protesters attempted and failed.

deleted 6y ago
[deleted]

idlewords 6y ago

I've seen a lot of this kind of concern, but people should keep in mind that the capitol is already a semi-public space, and is treated as such. The devices I'd really worry about if they were compromised are people's personal phones, which presumably they had on their person. A note for context: a friend of mine who works in the capitol brought me along one day and asked me to wait in the minority leader's antechamber (a large room like a hotel conference room) for a few minutes while a vote was called. There were various bits of CAT-5 sticking out of the wall and I was unsupervised for nearly a half hour. Various people came and went and paid me no heed. I can't imagine I'm the first or last person to have been in that situation. TL;DR special secure facilities exist for a reason. The Capitol is used to randos.

curiousgal 6y ago

This is a tad ironic. It's like backhandedly saying "we're so great that foreign nations wouldn't miss a chance to spy on us" but at the same time this great nation allowed its Capitol building to be ravished by a group of citizens. There are infinitely bigger concerns about this event than what this thread presents.

alkonaut 6y ago

This is a nightmare no doubt, but the IT security angle is so far down the list of concerns it's not even visible. If every machine, piece of infrastructure and password has to be changed, every log audited by a hundred people for a year? Tiny damage in comparison in context.

sample2448 6y ago

Why worry about some potential foreign asset implanted in capitol if one is already about to get office of the president :D

DoreenMichele 6y ago

I am reminded of Watergate, which I think a lot of people don't realize was about planting wiretaps in the Democratic National Committee headquarters. It led to Nixon's resignation and it has left us with a legacy of adding "-gate" onto the end of all kinds of things (a la "GamerGate"). As a child, I knew Watergate was a scandal that impacted the presidency. I think I was an adult before I learned it involved wiretapping. I remember being rather surprised to learn some of the details as an adult. https://en.wikipedia.org/wiki/Watergate_scandal https://en.wikipedia.org/wiki/Watergate_scandal

madengr 6y ago

If they had been this thorough with voting me hone security.....