Two trespassers climb to top of Empire State Building - NBC News

When two daredevils scaled the Empire State Building in broad daylight with a banner, they didn't just break into a landmark - they exposed a fundamental flaw in how we think about layered security systems. The incident, widely reported as "Two trespassers climb to top of Empire State Building - NBC News", raises urgent questions for engineers building safety-critical infrastructure in an age of spectacle-driven risk.

On March 20, 2025, Angela Nikolau and Ivan Beerkus climbed the entire height of the Empire State Building - approximately 1,454 feet from base to antenna - unfurled a banner, and apparently got engaged before being taken into custody. The world watched in disbelief. How could one of the most iconic buildings in the world, with decades of hardened security protocols, be breached so theatrically?

As a software engineer who has designed security frameworks for physical access control systems and studied risk modeling for high-value assets, I believe this isn't just a news story - it's a case study. It mirrors the kind of architectural overconfidence we see in distributed systems, cloud security footprints. And even CI/CD pipeline hardening. The Empire State Building's security stack failed not because the tools were absent,, and but because the threat model was incomplete

The Anatomy of a Vertical Security Breach

Physical security for high-rise structures typically operates on a layered model: perimeter barriers, lobby checkpoints, elevator access controls, stairwell alarms, and roof-level sensors. The Empire State Building employs all of these. Yet Nikolau and Beerkus managed to bypass them sequentially - a classic "defense-in-depth failure. "

From a systems engineering perspective, this is analogous to a multi-factor authentication scheme where all factors share the same vulnerability surface. If an attacker can phish an employee's password AND their second factor is SMS-based (which is itself phishable or SIM-swappable), then the layers collapse together. Similarly, if a motivated climber can hide in a restroom after security hours and then jimmy a roof hatch, the perimeter and lobby controls become irrelevant.

The breach sequence appears to have been: (1) evading lobby counters, (2) hiding inside the building after hours, (3) accessing a maintenance stairwell bypassing electronic locks and (4) climbing the external structure from the 103rd floor observation deck. Each step exploited a gap in what security engineers call the "trust boundary" - the point at which one zone transitions to another without re-verification.

What Software Engineers Can Learn From the Stunt

In distributed systems, we talk about blast radius - the extent of damage a single compromised component can cause. The Empire State Building's security architecture had a blast radius problem. Once the stairwell was breached, the roof access was implicitly trusted. Any infrastructure engineer who has debugged a Kubernetes cluster where one compromised pod gains access to the entire namespace will recognize this pattern immediately.

The principle of least privilege applies directly: every access point should independently authenticate. The climbers should have been stopped at the roof door, the maintenance ladder. And the external antenna structure - regardless of how they arrived. In code, we enforce this with scoped API tokens and per-endpoint authorization. Physical security too often defaults to "once you're inside the building, you're safe," which is as dangerous as running a database server with network trust disabled.

Another parallel is observability. The New York Police Department was alerted only after the climbers were already visible from street level. That's like detecting a production outage because users start tweeting about it. Real-time monitoring, anomaly detection on motion sensors. And automated alerts tied to camera feeds could have flagged the breach earlier. In DevOps, we call this "shift left" - detect failures earlier in the pipeline.

Why Surveillance Systems Couldn't Prevent the Climb

The Empire State Building has hundreds of cameras. Yet camera coverage isn't the same as security coverage. According to the NIST guide on security camera system design, effective surveillance requires overlapping fields of view, adequate resolution at all distances. And - critically - active monitoring. Many high-rise buildings rely on passive recording: the footage exists, but no one watches it in real time unless an incident is already reported.

A 2023 study by the IEEE on automated anomaly detection in public security feeds found that AI-based threat detection can reduce response time by up to 78% in controlled environments. However, most legacy buildings don't deploy such systems. The Empire State Building's cameras likely use motion detection, but that triggers false positives from birds, maintenance workers. And even wind-blown debris. Without proper context filtering, security teams tune out alerts - a well-known problem in SIEM (Security Information and Event Management) systems as well.

The broader point: surveillance isn't prevention, and it provides evidence after the fact,But it rarely stops a determined actor. This is identical to logging in software systems - logs tell you what happened, not how to prevent it. Prevention requires active controls, not passive observation.

How Risk Assessment Models Failed at Iconic Landmarks

Any security engineer familiar with ISO 31000 or the NIST Risk Management Framework will tell you that risk assessment is about identifying likely threats? The Empire State Building's threat model almost certainly included terrorism, fire, structural failure. And maybe even drone interference. But "romantic daredevils with a banner climbing the facade with suction cups", and probably not in the register

This is a cognitive bias known as availability heuristic - security planners focus on the threats that have already happened, not the ones that are theoretically possible. The same flaw haunts software engineering: teams patch known CVEs but ignore architectural weaknesses that haven't been exploited yet. The SolarWinds attack, the Log4j vulnerability, and countless cloud misconfiguration breaches all followed this pattern - the threat was plausible but hadn't made headlines yet.

A more robust approach would be scenario-based risk modeling. Where a team systematically enumerates "what if" cases regardless of prior incidents. For building security, that could include "what if someone scales the exterior with climbing gear? " For an API, "what if an attacker sends 10,000 requests with a manipulated JWT? " The exercise forces defenders to expand their mental model of the attacker's capabilities.

The Technology Stack Behind Modern Building Security

Modern high-rise security systems are no longer purely physical - they're cyber-physical systems that integrate access control software - IoT sensors, biometric readers, and cloud-based monitoring. The Empire State Building has been retrofitted with electronic locks, elevator destination dispatch systems. And a centralized security operations center (SOC). Many of these components run on legacy Windows-based servers, some with known vulnerabilities.

A 2024 CISA report on industrial control system security highlighted that building management systems are increasingly connected to corporate networks, creating attack surfaces that aren't always monitored by traditional IT security teams. The stairwell door that the climbers accessed might have had an electronic strike - controlled by a building management system (BMS) accessible via an exposed API. If that API was behind a weak VPN or had default credentials, the physical breach could have been enabled by a digital vulnerability.

For engineers, the lesson is that security silos kill. and physical security and IT security must coordinateWhen they don't, you get exactly this outcome - a breach that exploits gaps between systems.

Social Engineering - Media Tactics, and the Attention Economy

Nikolau and Beerkus didn't just climb a building - they staged a production. The banner, the engagement - the video, the coordination with news outlets - it was a content operation disguised as a stunt. The result was global coverage, including the very article chain linked in the query: "Two trespassers climb to top of Empire State Building - NBC News" alongside coverage from CNN, Fox News, ABC7. And The Guardian, and they optimized for virality, and they won

This introduces a variable that most security models ignore: incentive asymmetry. The defenders (building security, NYPD) are paid to prevent harm. The attackers (the climbers) are incentivized by fame, content revenue, sponsorship potential, and daredevil reputation. If the defenders prevent the event, they succeed silently. If the attackers succeed just once, they win permanently, and the math favors the attacker

In software, we see this with bug bounty programs and ransomware - the attacker's upside is enormous. While the defender's upside is, and continued normal operationThe only countermeasure is to make the attack so expensive (in effort, risk. Or time) that the expected value becomes negative. The Empire State Building did not do that. A more effective deterrent might have been: physical spikes on ledges, pressure-sensitive roof tiles. Or real-time drone surveillance. But those would have changed the aesthetic of a beloved landmark.

Policy Implications and Engineering Standards

This incident will likely lead to updated National Fire Protection Association (NFPA) standards for high-rise security, particularly NFPA 730 (Premises Security). We may see mandates for secondary authentication at roof access points, tamper-resistant stairwell doors, and integration between building security and law enforcement notification systems.

From an engineering perspective, I'd recommend a zero-trust architecture for physical infrastructure. Every door, every hatch, every ladder should verify independently - no implicit trust between zones. In code, zero trust means every request is authenticated, authorized, and encrypted. In a building, it means that even if you get to the 100th floor, you still need credentials to access the maintenance roof. This is hard to retrofit. But the Empire State Building is getting a costly lesson in why it matters.

Additionally, we need standardized incident reporting for physical security breaches at critical infrastructure sites. Right now, the only reason we know what happened is because the perpetrators filmed themselves. Imagine if we only discovered software breaches through YouTube videos - that's exactly where we're with physical security at many landmarks.

The Intersection of Physical and Cybersecurity Engineering

The discipline of converged security is still in its infancy. Most organizations have separate teams for building security and IT security. They use different vendors, different budgets, and different reporting lines. The climbers walked straight through that organizational gap. The security guards at the lobby didn't know what the SOC staff in the basement were monitoring. And vice versa.

In my experience building secure deployment pipelines for fintech applications, I've seen the same issue: the DevOps team manages cloud infrastructure, the security team manages compliance scanning. And the network team manages firewalls. No single person has full visibility. The solution is to create cross-functional security teams with authority over both digital and physical layers. This isn't just theory - it's now being recommended by the FBI's Cyber Division as a best practice for critical infrastructure.

For engineers reading this, ask yourself: does your deployment pipeline have implicit trust zones? Are your secrets stored in a way that assumes network isolation is sufficient? If someone physically walked into your office building, could they plug a USB drive into an unmonitored server? Those questions matter as much as your software architecture.

Frequently Asked Questions

1. How did the trespassers get past security without being detected? According to reports, Angela Nikolau and Ivan Beerkus entered the Empire State Building during regular hours, evaded initial checkpoints. And hid inside the building until after closing. They then accessed a maintenance stairwell that bypassed electronic locks and climbed the external structure from the observation deck level.
2. What security failures allowed the Empire State Building breach to happen? The primary failures were (a) lack of secondary authentication at roof access points, (b) no real-time monitoring of external surfaces at upper levels, (c) passive surveillance that only triggered after the climbers were visible from the street. And (d) a threat model that did not include vertical climbing as a plausible scenario.
3. Could AI-based surveillance have prevented this incident. PossiblyAI-powered anomaly detection systems that analyze camera feeds in real time can flag unusual motion patterns - such as a human figure climbing a vertical surface - with low false-positive rates when properly trained. However, few legacy building systems deploy such technology due to cost and complexity.
4. What are the legal consequences for climbing a building like the Empire State Building? In New York, trespassing on a landmark building can result in charges including criminal trespass - reckless endangerment. And burglary (if entering with intent to commit a crime). The climbers were taken into custody and could face jail time, fines. And restrictions on future activities.
5. What is zero-trust architecture in physical security? Zero-trust architecture in physical security means that no location or zone is implicitly trusted, regardless of how a person arrived there. Every door, gate, and access point independently verifies authorization - just as zero-trust networking requires authentication at every service boundary rather than just the perimeter.

What do you think?

Should building security systems be required to add zero-trust access control for all roof and maintenance access points, even if it significantly increases retrofitting costs for historic landmarks?

Are the engineering lessons from this physical breach - layered authentication - active monitoring, and threat model expansion - applicable to your own software systems, and if so,? Which gap is most dangerous in your stack right now?

Would you support a regulation mandating that all buildings over a certain height must publicly disclose their physical security incident response plans, similar to how software vendors disclose data breach timelines?