The attack on the Capitol may pose a cybersecurity risk. Here’s how

The pro-Trump mob that stormed the U.S. Capitol’s Senate floor and Capitol rotunda on Wednesday may have breached more than just the building’s physical security.

Photos show rioters in congressional offices, including that of House Speaker Nancy Pelosi (D-San Francisco). Any computers left on could be vulnerable, and so could papers — such as personal schedules or mail — that weren’t locked away, information security experts said. Sen. Jeff Merkley (D-Ore.) said his office was ransacked and a laptop stolen. An aide to Pelosi said a laptop used only for presentations was snatched from a conference room.

What does this mean for the security of the nation’s information? Here are insights from experts who spoke with The Times.

Does the invasion of the Capitol pose a cybersecurity risk?

It depends. If rioters got their hands on congressional computers that were still logged in, they may have been able to access information. But if those computers were encrypted, they wouldn’t be able to get anything, said Jesse Varsalone, associate professor of computer networks and cybersecurity at University of Maryland Global Campus.

However, if a computer was encrypted but documents were left open onscreen, that information would already have been decrypted and could have been read, said Suzanne Spaulding, an advisor to Nozomi Networks and former undersecretary for the Department of Homeland Security. That means members of the mob could have snapped images of documents such as emails.

“I would not assume right off the bat that the folks who broke into the Capitol … had folks whose objective and skill set was to use their physical access to gain access to the IT system, to sensitive information,” she said. “But … if someone takes a laptop, they can later decide, ‘Hey, this could be really interesting. I don’t have the skills to exploit it, but I’m going to find someone who does.’”

The theft of a laptop, as from Merkley’s office, poses special concern because the machine is part of a federal network and could help outsiders access the entire network.

“That’s the concern about a stolen laptop,” Spaulding said. “It’s not just about what’s on the laptop.”

Could someone have put malware onto congressional computers?

It’s possible, but Varsalone said it’s unlikely.

“It seems they were more motivated to kind of actually derail [the electoral college vote certification], as opposed to plant something,” he said.

What about sensitive or confidential documents?

Congressional leaders with security clearances must abide by rules intended to protect that information, Varsalone said. If such information was on a computer, it probably would be shielded with encryption.

How does this situation compare with other potential threats to the nation’s information security?

It’s not clear yet whether Wednesday’s events included a breach of cybersecurity or information security at all, Spaulding said.

There is no indication that any of the rioters had IT savvy or were prepared to infect congressional computers with malware, she said.

“From an IT perspective, when I look at the events of what happened [Wednesday] and all of the incredible implications … the IT cybersecurity concerns are not the highest on my list,” Spaulding said.