Protocol | Enterprise

Don’t worry about the cybersecurity fallout of the Capitol breach

Members of Congress can't access classified information on their work computers, and the chances that Wednesday's mob contained a few moonlighting cyberspies are slim.

Capitol building

Any lasting cybersecurity damage from the breach is likely to be limited.

Photo: Louis Velazquez/Unsplash

Among the disasters that visited Capitol Hill on Wednesday, the fact that the people who infiltrated Congressional offices had unfettered access to IT assets for several hours ranks rather low.

One of the most iconic images of Wednesday's events was a picture of the home screen of Speaker Nancy Pelosi's office computer, abandoned in haste after a mob broke into the Capitol building, forcing Congress and staffers to retreat to safer locations. By design, nothing on Pelosi's computer was classified: Members of Congress have to enter a protected area room in the building to view secret documents, as you'll recall from last year's impeachment proceedings when several House Republicans stormed into such a room in protest because they were denied access to documents their leaders could access.

There could have been plenty of unclassified information that would still be considered sensitive, such as Pelosi's contacts and email correspondence. And it's fair to say that congressional IT practices are somewhat haphazard; some computers might have been encrypted, while some might not have even had password protection, according to security experts.

As Katie Moussouris, CEO and founder of Luta Security, told The Washington Post: "There's an old saying, if an attacker has physical access to your computer, it's not your computer anymore."

Still, any lasting cybersecurity damage from the breach is likely to be quite limited.

A laptop from Sen. Jeff Merkley's office was taken, but there were no other reports of missing computers. Representatives from Merkley's office did not respond to an inquiry as to whether or not that laptop was encrypted; computers purchased for Senate offices after October 2018 were required to have encryption technology turned on at the urging of Merkley's fellow Oregon senator, Ron Wyden, but it's not clear when the laptop in question was purchased.

There's a far greater threat to information security in the Capitol Building, and it doesn't require access to the building itself. As we've seen with the SolarWinds hack that infiltrated several executive branch agencies last year, the biggest threats to government information security aren't wearing red hats and breaking windows; they're coming from overseas through the internet to steal sensitive data.

And in any event, the Capitol Building is not exactly the most secure facility controlled by the government, as Wednesday's events show. Any foreign intelligence agent bent on figuring out what the House Committee on Ways and Means is up to would probably have better luck accessing computers by infiltrating the cleaning staff or mingling with visitors on a post-pandemic tour of the building.

The incident does shine a light on congressional cybersecurity practices, which are far less robust than the requirements of the executive branch.

In the House, members of Congress are responsible for procuring their own IT assets just like any of us, whereas in the Senate, technology purchases are made through the office of the Sergeant at Arms. Email and file servers in the House are managed by the chief administrative officer, a non-partisan position. In the Senate, that duty falls to the Sergeant at Arms, who serves at the pleasure of the party in power.

"Images on social media and in the press of vigilantes accessing congressional computers are worrying," said Rep. Anna Eshoo, a Democrat from California, in a statement. "I asked the Chief Administrative Officer of the House to conduct a full assessment of threats based on what transpired yesterday, and the CAO has already taken important steps to that end. I have confidence that House and Senate IT and cybersecurity professionals are taking the matter seriously."

On Thursday afternoon, the CAO updated members of the House saying that administrators took "efforts including issuing commands to lock computers and laptops and shutting down wired network access to prevent inappropriate access to House data." It's not clear what, if any, action was taken on the Senate side.

Executive branch staff are almost universally required to use two-factor authentication to log into their work computers, but such a requirement does not exist in the legislative branch. Congresspeople are essentially small-business owners who can require their staff to follow whatever cybersecurity practices they deem necessarily, including, well, nothing.

There's certainly a chance that a few individuals among the mob that breached the Capitol Building could have read less-than-flattering emails sent by or to members of Congress, and could use those emails to damage a few reputations.

But the most likely outcome of Wednesday's breach is that a lot of passwords have already been changed, or will be changed in the next few days.

Update: This article was updated at 4:07 p.m. PT to include a statement from Rep. Anna Eshoo, and corrected at 5:17 p.m. PT to fix the spelling of her first name.

Diversity Tracker

Tech company diversity reports are more important than ever

More tech companies released their reports following the murder of George Floyd in 2020.

Tech companies started reporting their own numbers around 2014.

Photo: SCC/Getty Images

Years after most tech companies had been publishing diversity reports, Snap's CEO Evan Spiegel remained steadfast about not releasing his company's numbers. "I've always been concerned that releasing that data publicly only reinforces the perception that tech is not a place for underrepresented groups," he said during an all-hands in June 2020 after years of only releasing a report internally.

A few months later, Snap, one of the most vocal diversity report holdouts, became part of a second wave of companies that started releasing diversity data. Following the murder of George Floyd in 2020, others like Tesla and Oracle — which was facing a shareholder resolution on more transparency — also publicly released diversity reports. Netflix, although it had been posting diversity data on its jobs page quarterly since 2013, also released its first formal inclusion report in 2021.

Keep Reading Show less
Biz Carson

Biz Carson ( @bizcarson) is a San Francisco-based reporter at Protocol, covering Silicon Valley with a focus on startups and venture capital. Previously, she reported for Forbes and was co-editor of Forbes Next Billion-Dollar Startups list. Before that, she worked for Business Insider, Gigaom, and Wired and started her career as a newspaper designer for Gannett.

If you've ever tried to pick up a new fitness routine like running, chances are you may have fallen into the "motivation vs. habit" trap once or twice. You go for a run when the sun is shining, only to quickly fall off the wagon when the weather turns sour.

Similarly, for many businesses, 2020 acted as the storm cloud that disrupted their plans for innovation. With leaders busy grappling with the pandemic, innovation frequently got pushed to the backburner. In fact, according to McKinsey, the majority of organizations shifted their focus mainly to maintaining business continuity throughout the pandemic.

Keep Reading Show less
Gaurav Kataria
Group Product Manager, Trello at Atlassian
Diversity Tracker

The tech industry needs to standardize diversity reports

No tech firm reports diversity the same way. That makes tracking progress harder.

Tech lacks a standard, comprehensive method of reporting and presenting employee demographic data.

Illustration: Christopher T. Fong/Protocol

Diversity reports don't always tell the full story of what representation looks like at tech companies.

The earliest versions of tech industry diversity reports created a binary narrative about diversity and inclusion, according to Bo Young Lee, Uber's chief diversity officer. The reports, which tech companies began consistently releasing in 2014, communicated that "diversity is about gender representation, and it's about race and ethnicity, and it's about nothing else," Lee told Protocol.

Keep Reading Show less
Megan Rose Dickey

Megan Rose Dickey is a senior reporter at Protocol covering labor and diversity in tech. Prior to joining Protocol, she was a senior reporter at TechCrunch and a reporter at Business Insider.

Protocol | Workplace

Introducing Protocol’s Diversity Tracker

Tech companies talk a good game on diversity. Our new tracker shows where there's progress – and where there isn't.

Our tracker contains historical and current diversity data for the most powerful tech companies.
Illustration: Christopher T. Fong/Protocol
Protocol team

A new media company from the publisher of POLITICO reporting on the people, power and politics of tech.

Protocol | Workplace

Productivity apps can’t stop making money

ClickUp had one of the biggest Series C funding rounds ever. Here's how it matches up to the other productivity unicorns.

ClickUp made $400 million in its series C funding round.

Photo: ClickUp

Productivity platform ClickUp announced a milestone today. The company raised $400 million, which is one of the biggest series C funding rounds in the workplace productivity market ever. The round, led by Andreessen Horowitz and Tiger Global, put the private company at a $4 billion valuation post-money.

In case it's not clear: This is a massive amount of money. It shows how hot the productivity space is right now, with some predicting the market size could reach almost $120 billion by 2028. In a world of hybrid workers, all-in-one tool platforms are all the rage among both startups and productivity stalwarts. Companies everywhere want to escape tool overwhelm, where work is spread across dozens of apps.

Keep Reading Show less
Lizzy Lawrence

Lizzy Lawrence ( @LizzyLaw_) is a reporter at Protocol, covering tools and productivity in the workplace. She's a recent graduate of the University of Michigan, where she studied sociology and international studies. She served as editor in chief of The Michigan Daily, her school's independent newspaper. She's based in D.C., and can be reached at llawrence@protocol.com.

Latest Stories