This person, who seems to have more intimate knowledge of capitol IT, also mimics the concern: https://twitter.com/neurovagrant/status/1346964347684179970

Here is why Foone thinks that “forgetting to lock the screen” is unlikely: https://mobile.twitter.com/Foone/status/1346924327996772354

Congress apparently doesn't use CACs, and the photo shown of the desktop shows no card reader to stick a card in.

The idea that a senior US Congressperson or Senator would have the same rules as some IT contractor is ludicrous.

Her password is probably password123 or some such nonsense too.

Security problems that begin with "the user had a weak password" are strictly the fault of IT nowadays. Every application and gateway should check password complexity and reject passwords on the top 1000 list. If password123 is allowed the IT director should be fired.

Password rejection rules are the primary cause of sticky notes with passwords under the keyboard/on the screen - and they are phishable, loggable, videoable and can be deduced from the keyboard click sounds.

2FA / 3FA is a minimum these days (and can be easier to use than a password)

Keyboard click sounds? I'm gonna need to see some kind of something for that. Sorry, it just sounds like something out of Eagle Eye, like that cup of coffee in that secure room the computer reads the waves on.

It's not a new threat. https://www.berkeley.edu/news/media/releases/2005/09/14_key.... is 16 years old.

Standard rules for (Soviet) embassy staff during the cold war included writing secret documents with a pencil rather than a typewriter because the text might be deducible from the sound of the typing.

Of course the writing would also be done in a box suspended inside another room with white noise generators in the intermediate space, just in case the text might also be deducible from the sound of handwriting.

My source for that might be one of Viktor Suvorov's books.

Relevant Picture (from since deleted tweet - Interesting that the media is still accessible on twitter...)

https://pbs.twimg.com/media/ErErUqKXMAMQtyy.jpg

I _believe_ this is where that picture originated from https://twitter.com/mikko/status/1346922681158000640?s=21

It almost looks like a photo that an employee themselves might take after being shown such an alert message.

> I would already be operating under the assumption that all the clients are hostile.

You can't operate assuming all computers in the Capitol are hostile. How are the members supposed to do work if their computers are assumed hostile? Why even give them computers then?

> I would already assume Member computers are a huge attack vector, and act accordingly.

What would "acting accordingly" look like for you in that example scenario you outlined.

You absolutely do assume that that network is hostile/compromised. There are a number of other networks in other places where more important communications are done. It's a giant PITA, and a lot of stuff leaks from Congress because most people believe that they are too important to have to keep things secure.

Being in Congress is not an automatic ticket to having all the country's secrets on your desktop, and things actually are compartmented quite heavily when necessary.

> Being in Congress is not an automatic ticket to having all the country's secrets on your desktop

I'm not suggesting that they have _all_ the country's secrets on their desktops, but surely the speaker of the house needs access to their emails on their desktop. Those are private, but without them, why even give the speaker a desktop at all?

The actual Members are in many ways, a bug of the system, and recent events have demonstrated that very clearly. Capitol IT probably puts them on a "Guest WiFi" and lets them surf Twitter without bothering anyone. The majority of the US government apparatus functions on a day-to-day basis without any input or functional oversight from anyone, and that is the so-called "Deep State" which in reality is the only reason anything works at all. Can you imagine the country if Donald Trump was functionally the CEO the way that Elon Musk is the CEO of Tesla?

They're going to have to rebuild from scratch anyway, this event has just made sure they do so.

Random visitors don't go into offices. They don't look into cupboards. They don't sit behind desk with computer.

I am a random nobody and I was able to waltz in to my congresswoman's office. Obviously I wasn't digging through the desk drawers, but it's not like I was closely observed while I waited for my congresswoman's secretary to get off her phone call

This is not similar to having 4 ours of unfettered access during a riot. They literally were digging in desk drawers, using the phone, leaving threats, carving hate speech into wooden doors, etc.

I once saw a citizen with a 6-shooter strapped to his hip at a Colorado county clerk's office peacefully fill out some paperwork for 5 minutes. What does this story tell us about what rioters did or didn't do while tearing up the capital building?

> I once saw a citizen with a 6-shooter strapped to his hip at a Colorado county clerk's office peacefully fill out some paperwork for 5 minutes. What does this story tell us about what rioters did or didn't do while tearing up the capital building?

1 minute of Googling tells me that Colorado is an open-carry state, and there is no specific exclusion for county offices, so unless this was in Denver or another municipality that prohibits open carry I don't see the relevance of your story to what happened in the Capitol.

That's his point. There's no comparison between entering the public part of an office during business hours and what happened yesterday.

But perhabs visitors like lobbyists, donors etc. could be often alone long enough with a computer to something bad. And don't forget all the viruses that tweet porn links.

I'm sure it happens. According to what I've seen on TV, all you need to do is stick a thumb drive in a laptop and utter the magic incantation "OK, I'm in" and you can either download the entire content of the network or implant a virus in the time it takes for someone to come back into the room.

Unlikely, given that it does not happen in commercial companies either and there no one particularly has reason to care.

Private companies are compromised by visitors every single day. Outsiders on-premise are one of the largest attack vectors after insiders.

This is why both the local network and endpoints are no longer trusted in security models.

How about staffers working for members from the other party? Yes, you'd expect a "gentlemen's agreement" not to do such things. You might not be wise to trust it, though...

I doubt there is anything like gentlemens agreement last 8 year's. Everyone was aware it is sociopaths run the place.

So I think other party stsffers are not trusted to be left alone.

"You will go to jail forever" and "You will be completely unemployable forever" are still two surprisingly effective deterrents against the vast majority of the population when they have a job.

There's lots of stuff you "could" do everyday, but the probability of getting caught is high, the ultimate impact to anyone else is low, and the severity of punishment immense.

All that changes quite significantly when even basic access control is lost and the building is overrun by unidentified belligerents for a few hours. I'm betting a number of foreign intelligence agencies were scrambling to see if they could take advantage usefully.

There's no "unemployable" for political crimes. It makes you more employable by the side you did the crimes to help.

And yet you still have to assume they might.

Authorized individuals have classified documents on Capitol hill computers, there have been many options available to support breaching a workstation given physical access for years.

In this event you don't even know if such authorized persons had time to lock their computers.