New York: Two people scale to top of Empire State Building carrying banner - CNN

The Security Engineering Lessons from a Daring Empire State Building Ascent

On a crisp March morning in 2025, two individuals-reportedly a couple-successfully scaled the exterior of the Empire State Building to its iconic 102nd-floor observation deck and beyond, reaching the building's radio antenna mast. Carrying a banner that read "The Power of Love," they briefly unfurled it before being taken into custody by NYPD officers waiting on the roof. The headline New York: Two people scale to top of Empire State Building carrying banner - CNN instantly dominated newsfeeds, but for engineers and technologists, this event raises deeper questions about physical security, building access controls, and the limits of modern surveillance systems.

This wasn't the first time someone has attempted to scale one of the world's most recognizable skyscrapers-in 2019, a similar protest occurred near the top-but the successful breach of a building that handles over 4 million visitors annually, with 24/7 security and a dedicated counter-terrorism unit, is a stark reminder that no system is foolproof. For those of us who design security architectures, this event is a case study in how determined adversaries exploit gaps between layers of protection. In this article, we'll dissect the incident through an engineering lens: the physical access control methodology, the technology used to broadcast the stunt and what the response tells us about our increasingly automated security infrastructure.

As a former security systems integrator who worked on high-rise access control projects in New York City, I can attest that the Empire State Building's security posture is among the most robust in the world-yet it was bypassed. What went wrong, and what can we learn about resilience in both physical and digital environments?

The Anatomy of a Vertical Breach: How They Got Past Four Zones of Security

To understand the vulnerability, we need to map the building's layered security model-a classic "defense in depth" approach. The Empire State Building employs multiple zones: perimeter barriers (bollards, patrols), lobby access control (turnstiles, bag checks, X-ray machines), elevator security (key-card interlocks, CCTV). And rooftop protection (alarmed hatches, guards). Yet the climbers managed to bypass at least three of these layers without triggering a real-time alert.

Based on witness reports and NYPD statements, the pair likely entered as regular visitors-purchasing tickets, passing through metal detectors. And taking an elevator to the 86th-floor observation deck. The breach occurred when they circumvented a secondary gate or barrier that separates the public deck from maintenance stairways leading to the 102nd floor and the antenna. This mirrors the classic "insider threat" scenario in cybersecurity: an attacker who follows normal authentication procedures but then exploits a weak boundary on a privileged surface.

The physical security industry has long debated whether "last mile" hardening-the point where a trusted user transitions to a sensitive area-is worth the investment. Here, a simple padlock or a malfunctioning electronic strike may have been the single point of failure. In my experience deploying Lenel access control panels with HID iClass readers, we often found that maintenance doors were left on "locker override" during the day to help with cleaning crews that's a plausible vector here.

Social Media as a Live Monitoring Channel-and a Liability

While the building's internal CCTV system likely captured the climbers' movements, the world watched the drama unfold primarily through livestreams on TikTok and X (formerly Twitter). The couple reportedly used a GoPro head-mounted camera and a smartphone to broadcast their ascent in real time. Within minutes, the video had amassed millions of views-becoming a self-propagating news event that forced CNN and other outlets to cover it as breaking news.

From a software engineering perspective, this demonstrates the scalability of modern content distribution platforms. As soon as the livestream gained traction, recommendation algorithms-based on engagement metrics like watch time and shares-amplified it across geographic and demographic boundaries. An event that might have remained a localized police matter became a global headline within 30 minutes. This raises a critical question: should physical security systems be designed to anticipate and detect livestreaming as a tool for coordination?

There is a growing field of "digital-physical threat intelligence" that correlates real-time social media posts with facility security feeds. Companies like Microsoft and Amazon have experimented with AI-based tools that flag unusual activity near critical infrastructure. However, the false-positive rate remains high, and privacy concerns limit deployment. In this case, a simple text alert from the building's security team to NYPD might have led to interception before the antenna was reached.

The Engineering of the Antenna: Climbing a 200-Foot Steel Mast Without Safety Lines

The climbers did not stop at the 102nd floor observation deck-they scaled the antenna mast itself, adding about 200 feet to the vertical climb. The mast, originally constructed in the 1950s and reinforced in the 1990s to support broadcast antennas for major TV and radio stations, is a lattice structure of steel beams and diagonal cross-bracing. For an engineering audience, this is a remarkable feat of unassisted climbing-akin to scaling a communication tower with no safety harness on bolts spaced three feet apart.

The structural integrity of the mast was never in question: it's designed to withstand wind loads of up to 100 mph and has numerous attachment points for maintenance workers. However, the absence of anti-climbing shields or motion sensors on the mast itself is a design gap. In many modern transmission towers, motion-activated floodlights and vibration sensors are standard-yet the Empire State Building's antenna, a historic structure, was never retrofitted with such countermeasures. The city's building code only requires anti-climbing measures for structures over 200 feet if they're accessible from a public area-a clause that may be interpreted differently after this incident.

The couple's engagement (they reportedly proposed on the antenna) added a human angle. But from an engineering perspective, the risk of a slip or equipment failure was extreme. A single misstep could have caused a fatal fall onto the observation deck below, potentially harming dozens of tourists. The incident underscores the need for risk analysis methodologies like fault tree analysis (FTA) for historic landmarks-a discipline familiar to safety-critical software engineers but often neglected in physical security design.

What the News Cycle Teaches Us About Error Handling in Large Distributed Systems

The immediate aftermath of the event saw a cascade of responses: NYPD issued a statement, CNN published the breaking story. And within hours, headlines like New York: Two people scale to top of Empire State Building carrying banner - CNN were syndicated globally. For engineers who maintain large-scale systems, this is a textbook example of how error propagation can amplify an anomaly into a full-blown incident.

In complex distributed systems-whether a cloud infrastructure or a city's security network-every component should have built-in alerts that escalate to human operators when an anomaly is detected. In this case, the security system likely logged an access violation at the maintenance door. But that alert may have been routed to a low-priority queue. This is analogous to a silent alarm in a log file that no SRE sees until the next on-call rotation.

We can map a standard incident response runbook to what actually happened: detection (observatory guard notices unusual activity), analysis (guard confirms climbers on mast), containment (NYPD swarm roof), resolution (arrest, securing the mast). The failure was in the detection stage-the automated systems did not trigger a real-time visual confirmation because the CCTV cameras on the antenna were either not monitored live or were blocked by the banner placement. A redundant motion sensor or a thermal camera could have bridged that gap.

Lessons for Security Architects: Redundancy, Posture. And User Intervention

For professionals designing access control systems-whether for buildings - cloud platforms. Or hardware devices-the Empire State Building incident reinforces three well-known principles:

• Redundant detection paths: Never rely solely on one sensor type. Combine magnetic contacts, infrared beams. And video analytics so that a single bypass does not grant access to a sensitive zone.
• Continuous posture assessment: In the same way that zero-trust architectures continuously verify a user's identity, a building's security system should re-evaluate a visitor's authorization as they move to higher-security zones.
• Human-in-the-loop for critical alerts: Automated alerts that reach a guard's smartphone are worthless if the guard is distracted. A tiered escalation system-with mandatory acknowledgment by a supervisor within two minutes-can prevent delays.

Several modern commercial access control platforms, such as Brivo or Genetec, now offer "smart latch" hardware that can detect physical tampering and send an immediate push notification to on-site security. After the Empire State Building incident, I expect many landmark owners will evaluate retrofitting such devices on all roof access points.

The Role of Drones and Counter-UAS Technology in Future Detection

Interestingly, the incident occurred without any drone involvement from the climbers-they climbed physically. But in the aftermath, news helicopters circled the building, creating a secondary security concern. For engineers working on counter-unmanned aircraft systems (C-UAS), this event highlights a potential future threat: what if a climbing stunt were combined with a drone swarm carrying a larger banner?

The FAA already restricts airspace above the Empire State Building. But enforcement relies on passive detection. Active systems like drone detection radar (e. And g, DroneShield) or radio frequency triangulation aren't standard on most skyscrapers. Integrating such sensors into a building's physical security architecture could provide early warning of coordinated attacks-both from above and via climbing.

Some forward-looking designs, such as those proposed by the NIST guidelines for high-rise security, recommend layered air-gap monitoring using both lidar and acoustic sensors. The cost remains high ($500K+) but might be justified for iconic structures that are also critical communication hubs.

How Algorithms Turned a Local Stunt Into a Global News Story

Let's step back from hardware and examine the software ecosystem that amplified this event. When the livestream hit platforms like TikTok, the content moderation systems-designed to catch harmful or illegal activity-likely flagged the video for review. However, the delay between upload and human review (often 15-30 minutes) allowed the video to accumulate millions of views before any takedown action could be taken.

Content recommendation algorithms operate on a positive feedback loop: higher engagement begets more distribution. The "Power of Love" banner was non-violent and romantic, so it dodged the automated classifiers that might have removed a more threatening video. This is a known vulnerability in content moderation systems: they're trained to detect specific categories of harm (violence, terrorism, harassment) but fail to identify coordinated physical security breaches that are non-violent.

In my previous work building ML-based moderation pipelines at a social media startup, we found that using graph-based anomaly detection-mapping unusual geolocation patterns and sudden spikes in view counts-could flag potential real-world events earlier. However, privacy regulations (GDPR, CCPA) and compute costs limited deployment. The Empire State Building incident is a perfect validation of that approach.

FAQ: Common Questions About the Empire State Building Climb

1. How did the climbers bypass security without being stopped?
   They followed standard tourist entry procedures up to the 86th floor observation deck, then circumvented a door or gate that was likely unlocked or propped open for maintenance access. A secondary security barrier-perhaps a simple padlock-was either missing or defective.
2. What charges were filed against the couple?
   According to news reports including