Infosec implications of the US Capitol physical breach

IMHO, privacy is a key part of negotiation, creativity, and planning. Lack of privacy would make it difficult for them do their jobs well or (more likely) drive them to use unofficial, private channels.

Sometimes a deal or a new idea needs a "safe space" to grow.

I assume you are a programmer (this is HN). Do you think operations at your company would improve if everyone's screen was constantly broadcast to management? Personally, I'd prefer to be judged on my job performance, rather than having some non-engineer decide if I'm doing a good job based on their impression of what's on my screen.

The legislative record and public statements of our congressmen are almost always enough to evaluate their competence.

1. https://www.nytimes.com/live/2021/01/06/us/washington-dc-pro...

Boy, I wonder if the fact that these guys basically just goofed around and took pictures instead of burning down the capitol (like what happened in the Portland courthouse) had any bearing on that.

Let's not lose perspective.

In the protests outside the Portland federal courthouse building, police held out for weeks while insurrectionists threw bombs [0] and incendiary devices [1], attacked officers with hammers [2] and blinding lasers [3], and tried to breach the courthouse with crowbars and power saws [4]. Nightly arson attempts set fires at, around, and inside the courthouse [5]. The protestors' goal- as stated in their extensive graffiti [6]- was to attack police, breach the courthouse and destroy public property, much as they had done in earlier riots [7]. One stabbed a black conservative journalist in the stomach [8]. Many were arrested carrying illegal guns and ammunition [9].

In response, and after local law enforcement abandoned the courthouse by order of Portland's Mayor Wheeler, federal agents arrested suspects in accordance with the law. They read suspects their rights, treated them fairly, and in most cases- thanks to an extremely permissive District Attorney [10]- released them within 48 hours of arrest.

What happened in Portland (and Seattle, Minneapolis, Chicago, and other American cities) this summer was also undeniably insurrection, and undeniably much more violent. Despite this, police in Portland never shot anyone in the back, much less fatally.

Call today's insurrection what it is, but be consistent.

[0] https://twitter.com/thetypeofguy69/status/129308897288596275...

[1] https://katu.com/news/local/molotov-cocktail-rattles-portlan...

[2] https://www.justice.gov/usao-or/pr/portland-man-charged-assa...

[3] https://www.king5.com/article/news/politics/federal-officers...

[4] https://twitter.com/Clypian/status/1286906816018841600

[5] https://www.opb.org/news/article/portland-police-less-lethal...

[6] https://www.kgw.com/article/news/local/protests/protesters-h...

[7] https://www.justice.gov/usao-or/pr/portland-man-charged-may-...

[8] https://www.oregonlive.com/crime/2020/07/man-knifed-in-back-...

[9] https://www.usatoday.com/story/news/nation/2020/07/26/portla...

[10] https://www.washingtonpost.com/health/no-charges-for-many-ar...

It appears the DC leadership and the Pentagon wanted to avoid a show of force that mimicked what happened during the summer, trying to learn from their mistakes during the protests triggered by Floyd’s death.

- At least one flash-bang (probably) and one tear gas grenade (definitely) were used on the capitol steps.

- Their duty as police is to protect and serve, so shooting would have been a terrible idea. Evacuation is not difficult in an ultra-hard target like the capitol, and a lot of civilians had bags, some of which definitely contained firearms. I also heard some shouts about fetching guns from hotel rooms (we did not stay overnight in the city). A gun battle would have been catastrophic on both sides.

You want cops to be more like stoic stormtroopers? If every cop out there took a selfie with rioters, it would have been easier to manage them by a degree. Imagine hundreds of selfies with cops were posted in right wing social media, how will that not make right wing protestors have a nicer attitude towards the cop in the future?

what's really the downside of letting this happen? Not focused on crowd control? This is also crowd control.

Based on the reports, some of the rioters were carrying blue lives matter flags. I would say it's pretty obvious there were shared sympathies between the mob and those protecting the Capitol.

Being overrun by attackers is one thing. Ignoring them would be dereliction of duty. But assisting and siding with them? I don't even know what you'd call that anymore.

They could have easily guarded the building itself. Close the doors and post 30 guards at each entrance?

The mayor's request was basically that the Feds not unilaterally start escalating and militarizing police efforts in her jurisdiction without her involvement. In hindsight, that does seem to have been the correct strategy for her police department, because all the violence seems to have been concentrated within the jurisdiction of a different police department.

Obviously this is a developing situation. And the details don’t actually matter to my point. Clear and present evidence to commit acts of domestic terrorism was available, and people were still allowed to loiter and vandalize as they pleased.

I expect (given the consequences of allowing them in and prior use of lethal force against demonstrations by Americans in America) the security personnel to be ready, willing, and able to use lethal force to keep armed protestors out, even if the doors were open.

I expect the doors to be strong enough to withstand anything short of an RPG.

I do not expect security personnel to desert their posts in their own capital city.

Others disagree. Nearly half a billion was spent in total in the fight over the seat for Georgia.

https://www.nytimes.com/2020/12/20/us/politics/georgia-senat...

If North Korean terrorists were to execute 100 senators, you've already lost. Massacring a bunch of poor pawns in North Korea doesn't solve anything except maybe appeasing some people's ideas of revenge. The DPRK hardly cares today about most of population, but in return they would effectively shutdown the US government and possibly put the entirety of the government into a standstill, possibly freezing tons of regular processes. Before any other bomb is launched, people would be more concerned about making sure they are properly secured - after all if north korean terrorists already executed the Senate, your main fear would be that you're next; and glassing peasants wouldn't prevent that.

In other words, your opponent has just taken your all your Rooks, Knights and Bishops and in response you wipe out their pawns while the opponent's queen is about to checkmate you.

https://twitter.com/Tender_oni/status/1346916038269689862?s=...

https://twitter.com/theangiestanton/status/13469560673019412...

Edit: anyone want to respond about what's wrong with my comment rather than arbitrarily down voting?

I'd say require the police line to wear body cams, have them on, and then require connecting a shot to a specific act. That would also serve as good Pavlovian training for people who think violence is ok as long as they personally think it's ok. The definition of what act can vary, but what I meant above is limited to this instant, targeted reaction - what I want to see is a specific "protester" throw a rock at police, or force entry, or set something on fire, and instantly gets shot; with camera evidence of both. Of course, I'd also accept arresting (and prosecuting with real punishment, not releasing after a few hours), but I don't believe it matters which one is used in the case of violent riots.

I should point out that the photo going around showing the difference between the BLM response and the response to this mob is of the DC national guard, not Capitol Police. The DC national guard was not mobilized when the rioting started yesterday. Apparently it was requested but the DoD had not approved it. You can bet there will be some investigations there, and people involved will try to hide themselves in the bureaucracy and pointing fingers.

My bet is that, in a year or two, we'll see some serious reforms in this area. Probably an expedited procedure for mobilizing the DC National Guard, or Congress will be so angry they will demand an expansion of the Capitol Police force, since that force works directly for them.

Our collective goal should always be to resolve the conditions that lead to rioting. But when a riot occurs it should be stopped and dispersed as safely and expediently as possible.

The US democracy is not threatened by violence against any single building or even most sets of people.

Had they burned the building to the ground and somehow caused the deaths of everyone inside, the US democracy would continue. They did not achieve anything remotely close to that.

There is no basis for calling some angry rioters smashing windows and smoking pot "a substantial threat to democracy". None.

Group A gets treated unfairly w.r.t how group B is treated.

Clearly the welcome outcome is that group A becomes treated justly, at least as justly as group B.

Yet, some members of group A wouldn't mind that at, if that option were not on the table, group B were treated at least as badly as group A. It's stupid, it's counterproductive, but hey, humans...

When group A sees another instance of group B being treated (again) better than how group A would have been treated in those circumstances, I think it's not surprising how people can get a tad angry and when you're angry, your thoughts wonder a little bit more on the dark side, right?

When some people from abroad kill people in your soil, it's quite understandable that people get angry and talk about bringing pain to people in the countries where these attackers come from. It's that "right"? Will that create a better world? Clearly if you just found a way for that never happening again, that would be enough right? The sense of "punishment" is so deeply ingrained in our nature; it's not a prerogative of part of the political spectrum.

This is a particular point of the "kettling" tactic, where protestors are herded into an area and kept there for hours.

The fact that a woman was shot by police in last night's protest is a tragedy, as all human life is precious. But a democracy can't bow down to mob rule for fear of violence. The protesters should have never even been allowed to get near the Capitol building while Congress was in session, and in that case perhaps this loss of life could have also been avoided.

Police brutality and the police culture of violence before other solutions is also something that has been discussed in leftist circles the entire year. It is a culture that must be changed, which will surely be a monumental task, if it even is attempted. Still, the alternative is not simply allowing mobs to attack federal institutions with impunity.

People used to call this “deescalation” and considered it the prime example of how to deal with protesters. When protesters are taking selfies with the cops then something is clearing going right.

On the other hand, an unarmed protestor was shot and killed, but almost certainly there will be no riots or sacking of small town centers in response.

The Federal courthouse was under constant siege for weeks in Portland, but that was “mostly peaceful”. This on the other hand was clearly a “mob” according to NYT.

I just want to see people be consistent with how they describe and respond to protesters regardless of the political affiliation of the protest.

Relative to the scale of rioting throughout 2020 this was objectively pretty tame, minus the fatal shooting. At least you can say it wasn’t a targeted assassination unlike other cases last year.

The next fascist president may be less incompetent and achieve far more sinister goals.

The whole point is that we should re-establish the supremacy of the rule of law. What happened last night was an assault on this. Enacting your suggestion would be the same.

It was for show, but the police allowed it to go way too far. Not to mention, where was all the surveillance power of the NSA to provide advance warning?

The disturbing part of what happened yesterday was not that a bunch of assholes formed a mob to disrupt Congress. The disturbing part is that they were obviously allowed to do so.

It’s over let’s move on.

Sure, I'm not proposing to escalate and it's wonderful that it is over with no real effects. But the security handling was atrocious, and the results would have been much worse if the mob were only slightly more organized and intent on bloodshed.

I'm not claiming that they would have succeeded to actually install Donald Trump for a second term. But I do believe that they could have forced a mock result to eb proclaimed on the senate floor, creating a much larger problem for the future and giving much more power to their narrative.

Also, note that the quote from me was supposed to reinforce the idea that there were compelling reasons for the police to take their presence as a serious threat. These weren't protesters chanting to save the whales, they were protesters asking for the election to be overturned (even if I agree with you that they had no real chance of achieving this goal).

Rioters inflamed by years of Trump's gross lies storm the Capitol, demanding to overturn the results of the election, four die, and your response is, "Calm down"?

This is not the issue here. It is not even that the outgoing president very deliberately provoked the attack, as well as a much wider opposition to the democratic process. The biggest problem is that the president was actively supported, in his provocation, by more than a few US senators, along with elected officials of several states (some of whom are plausible presidential candidates themselves.)

There is little doubt that if any of the extra-legal or simply bogus attempts to overthrow the election had succeeded, these senators, and most likely the republican party as a whole, would have been happy to go along with that act, in what would, in reality, have been a coup d'état.

Even if the supreme court put a stop to it - which is not a certainty - much damage would have been done.

It wasn't a protest of a bill, or a protest for a particular legislative action. It was a protest against the election of the President itself - against all evidence, all facts, and all testimony from just about every official except the President, who egged this on.

I didn't want to see heads rolling, but I was shocked at how delicately they were handled - cops even let them through barricades.

Contrast this with left-wing protesters and their treatment by cops, and you see a much different picture, of people walking or sitting down getting pepper sprayed, or 70-something men getting shoved to the ground in a public square by a team of armored officers.

There are a number of reasons to be angry at this stunt, and a number of conclusions to draw from it. First thing is first, if we had any kind of collective conscience, Trump would be impeached today.

https://en.m.wikipedia.org/wiki/Zug_massacre

Context is important.

As to the infosec problems: legislature is run (even more in the US) by mostly senile, corrupt lawmakers and a staff of technically inept party groupies (or so I guess, clicking random aides linkedin-profiles). I doubt that any nationstate actor needs a raid of their offices to get to their computers (and that's why these people probably get the real national-security stuff on paper...)

The other difference is that not even a few months ago, police used massive shows of force against people who were unarmed (other than cameras for the reporters among them) and completely peaceful, in the same area.

If you think those three police officers at the Reichstag would have stopped those protestors if they action had wanted to storm the building, you are delusional.

Oh, and not too long before that Greenpeace members actually climbed the Reichstag and unrolled an anti-coal banner. Just that the media didn’t frame this into “an attack on democracy”.

That does not mean that they should have ever allowed protesters to attack the Capitol building while Congress was in session.

It's also important that the BLM protests were not about wanting to overturn the results of the election and install their preferred candidates. The cause that is at least proclaimed by a protest movement matters, it is not just a detail when considering a valid response to it. And even so, any police officers who fought BLM protesters to keep them from attacking democratic institutions, especially those in session, were fully justified.

It is not acceptable for the certification of the legal election to even be delayed as it has by a mob.

I assure you that I would believe the same if pro-Hillary crowds would have amassed in hopes of convincing or forcing Congress to overturn the electors vote in 2016. Especially if police had done little to deter them.

But as organizations (Capital Police, Metro Police, FBI, etc.) this event was broadly known to be happening all over social media well in advance of Wednesday's event. There should have been a response as soon as that crowd made it to the steps of the building.

What concerns me is how this could have played out if that rioting group was even 10% more organized than they were. Or if they were intending to destroy/damage the building beyond windows and doors. Could you imagine if instead of just taking selfies in the senate president's chair, they piled up the desks and lit them on fire?

I hope this event sparks some changes in security protocols, because now any extremist group intending to disrupt government or make a bold statement know exactly how to do it and know they'll get far enough to do some serious damage.

While at the individual level it probably makes sense to err on the side of inaction, at the organizational level this is a massive failure.

What would happen next? Who would cancel these acts of Congress? What if the Supreme Court (filled with partisan judges) decided to accept the results as well?

It means reducing the scope of the police so that they aren't the ones dealing with things like homelessness and mental illness, things that they usually are not trained to deal with.

Here's a good explanation [1].

[1] https://www.goodhousekeeping.com/life/a33024951/defund-the-p...

There can be no reasonable doubt that this was allowed to play out, with the few policemen stationed there being openly friendly with the crowd by some reports. The level where the decision to allow the protest to attack Congress was taken is of course up to the courts to investigate, but I feel it is disingenuous to claim that this isn't the most reasonable conclusion by far.

There are plenty of options for stopping a person going into a place, that don't involve executing or seriously wounding them. It should be a grave concern for every citizen that the police generally have so few qualms about firing their guns at people.

The police should have attempted to deescalate this situation with a minimum of violence - not the maximum.

The Policeman was with a number of other cops. They had ample room and time to retreat. There was a closed and barricaded door between him and the woman he shot. He fired the first shot.

They both have a case for self-defense, but the Cop's case is going to be a harder sell.

That's likely a national statistic. Remember, these are police in DC, a very liberal area.

> Several 9-1-1 calls were made by Wallace's sister, brother, and neighbor, telling dispatchers that Wallace was assaulting his parents

> The two officers arrived in the area to respond to a domestic dispute. When they arrived, Wallace walked out of his house carrying a knife. The two officers backed away while telling him to drop the knife, and as Wallace walked in their direction, each officer fired several rounds at Wallace, hitting him in the shoulder and chest. He later died from his wounds in the hospital. Wallace's family stated that Wallace was having a mental health crisis.

> Protests and demonstrations against police brutality and institutional racism in response to Wallace's killing took place across Philadelphia throughout late October.

> The then-presidential nominee Joe Biden and his running mate Kamala Harris published a joint statement saying, "Our hearts are broken for the family of Walter Wallace Jr... We cannot accept that in this country a mental health crisis ends in death."[34]

https://en.wikipedia.org/wiki/Killing_of_Walter_Wallace

Body cam video: https://www.youtube.com/watch?v=xl1QBL8TijI

Edit: And it really says something about our ability to discuss facts on Hacker News when quotes from Wikipedia and a body cam video are downvoted to invisibility.

Is there a source for this claim? All I could find was https://www.policemag.com/342098/the-2016-police-presidentia...

It says that 84% of responding email-registered readers of POLICE MAGAZINE indicated that that they would vote for Trump. That's not the same as what you said at all.

This magazine "emailed 59,238 readers". There are more than 10x that many full-time police officers in the US. Can one conclude that the responding fraction of this tiny-circulation magazine's readership is statistically representative of all police officers in the country?

there's a large security perimeter that's already been breached, and the video shows one chokepoint of the perimeter that hasn't yet been breached.

The officers at that checkpoint know what the situation is: They aren't going to do any good in an open space surrounded by a mob of thousands. They are moving back to a more defensible position (presumably where they can buy time to evacuate the Congress floors). They are calmly walking because breaking into a jog could incite the mob further.

I don't see them opening the gates.

It's slightly surprising there's not an emergency evacuation procedure for people who work in the building that involves locking all devices that remain in the building via a hot-key or hot-corner. Come to think of it, I wonder if a screen lock command is something that could be pushed from a Windows domain controller...and if so, why wasn't that used?

The report I saw before was one of her staffer's computers was unlocked. Was there a report about her personal computer? (Does she even use one..?)

There are several instances of Trump going against his intelligence community, specifically in regards to Russia, to weaken America's cyber-defense. There are legitimate reasons to be concerned that he was being blackmailed by a foreign government to weaken America's institutions, and sow chaos and division.