News for hackers. Stuff that matters.
Re:Infosec implications of the US Capitol physical breach by csomar on Thursday January 07, 2021 @05:52AM (#25669597)
> with the express purpose of overturning the legal election results.

I guess the answer is... calm down? A few hundred (even heavily armed) people do not stand a chance changing the results of the election, or almost anything in the US.

The event was for show. Although, unfortunately, one of them died. But it should remain that way and there is no reason to escalate further. (I guess we already have precedents of how escalation usually lead to innocent deaths).

Re:Infosec implications of the US Capitol physical breach by mannykannot on Thursday January 07, 2021 @09:11AM (#25671197)
> A few hundred (even heavily armed) people do not stand a chance changing the results of the election, or almost anything in the US.

This is not the issue here. It is not even that the outgoing president very deliberately provoked the attack, as well as a much wider opposition to the democratic process. The biggest problem is that the president was actively supported, in his provocation, by more than a few US senators, along with elected officials of several states (some of whom are plausible presidential candidates themselves.)

There is little doubt that if any of the extra-legal or simply bogus attempts to overthrow the election had succeeded, these senators, and most likely the republican party as a whole, would have been happy to go along with that act, in what would, in reality, have been a coup d'état.

Even if the supreme court put a stop to it - which is not a certainty - much damage would have been done.

Re:Infosec implications of the US Capitol physical breach by kritiko on Thursday January 07, 2021 @09:48AM (#25671626)
>There is little doubt that if any of the extra-legal or simply bogus attempts to overthrow the election had succeeded, these senators, and most likely the republican party as a whole, would have been happy to go along with that act, in what would, in reality, have been a coup d'état.

You could describe the 2000 election as a successful bogus attempt to overthrow an election. Has America already had a coup d'etat?

Re:Infosec implications of the US Capitol physical breach by wan23 on Thursday January 07, 2021 @12:01PM (#25673641)
In 2000 it was unclear who actually won because the Florida vote count was very close. No one was alleging that one side or the other was cheating, and everyone was in agreement that whoever got the most votes should be president. Also, Al Gore, as the outgoing Vice President, presided over the same certification proceeding that Trump and his followers disrupted yesterday. In January 2001, that proceeding went without a hitch even though the loser of the election was in charge of it.
Re:Infosec implications of the US Capitol physical breach by tsimionescu on Thursday January 07, 2021 @06:21AM (#25669786)
What would have happened if they had pushed into the room? What would have happened if they had had firearms on them? What if they had been able to grab just a few congressmen at gun point?

Sure, I'm not proposing to escalate and it's wonderful that it is over with no real effects. But the security handling was atrocious, and the results would have been much worse if the mob were only slightly more organized and intent on bloodshed.

I'm not claiming that they would have succeeded to actually install Donald Trump for a second term. But I do believe that they could have forced a mock result to eb proclaimed on the senate floor, creating a much larger problem for the future and giving much more power to their narrative.

Also, note that the quote from me was supposed to reinforce the idea that there were compelling reasons for the police to take their presence as a serious threat. These weren't protesters chanting to save the whales, they were protesters asking for the election to be overturned (even if I agree with you that they had no real chance of achieving this goal).

Re:Infosec implications of the US Capitol physical breach by phs318u on Thursday January 07, 2021 @07:13AM (#25670144)
> it is over with no real effects

I admit to being a little shocked at the glibness of this statement. As a non-USian, I see a profound shock among other thoughtful non-USians that it has come to this. Regardless of political affiliation, I believe most honest, ordinary non-USians have held in high regard the robustness of the American democratic system and its resilience to the wholesale corruption that plagues many other countries. The democratic ideal, and America as exemplar, has always been held in lofty regard. However, I’m more certain than ever that this ideal has now been firmly relegated to a historical oddity. A 200 year blip in the record of human governance, with a forthcoming return to mean. Watching this slow motion disaster unfold has mad me very, very sad.

Re:Infosec implications of the US Capitol physical breach by pjc50 on Thursday January 07, 2021 @08:17AM (#25670635)
I'm not so much shocked as tired. This is like 9/11 with a four year warning of the planes arriving and being able to watch them on Flightradar, towing a huge sign saying "we're going to crash this baby into the Pentagon". And nobody doing anything about it because that would mean that "both sides" weren't in fact equal.

Pleasantly surprised that the death toll was only four, of which only one was shot; much better than the regular death toll of single mass shooter incidents.

Re:Infosec implications of the US Capitol physical breach by bonoboTP on Thursday January 07, 2021 @09:02AM (#25671113)
How is it a 9/11? In 9/11 thousands of people died, postcard-symbolic buildings demolished by foreign terrorists. Here... A few hundred people strolled around in the Capitol and 4 people died.
Re:Infosec implications of the US Capitol physical breach by pjc50 on Thursday January 07, 2021 @09:39AM (#25671507)
Ah, but how many of those people died of 9/11 or just with 9/11? How many of them had pre-existing conditions? Besides, that's just one day of COVID. Was it worth closing the skies and invading Iraq for a mere three thousand people some of whom would have died anyway?

... no, I probably shouldn't joke about this, however dark, but if there's one thing that last year has made clear is that death tolls barely move the needle politically and that symbols stick in people's heads and effect real change. Even if the symbols aren't tied to underlying reality. The revenge of Baudrillard.

https://www.webmd.com/lung/news/20201210/covid-19-deaths-sur...

The symbolism of protestors in the capitol was "shocking" upthread. I worry that next month we'll have forgotten about it because something worse will have happened. We've already moved on from the guy who blew up a telephone exchange, and the other occupations of state capitols, and those guys who tried to kidnap a state governor despite being infiltrated by the FBI.

(For the avoidance of doubt, I am with John Donne that anyone's death diminishes us, but avoidable and preventable deaths doubly so, which is why I'm in favour of responsible politics and the politicisation of preventable deaths)

Re:Infosec implications of the US Capitol physical breach by bonoboTP on Thursday January 07, 2021 @10:03AM (#25671826)
People care about whatever they are told to care about by the media or whatever social media algorithms shove onto their feed.

Whole countries can freak out about the disappearance of one child or a car accident caused by some random intoxicated person and then everybody talks about their names, there are political leaders chiming in etc. Whole countries can come together to donate millions for the treatment of a rare disease of a single child. It's kinda random.

Humans are not calibrated to care about actual stats, just stories. A good story of one person can weigh more than a boring story of millions.

It's all theater, nothing more, whichever party wins... It's circus.

Re:Infosec implications of the US Capitol physical breach by bonoboTP on Thursday January 07, 2021 @09:00AM (#25671083)
> Regardless of political affiliation, I believe most honest, ordinary non-USians have held in high regard the robustness of the American democratic system and its resilience to the wholesale corruption that plagues many other countries. The democratic ideal, and America as exemplar, has always been held in lofty regard

Where are you from, how old are you? Watching too many Hollywood hero movies?

I think the above attitude is less common outside the US than within. It's usually Americans who view themselves as through the lens of American exceptionalism, the rightful police of the world, just bringing democracy everywhere out of altruism and a care for people everywhere etc.

In Europe, the US is definitely seen in a more ambivalent light with lots of corruption etc.

Re:Infosec implications of the US Capitol physical breach by QuesnayJr on Thursday January 07, 2021 @10:08AM (#25671877)
I live in Europe, and the universal reaction I saw in my circle was shock. People don't think the US is perfect, but the events of yesterday are completely outside the range of what they expect to see in the US.
Re:Infosec implications of the US Capitol physical breach by bonoboTP on Thursday January 07, 2021 @10:29AM (#25672113)
What exactly? They broke into a building and wandered about a bit. They didn't take any politician hostage, didn't burn down the building, etc. They were like unruly children.

Aren't you shocked to see thousands of cars burned in France over NYE? About seeing the American riots last summer?

It's blown out of proportion. This Trumpist crowd was disorganized. They didn't have a plan, didn't have leaders, didn't have demands or any credible way to win. Life goes on.

Re:Infosec implications of the US Capitol physical breach by pjc50 on Thursday January 07, 2021 @10:43AM (#25672243)
They had a plan, albeit an insane one, a leader, albeit an insane one, demands (change the election result), and a credible way to win (abduct or kill senators in order to change the outcome of votes). It's all very "we took six of the seven control rods out of the reactor and nothing happened!"
Re:Infosec implications of the US Capitol physical breach by bonoboTP on Thursday January 07, 2021 @11:01AM (#25672507)
Fundamental disagree. They didn't even scratch the surface. These buildings, the senators etc are all symbolic. They are expressions of the power relations, not the originators of it. Even if they do say stuff under threat, that would not have a real effect. It would be overturned by the Supreme Court or whatever.

There is no way to make Trump win this way and actually get obedience from the institutions of the country. They would just not recognize Trump, even if somehow senators, under duress, said he won.

It was 0 rods of the 7. Power is not in the buildings. It's in the network of interests of powerful people in the background across the country.

Re:Infosec implications of the US Capitol physical breach by QuesnayJr on Thursday January 07, 2021 @11:03AM (#25672535)
They stormed the Capitol, trying to disrupt the process by which the President is chosen. How many times have you seen this happen before in the US? For me personally, it's zero.

France has famously unstable politics, which is why they are on their fifth Republic. No one was surprised to see something like BLM because the US has long-running problems with racism. But this? This was new.

Re:Infosec implications of the US Capitol physical breach by ativzzz on Thursday January 07, 2021 @11:27AM (#25673058)
If anything, yesterday's event should reinforce your opinion of

> the American democratic system and its resilience

because there was a half-hearted attempt at a coup, and it failed miserably, even when indirectly backed by the current president.

Re:Infosec implications of the US Capitol physical breach by tsimionescu on Thursday January 07, 2021 @08:25AM (#25670709)
I meant 'no real effect' in terms of modifying the results of the election itself, or loss of life.

You're absolutely right that the symbolic effect is huge and will likely be long-lasting - both inside the US and outside.

Re:Infosec implications of the US Capitol physical breach by mywittyname on Thursday January 07, 2021 @10:21AM (#25672032)
> What would have happened if they had had firearms on them?

They (some) did have guns on them, along with knives, restraints, bombs (allegedly) and probably other weapons hidden on their person.

Re:Infosec implications of the US Capitol physical breach by nerdponx on Thursday January 07, 2021 @05:56AM (#25669623)
You don't get it.

It was for show, but the police allowed it to go way too far. Not to mention, where was all the surveillance power of the NSA to provide advance warning?

The disturbing part of what happened yesterday was not that a bunch of assholes formed a mob to disrupt Congress. The disturbing part is that they were obviously allowed to do so.

Re:Infosec implications of the US Capitol physical breach by techdragon on Thursday January 07, 2021 @08:44AM (#25670899)
The NSA is officially not supposed to be spying on the citizens of the USA. That’s the FBI’s job technically... as the USA has no dedicated domestic intelligence agency. There are a number of agencies with limited domestic intelligence roles tasks with specific kinds of intelligence work such as the intelligence branches of the US Treasury, the Department of Energy, and the Coast Guard... but there’s no USA agency equivalent of the United Kingdom’s MI5.

To extend the comparison, the CIA is roughly the USA’a MI6 and the NSA is very roughly equivalent to the GCHQ but not exactly as the NSA are not meant to spy domestically while the GCHQ don’t have that explicit limitation.

Re:Infosec implications of the US Capitol physical breach by Lendal on Thursday January 07, 2021 @09:28AM (#25671387)
They didn't need to spy. They already knew and didn't care. The president held a speech in the morning, addressing his supporters who had traveled from all over the country to come to Washington. He told the crowd to storm the Capitol over the loudspeaker, and that he would lead them in doing so. He didn't. Instead he returned to the White House. But the crowd did what they were told anyway. (People do that a lot these days. They do what they're told.)
Re:Infosec implications of the US Capitol physical breach by nerdponx on Friday January 08, 2021 @11:13AM (#25686121)
Regardless of what it officially is and is not supposed to do, the NSA and not the FBI is the organization that developed programs like PRISM.

The point is that the US federal government has a huge intelligence organization, with a huge amount of resources invested in dragnet data collection and surveillance on anyone and everyone.

The specific 3-letter organization that is technically supposed to be looking at and taking action based on that data isn't that relevant.

Re:Infosec implications of the US Capitol physical breach by enumjorge on Thursday January 07, 2021 @09:54AM (#25671702)
No offense, but I don’t think you understand the gravity of what happened. The fact that a mob of people, attempted to overturn the results of an election, is in itself a pretty serious event. That they were unlikely to succeed doesn’t cancel out the fact that they could have easily started a shootout with Congress people inside, that law enforcement seemed so unprepared to deal with a situation that had been telegraphed for so long, that as the article points out this has serious infosec implications, and that the sitting president of the US helped instigate an attempted coup.
Re:Infosec implications of the US Capitol physical breach by unethical_ban on Thursday January 07, 2021 @10:51AM (#25672363)
It is symbolic, but I have particularly little sympathy for their stunt.

It wasn't a protest of a bill, or a protest for a particular legislative action. It was a protest against the election of the President itself - against all evidence, all facts, and all testimony from just about every official except the President, who egged this on.

I didn't want to see heads rolling, but I was shocked at how delicately they were handled - cops even let them through barricades.

Contrast this with left-wing protesters and their treatment by cops, and you see a much different picture, of people walking or sitting down getting pepper sprayed, or 70-something men getting shoved to the ground in a public square by a team of armored officers.

There are a number of reasons to be angry at this stunt, and a number of conclusions to draw from it. First thing is first, if we had any kind of collective conscience, Trump would be impeached today.

Re:Infosec implications of the US Capitol physical breach by TomSwirly on Thursday January 07, 2021 @06:52AM (#25669993)
> I guess the answer is... calm down?

Rioters inflamed by years of Trump's gross lies storm the Capitol, demanding to overturn the results of the election, four die, and your response is, "Calm down"?

Re:Infosec implications of the US Capitol physical breach by TigeriusKirk on Thursday January 07, 2021 @07:12AM (#25670137)
What's the alternative? Escalate and inflame emotions even more?

What good would come of that?

The right thing to do here is to break the feedback loop and take some energy out of the system.

Re:Infosec implications of the US Capitol physical breach by PeterisP on Thursday January 07, 2021 @10:49AM (#25672345)
One consideration here is that lack of consequences enables escalation - if it turns out that this disruption is not prosecuted and punished, then (as their core reasons for doing so have not changed) they are going to be emboldened and repeat similar acts with more force.

Breaking the loop requires a deterrent, not only verbal "we will not stand for this".

Re:Infosec implications of the US Capitol physical breach by refurb on Thursday January 07, 2021 @06:11AM (#25669726)
That’s my take. A lot of smoke but no fire. The chance of these people actually overthrowing the change in presidency is pretty much 0%.

It’s over let’s move on.

Re:Infosec implications of the US Capitol physical breach by bigbluedots on Thursday January 07, 2021 @09:22AM (#25671304)
There needs to be some consequences here. Maybe it was just for show, and turned out harmless, whatever. Regardless, the people who participated in this, and those who incited them, should be prosecuted to the full extent of the law. Otherwise this sort of thing will happen again, and next time it may not be so harmless.
Re:Infosec implications of the US Capitol physical breach by gwright on Thursday January 07, 2021 @10:35AM (#25672162)
I agree 100%. Of course that is what lots of people have said previously about similar incidents coming from the left but calls for prosecution and stronger police tactics were dismissed in favor of the less-than-peaceful actions because "reasons".

Personally I'm exhausted at trying to "score" the actions of two teams when in fact I really don't want either team to win. It has become an absurd attempt to decide which team is less awful while each side fools itself into thinking it exclusively represents political virtue.

I'm hoping that events don't escalate further and that perhaps there is some opportunity for the emergence of some alternate political parties and more thoughtful political leadership in order to let the existing parties fade into history.

Re:Infosec implications of the US Capitol physical breach by InitialLastName on Thursday January 07, 2021 @12:50PM (#25674503)
I wonder if the Trump administration will enforce their executive order calling for maximized penalties for anyone damaging federal property [0]

[0] https://www.whitehouse.gov/presidential-actions/executive-or...

[dead]
Re:Infosec implications of the US Capitol physical breach by curryst on Thursday January 07, 2021 @10:24AM (#25672073)
Regardless of your opinion of BLM, there's a huge difference between rioting in the streets, and rioting in the fucking Capitol building while Congress is in session.

The latter seems to wander dangerously close to treason, depending on their goals.

Re:Infosec implications of the US Capitol physical breach by sokoloff on Thursday January 07, 2021 @10:54AM (#25672410)
I'm not sure I see the same huge difference you describe. The streets are a shared publicly owned resource just as the Capitol is. People who could be identified acting lawlessly in either situation should be prosecuted to the full extent with an eye towards stopping lawless idiocy.

Just for clarity: People standing peacefully nearby whose worst law-break is a curfew violation? I don't think they should face any consequences, which I realize makes the curfew on its own fairly toothless, but that's already the case now. But when you pick up a rock or bottle and throw it at police, that's AB-DW on police in my book. (Same thing with criminal trespass and malicious destruction of property for the events yesterday.)

Basically, if you're acting like a lawless idiot, I don't care what your shirt says or what sign you're carrying while you do it.

Re:Infosec implications of the US Capitol physical breach by chimprich on Thursday January 07, 2021 @01:22PM (#25675038)
> The streets are a shared publicly owned resource just as the Capitol is.

There's one absolutely huge difference here, and that is that the streets are designated for public access, while the seat of government and the offices of elected representatives are not.

Just because something is publicly owned does not make it legal to access, protest in, or damage. Consider some other publicly-owned properties: nuclear missile sites, courtrooms, the President's bedroom, police evidence rooms.

This is such an obvious distinction I am puzzled why it apparently needs pointing out.

Re:Infosec implications of the US Capitol physical breach by SamoyedFurFluff on Thursday January 07, 2021 @11:04AM (#25672557)
Right but in this case BLM got arrested so much people were put in holding buses in this case nothing happened
Re:Infosec implications of the US Capitol physical breach by sokoloff on Thursday January 07, 2021 @11:07AM (#25672606)
If fewer than 100 people are charged as a result of yesterday's events, I agree that's a grave miscarriage of justice.

I don't care if they're arrested right now (as the violence has ended), but I care greatly that they are eventually charged and that those facts are transparently shared with the public.

Re:Infosec implications of the US Capitol physical breach by SamoyedFurFluff on Thursday January 07, 2021 @11:41AM (#25673283)
Yes, my confusion is that mass arrests happened during BLM protests and after them. In this case during the protests there were no similar actions and that’s what people are pointing out as disproportionate.
Re:Infosec implications of the US Capitol physical breach by sokoloff on Thursday January 07, 2021 @11:44AM (#25673330)
To be perfectly honest, I hope they’re arrested on/after Jan 21, so they can’t be pardoned by 45.
Re:Infosec implications of the US Capitol physical breach by InitialLastName on Thursday January 07, 2021 @12:56PM (#25674594)
Last I saw 52 people had been arrested.

In interviews on C-SPAN last night, the DC Attorney General (an elected official by the city) made clear that many of yesterday's actions fall under his jurisdiction, but that (because DC is a federal district directly controlled by the executive branch) he is only able to operate under the guidance of the US Attorney for the District of Columbia, a Trump appointee named Michael Sherwin [0]

[0] https://www.justice.gov/usao-dc/meet-us-attorney

Re:Infosec implications of the US Capitol physical breach by eplanit on Thursday January 07, 2021 @11:11AM (#25672682)
I think you place too much emphasis on the symbolism of the capitol building. There was far less damage done to the Capitol (fortunately) than was done in the streets during BLM riots.

And, the police killed an unarmed woman -- no outrage for that?

Re:Infosec implications of the US Capitol physical breach by sokoloff on Thursday January 07, 2021 @11:42AM (#25673301)
From what I understand (and I realize that more will come out over time), she was shot while actively trying to breach into a room that she knew she was not authorized to enter and which was secured and defended by armed police.

At some point, an element of “what did they think would or should happen?” has to be considered.

Re:Infosec implications of the US Capitol physical breach by eplanit on Thursday January 07, 2021 @12:12PM (#25673829)
I agree -- and the same thought should occur to someone punching a police officer during an arrest, or grabbing the officer's gun, running away, etc., right?

It seems that usually when those things happen, however, that itself is cause for riots.

Re:Infosec implications of the US Capitol physical breach by sokoloff on Thursday January 07, 2021 @12:16PM (#25673890)
Yes with an asterisk. I put punching a police officer or grabbing for their gun into a very different category than running away. In my worldview, the first two, standing alone, subject you to lawful use of force, including deadly force if necessary. The last subjects you to being chased but not to the lawful use of deadly force merely as a result of running away.
Re:Infosec implications of the US Capitol physical breach by cultus on Thursday January 07, 2021 @12:35PM (#25674258)
You don't think that the US government should be able to defend itself? That's an interesting opinion.
Re:Infosec implications of the US Capitol physical breach by gwright on Thursday January 07, 2021 @11:36AM (#25673204)
The difference is that we could have prevented the wildfire by putting out the small fires in the first place instead of viewing them as legitimate activities.

Can we ditch the "treason" talk? It is just technically inaccurate. I wouldn't even say "insurrection". This was basically a low-grade riot at a symbolically significant location. Everyone should be prosecuted, including perhaps the people responsible for the atrocious police preparation and response. Even if the mob had managed to physically control the building there was no way that would have resulted in any actual change in the proceedings.

I'm not going to defend Trump on this either, but it is a mistake to think that Trump is the source of the discontent. He has taken advantage of the discontent but he isn't the source.

Re:Infosec implications of the US Capitol physical breach by SamoyedFurFluff on Thursday January 07, 2021 @11:02AM (#25672526)
The BLM riots resulted in a lot of arrests actually that’s why so many orgs were doing bail fund drives.

That storming the capital doesn’t result in a similar slew of arrests is weird to me

Re:Infosec implications of the US Capitol physical breach by tartoran on Thursday January 07, 2021 @12:44PM (#25674407)
There are actually dozens of arrests and plenty of evidence, self incriminating evidence floating around the social media. It remains to be seen what the outcome of these arrests will be. If they're arrested and let go it would be indeed weird and inviting for more of this in the future.
Re:Infosec implications of the US Capitol physical breach by cultus on Thursday January 07, 2021 @12:36PM (#25674268)
Luckily the difference in response is absolutely not emblematic of any serious structural issues in American policing, and we can all move on from this with no real reforms.
Re:Infosec implications of the US Capitol physical breach by tsimionescu on Thursday January 07, 2021 @10:39AM (#25672204)
Were the BLM protests trying to violently overturn the election and install their preferred candidate?

There can be no equivocation between a protest sparked by continued police brutality against citizens; and a protest sparked by massive lies from a leader with fascistic tendencies trying to overturn his democratic loss.

One is a net social good, even if it had deplorable bouts of violence; the other is strictly a social evil.

Re:Infosec implications of the US Capitol physical breach by eplanit on Thursday January 07, 2021 @11:25AM (#25673005)
More accurately, and interesting:

One group perceives widespread (their word 'systemic') racism -- the reality is that is isn't widespread, at all. Yet, they riot.

Another group perceives widespread election fraud -- the reality is that is wasn't widespread, at all. Yet, they riot.

It's all freedom of speech, except for the violence and destruction, right?

Re:Infosec implications of the US Capitol physical breach by tartoran on Thursday January 07, 2021 @12:56PM (#25674583)
This is also your perception that the racism isn't whitespread. Step into the shoes of a dark skinned person and we'll see what your perception is then.
Re:Infosec implications of the US Capitol physical breach by halfnormalform on Thursday January 07, 2021 @02:47PM (#25676267)
Racism must affect all skin colors equally before you will call it widespread? Interesting.
Re:Infosec implications of the US Capitol physical breach by TomSwirly on Thursday January 07, 2021 @06:54AM (#25670004)
"A mob overtook the capitol, four people died, the police did nothing and let them go, let's move on"?

Literally shaking my head. I just can't fathom how this is so unremarkable to you.

Re:Infosec implications of the US Capitol physical breach by refurb on Thursday January 07, 2021 @08:51AM (#25670978)
3 people died not at the capital building. Why are you including them?
Re:Infosec implications of the US Capitol physical breach by tartoran on Thursday January 07, 2021 @12:57PM (#25674623)
Are those 3 people not related in any way to this incident? As far as I can tell the 4 deaths were directly related to the protest. The one person in the US Capitol was shot and was pronounced dead later on. Does it make a difference that not all 4 were shot in the same place?