How a Vendor Vulnerability Enabled a Takeover at the U.S. Institute of Peace

Headline
How a Vendor Vulnerability Enabled a Takeover at the U.S. Institute of Peace
Pubdate
One-liner
"DOGE, the White House, the U.S. Attorney, the FBI, and the Metropolitan Police Department were all collaborating with our guard force to seize the building."
Timeline
Report Excerpt

At the start of March 2025, USIP had more than 400 employees in Washington, D.C., and in more than 20 locations around the globe. [Former Chief Security Officer Colin] O’Brien was hired in 2023 to build its corporate security program from the ground up. The security program already consisted of a few in-house security team members and a contracted guard force to manage the physical security of the headquarters campus.

Over time, O’Brien transitioned that program into an international security team capable of responding to and monitoring developments, threats, and incidents that directly affected USIP staff.

USIP’s security team had two additional full-time USIP staff members overseeing physical access to the headquarters facility. They were responsible for ensuring that USIP’s security systems were working properly, including electronic key cards, surveillance cameras, magnetic locks, and the anti-ram devices set up to control vehicular access.

Those staff members were also responsible for managing USIP’s contracted security guard force, supplied by Inter-Con Security. This was a longstanding contract that originated in 2011 or 2012, prior to when O’Brien joined USIP. Inter-Con provided special police officers, with responsibility to provide armed physical security and direct incident response.

“Had there been an active shooter or there’s a protester that gets in the building for an event, they’re essentially the first responders in the building,” O’Brien says. “They have the authority to arrest while they’re on duty. They have a higher level of training than an average security guard.”

During business hours, there were anywhere from nine to 14 Inter-Con security officers on duty at USIP headquarters. Overnight, the shift would usually have just six to seven officers.

O’Brien was tasked with creating a plan in case DOGE personnel arrived unexpectedly… That initial plan soon changed, however, due to the tactics that DOGE used to gain access to organizations like the African Development Foundation in Washington, D.C. There DOGE representatives showed up at the foundation’s offices in a mixed-use building and requested entry but were denied. They then returned with federal law enforcement and forced their way into the facility to physically take over the premises. USIP wanted to avoid a similar confrontation.

Everything was quiet for a few days, and then someone tipped off O’Brien that DOGE was asking around at the Federal Protective Service (FPS) about USIP. FPS is a government security organization that generally provides security and support for government buildings. DOGE wanted to know if FPS provided security at USIP. Now, O’Brien says he was convinced that DOGE was planning to show up and try to enter the USIP site.

[USIP’s outside legal counsel, George] Foote also became aware that the FBI was at the staff member’s house [staffer was on medical leave] and had asked if he worked for USIP or Inter-Con Security. Foote then told O’Brien that the staff member had been asked several questions about Inter-Con Security.

This is when the lightbulb went on for O’Brien. He knew what DOGE’s plan was: to flip the contract security guard force.

“The realization hit me that the guards who have guns, who have carte blanche access throughout the building, and legally the authorities of a police officer on duty, are my biggest vulnerability,” O’Brien says.

He was also concerned that Inter-Con would be pressured into turning on USIP by threats to discontinue its U.S. Department of State contract—worth $460 million and set to expire on 31 October 2025.

O’Brien then made one of the strangest recommendations of his security career: to fire the Inter-Con Security guard force. He then informed the Inter-Con Security officers at USIP that the contract was being suspended, that their badges would be deactivated, and that they should not return. O’Brien also collected physical keys from the duty lieutenant, who also had a master key.

There was one key, however, that O’Brien did not collect: [Inter-Con Security Account Manager Kevin] Simpson’s master key. Simpson is the retired chief of the uniformed division of the U.S. Secret Service and the best friend of one of USIP’s security staff members. He wasn’t on-site on Sunday, and O’Brien, given their relationship and Simpson’s background, thought he could be trusted to keep the master key until a later date.

Lambert here: O’Brien trusted a cop, lol.

And the denouement:

“It was a very fast loss of respect for our Inter-Con guards, but that went along with the loss of respect for our Metropolitan Police Department as well, because we realized during the day, certainly at the time we were being evicted from the building, that the DOGE, the White House, the U.S. Attorney, the FBI, and the Metropolitan Police Department were all collaborating with our guard force to seize the building from USIP,” Foote says.

“At this point, they had no court order. They simply had an executive order from the president and one-line, two-line emails from the White House Personnel Office to our directors and a trumped-up, fake resolution by a couple of board members who were not fired that there would be a new president,” he continues. “There was no court order. There was no warrant. There was no right for them to be in the building, but all of these law enforcement entities and government entities collaborated to seize the building from USIP, and Inter-Con lined up with them and marched right along.”

Simpson “knew all the protocols. He was a trusted insider,” O’Brien says. “He was a value add, until he wasn’t.”

Kicker
Tags

Add new comment

You have the option to tag the comment. When you start typing in the "Comment Tags" field, a dropdown with existing tags will appear; use these if possible. You can create tags that do not appear in the dropdown, but please remember that this is a family blog.