IT Lessons Learned from the Capitol Breach

The breach of the U.S. Capitol building this week was abhorrent. Participants should be held accountable. This is not how we solve our differences or push for political change in America, and I hope we never have an incident like this again in our country.

Much of the focus has been on the physical destruction and intrusion. Windows and doors were broken; artifacts were stolen or defaced; those locked inside with the terror of not knowing the goals or intentions of the intruders.

The aspect of the event receiving far less attention is the cyber threat. Hundreds of computers, servers, and networked devices were left unattended for hours with unsupervised and unverified strangers wandering the hallways. Is it possible that a computer hacker was among the mob who entered the building, not with the goal of sitting in a congressman’s office or knocking over a podium, but rather injecting a computer with spyware or a keylogger? Planting a listening device, or copying/downloading files from an unlocked terminal?

This is a valid concern. The event was planned and promoted well in advance, giving someone with bad intentions plenty of time to prepare one or more methods of cyberattack. It would have been extremely easy to blend in with the crowd. There was no pat-down or security scanner to walk through, no escorts, no guards.

The one bright spot is the fact the Capitol has every entrance, hallway and corner covered with security cameras. While I don’t know this for certain, I will bet that facial recognition technology is in place to log and identify all visitors to the building. This controversial technology will assist law enforcement efforts to track down all of the offenders, and possibly identify any surreptitious efforts to conduct cyber-espionage.

It would be completely irresponsible to ignore this threat. If a corporate office was overrun by unknown visitors with bad intentions, the CIO would absolutely begin to quarantine potentially impacted systems and begin scanning for threats.

The process is remarkably similar to COVID-19 protocols. If you might be infected, you are quarantined, and contact tracing is performed to identify anyone else you had contact with. Capitol IT and security professionals should be doing the same right now, and only allowing endpoints back onto the network when deemed safe.

The speed at which congressional lawmakers returned to the Capitol was symbolically important and laudable, but it also raises serious concerns. There is no conceivable way that computers, networks and endpoints were adequately scanned and scrubbed in the time between the hallways being cleared and the lawmakers returning to work. It would also be hard to believe that the entire building was inspected for listening devices or cameras in that time.

Nothing about this breach was positive and only time will tell what the fallout and implications of the event might be. We are still coming to grips with the so-called Sunburst hack involving SolarWinds and 18,000 of their customers. Events at the Capitol this week could be just as devastating if by chance someone in that mob had the intent and means to pull something off, because they definitely had access and time to do it.

We have the brightest minds and most innovative cybersecurity companies and organizations in the world here in the United States. The government needs to re-prioritize cybersecurity and invest more heavily in our cyber defenses. The wars of today and tomorrow will be in cyberspace and we seemed to still be focused on the physical battlefield. It is encouraging to know that President-Elect Joe Biden has plans to elevate a cybersecurity expert to his National Security Council, a position that President Trump eliminated in 2018.

We cannot undo what happened at the Capitol this week, but we must take immediate measures to limit the potential cyber damage from that event and we must improve the physical security to make future intrusions much more difficult. The loss of life and the trampling of our Constitution was enough to be filled with sorrow and sadness for where we are as a nation right now. Better days lie ahead.

About the Author

Josh Bohls is the founder of Inkscreen.

Featured

  • AI Is Now the Leading Cybersecurity Concern for Security, IT Leaders

    Arctic Wolf recently published findings from its State of Cybersecurity: 2025 Trends Report, offering insights from a global survey of more than 1,200 senior IT and cybersecurity decision-makers across 15 countries. Conducted by Sapio Research, the report captures the realities, risks, and readiness strategies shaping the modern security landscape. Read Now

  • Analysis of AI Tools Shows 85 Percent Have Been Breached

    AI tools are becoming essential to modern work, but their fast, unmonitored adoption is creating a new kind of security risk. Recent surveys reveal a clear trend – employees are rapidly adopting consumer-facing AI tools without employer approval, IT oversight, or any clear security policies. According to Cybernews Business Digital Index, nearly 90% of analyzed AI tools have been exposed to data breaches, putting businesses at severe risk. Read Now

  • Software Vulnerabilities Surged 61 Percent in 2024, According to New Report

    Action1, a provider of autonomous endpoint management (AEM) solutions, today released its 2025 Software Vulnerability Ratings Report, revealing a 61% year-over-year surge in discovered software vulnerabilities and a 96% spike in exploited vulnerabilities throughout 2024, amid an increasingly aggressive threat landscape. Read Now

  • Motorola Solutions Named Official Safety Technology Supplier of the Ryder Cup through 2027

    Motorola Solutions has today been named the Official Safety Technology Supplier of the 2025 and 2027 Ryder Cup, professional golf’s renowned biennial team competition between the United States and Europe. Read Now

  • Evolving Cybersecurity Strategies

    Organizations are increasingly turning their attention to human-focused security approaches, as two out of three (68%) cybersecurity incidents involve people. Threat actors are shifting from targeting networks and systems to hacking humans via social engineering methods, living off human errors as their most prevalent attack vector. Whether manipulated or not, human cyber behavior is leveraged to gain backdoor access into systems. This mainly results from a lack of employee training and awareness about evolving attack techniques employed by malign actors. Read Now

New Products

  • Luma x20

    Luma x20

    Snap One has announced its popular Luma x20 family of surveillance products now offers even greater security and privacy for home and business owners across the globe by giving them full control over integrators’ system access to view live and recorded video. According to Snap One Product Manager Derek Webb, the new “customer handoff” feature provides enhanced user control after initial installation, allowing the owners to have total privacy while also making it easy to reinstate integrator access when maintenance or assistance is required. This new feature is now available to all Luma x20 users globally. “The Luma x20 family of surveillance solutions provides excellent image and audio capture, and with the new customer handoff feature, it now offers absolute privacy for camera feeds and recordings,” Webb said. “With notifications and integrator access controlled through the powerful OvrC remote system management platform, it’s easy for integrators to give their clients full control of their footage and then to get temporary access from the client for any troubleshooting needs.”

  • QCS7230 System-on-Chip (SoC)

    QCS7230 System-on-Chip (SoC)

    The latest Qualcomm® Vision Intelligence Platform offers next-generation smart camera IoT solutions to improve safety and security across enterprises, cities and spaces. The Vision Intelligence Platform was expanded in March 2022 with the introduction of the QCS7230 System-on-Chip (SoC), which delivers superior artificial intelligence (AI) inferencing at the edge.

  • PE80 Series

    PE80 Series by SARGENT / ED4000/PED5000 Series by Corbin Russwin

    ASSA ABLOY, a global leader in access solutions, has announced the launch of two next generation exit devices from long-standing leaders in the premium exit device market: the PE80 Series by SARGENT and the PED4000/PED5000 Series by Corbin Russwin. These new exit devices boast industry-first features that are specifically designed to provide enhanced safety, security and convenience, setting new standards for exit solutions. The SARGENT PE80 and Corbin Russwin PED4000/PED5000 Series exit devices are engineered to meet the ever-evolving needs of modern buildings. Featuring the high strength, security and durability that ASSA ABLOY is known for, the new exit devices deliver several innovative, industry-first features in addition to elegant design finishes for every opening.