And now people are pointing out the very real issue of cyber-security in the form of unsecured computers, networks, and email systems.
Indeed, that's overly appalling.
My work has often been of a nature that requires armed guards at the facilities I work at. Sometimes very armed guards. Yes, I know what it's like to have a loaded machine gun pointed at my head and be ordered to assume a submissive posture. And that's in a place where I was authorized to be. (The guards had an old list of approved occupants.) Aside from mistakes like that, in twenty years, in only two instances have the guards actually had to do guard things. Once a disgruntled former employee tried to enter an administrative area. (Thankfully he wasn't armed and was quickly and nonviolently taken into custody.) Another time, the local police showed up with a warrant for the arrest of one of our temporary assembly workers on a minor charge. (Our guards had to go get him while the armed officers waited outside the perimeter, which required some negotiation.)
All we ever anticipate are small-scale attempts to breach physical security attempting either to sabotage something, get access to controlled chemicals, or obtain information. And yes, we have security drills, including active-shooter drills. Sad to say I work with people who can probably improvise at least three weapons out of every piece of equipment on the property, but that's that. The point is that we have a protocol for securing sensitive information and hazardous materials in a number cases that include armed intrusion.
Nothing terribly sensitive going on now, but at the height of work that included nuclear defense work, it was abundantly clear that our armed guards had the explicit duty to buy time with their lives, if necessary, so that we could complete the steps necessary to secure the facility. That's a sobering thought. I'm not sure that's expected of Capitol Police, but it should be expected of the people they protect to know how to secure an office.
...and the small (e.g. USB drives).
For nearly all my work, we don't get to use those. When it's unavoidable, a numbered USB thumb drive is checked out to you from an inventory, used once for what is needful, then physically destroyed by the inventory officer. Being caught with portable storage in some areas of my work is a fire-on-the-spot offense and, in some cases, likely a criminal offense. And this is not especially uncommon, even outside my industry. My understanding, for example, is that HIPAA-qualified institutions have similar restrictions on the kinds of computer storage that are allowed around protected information.
I would bet, however, that IT has actually tried for years to put such measures in place, but have been overruled by the members because "it is annoying to have to keep logging in" or some such.
Yeah, autolock is a standard and annoying feature. In some cases they seem to gimmick it so that things that would normally inhibit the lock (e.g., watching a video) don't work and you have to keep unlocking your workstation to resume your passive activity. Good on you IT-type guys for closing that loophole.
This is especially acute in COVID times, when we're all doing virtual meetings. I've taken to absent-mindedly stroking the trackpad every minute or so to keep the screen from locking.