A physical breach is a nightmare scenario for Capitol IT

https://twitter.com/jacobian/status/1347000969435860993

by rmason • 6 years ago

316 165 6 years ago

They can't sign emails without PKI right?

Officially yes, but the use of S/MIME signed email in the federal government is minimal/non-existent beyond a few instances.

unixhero• 6 years ago

Hey! They used it on The X-Files. I've got proof. (Joke)

blabitty• 6 years ago

Not exactly true I've worked for several very large agencies that use encrypted and/or signed email extensively

jaywalk3• 6 years ago

The one person who almost got into an area where they really didn't want people was shot dead. This guy's acting like the rioters breached a SCIF or something. The Capitol building is (was, normally) open to the public.

saargrin2• 6 years ago

not sure the office computers are typically accessible to public

now they gonna check everything for possible keyloggers or whatnot

and theres no way of knowing if any computer was left unlocked and might have had something installed on it

NortySpock• 6 years ago

At least one protestor claimed he found an unlocked computer. Up to others to verify if that claim is accurate.

https://arstechnica.com/tech-policy/2021/01/pro-trump-report...

Windows-L is the keyboard command to lock on Windows. I strike it by habit every time I get up from my chair.

jedberg2• 6 years ago

"Hi Representative Foo, I have a presentation on the USB stick here I'd like to show you, mind if I plug it in?"

"I just need to download the presentation from my website, can I use your computer real quick?"

Do you really think an 80 year old anti-tech representative would even consider that a problem?

I'd have to assume the computers are already protected from that attack vector.

Edit: I'm getting a lot of downvotes without replies, which makes me thing people don't agree with this. I wonder, how many have actually worked in corporate IT security for a non-tech company with older employees? Because things like this definitely happen on a daily basis.

Case in point: Pelosi's screen was unlocked when that guy sat down, which was at least 20 minutes after she left. That means that not only does she not lock her screen when she gets up, but the screen saver doesn't even auto-lock after 20 minutes.

Ruthalas• 6 years ago

There's at least one photo of the screen of an unlocked laptop, with a security warning popup in the corner suggesting evacuation.

paxys2• 6 years ago

Multiple computers belonging to congressmen/their aides have been reported accessed or stolen (https://thehill.com/homenews/senate/533162-merkley-says-capi...). Someone posted a picture of Nancy Pelosi's email client, stole mail and left a threatening note in her office. Other private chambers were vandalized (https://twitter.com/SenJeffMerkley/status/134703950452849868...). Can anyone really confirm that there were zero foreign agents among the thousands of rioters who accessed the building? Let's not pretend what happened was normal.

jaywalk3• 6 years ago

Not normal, not good. Will cause issues for sure. But those computers did not have access to classified information.

chefkoch3• 6 years ago

You'd have to reimage all those computers for sure.

asdff• 6 years ago

In that picture (1) it's actually an aid's computer that is unlocked. No chance Pelosi shares an office with someone six feet across from her.

https://www.shorenewsnetwork.com/2021/01/06/d-c-protesters-s...

tgsovlerkhgsel• 6 years ago

The vandalized office you linked is... weird. Judging by the dirt on the carpet a sizeable horde stampeded through the office, some of them stayed long enough to put cigarettes out on a picture frame or something, and yet the destruction seems pretty limited.

I would have expected way worse, including fires.

thinkmassive• 6 years ago

Yep, the important rooms would not accidentally be left accessible, even in a situation like what happened yesterday.

https://en.wikipedia.org/wiki/Sensitive_Compartmented_Inform...

meragrin_2• 6 years ago

The one person who almost got into an area where they really didn't want people was shot dead.

The videos showing her get shot had several police in the area and they never looked like they were very interested in protecting that area before she was shot.

c_r_w2• 6 years ago

Difference between the Secret Service and Capitol PD.

orblivion• 6 years ago

This is something that surprises me about the whole thing. Wouldn't the chambers full of Very Important People who are presumably targets of many an angry/deranged person be among those highly sensitive areas? When I heard that these people were breaking down barriers and potentially storming the Capitol building, I thought surely they would stop as soon as they foolishly approached the chambers and started getting shot dead. When I was so much as standing across the street from the White House, where all the protesters hang out, I assumed I basically had a red dot on my head, so I should be careful what I do.

Spooky232• 6 years ago

They are representatives to people and basically shake hands and kiss babies for a living. They can’t be isolated.

Obviously, the security services stood back and had high level direction to do nothing. They left a few capitol police flapping in the breeze and the cavalry (national guard, other law enforcement) never showed up.

I work near a VA hospital, and a few years ago a deranged man was running around the grounds with a machete and what looked to be a rifle. They activated their protocol and within 10 minutes mutual aid (Federal Protective Service police, State Troopers, local PD were on site.

That didn’t happen. I hope Biden purges the top layers of career management in those police agencies as well as the commanders of the National Guard. They failed the nation.

tunesmith2• 6 years ago

The one person who almost got into an area where they really didn't want people was shot dead.

Wait, what is the context on this? I saw the footage once before I knew she died. It honestly looked like law enforcement with guns coming up the stairs, and it looked like a crowd of people, not a woman acting alone. What area of the building was that that was extra-sensitive?

EDIT: I see now, other angles are easy to find. Trying to climb through a blockaded entry point as guns were already pointed at her...

harshreality• 6 years ago

It was at the locked corridor barrier to the Speakers Lobby which adjoins the House Chamber. Rumors that Pence was there and it was Secret Service haven't been confirmed; he had been in the Senate chamber and Secret Service had evacuated him, so it's unlikely he would end up on the House side in a poorly secured area. News reports indicate it was simply Capitol Police, possibly someone associated with the House Sgt at Arms since they have an office somewhere around there.

I guess the woman, despite being a veteran (Air Force... why is it the Air Force has so many crazy people?), was so caught up in LARPing that she couldn't rationally evaluate that this was the last meaningful barrier to the House chamber and they might have more liberal rules of engagement or someone might panic and overstep their RoE to prevent an unauthorized mob from entering. If she'd climbed through, she could have opened the door to the mob.

On the other hand, I can see the argument that shooting her was an absurd overreaction. There were armed capitol police who had just come up the stairs behind her and that group of protesters, and they were doing nothing. The news reports that the justification for the shooting was that she might have been armed, but if that's really their rationale, it's a bad one. They should have retreated to the main chamber, because they weren't in a good tactical position, trying to defend a barrier with windows large enough for people to climb through. In addition, no such resistance was offered on the Senate side. When you're outnumbered that badly, unless you have special training like the Secret Service would, and plenty of ammo, you're not going to accomplish anything by shooting anyone, unless they are overtly threatening people such that you think you're going to die or be taken captive anyway.

I don't think Capitol Police are legally at fault in any way for her death, but I think they did the wrong thing there.

mcintyre1994• 6 years ago

In the video I saw of the person who got shot, it looked like she was climbing into a room that already had both police and other rioters inside - is that incorrect? I’ve also seen pictures of people inside Pelosi’s office, including on her unlocked computer with emails displayed (albeit I assume these weren’t confidential - the only one mentioned was about the security breach).

jedberg2• 6 years ago

Is it though? I was having this discussion with a friend last night. If I were IT for the Capitol, I would already be operating under the assumption that all the clients are hostile.

There are constantly visitors to the Capitol, including foreign visitors who could easily be spies. Also, the Members themselves are often old, anti-tech, and not the kind of people who will remember to lock their screen when they get up. I would already assume Member computers are a huge attack vector, and act accordingly.

watwut3• 6 years ago

Random visitors don't go into offices. They don't look into cupboards. They don't sit behind desk with computer.

generalizations• 6 years ago

And yet you still have to assume they might.

AnimalMuppet• 6 years ago

How about staffers working for members from the other party? Yes, you'd expect a "gentlemen's agreement" not to do such things. You might not be wise to trust it, though...

chefkoch3• 6 years ago

But perhabs visitors like lobbyists, donors etc. could be often alone long enough with a computer to something bad. And don't forget all the viruses that tweet porn links.

Rebelgecko• 6 years ago

I am a random nobody and I was able to waltz in to my congresswoman's office. Obviously I wasn't digging through the desk drawers, but it's not like I was closely observed while I waited for my congresswoman's secretary to get off her phone call

bszupnick• 6 years ago

This person, who seems to have more intimate knowledge of capitol IT, also mimics the concern: https://twitter.com/neurovagrant/status/1346964347684179970

_Microft2• 6 years ago

Here is why Foone thinks that “forgetting to lock the screen” is unlikely: https://mobile.twitter.com/Foone/status/1346924327996772354

mikeryan• 6 years ago

Relevant Picture (from since deleted tweet - Interesting that the media is still accessible on twitter...)

https://pbs.twimg.com/media/ErErUqKXMAMQtyy.jpg

chipsa3• 6 years ago

Congress apparently doesn't use CACs, and the photo shown of the desktop shows no card reader to stick a card in.

renewiltord• 6 years ago

The idea that a senior US Congressperson or Senator would have the same rules as some IT contractor is ludicrous.

Her password is probably password123 or some such nonsense too.

anothernewdude• 6 years ago

They're going to have to rebuild from scratch anyway, this event has just made sure they do so.

admax88q2• 6 years ago

I would already be operating under the assumption that all the clients are hostile.

You can't operate assuming all computers in the Capitol are hostile. How are the members supposed to do work if their computers are assumed hostile? Why even give them computers then?

I would already assume Member computers are a huge attack vector, and act accordingly.

What would "acting accordingly" look like for you in that example scenario you outlined.

structural• 6 years ago

You absolutely do assume that that network is hostile/compromised. There are a number of other networks in other places where more important communications are done. It's a giant PITA, and a lot of stuff leaks from Congress because most people believe that they are too important to have to keep things secure.

Being in Congress is not an automatic ticket to having all the country's secrets on your desktop, and things actually are compartmented quite heavily when necessary.

spoonjim• 6 years ago

The actual Members are in many ways, a bug of the system, and recent events have demonstrated that very clearly. Capitol IT probably puts them on a "Guest WiFi" and lets them surf Twitter without bothering anyone. The majority of the US government apparatus functions on a day-to-day basis without any input or functional oversight from anyone, and that is the so-called "Deep State" which in reality is the only reason anything works at all. Can you imagine the country if Donald Trump was functionally the CEO the way that Elon Musk is the CEO of Tesla?

cpascal• 6 years ago

The author of the Twitter thread links to another thread towards the end that notes the risk of a classified information breach isn't too high.

https://twitter.com/ericgeller/status/1347226499930230785

Obviously that doesn't change the fact that the entire building should be considered compromised and scrubbed.

slg• 6 years ago

The last 5+ years of leaks from politicians should have taught us that something doesn't need to be classified to be highly damaging to both the individual and the nation.

jmiter• 6 years ago

Maybe someone can answer this for me:

having worked for the US gvt, though not in legislature or dept of state, PIV cards were always required to access a gvt machine, and leaving your PIV inserted while absent from the room was, in theory, a serious offense.

Are congress critters and others not required to use ID cards when accessing gvt networks?

Jtsummers4• 6 years ago

Different agencies have different IT systems at the federal level. The PIV cards used by the DOD and some other departments are not universal within the executive branch, and the legislative and judicial branches manage their own IT systems (sometimes still managing it locally rather than having any kind of centralized system). Government IT is very much a set of feudal territories still and many of them are not well or consistently managed.

chefkoch3• 6 years ago

I'm not sure you can say no to senator who wants stuff changed?

jnwatson• 6 years ago

The rules for the executive branch are fairly rigorous. The legislative branch, not so much. There's a huge difference in scale: the executive branch employs some 4 million folks, the legislative branch just 35K.

Just the picture of Pelosi's desktop indicates there's no automatic screenlock, which is a fairly low bar as controls go.

fl0wenol2• 6 years ago

It wasn't Pelosi's desktop, it was her scheduling assistant's. You can clearly see his name on the Outlook inbox.

Not that it's much better, but it is still an important clarification.

SolarNet• 6 years ago

My understanding is that each legislator is like an independent client and is able to run basically whatever IT they want as far as the unclassified (yet still sensitive of course) stuff goes. Given that, I'm betting the shared IT group is basically just recommending best practices and hoping people are listening.

wnoise• 6 years ago

What wag decided on that acronym that exactly overlaps a far more prurient one?

chipsa3• 6 years ago

https://arstechnica.com/information-technology/2017/04/pictu...

dillondoyle3• 6 years ago

Another thread that I think offers some context a bit less 'scary' than this [1]. Most of the stuff the invaders could of had easy access to - eg in a Member's office - is not that important, consider what is leaked to the press strategically for politics every day.

I'd be more concerned about listening devices especially key committee Members and staff e.g. foreign relations LAs

I don't have firsthand knowledge of the non-classified working computers of Congress but maybe someone can confirm if IT used SolarWinds and their network is already compromised.

* also individual Member offices are treated basically like businesses in a lot of ways. e.g. the Member can contract/share hire their own IT helpers too. i can't find a source quickly but a few years ago remember the article about some guy working for a few Dems being a dumb ass

* * I'll also add that almost any US citizen can get a meeting inside a Member's office. A house member directly or with a staffer. I'm sure there are a ton of listening devices that metal detectors wouldn't find and that are quick to place surreptitiously

https://twitter.com/ericgeller/status/1347226499930230785

rootusrootus3• 6 years ago

almost any US citizen can get a meeting inside a Member's office

Indeed, most days you can just walk directly into any senator's or member's office. Maybe leadership has different rules, I haven't tested that, but I had no trouble strolling into Ron Wyden's office. So anything you can get through the building metal detectors (which really aren't very sensitive, they're just looking for weapons) you could take in and surreptitiously drop off.

cheeze• 6 years ago

That's terrifying, knowing just how bad some of these people are with technology....

pkulak• 6 years ago

I had no idea. I'd love to meet my reps, especially Wyden. They represent me so well I wouldn't really have anything to say, but it would still be a bucket list kinda thing.

idlewords2• 6 years ago

It's important to remember that nearly all of these offices are in other buildings across the street.

xtracto• 6 years ago

I'd be more concerned about listening devices especially key committee Members and staff e.g. foreign relations LAs

Or better yet, placing an annoyatron on key offices of members of the party you don't like.

bregma4• 6 years ago

Do those work on people over 70?

ufmace• 6 years ago

Does anybody remember when Bradley/Chelsea Manning released ~hundreds of thousands of classified diplomatic cables? I seem to remember that most of the tech world at the time thought that was awesome. I wonder why this time they're clutching pearls about how scary and terrible this could be.

randylahey2• 6 years ago

Your recollection does not comport with my own. A lot of sensitive classified information was leaked, a good deal of it having nothing to do with warrant-less wire-tapping, etc.

mjburgess• 6 years ago

Four 5seconds until their contents was clear.

It was initally assumed to be a leak on moral grounds. And ended up just putting a lot of people in danger, and disrupting international diplomacy.

I dont think many who know the details support the leak.

jessaustin• 6 years ago

No human was physically harmed as a result of Manning's leaks. If there had been, such a person would have been mourned in the USA war media for months.

Sebb767• 6 years ago

I wonder why this time they're clutching pearls about how scary and terrible this could be.

Most of the readers here know quite a few things about system administration and/or IT security. As I read this thread, most comments only discuss the IT security implication or express sympathy for the poor souls that will need to clean up this mess; there's hardly any discussion about the morality of possible leaks.

fl0wenol2• 6 years ago

Since you're bringing up Manning but not mentioning Snowden, and also helpfully dead naming her in case we were confused, we can assume you're not bringing this up in good faith but as a slanted whataboutism.

TT3351• 6 years ago

Access to the Capitol isn't very restricted. People who are handling top secret information know that very well; that said, plenty of personally compromising information can usually be found on any given personal computer.

psychlops• 6 years ago

Heaven forbid someone front runs the trades of Congress.

adrianmonk• 6 years ago

Are there security cameras? If so (assuming footage wasn't tampered with), then you can maybe narrow down the locations where people actually did have physical access.

moonbug• 6 years ago

They need to toss everything and start again. Safer, and probably faster. But I expect they'll just turn back on and resume using everything not ruined by piss.

qwantim1• 6 years ago

I’d assume they were already bugged. Also, whose to say all of the new equipment they replace it with won’t be bugged?

And why do they even need offices in the capitol building at this point? Everything could be done online.

Ericson2314• 6 years ago

I think the thread model is a bit off, in that all the "real secrets" are sadly with the executive branch.

However, if congress can learn a bit about the pitfalls of commonplace devices, that would be nice.

m3kw9• 6 years ago

Not as bad as he says. https://twitter.com/ericgeller/status/1347226499930230785?s=...

nabla9• 6 years ago

Obviously all computers left around in offices should be considered unsafe. Confidential information may have been leaked.

But Capitol has SCIF's for storing top secret information and committee meetings that deal with classified information. You can't bring your own laptops or even phones to them.

tareqak• 6 years ago

Doesn’t the Capitol have those controlled access rooms that Congress had to use to access evidence concerning Trump’s impeachment (I forget the exact name of the rooms)?

Given that Congress was recently sworn in, there probably was nothing just lying around, but that is the sort of physical evidence that would be especially sensitive and embarrassing to leak.

enw• 6 years ago

Is it just me, or do some people have a fetish for catastrophe?

Greatly overestimating security impacts, the impacts of COVID, aggressive "new normal" lockdown proponents, militant preppers, etc.

Paradoxically, I think some might feel more secure when they are the messengers of chaos. I wonder if there's a psychological reasoning underneath.

Razengan• 6 years ago

I wonder if there's a psychological reasoning underneath.

boredom

A safe, regulated, mechanically functioning society day after day is boring as hell†. Catastrophe is one of the easiest changes to imagine and fantasize about. Which is probably also why dystopian cyberpunk is more popular than utopian sci-fi.

† If you don't get enough leisure time or have enough activities to fill it with.

ehnto• 6 years ago

I think what's truly missing is purpose and community, not leisure time although you may have left that implied.

Many want their life to be special, to be part of something bigger. Modern life can lack a sense of purpose and community, so even with infinite entertainment at our fingertips we still yearn for something deeper. Like you said, conspiracy or chaos can fill those desires. You get to be part of an "in-group" and be part of something bigger. Life just gets a bit more dramatic and interesting. Probably why cults can exist at all as well.

I used to wonder how anyone could be stupid enough to fall in with a cult, but after living a traditional modern 9-5 for a while I can totally see the hole that was missing that a cult, religion, conspiracy or commune would fill.

smt88• 6 years ago

Humans are special because of our ability to forecast and run scenarios. You can "practice" dangerous situations in your mind -- a great tool to mitigate them if they arise!

This can go to an extreme, of course. People seek security by modeling everything, playing it all out, and trying to prevent bad things from happening.

It's normal human behavior that is supercharged by modern information overload.

taitems• 6 years ago

I would counter and say that those who reacted most fervently to COVID were the quickest to recover and those who were most blasé and dismissive are paying the price. New Zealand went immediately to stage 4 “where you sleep tonight is where you must stay” and their efforts have been admired.

golergka• 6 years ago

Is it just me, or do some people have a fetish for catastrophe?

Historically, having such fetish is what helped to prevent catastrophes.

fareesh• 6 years ago

The previous non-violent protests over the last few years that took place in the Capitol also had protesters present in all of the same places, including the chambers.

As such this is not a new situation, but it's interesting that devious motives are attributed when the protester has a particular set of politics, or because they were successful in breaking past security whereas previous protesters attempted and failed.

idlewords2• 6 years ago

I've seen a lot of this kind of concern, but people should keep in mind that the capitol is already a semi-public space, and is treated as such. The devices I'd really worry about if they were compromised are people's personal phones, which presumably they had on their person.

A note for context: a friend of mine who works in the capitol brought me along one day and asked me to wait in the minority leader's antechamber (a large room like a hotel conference room) for a few minutes while a vote was called. There were various bits of CAT-5 sticking out of the wall and I was unsupervised for nearly a half hour. Various people came and went and paid me no heed. I can't imagine I'm the first or last person to have been in that situation.

TL;DR special secure facilities exist for a reason. The Capitol is used to randos.

curiousgal• 6 years ago

This is a tad ironic. It's like backhandedly saying "we're so great that foreign nations wouldn't miss a chance to spy on us" but at the same time this great nation allowed its Capitol building to be ravished by a group of citizens. There are infinitely bigger concerns about this event than what this thread presents.

alkonaut• 6 years ago

This is a nightmare no doubt, but the IT security angle is so far down the list of concerns it's not even visible. If every machine, piece of infrastructure and password has to be changed, every log audited by a hundred people for a year?

Tiny damage in comparison in context.

DoreenMichele• 6 years ago

I am reminded of Watergate, which I think a lot of people don't realize was about planting wiretaps in the Democratic National Committee headquarters. It led to Nixon's resignation and it has left us with a legacy of adding "-gate" onto the end of all kinds of things (a la "GamerGate").

As a child, I knew Watergate was a scandal that impacted the presidency. I think I was an adult before I learned it involved wiretapping. I remember being rather surprised to learn some of the details as an adult.

https://en.wikipedia.org/wiki/Watergate_scandal

A physical breach is a nightmare scenario for Capitol IT

Related Stories