Attack on the Capitol may pose national cybersecurity risk

The mob at the U.S. Capitol on Wednesday that stormed the Senate floor and Capitol rotunda may have breached more than just the building’s physical security.

Photos show rioters in congressional offices, including that of House Speaker Nancy Pelosi, DSan Francisco. Any computers left on could be vulnerable, and so could papers — such as personal schedules or mail — that weren’t locked away, information security experts said.

Sen. Jeff Merkley, DOre., said his office was ransacked and a laptop stolen. Officials also said multiple electronic items were taken from the building, according to CNN.

What does this mean for the security of the nation’s information? Here are insights from experts who spoke with The Los Angeles Times.

Q:

Does the breach of the Capitol pose a cybersecurity risk?

A:

It depends. If rioters got their hands on congressional computers that were still logged in, they may have been able to access information. But if those computers were encrypted, they wouldn’t be able to get anything, said Jesse Varsalone, associate professor of computer networks and cybersecurity at University of Maryland Global Campus.

However, if a computer was encrypted but documents were left open onscreen, that information would already have been decrypted and could have been read, said Suzanne Spaulding, an adviser to Nozomi Networks and former undersecretary for the Department of Homeland Security. That means members of the mob could have snapped images of documents such as emails.

“I would not assume right off the bat that the folks who broke into the Capitol yesterday, forced their way in, had folks whose objective and skillset was to use their physical access to gain access to the IT system, to sensitive information,” she said. “But ... if someone takes a laptop, they can later decide, ‘Hey, this could be really interesting. I don’t have the skills to exploit it, but I’m going to find someone who does.’”

The theft of a laptop, as from Merkley’s office, poses special concern because the machine is part of a federal network and could help outsiders access the entire network.

“That’s the concern about a stolen laptop,” Spaulding said. “It’s not just about what’s on the laptop.”

Q:

Could someone have put malware onto congressional computers?

A:

It’s possible, but Varsalone said it’s probably unlikely.

“It seems they were more motivated to kind of actually derail (the electoral college vote certification), as opposed to plant something,” he said.

Q:

What about sensitive or confidential documents?

A:

Congressional leaders with security clearances must abide by rules intended to protect that information, Varsalone said. If such information was on a computer, it probably would be shielded with encryption.

Q:

How does this situation compare with other potential threats to the nation’s information security?

A:

It’s not clear yet whether Wednesday’s events included a breach of cybersecurity or information security at all, and if only one laptop was stolen, the risk may be more limited, Spaulding said.

The riot at the Capitol came just weeks after a much bigger cybersecurity revelation: that an “outside nation state” suspected to be Russia had been spying on U.S. government computer networks by exploiting a vulnerability in software produced by Solar Winds, a Texas company.

The FBI and the Homeland Security Department are investigating the matter.