Two people climb to top of NYC's Empire State Building - BBC

The Empire State Building as a System: Perimeter, Layers. And Failures

On a clear morning in early 2025, two individuals-dressed in climbing gear and carrying a banner-managed to ascend the spire of the Empire State Building, reaching its 1,454-foot apex before being apprehended. The event, widely reported under the headline "Two people climb to top of NYC's Empire State Building - BBC", is more than a viral stunt. For security engineers, it's a stark case study in physical penetration testing against a high-value target. If we treat the Empire State Building as a mission-critical system, this climb was the equivalent of a successful zero-day exploit. The defenders-NYPD - building security. And the public-were caught off-guard by an attack vector that was never fully threat-modeled.

Modern building security, like enterprise network security, relies on layered defenses: CCTV cameras - motion sensors - uniformed guards, access control systems. And perimeter barriers. The Empire State Building, a National Historic Landmark built in 1931, has been retrofitted over decades with state‑of‑the‑art technology. Yet the climbers bypassed every one of those layers. They avoided detection by scaling the exterior rather than entering through a door. They triggered no alarms because the building's motion sensors are optimized for large moving objects (elevators, crowds), not for slow motion on a vertical facade. This is a classic "false negative" in physical surveillance-analogous to a network intrusion detection system that ignores traffic on an unusual port.

Zero-Day Exploit in the Physical World: What Security Engineers Can Learn

In cybersecurity, a zero-day exploit is a vulnerability unknown to the vendor, for which no patch exists. The Empire State Building climb fits that definition perfectly. No one had considered that an individual could legally or illegally scale the outer spire-the building's safety assessments focused on falls from windows, not deliberate ascents. This blind spot underscores a critical lesson: threat modeling must account for adversarial creativity. The climbers exploited a gap in "physical software"-the security procedures and hardware configurations-that no one had imagined.

Consider analogies from the software world. The Heartbleed bug (CVE‑2014‑0160) allowed attackers to read memory from servers running OpenSSL-a protocol trusted by millions. Similarly, the Empire State Building's trust in its external walls (i e., "no one can climb this because it's too high") was the equivalent of an unvalidated assumption. The takeaway is clear: always test the extreme edge of your security boundary. For network engineers, this means simulating adversarial movements through lateral paths. For building operators, it means commissioning "physical red teams" to attempt roof access, facade scaling, and subterranean entry.

The Role of Environmental Protest in Technology Discourse

The banner unfurled by the climbers called attention to climate change-a protest that brilliantly leveraged technology to amplify its reach. They used social media feeds, live-streamed from smartphones, and the BBC and other outlets ran the story globally within minutes. This incident is a modern example of how activism has evolved from printed flyers to algorithmic amplification. Software engineers build the platforms that enable such rapid spread; we should understand how our architectures can be weaponized for good or ill.

From an engineering perspective, the protest relied on a well-orchestrated content distribution pipeline. The climbers likely pre-scheduled tweets and press releases, ensuring that when they reached the top, the message would be captured by news aggregators. This mirrors a coordinated DDoS attack-not on a server. But on public attention. The lesson for developers building social media tools is to consider how viral content (even legitimate protest) can be used to bypass editorial gatekeeping. As we design recommendation algorithms, we must weigh the impact of amplifying events engineered for maximum outrage or emotion.

Incident Response: How NYPD and Building Security Reacted

Once the climbers were spotted, NYPD's Emergency Services Unit (ESU) responded by closing streets and blocking pedestrian access-a textbook containment strategy. The response timeline is instructive: detection occurred only after onlookers tweeted photos; internal camera feeds hadn't flagged the anomaly. This latency is analogous to a security operations center (SOC) that relies on user reports rather than automated alerts. The delay allowed the protest to continue for roughly 30 minutes before the climbers were apprehended.

From an incident response playbook, there are parallels to the "detect, contain, eradicate, recover" cycle. Detect: failure of automated video analytics. And contain: street closure and crowd managementEradicate: removal of climbers via helicopter or fire ladder (reports suggest they came down voluntarily after negotiation). Recover: repair any damaged infrastructure and run a post-mortem. The NYPD's later statement noted they would review surveillance protocols. In software security, such post‑incident reviews are mandatory-why not for physical landmarks too?

Physical Security vs. Cybersecurity: A Two-Way Mirror

The Empire State Building incident reveals that the principles of defense in depth apply equally to atoms and bits. Both domains have a perimeter, assets, threat actors, and escalation paths. Yet organizations often treat them as separate silos: the security team handles network firewalls while facilities management handles locks and cameras. This climb demonstrates the danger of such fragmentation. A single adversary can cross all boundaries-scaling the building, bypassing guard posts. And exploiting physical access to deliver a message that ricochets across the internet.

I recommend that enterprise security teams conduct joint tabletop exercises with facilities staff. For example, simulate a scenario where a protest group uses drones to bypass perimeter alarms. Or where a social engineer impersonates a maintenance worker to access a server room. Such drills expose gaps that a purely logical threat model misses. In my own work as a security architect, I've seen how integrating physical and cyber risk registers leads to more robust defense. The Empire State Building climb is a textbook case for this integration.

The Engineering Challenge of Climbing the Spire

Beyond security, the climb itself is a remarkable feat of human engineering and physical prowess. The spire isn't designed for climbing; its surface is a mix of glass, metal, and intricate latticework. The climbers likely used ascenders and static ropes, installing protection points on antenna mounts and cross-bracing. This terrain is reminiscent of "big wall" climbing. But at an never-before-seen height in an urban environment. For civil engineers, this raises questions about load capacity: the spire was designed to withstand wind and ice, not a 150‑pound person pulling outward. The fact that it held under dynamic loads shows a safety margin-a good design practice that saved lives.

From a safety engineering perspective, the climb also highlights the lack of anti‑climb features. Many skyscrapers now install pigeon spikes, anti‑graffiti coatings, and even electrified strips on ledges. The Empire State Building had none on its spire. A post‑incident retrofit could include motion-activated netting or glass panels that are slippery. Yet such countermeasures must be balanced against architectural aesthetics and structural integrity. This is a classic engineering trade-off: security vs. openness. The same debate occurs in software when deciding whether to lock down an API endpoint or keep it flexible for legitimate users.

Authentication and Authorization in the Real World

The climbers' method of gaining initial access remains partly unclear. They likely entered the building's lower floors as regular tourists, then broke into a maintenance area to bypass rooftop barriers. This is analogous to gaining a foothold in a network via a phishing email-once inside, you move laterally. The tower's access control system relied on keycards and security guards at key points. But the climbers exploited a "tailgating" vulnerability (following an authorized employee through a door) or found an unsecured service hatch.

In information security, authentication is based on "something you know, have,, and or are" The building had guards (knowledge) and keycards (possession). But no biometric verification at every internal door. The climbers bypassed this by not needing to prove identity-they simply moved through physically open spaces. This is analogous to a system where session tokens are never rotated. The recommendation: implement multi-factor authentication not only for digital access but also for physical access to critical areas. For example, a maintenance door on the roof should require both a keycard and a biometric scan, and alarms should trigger if the door is opened without proper clearance.

The Media as a Secondary Attack Vector

The BBC and other outlets-including ABC News and FOX 5 New York-picked up the story within hours. From a software engineer's lens, the news ecosystem acts as a propagation channel. Unlike a DDoS attack that overwhelms a server, this "message bomb" overwhelmed the public attention. The climbers essentially executed an asymmetric attack: low cost (rope and shoes) vs. high impact ($1 million worth of free media coverage).

Engineers who build content management systems (CMS) should consider how their platforms handle rapid surges of traffic around breaking news. The BBC's website likely scaled automatically to handle millions of clicks. But smaller news sites may have crashed. This event is a reminder of the importance of auto-scaling and caching strategies. Moreover, the story's spread through Google News RSS feeds (as seen in the link collection) shows how algorithmic aggregation can be hijacked by a well-timed event. Developers working on news feed algorithms should examine how to prevent "coordinated message" abuse while preserving free speech.

Future-Proofing Iconic Structures: Lessons from Software Patching

Just as software receives security patches after a zero-day is discovered, physical landmarks must now consider a "security patch" for their external surfaces. Potential retrofits include installing pressure-sensitive mesh that triggers alarms when climbed, deploying drone-based surveillance that can track vertical movement. And adding anti‑climb paint that's extremely slippery. These are similar to applying security headers (e. And g, Content-Security-Policy) to a web application after a cross‑site scripting (XSS) attack.

However, patching physical infrastructure is costlier and slower. The Empire State Building's owner must now weigh the cost of retrofitting its iconic spire against the probability of another climb. In software, we make similar decisions using risk matrices. For low-probability, high-impact events (like a zero‑day), we often rely on detection rather than prevention. Similarly, the building may invest in better motion‑alert cameras and real‑time analytics powered by computer vision (AI). This incident will likely accelerate the adoption of AI‑based surveillance for vertical surfaces at major landmarks worldwide.

Conclusion: From Stunt to Security Blueprint

The incident widely reported as "Two people climb to top of NYC's Empire State Building - BBC" is far more than a viral video it's a powerful demonstration that security-whether digital or physical-must evolve to anticipate adversarial innovation. For engineers, the lessons are practical: integrate physical and cyber red‑team exercises, design for the edge case. And treat high‑profile assets as critical infrastructure deserving continuous vulnerability assessment,