1
00:00:31,550 --> 00:00:37,190
I'm an investigative attorney, and I do a lot of security work around the world.

2
00:00:37,350 --> 00:00:49,790
My associate this morning is Matt Fidler, who is a security consultant and former military intelligence, and does a lot of security work, both hardware and software.

3
00:00:50,390 --> 00:00:57,870
The impetus for this discussion this morning grew out of last year, the conference in New York.

4
00:00:57,870 --> 00:01:06,810
I was part of a panel involving vulnerability of locks issues, which is what I mainly deal with.

5
00:01:06,870 --> 00:01:09,690
And as a result of that, there was a sense

6
00:01:15,860 --> 00:01:24,100
of security community with regard to the ethics of disclosure of vulnerabilities of locking systems.

7
00:01:24,100 --> 00:01:42,620
And so we decided that we'd put together a presentation and really would like, at the conclusion of our PowerPoint, to solicit comments from you folks as to what your thoughts are so these can be taken back to the hardware security community.

8
00:01:43,700 --> 00:02:00,840
Essentially, the locksmiths and their organization have determined that there should not be any disclosure of defects or vulnerabilities other than the security professionals and security management and other locksmiths.

9
00:02:00,880 --> 00:02:04,460
I don't particularly subscribe to that theory, nor does Matt.

10
00:02:04,460 --> 00:02:07,520
We want to go through why we do not.

11
00:02:07,520 --> 00:02:15,280
It's obviously been dealt with in the logical security community a long time ago, but not really in the hardware community.

12
00:02:15,380 --> 00:02:18,740
And so we'll present a PowerPoint first.

13
00:02:18,740 --> 00:02:19,820
Matt will do that.

14
00:02:19,820 --> 00:02:25,260
And then we want to solicit your comments and input.

15
00:02:25,260 --> 00:02:27,020
Good morning, everybody.

16
00:02:27,120 --> 00:02:30,060
So as Mark said, we're going to run through this pretty quick.

17
00:02:30,060 --> 00:02:31,080
Then we can hop down.

18
00:02:31,080 --> 00:02:33,260
We've got some swag to throw out.

19
00:02:45,200 --> 00:02:48,760
So this quote goes back over 150 years.

20
00:02:49,460 --> 00:02:49,820
A.C.

21
00:02:49,820 --> 00:02:52,880
Cox wrote the book Locks and Safes.

22
00:02:53,040 --> 00:03:01,540
And you can read it, but it details that the unscrupulous individuals already have this bit of information.

23
00:03:01,540 --> 00:03:03,220
They already know about the defects.

24
00:03:03,220 --> 00:03:04,980
They're already exploiting them.

25
00:03:04,980 --> 00:03:09,660
And it's better to provide this information to the public and make it available.

26
00:03:10,340 --> 00:03:15,820
This was a Usenet post in June 2nd of this year from a locksmith.

27
00:03:15,820 --> 00:03:34,280
And again, you can read it, but basically they're indicating that providing this type of information, and I think this was in response to top-level master key or Eric Michaud's multi-lock attack on a plate, and just indicating that this is all secret information.

28
00:03:34,280 --> 00:03:35,760
It should not be published.

29
00:03:37,100 --> 00:03:39,140
So clearly, there are no secrets.

30
00:03:39,720 --> 00:03:43,160
We're going to talk about the importance of full disclosure.

31
00:03:43,160 --> 00:03:47,720
We'll identify from a physical security perspective what defects are.

32
00:03:48,200 --> 00:03:50,620
Mark will go into some of the legal issues of them.

33
00:03:55,350 --> 00:03:58,190
And then we'll go into some case examples of the last year.

34
00:04:01,030 --> 00:04:05,150
So again, locksmiths are the first line in most cases.

35
00:04:05,150 --> 00:04:11,060
They have publicly come out and said that, like you said...

36
00:04:11,060 --> 00:04:12,680
That would be all of you.

37
00:04:19,840 --> 00:04:21,860
So defects, what are defects?

38
00:04:21,860 --> 00:04:25,260
They're simple bypasses, really simple tools.

39
00:04:25,260 --> 00:04:28,320
We're talking seconds of bypass.

40
00:04:47,110 --> 00:04:54,130
We're talking about the type of bypass that does not require sophisticated tools, expertise, and time.

41
00:04:54,130 --> 00:04:56,570
The type of tools that I routinely deal with.

42
00:04:56,670 --> 00:05:00,630
Versus the ballpoint pen opening the tubular lock trick.

43
00:05:01,470 --> 00:05:05,290
That's the type of bypass that we're really talking about.

44
00:05:05,290 --> 00:05:13,430
The simple, really, defects or problems that lead to the ability to circumvent a locking system.

45
00:05:17,530 --> 00:05:20,410
Okay, well, the legal issues are real simple.

46
00:05:20,410 --> 00:05:21,630
The real question is...

47
00:05:22,510 --> 00:05:29,030
What does the end user have a right to know about the security products that they're buying and using?

48
00:05:29,030 --> 00:05:38,810
And what's the liability for the locksmith or architect or hardware vendor if they don't tell you about a vulnerability?

49
00:05:38,890 --> 00:05:42,610
And you put in that system and then you suffer a loss.

50
00:05:42,610 --> 00:05:43,590
Somebody gets injured.

51
00:05:43,590 --> 00:05:44,690
Somebody gets killed.

52
00:05:44,690 --> 00:05:45,750
There's a major theft.

53
00:05:45,750 --> 00:05:47,890
There's a compromise of information.

54
00:05:48,270 --> 00:05:51,830
Who's got the liability or is there any liability?

55
00:05:51,830 --> 00:06:00,950
And especially involving federal and state statutes regarding the disclosure of protection of medical information, financial information.

56
00:06:00,950 --> 00:06:03,730
These are serious legal issues.

57
00:06:03,730 --> 00:06:11,030
The locksmiths really haven't come to grips with them and frankly don't understand a lot of the problems that can face them.

58
00:06:11,030 --> 00:06:19,450
And as an end user security administrator or person responsible for physical security, the real question is...

59
00:06:19,450 --> 00:06:25,310
How much information do you have a right to know in order to make the security assessment?

60
00:06:26,070 --> 00:06:32,390
If you rely on a security consultant to make that assessment for you, that's fine.

61
00:06:32,390 --> 00:06:40,630
But if you're charged with the responsibility and fail to have all the needed information, then you really can't make that assessment.

62
00:06:40,630 --> 00:06:42,270
And then who is liable?

63
00:06:42,390 --> 00:06:44,790
Those are really the critical issues.

64
00:06:45,390 --> 00:06:54,850
So as far as statutory liability, I'm sure most of you out there in the IT world are familiar with HIPAA, SOX, GLBA, all the regulatory compliance issues.

65
00:06:54,850 --> 00:07:07,070
HIPAA, over one quarter or almost one quarter of HIPAA statutes govern physical access control, access to facilities, file lockers, etc.

66
00:07:07,070 --> 00:07:09,710
containing protected health information.

67
00:07:09,710 --> 00:07:14,870
So clearly we're all in bed with these regulatory issues.

68
00:07:14,870 --> 00:07:20,050
SB 1386, the loss of information, defamation assets.

69
00:07:21,410 --> 00:07:28,870
It's incumbent on us to understand the physical hardware that protects these assets.

70
00:07:30,770 --> 00:07:33,290
So we'll get into the ethical debate.

71
00:07:33,290 --> 00:07:37,630
Again, the question we want to throw out there, we'd like to get your feedback.

72
00:07:37,630 --> 00:07:39,570
Come on up, ask questions.

73
00:07:40,390 --> 00:07:43,950
But again, if the manufacturer is notified, what should they do?

74
00:07:43,950 --> 00:07:44,850
Should they admit it?

75
00:07:44,850 --> 00:07:46,810
Should it be publicized?

76
00:07:46,810 --> 00:07:48,870
We'll talk about some case examples.

77
00:07:48,870 --> 00:07:52,310
We recognize some other vendors and how they use it.

78
00:07:52,310 --> 00:07:53,630
Full disclosure.

79
00:07:53,990 --> 00:07:58,410
And ultimately, what is the vendor's level of negligence?

80
00:07:58,410 --> 00:08:00,350
And one other comment.

81
00:08:00,350 --> 00:08:12,070
If you find a security defect or a vulnerability that allows a lock or system to be bypassed, do you take it to the manufacturer without making it public?

82
00:08:12,210 --> 00:08:14,190
Or do you make it public?

83
00:08:14,190 --> 00:08:22,950
And that's really an interesting question because if you take it to the manufacturer and they have a large embedded base of security products, do they make it public?

84
00:08:22,950 --> 00:08:25,330
The responsible manufacturers will.

85
00:08:25,330 --> 00:08:26,650
A lot of them will not.

86
00:08:26,650 --> 00:08:28,830
So where does that leave the end user?

87
00:08:44,100 --> 00:08:45,140
Anywhere.

88
00:08:45,140 --> 00:08:47,180
In a closed group.

89
00:08:47,280 --> 00:08:49,060
In a closed group, yeah.

90
00:08:49,760 --> 00:08:56,700
So the second point, the reality is you disclose a defect but there isn't one really there.

91
00:09:01,430 --> 00:09:04,030
Someone else may or may not find it.

92
00:09:05,250 --> 00:09:07,690
So, again, we want to pose this question.

93
00:09:07,910 --> 00:09:16,450
There's been a lot of public disclosures on non-physical vulnerabilities that haven't come to fruition.

94
00:09:16,450 --> 00:09:21,730
They were one-time bypasses that someone was able to do in a controlled environment.

95
00:09:25,030 --> 00:09:39,910
Well, the other issue is, and a lot of the locksmiths have propounded, okay, if there's a known vulnerability in a lock or a piece of hardware, okay, you can tell the public, yes, there's a vulnerability, but you can't tell them what it is.

96
00:09:39,910 --> 00:09:41,350
What does that do for you?

97
00:09:41,350 --> 00:09:42,950
In our view, nothing.

98
00:09:43,150 --> 00:09:48,210
Because the minute you disclose there's a hardware defect, somebody's going to find it.

99
00:09:48,210 --> 00:09:50,330
And if they find it, they're going to publish it.

100
00:09:50,330 --> 00:09:52,810
A lot of locksmiths haven't heard of the Internet yet.

101
00:09:52,810 --> 00:09:56,210
And so they still believe that there are secrets out there.

102
00:09:56,210 --> 00:09:59,290
And as we keep trying to tell them, there are no secrets anymore.

103
00:10:00,970 --> 00:10:06,230
So some considerations for thought, again, between the questions and the evidence here.

104
00:10:06,410 --> 00:10:08,290
Need to know at full disclosure.

105
00:10:08,910 --> 00:10:11,650
The level of expertise that we spoke about, you know, some

106
00:10:20,990 --> 00:10:23,610
in seconds, but little or no training.

107
00:10:49,540 --> 00:10:55,560
So as far as UL ratings and other industry standard hardware ratings, point of danger feedback should be

108
00:10:59,040 --> 00:10:59,900
everywhere.

109
00:10:59,900 --> 00:11:01,460
And what is enough to be secured?

110
00:11:01,460 --> 00:11:04,020
What's too much or too little?

111
00:11:04,500 --> 00:11:06,440
And what's a security defect?

112
00:11:06,440 --> 00:11:12,940
A manufacturing defect versus an exposed vulnerability.

113
00:11:12,940 --> 00:11:19,640
Because there's a continuum of vulnerability versus a real significant design defect.

114
00:11:49,740 --> 00:11:52,940
Let me even take it farther.

115
00:11:53,860 --> 00:11:57,320
The real question is, who has a need to know?

116
00:11:57,320 --> 00:12:01,060
And let's talk about one of the security releases we did last year.

117
00:12:01,060 --> 00:12:05,500
I found a vulnerability in gun lock, gun trigger locks.

118
00:12:05,720 --> 00:12:15,400
A really serious vulnerability to the point that literally I shot a video in Toronto with an 11-year-old kid removing three of the most popular gun locks off a rifle in seconds.

119
00:12:15,500 --> 00:12:19,120
Should that vulnerability be disclosed to the public?

120
00:12:19,120 --> 00:12:21,040
Or how should they be warned?

121
00:12:21,040 --> 00:12:30,060
Because at some point, some kid's going to get hurt or killed by removing one of these gun locks that their parents mistakenly believe provides security on that weapon.

122
00:12:30,060 --> 00:12:33,600
It's a perfect example where there can be tragic results.

123
00:12:33,600 --> 00:12:34,460
Do you disclose it?

124
00:12:34,460 --> 00:12:35,400
Do you not disclose it?

125
00:12:35,400 --> 00:12:42,380
When I talked to one of the leading manufacturers in the industry, who I did some work for a long time ago, they didn't want to disclose.

126
00:12:42,380 --> 00:12:44,780
They didn't think it was a big problem, and they weren't talking about it.

127
00:12:44,780 --> 00:12:48,140
And they haven't to this day, and they continue to manufacture the locks.

128
00:12:48,220 --> 00:12:52,940
And these are major manufacturers that are putting this material out there.

129
00:12:52,960 --> 00:12:56,700
Every hardware store and sporting goods store in the country sells them.

130
00:12:56,700 --> 00:13:00,340
Should that be exposed in the national media?

131
00:13:05,270 --> 00:13:07,270
Okay, and we'll talk about that in a minute.

132
00:13:07,330 --> 00:13:21,170
Because, well, you say yes until you're the parent of a kid that reads a report on the Internet and then goes and pulls a gun lock off a weapon and shoots one of his classmates, and then you're going to be coming to me saying, what the hell did you publish it for?

133
00:13:21,650 --> 00:13:24,990
Because my kid wouldn't have known about it if you didn't publish it.

134
00:13:24,990 --> 00:13:26,310
That's the problem.

135
00:13:32,050 --> 00:13:32,990
I agree.

136
00:13:32,990 --> 00:13:34,590
We'll talk about it in just a minute.

137
00:13:38,930 --> 00:13:40,250
Right, well, that's the attitude.

138
00:13:40,370 --> 00:13:44,050
Actually, we took the attitude that we didn't publish it directly.

139
00:13:44,110 --> 00:13:53,550
We charged a $3 fee for the report so that you'd have to have a credit card to buy it, which would eliminate virtually every kid from buying the report.

140
00:13:53,550 --> 00:13:55,910
And that's how we control distribution.

141
00:13:55,910 --> 00:13:59,190
All right, we're going to get some swag out.

142
00:13:59,850 --> 00:14:01,070
Oh, yeah, that's important.

143
00:14:01,070 --> 00:14:02,730
Let's, uh, and R.C.

144
00:14:02,730 --> 00:14:04,350
and, uh, ask Bob.

145
00:14:08,890 --> 00:14:11,250
Yeah, that's it.

146
00:14:12,650 --> 00:14:14,950
All right, R.C., now you can answer.

147
00:14:16,330 --> 00:14:20,910
In the hardware, locked and hardware environment.

148
00:14:20,910 --> 00:14:21,990
Okay, there you go.

149
00:14:21,990 --> 00:14:24,910
Here's a copy of Make Magazine for you.

150
00:14:25,770 --> 00:14:28,850
So you're all familiar with the controversy.

151
00:14:28,850 --> 00:14:39,210
When we were in the New York Times two years ago on top-level master key, as I've referred to it in my disk set, in my book, extrapolation of the top-level master key.

152
00:14:39,210 --> 00:14:42,230
Very, very serious security vulnerability.

153
00:14:42,610 --> 00:15:01,510
Basically, anybody in an organization that has access to one key to one door that is on the top-level master key system can compromise that system unless they have the proper locks installed, they've been coded properly, and they have the proper restricted type of blank with sidebar coding.

154
00:15:01,510 --> 00:15:03,830
It's a serious, serious problem.

155
00:15:03,830 --> 00:15:08,290
Yeah, so the, uh, the second quote I got from Bob, about locksmiths

156
00:15:15,030 --> 00:15:17,570
being huge up in Arkansas,

157
00:15:21,430 --> 00:15:24,170
and that we compromise national security.

158
00:15:24,250 --> 00:15:31,470
Now, then, of course, they turned around and said, yes, but every locksmith has known about this for 50 years, so it's no secret.

159
00:15:31,470 --> 00:15:38,970
So, of course, there would be a slight inconsistency in that position, but it shouldn't have been disclosed notwithstanding everybody knew about it.

160
00:15:39,390 --> 00:15:41,250
Everybody except the consumer.

161
00:15:41,250 --> 00:15:44,690
So, the tubular lock bypass,

162
00:15:50,860 --> 00:15:54,860
and then shortly after Hope published information on Weinstadt

163
00:16:01,600 --> 00:16:06,660
News, got some, a little bit of, you know, attention.

164
00:16:06,800 --> 00:16:20,840
It wasn't until an individual took that bypass technique and applied it to a kryptonite lock, that bike users are, you know, a little bit more crazy than motor users.

165
00:16:20,840 --> 00:16:27,860
Right, well, I can tell you the first two days that we posted that on our website, we had 100,000 hits.

166
00:16:27,860 --> 00:16:44,940
And I had thousands of emails from security administrators from colleges, governments, hospitals, schools, wanting to know what to do about their laptop locks, which escalated into the bike lock issue and into gun locks that use tubular locks.

167
00:16:44,940 --> 00:16:47,600
The problem isn't with the tubular lock.

168
00:16:47,600 --> 00:16:51,940
The problem is with inexpensive tubular locks that aren't designed properly.

169
00:16:51,940 --> 00:17:01,190
Now, as a result of that, and I can talk about kryptonite, they really did the right thing.

170
00:17:01,520 --> 00:17:14,580
They woke up one morning to all the flood of media, and it was sort of, it was a big surprise for them.

171
00:17:14,580 --> 00:17:20,460
And so, they spent a couple days looking at the issue, and then they finally made a corporate decision.

172
00:17:20,460 --> 00:17:26,640
They were going to replace every lock, which I believe was the very responsible thing to do.

173
00:17:26,640 --> 00:17:28,760
Frankly, there wasn't anything else they could do.

174
00:17:31,560 --> 00:17:42,420
They, the management of kryptonite, which is a subcompany of Schlage Lock, they made the decision to bite the bullet.

175
00:17:42,420 --> 00:17:49,060
They admitted the problem, and they offered a free replacement no matter when you bought your lock.

176
00:17:49,060 --> 00:17:58,040
They, to date, have replaced, to my understanding, about 350,000 of them, at a cost of about $10 million or more to Schlage.

177
00:17:58,200 --> 00:18:04,700
That is the responsible way to do it, and they've redesigned their lock, and so now it is a very secure piece of hardware.

178
00:18:04,700 --> 00:18:08,980
In fact, it has a security rating in Europe from the rating agency.

179
00:18:09,100 --> 00:18:11,140
They're not going to be easily broken.

180
00:18:11,140 --> 00:18:39,100
Now, that would never have occurred if, actually, we hadn't released our initial report, and then one of the bikers picked up on it and described the vulnerability for kryptonite locks, which have been and are the leader worldwide in the industry.

181
00:18:39,100 --> 00:18:41,100
And so it's a prime example.

182
00:18:41,280 --> 00:18:44,680
You know, the bottom line is don't kill the messenger for the message.

183
00:18:44,680 --> 00:18:50,140
If you have a security defect or vulnerability in your hardware, fix it or don't sell it.

184
00:18:50,160 --> 00:18:51,820
That's really the bottom line.

185
00:18:51,820 --> 00:18:59,560
Now, obviously, a lot of lock manufacturers don't subscribe to that theory, but they should, and the consumer really dictates that.

186
00:18:59,560 --> 00:18:59,840
Right.

187
00:18:59,840 --> 00:19:02,540
So, again, kryptonite clearly did it right.

188
00:19:02,560 --> 00:19:08,500
Other vendors, and we're not going to name names, but, again, engineers could not duplicate.

189
00:19:08,500 --> 00:19:10,500
They couldn't take a big advantage.

190
00:19:10,500 --> 00:19:13,720
For our people, we flexed Krypultra to bypass the lock.

191
00:19:13,720 --> 00:19:14,380
It's amazing.

192
00:19:14,380 --> 00:19:21,560
But I can also tell you that they are, because I'm in contact with a lot of them, they are implementing design changes that frustrate the problem.

193
00:19:21,560 --> 00:19:24,220
It's actually a very difficult problem to solve.

194
00:19:24,220 --> 00:19:26,520
It's not quite so easy as everybody thinks.

195
00:19:26,520 --> 00:19:33,700
But all of the vendors that I'm dealing with, they are taking a responsible approach now, and they are solving the problem.

196
00:19:34,440 --> 00:19:37,240
Okay, so bump keys or 999 keys.

197
00:19:37,240 --> 00:19:43,320
This is where a key is cut to its highest position on all the fittings.

198
00:19:43,420 --> 00:19:48,660
The inertia effect against all the pins.

199
00:19:48,660 --> 00:19:51,500
The key is inserted blind

200
00:20:00,350 --> 00:20:01,990
, and turn the key and open it.

201
00:20:01,990 --> 00:20:03,430
Yeah, actually, it's Mr.

202
00:20:03,430 --> 00:20:08,630
Newton from England, from 300 years ago, that helped us out on that with his third law of motion.

203
00:20:09,030 --> 00:20:14,350
He just didn't quite foresee it at that time, but that's exactly what it is.

204
00:20:14,350 --> 00:20:17,010
For every action, there's an equal and opposite reaction.

205
00:20:17,070 --> 00:20:24,490
And basically, when you wrap on the pins in a specific way, you create a few milliseconds of gap, and you can open the lock.

206
00:20:24,490 --> 00:20:33,870
I did some television interviews back at home demonstrating this, because it is a very big security vulnerability.

207
00:20:33,870 --> 00:20:39,670
Barry Wells has done a lot of work with it in Europe, and there's been a lot of publicity.

208
00:20:39,670 --> 00:20:42,350
Not so much in America yet, but it is a problem.

209
00:20:42,350 --> 00:20:45,450
It's a problem for every standard, conventional pin number lock.

210
00:20:45,450 --> 00:20:48,130
Not for most of the high security locks.

211
00:20:48,130 --> 00:21:00,310
But again, if the public doesn't know about it, then literally somebody can walk up to your residence door, your business door, and in two seconds open it with no damage and no real evidence of injury.

212
00:21:16,600 --> 00:21:19,020
Yeah, let me just address that for two minutes.

213
00:21:19,020 --> 00:21:24,300
About seven or eight years ago, I got a phone call from a locksmith in Hawaii.

214
00:21:24,500 --> 00:21:42,860
L-Safe, which is the largest in-room safe manufacturer in the world, they're owned by the Asa Abloy Group, has over a million safes in luxury hotel rooms, and virtually all of them are insecure than they were at that time, although they rated them as a high security safe.

215
00:21:43,140 --> 00:21:56,600
I looked at it, documented the defect, and frankly had a 16-year-old kid that was working for me in the office for the summer open it with a screwdriver and a paper clip in about one minute.

216
00:21:56,920 --> 00:21:59,340
And this was brought to the attention of L-Safe.

217
00:21:59,340 --> 00:22:00,540
They really didn't fix it.

218
00:22:00,540 --> 00:22:01,720
They didn't acknowledge it.

219
00:22:01,720 --> 00:22:08,820
They didn't acknowledge that I even existed because of the massive lawsuits that would have flowed from it.

220
00:22:08,820 --> 00:22:10,300
This is a perfect example.

221
00:22:10,300 --> 00:22:12,080
Hotel guests have no clue.

222
00:22:12,080 --> 00:22:15,000
I've done a lot of work in the hotel liability area.

223
00:22:15,000 --> 00:22:17,980
A lot of hotel locks are not secure.

224
00:22:17,980 --> 00:22:20,080
They should not be relied on.

225
00:22:20,080 --> 00:22:27,480
And the hotels, they're concerned, but they're not concerned because they have statutory exemption from liability and they have insurance.

226
00:22:27,600 --> 00:22:29,000
And so it's a problem.

227
00:22:29,000 --> 00:22:32,280
And again, as a consumer, you ought to be aware of the problem.

228
00:22:34,120 --> 00:22:37,800
So again, as Mark mentioned, we continue to do locks.

229
00:22:37,800 --> 00:22:41,220
That extends across the whole host of applications.

230
00:22:41,220 --> 00:22:45,640
Safes, Harley-Davidson brake locks, J.I.R.

231
00:22:45,640 --> 00:22:48,440
keys are compromised with that.

232
00:22:48,700 --> 00:22:49,700
It's huge.

233
00:22:49,700 --> 00:22:51,460
TSA luggage locks.

234
00:22:51,540 --> 00:22:54,160
Everybody's using them to lock their luggage when they fly.

235
00:22:54,160 --> 00:22:55,700
They're very insecure.

236
00:22:55,880 --> 00:23:06,300
We put out a security alert and demonstrated how you can take a piece of plastic from a credit card and open the most popular ones just by sticking a little piece of square plastic in the keyway.

237
00:23:06,300 --> 00:23:07,520
This is not security.

238
00:23:07,520 --> 00:23:13,420
And the real problem in that area is not theft from your luggage because it's easy to rip open luggage.

239
00:23:13,420 --> 00:23:23,360
The real issue, in my view, and I did a magazine article over in Europe on it, is that contraband can be put into your luggage after you think it's locked.

240
00:23:23,360 --> 00:23:27,520
And if it's not caught in security, then it can be a real serious problem.

241
00:23:27,520 --> 00:23:29,960
And again, Mark, talk about the gun

242
00:23:50,430 --> 00:23:50,750
.

243
00:23:50,810 --> 00:23:55,550
Well, multi-lock is a telescoping pin, very high security lock.

244
00:23:55,550 --> 00:23:56,890
They're made in Israel.

245
00:23:56,890 --> 00:23:59,090
I've been to their factory many times.

246
00:23:59,090 --> 00:24:02,230
They're also part of the Assa Abloy group out of Finland.

247
00:24:03,170 --> 00:24:08,890
Eric Michaud actually thought he came up with a compromise.

248
00:24:09,710 --> 00:24:22,090
When you are talking about bypass of locks, especially high security, one of the criteria is repeatability, which I don't believe can be shown in this particular bypass.

249
00:24:22,510 --> 00:24:24,710
Opening one lock doesn't mean anything.

250
00:24:24,710 --> 00:24:29,390
Opening all of them or 99% of them reliably within a time frame means a lot.

251
00:24:29,390 --> 00:24:31,950
That has not been demonstrated with multi-lock.

252
00:24:31,950 --> 00:24:33,550
And frankly, I don't think it will.

253
00:24:33,550 --> 00:24:36,750
I've done quite a bit of analysis on their locking system.

254
00:24:36,750 --> 00:24:38,170
It's a very secure device.

255
00:24:38,170 --> 00:24:40,150
But it was published.

256
00:24:40,170 --> 00:24:47,050
And the flip side of this argument is, it shouldn't have been published until it was truly documented.

257
00:24:47,050 --> 00:24:58,630
Theoretical in the laboratory is one thing, but you don't cause a manufacturer problem or you don't cause the public a security concern unless you can document it.

258
00:24:58,630 --> 00:25:01,770
And so that really is the flip side of this argument.

259
00:25:01,770 --> 00:25:04,190
All right.

260
00:25:04,190 --> 00:25:15,190
So, you know, we're really looking to empower you with your experience, your vulnerability exposures, to go out there, to look at hardware, and get all the

261
00:25:26,160 --> 00:25:27,060
information out there.

262
00:25:27,060 --> 00:25:28,800
There's a lot of material on the net.

263
00:25:28,800 --> 00:25:31,540
There's some on our website that's publicly available.

264
00:25:31,640 --> 00:25:33,200
A lot of it's restricted.

265
00:25:33,380 --> 00:25:36,180
But there's a lot of material out there.

266
00:25:36,180 --> 00:25:38,440
You really have to understand these systems.

267
00:25:38,440 --> 00:25:43,880
And again, it all comes down to what is your need to know, which is where I think we ought to begin this discussion.

268
00:25:43,960 --> 00:25:48,200
What is your need to know from manufacturers about vulnerabilities?

269
00:25:49,480 --> 00:25:52,040
So if you want to come up, I'll bring a mic down.

270
00:25:53,620 --> 00:25:58,420
And I think we ought to start off, what do you all think about the gun lock issue?

271
00:25:58,420 --> 00:26:01,080
And should we have disclosed it?

272
00:26:01,960 --> 00:26:04,640
I thought that's almost unanimous.

273
00:26:04,640 --> 00:26:07,540
Anyone for a free copy of LSS Plus?

274
00:26:08,280 --> 00:26:09,520
Come on up!

275
00:26:10,680 --> 00:26:11,960
I'm about to ask you a question.

276
00:26:11,960 --> 00:26:16,980
Actually , Matt, maybe they ought to come up afterwards, because otherwise it's going to take time into the presentation.

277
00:26:18,620 --> 00:26:21,240
Maybe they ought to come up to get CDs afterwards.

278
00:26:21,240 --> 00:26:22,100
Yeah, we'll do CDs afterwards.

279
00:26:22,100 --> 00:26:25,760
Why don't we do this at 10 to 11 so that we don't take time into this?

280
00:26:26,200 --> 00:26:30,240
Can you comment on electronic access control systems at all?

281
00:26:31,120 --> 00:26:31,920
Vulnerabilities?

282
00:26:32,220 --> 00:26:36,660
Can you comment on the vulnerabilities of electronic access control systems?

283
00:26:36,660 --> 00:26:45,820
Actually, I just did a survey study of all of the access control technologies for one of the government agencies.

284
00:26:46,260 --> 00:26:47,900
Some of them are secure.

285
00:26:47,900 --> 00:26:50,660
Some of them are marginally secure.

286
00:26:50,660 --> 00:26:54,020
There's been a lot in the media about how things can be compromised.

287
00:26:56,060 --> 00:27:05,900
Yeah, the real question is, if there's a security vulnerability on the electronic side, should it be published?

288
00:27:06,460 --> 00:27:07,920
What's your attitude?

289
00:27:10,540 --> 00:27:12,880
Okay, so should it be published?

290
00:27:17,250 --> 00:27:18,870
That's exactly correct.

291
00:27:18,870 --> 00:27:21,070
But the question is, should it be published?

292
00:27:23,370 --> 00:27:25,950
Yeah, you didn't have to use the microphone.

293
00:27:25,950 --> 00:27:31,710
I believe it should be, but manufacturers should be given some disclosure period so that they can react to it.

294
00:27:31,710 --> 00:27:36,950
Yeah, that is the responsible way to do it, unless national security is involved.

295
00:27:37,190 --> 00:27:44,830
Yeah, I mean, most manufacturers, us included, are working on preventing these things from coming out with new technologies.

296
00:27:44,870 --> 00:27:48,890
And it would be unfair for it to be disclosed before we had a solution to the problem.

297
00:27:48,890 --> 00:27:49,930
No , no, I agree with that.

298
00:27:50,030 --> 00:27:51,430
Okay, next question.

299
00:27:54,130 --> 00:27:57,570
Hello, my concern is...

300
00:27:57,570 --> 00:27:58,710
You have to speak up.

301
00:27:58,890 --> 00:28:08,350
My concern is with the HID card systems that I installed, just about every server room I had a chance to work in.

302
00:28:08,570 --> 00:28:15,010
And to date, I have not seen any published reports, any vulnerabilities on the system.

303
00:28:15,010 --> 00:28:20,890
I'm sure they exist, but what I'm basically concerned about is electronic systems.

304
00:28:20,890 --> 00:28:25,870
Well, obviously, Matt, maybe you should address that, but the old systems obviously were compromised.

305
00:28:25,870 --> 00:28:28,210
The newer ones are a little bit more difficult.

306
00:28:28,850 --> 00:28:29,630
Matt?

307
00:28:29,630 --> 00:28:35,910
So HID has their traditional proximity-based cards have been compromised.

308
00:28:35,910 --> 00:28:39,230
There is public information out there to duplicate a card.

309
00:28:39,550 --> 00:28:45,350
The new HID I-class cards defeat that capability.

310
00:28:45,350 --> 00:28:49,490
But there is publicly available information on the HID cards.

311
00:28:50,350 --> 00:28:51,230
Next.

312
00:28:53,130 --> 00:28:59,430
What do you think about a peer-review system like they do in scientific journals for lock security?

313
00:28:59,430 --> 00:29:00,090
Say that again?

314
00:29:00,090 --> 00:29:06,250
So in scientific journals, what they do is they sort of publish them and let everyone verify before it's considered good.

315
00:29:06,250 --> 00:29:08,310
Do you think that might apply well to lock?

316
00:29:08,310 --> 00:29:11,090
I think that happens on the internet about locks.

317
00:29:11,090 --> 00:29:16,510
It's just that it can really cause a manufacturer problem if you publish that there's a vulnerability.

318
00:29:16,510 --> 00:29:22,430
Well, I mean, do you think we could sort of engineer a place where you could publish a possible vulnerability and people wouldn't lose their head?

319
00:29:22,430 --> 00:29:25,370
I don't think... see, I think that would be all right.

320
00:29:25,670 --> 00:29:32,570
My theory and Matt's theory in all this is the more people that are looking at locks, the better.

321
00:29:32,570 --> 00:29:36,130
Because all it can do is improve the end product.

322
00:29:36,270 --> 00:29:39,370
There's a lot of sports lock-picking clubs in Europe.

323
00:29:39,530 --> 00:29:44,570
I go to some of them and routinely visit with them, speak and learn.

324
00:29:44,570 --> 00:29:48,290
They're just starting in America, and Matt can address that more.

325
00:29:48,390 --> 00:29:55,490
But I think it's a good thing because there are engineers, lawyers, doctors, teachers, kids, housewives.

326
00:29:55,730 --> 00:29:58,510
To pick a lock is an intellectual challenge.

327
00:29:58,510 --> 00:30:00,050
It's not just mechanical.

328
00:30:00,130 --> 00:30:01,750
To me, it's much better than chess.

329
00:30:01,750 --> 00:30:03,650
I've been doing it since I was 15.

330
00:30:03,770 --> 00:30:05,190
And it's intriguing.

331
00:30:05,190 --> 00:30:07,510
In fact, I'm doing a new book on the subject.

332
00:30:07,590 --> 00:30:10,770
And it is really intriguing.

333
00:30:10,770 --> 00:30:18,190
And so the more people that are looking at locks and finding potential exploits, in my view, the better.

334
00:30:18,190 --> 00:30:20,970
And the responsible manufacturers will agree with me.

335
00:30:20,970 --> 00:30:26,770
They want the input because at the end of the day, they want to make the best locks possible.

336
00:30:26,770 --> 00:30:28,130
End of story.

337
00:30:28,490 --> 00:30:29,270
Next.

338
00:30:30,050 --> 00:30:36,690
Briefly, lockpicking101.com is the definitive source for information.

339
00:30:36,690 --> 00:30:41,570
They've started some lock sports organizations.

340
00:30:41,630 --> 00:30:46,330
There's one in Europe that very well runs its tool, tool.nl.

341
00:30:46,330 --> 00:30:48,730
I think the URL was in the presentation.

342
00:30:49,410 --> 00:30:51,910
But lock sports are picking up.

343
00:30:51,910 --> 00:30:54,350
Clearly, we have the lockpicking competition here.

344
00:30:54,770 --> 00:30:55,930
It's a blast.

345
00:30:55,930 --> 00:30:57,010
It's a lot of fun.

346
00:30:57,990 --> 00:31:03,070
So I'm curious to get the thoughts on going back to the tubular gun lock issue.

347
00:31:03,070 --> 00:31:11,810
If you remove as far layers as you want to go, that also includes, say, store locks to gun stores.

348
00:31:13,210 --> 00:31:23,090
Given the number of lawsuits that have come against gun manufacturers for what has happened, do you believe there will be a change before there's a lot of lawsuits against gun lock manufacturers for the same thing?

349
00:31:23,090 --> 00:31:23,850
No.

350
00:31:23,850 --> 00:31:26,890
You know, it depends if they're negligent.

351
00:31:26,890 --> 00:31:30,350
If it was purely a negligent design, yes.

352
00:31:30,350 --> 00:31:40,990
The real problem in lockpicking and decoding and impressioning is one of expertise and skill level and time and tools required.

353
00:31:41,150 --> 00:31:59,830
If a 10-year-old kid can open a gun lock by wrapping it on the floor or sticking an ice pick into it, which is what I demonstrated, and pop it off the weapon in two seconds, I think they're going to get sued if somebody gets hurt or killed.

354
00:32:00,930 --> 00:32:05,070
It's a defective manufacturer and they all copied each other's defects.

355
00:32:05,250 --> 00:32:08,530
If it's more esoteric than that, no.

356
00:32:09,090 --> 00:32:16,670
Well , the reason why I mention that is a lot of the lawsuits that have been against manufacturers of guns have just been because of guns.

357
00:32:16,670 --> 00:32:17,750
Yeah, that's right.

358
00:32:17,770 --> 00:32:35,790
And so, going along those lines, if we do end up with something like a mandatory gun lock law, which could happen, given the fact that the locks actually work and you're still able to use a weapon, do you see that going down the bad path?

359
00:32:35,790 --> 00:32:48,930
Yeah, I mean, if the gun locks work, and I'm dealing with some manufacturers in Europe on this issue, if they work and then there's a defect and you're able to fire the weapon, it puts them a lot closer to liability.

360
00:32:49,930 --> 00:32:54,250
I'm not sure I... gun locks are a really complicated problem.

361
00:32:54,990 --> 00:32:55,990
Next.

362
00:32:57,610 --> 00:33:04,750
In the American patent system, we're dealing with software now, and it's stifling innovation left and right.

363
00:33:04,750 --> 00:33:14,570
I was wondering about your opinion on whether or not the American patent system is stifling or helping innovation in the creation of locks, and better locks.

364
00:33:15,010 --> 00:33:16,190
Yeah, I think it's helping.

365
00:33:16,190 --> 00:33:24,990
I mean, look, if you're inventive and create something that is unique and provides security, and some of them do, some of them don't, the patent doesn't guarantee security.

366
00:33:25,150 --> 00:33:31,970
I think our system rewards you for that, but it gives you a monopoly on that product for 20 years.

367
00:33:33,310 --> 00:33:37,710
Every major design defect in locks is described as patentless improvement.

368
00:33:38,130 --> 00:33:40,950
And so I've done a lot of research in the U.S.

369
00:33:40,950 --> 00:33:46,250
and in the patent offices to find out vulnerabilities from when I write books.

370
00:33:46,410 --> 00:33:49,450
And so, you know, it's a positive thing.

371
00:33:49,450 --> 00:33:53,990
So harder designs actually do make it into multiple vendors of locks.

372
00:33:54,170 --> 00:33:54,670
Yeah.

373
00:33:54,750 --> 00:33:56,030
Oh, sure.

374
00:33:56,270 --> 00:33:58,590
Yeah, look, there's nothing new in locks.

375
00:33:58,590 --> 00:34:02,530
Everybody copies everything and modifies it for patents.

376
00:34:02,550 --> 00:34:03,310
Yes, sir.

377
00:34:03,310 --> 00:34:12,230
Hi, you mentioned the full disclosure of 7 cases of national security.

378
00:34:12,290 --> 00:34:17,750
If you found out that some government organization was using a certain brand of lock, do you know about the users?

379
00:34:17,750 --> 00:34:20,330
You know, this audio system is not really good.

380
00:34:21,010 --> 00:34:40,290
If you found out that some government organization, you know, like some base was using a certain brand of lock and you knew there was a streaming vulnerability and you brought it to, you know, either the attention of security forces or someone in charge of security on the base or organization,

381
00:34:40,290 --> 00:34:44,790
and they didn't do anything about it, I mean, how do you normally handle that?

382
00:34:46,150 --> 00:34:49,110
Well, that's a real judgment call.

383
00:34:49,150 --> 00:34:55,390
I've brought vulnerabilities to GSA's attention and did not publish them upon their request.

384
00:34:55,510 --> 00:35:00,510
Even though their first comment was, if it's not covert, we don't care.

385
00:35:00,510 --> 00:35:03,490
If you have to drill a hole in the lock, we don't care.

386
00:35:03,490 --> 00:35:04,830
I said, okay, we're going to publish it.

387
00:35:04,830 --> 00:35:05,950
No, you're not.

388
00:35:06,350 --> 00:35:07,270
Why not?

389
00:35:07,270 --> 00:35:09,810
Well, because it's a security problem.

390
00:35:09,810 --> 00:35:16,050
Well, but these locks are used in the banking industry and everybody ought to know about it.

391
00:35:16,050 --> 00:35:20,090
No, they really shouldn't know about it, and if you publish it, we'll classify it.

392
00:35:20,270 --> 00:35:22,390
Now, that was the government's response.

393
00:35:22,390 --> 00:35:34,370
I wasn't afraid of their response because I don't think they could sustain that, but I didn't publish it because it was a responsible thing to do about five years ago.

394
00:35:37,030 --> 00:35:49,210
Regarding the situation where you disclosed to the manufacturer first, before the public giving them a chance to do like what Kryptonite did, what kind of turnaround time is reasonable for a manufacturer to be able to...

395
00:35:49,210 --> 00:35:51,130
Oh, I think Kryptonite was pretty reasonable.

396
00:35:51,130 --> 00:35:53,790
They did it in, like, two months.

397
00:35:53,850 --> 00:35:54,330
Really?

398
00:35:54,330 --> 00:35:55,090
Yeah.

399
00:35:55,090 --> 00:36:01,910
They had a huge problem, and they acknowledged it, and they fixed it.

400
00:36:01,910 --> 00:36:05,390
I mean, they did what they were supposed to do, and it cost them $10 million to do it.

401
00:36:05,430 --> 00:36:08,690
And with no questions asked, you know, they didn't depreciate the...

402
00:36:08,690 --> 00:36:12,650
If you had had that lock for 10 years, they still gave you a new one.

403
00:36:12,670 --> 00:36:25,850
They didn't depreciate the value like your insurance company would do on your homeowners and say, well, that lock's only... you know, you paid $100 for it, but it's only worth $25, so now we're going to give you a coupon for $25 to go buy a new one, which would have been a marketing bonanza for them.

404
00:36:25,850 --> 00:36:26,810
They didn't do that.

405
00:36:26,810 --> 00:36:27,670
They just replaced it.

406
00:36:27,670 --> 00:36:31,350
They said, hey, you know, send us your lock or send us proof, we'll send you more.

407
00:36:34,150 --> 00:36:39,630
I don't know if they... I don't know if they probably not.

408
00:36:39,630 --> 00:36:40,710
I don't know.

409
00:36:40,710 --> 00:36:43,030
But they do have a better lock now.

410
00:36:43,730 --> 00:36:45,130
It's a tough lock.

411
00:36:46,230 --> 00:37:01,270
I understand your argument about defective, you know, being something that maybe a 10-year-old could open versus a skilled person, but, you know, I don't have any 10-year-olds running around my corporation, and if I go to buy a lock to lock the data center door,

412
00:37:01,270 --> 00:37:03,230
you know, I want to be...

413
00:37:03,230 --> 00:37:16,870
I think as a consumer, I'm surprised that the Consumer Product Safety Commission or somebody else wouldn't go after manufacturers because, you know, we've had Firestone for the Ford tires on the SUVs.

414
00:37:16,870 --> 00:37:20,290
People got killed.

415
00:37:20,290 --> 00:37:27,310
You know, I mean, if I lock my house and a skilled burglar comes in and murders me, you know, I'm killed.

416
00:37:27,650 --> 00:37:36,430
Vioxx, the anti-arthritis drug, it was, you know, clearly uncovered that they knew there was a problem and swept it under the rug, and they're being punished for that fact.

417
00:37:36,950 --> 00:37:38,730
Will this happen in the lock industry?

418
00:37:38,730 --> 00:37:40,050
I don't think so.

419
00:37:40,050 --> 00:37:41,850
It's a different set of problems.

420
00:37:41,850 --> 00:37:48,610
And frankly, the problem is, in all those cases you've named, you're not dealing with criminal actions.

421
00:37:48,610 --> 00:37:56,930
Here you're dealing with somebody that's violating the law, and you really can't control that other than criminal statutes.

422
00:37:56,930 --> 00:37:58,270
That's the sanction.

423
00:37:58,390 --> 00:38:10,090
And so the real question, again, that nobody's really addressed yet is, what's your... how much information do you think you ought to be entitled to from the lock manufacturer, and who ought to be entitled to it?

424
00:38:10,090 --> 00:38:14,930
But isn't the lock's sole purpose to prevent criminal action in some ways?

425
00:38:14,930 --> 00:38:22,790
Yeah, that's true, but... yeah, I agree, but it's a little more complicated.

426
00:38:26,410 --> 00:38:27,430
That's right.

427
00:38:28,030 --> 00:38:30,330
Now, they're trying to sue the gun manufacturer.

428
00:38:32,610 --> 00:38:33,270
Right.

429
00:38:33,510 --> 00:38:36,590
Well, yeah, okay, but that's not going to go anywhere.

430
00:38:36,990 --> 00:38:38,990
Next question, because we're running out of time.

431
00:38:40,470 --> 00:38:56,270
Instead of waiting for a lock manufacturer to invest marketing dollars and then pissing them off by releasing a security breach, do you think the manufacturers would consider almost like a hardware open-source review of their design before going to market?

432
00:38:56,450 --> 00:38:58,990
Why not?

433
00:38:58,990 --> 00:38:59,470
No.

434
00:38:59,470 --> 00:39:00,910
But isn't it better than...

435
00:39:00,910 --> 00:39:04,550
Well , first of all, until they receive a patent, they're not going to publish anything.

436
00:39:04,970 --> 00:39:07,270
That's the way things work.

437
00:39:07,270 --> 00:39:12,890
And, I mean, part of the security of locks is you not knowing how they work.

438
00:39:12,970 --> 00:39:15,910
But didn't you just prove security by obscurity doesn't work?

439
00:39:15,910 --> 00:39:19,210
Yeah, well, actually, I prefer to call it security by ignorance.

440
00:39:19,750 --> 00:39:31,110
And that's really what it is, because, look, if you're a security manager, IT professional, you're charged with a physical security responsibility as well as logical security.

441
00:39:31,110 --> 00:39:41,450
You can't make the risk assessment in your organization unless you know what the bypass techniques are and are shown what those are.

442
00:39:41,550 --> 00:39:44,470
If they'll tell you that, I don't have a problem with their policy.

443
00:39:44,470 --> 00:39:47,970
I don't think we ought to be telling criminals how to bypass locks.

444
00:39:47,970 --> 00:39:55,590
If you have a need to know because you have a protection responsibility, I think you have a right to know everything about that lock.

445
00:39:55,590 --> 00:40:06,390
Now, unlike software and Bill Gates and everybody who doesn't give you the code, if you're smart, you can take a lock and it'll tell you everything about itself.

446
00:40:06,470 --> 00:40:10,070
So if you're smart enough to figure it out, the information is there anyway.

447
00:40:10,110 --> 00:40:13,430
But I think you have a right to know that information.

448
00:40:13,850 --> 00:40:17,950
How can you differentiate between a consumer and a possible criminal?

449
00:40:17,950 --> 00:40:27,310
Well, that's a real good question because if the consumer relies on his locksmith or their locksmith as their security professional, then no problem.

450
00:40:27,310 --> 00:40:30,310
Let the security professional say, look, yeah, there's a vulnerability.

451
00:40:30,310 --> 00:40:31,990
You don't need to know what it is.

452
00:40:31,990 --> 00:40:34,950
I mean, my mother, she puts new locks on their house.

453
00:40:34,950 --> 00:40:37,130
She doesn't need to know how to pick them or open them.

454
00:40:37,130 --> 00:40:42,870
She just needs to know, is it secure and how long would it take a competent burglar to open it?

455
00:40:42,870 --> 00:40:45,610
Well, first of all, burglars don't open locks by picking them.

456
00:40:45,610 --> 00:40:47,890
They use a crowbar or a brick.

457
00:40:47,970 --> 00:40:50,590
Ninety-nine percent of the burglaries are done that way.

458
00:40:50,590 --> 00:40:57,450
We're talking about more sophisticated burglaries and information theft and compromise of data and that type of thing.

459
00:40:57,770 --> 00:41:05,190
Just a quick question about, you were saying that 50 years they knew how to circumvent the tumbler lock.

460
00:41:05,190 --> 00:41:12,990
And I'm wondering if the information space in lock picking is a lot tighter than information security because 50 years the public hasn't heard about this.

461
00:41:12,990 --> 00:41:15,330
Honestly, they really haven't.

462
00:41:15,330 --> 00:41:16,710
It's really quite amazing.

463
00:41:16,710 --> 00:41:22,290
This has been around for a long, long time, especially on plum keying and on master keying.

464
00:41:23,150 --> 00:41:24,770
A lot of folks know about it.

465
00:41:24,770 --> 00:41:26,870
The locksmithing community was aware of it.

466
00:41:26,870 --> 00:41:30,830
The problem was they weren't telling their end-user customers.

467
00:41:30,830 --> 00:41:32,570
A lot of them didn't understand it.

468
00:41:32,570 --> 00:41:35,970
So the end-user customer had no way to assess their risk.

469
00:41:35,970 --> 00:41:41,250
So the second part of the question I had is, for the kryptonite locks, I don't know a lot about locks, but I know about bytes.

470
00:41:41,250 --> 00:41:47,890
And I haven't seen, before this vulnerability was published, anyone whose kryptonite lock ever was really knocked open.

471
00:41:49,410 --> 00:41:52,250
I'm sure there are, but I'm wondering if you have any statistics.

472
00:41:52,410 --> 00:41:58,110
Actually, what we published, a variance of that was published about 10 years before in the UK.

473
00:41:58,110 --> 00:41:59,690
Nobody paid any attention to it.

474
00:42:00,550 --> 00:42:06,310
If you understand lock-picking theory and impressioning theory, then it's a real simple deal.

475
00:42:10,710 --> 00:42:13,830
Going to travel locks for a second.

476
00:42:13,830 --> 00:42:24,910
About 10 years ago, actually maybe 12 or 13, we had an attempt by the government to put something into place called Keyestro in cryptography.

477
00:42:25,970 --> 00:42:32,650
Would you consider the quote-unquote TSA safe locks to be a form of physical Keyestro?

478
00:42:33,730 --> 00:42:34,550
No.

479
00:42:34,550 --> 00:42:37,330
First of all, they're $10 cheap locks.

480
00:42:37,330 --> 00:42:39,990
And the problem is the public doesn't understand that.

481
00:42:39,990 --> 00:42:41,890
They think they're buying security.

482
00:42:41,890 --> 00:42:43,790
And it's a matter of convenience.

483
00:42:43,790 --> 00:42:45,130
Look, you have two choices.

484
00:42:45,130 --> 00:42:56,710
If you want to lock your luggage to prevent pilfering, allegedly, then you put a lock that TSA can get into, because otherwise they're going to cut the lock, because they have a legitimate interest in seeing what's in your luggage.

485
00:42:56,710 --> 00:42:57,230
End of story.

486
00:42:57,230 --> 00:42:59,310
I mean, that's why TSA locks were developed.

487
00:42:59,510 --> 00:43:11,990
A trade organization got all the lock manufacturers together, established criteria for five different kinds of locks that all have master keys or a bypass key that TSA can get into.

488
00:43:12,050 --> 00:43:13,370
And that's their sole purpose.

489
00:43:13,370 --> 00:43:17,150
But isn't that a... that's not a form of Keyestro?

490
00:43:17,150 --> 00:43:21,290
It's not a form of giving them, here's the pattern for the key to get into the lock?

491
00:43:21,290 --> 00:43:22,950
In that regard, yeah.

492
00:43:22,950 --> 00:43:27,290
But I don't think anybody's going to disagree that TSA doesn't have the right to check your luggage.

493
00:43:27,290 --> 00:43:28,430
No, I'm not disagreeing with that.

494
00:43:28,430 --> 00:43:29,310
I'm just saying that this is...

495
00:43:29,970 --> 00:43:30,310
Yeah , maybe.

496
00:43:30,310 --> 00:43:32,330
I mean, it's a loose parallel.

497
00:43:33,110 --> 00:43:34,790
I don't think it's exact.

498
00:43:35,370 --> 00:43:36,090
Okay.

499
00:43:36,090 --> 00:43:36,430
Yeah.

500
00:43:36,430 --> 00:43:37,190
All right.

501
00:43:39,070 --> 00:43:40,230
Yeah, actually, I would just...

502
00:43:41,250 --> 00:43:45,290
I travel a lot, and I would recommend, instead of using a lock, use a penetration tag.

503
00:43:45,290 --> 00:43:47,350
Use, like, the little wire tags or something like that.

504
00:43:47,350 --> 00:43:49,530
Because at least that way you know if somebody broke into the bag.

505
00:43:49,810 --> 00:43:51,110
You tagged it.

506
00:43:51,110 --> 00:43:53,210
You know when you pull it...

507
00:44:01,510 --> 00:44:05,030
Well, it's not TSA that I'm worried about sticking something back in there.

508
00:44:05,030 --> 00:44:05,690
They'll steal it.

509
00:44:05,690 --> 00:44:06,950
They won't put it back in.

510
00:44:08,450 --> 00:44:10,350
Well, that's been documented.

511
00:44:10,350 --> 00:44:11,490
There's been lots of arrests.

512
00:44:11,490 --> 00:44:22,330
The problem is your hotel porter in London putting something into your locked luggage that you don't know is there, either narcotics or explosives or whatever, and you think you're okay because it was locked.

513
00:44:22,330 --> 00:44:24,050
That's where I think the problem is.

514
00:44:24,290 --> 00:44:26,130
We've got time for one more quick question.

515
00:44:26,130 --> 00:44:26,570
Yeah .

516
00:44:32,250 --> 00:44:36,750
I'd love to do something with it.

517
00:44:36,750 --> 00:44:38,650
I had some media interest, but nobody...

518
00:44:38,650 --> 00:44:39,470
It's America.

519
00:44:39,470 --> 00:44:40,590
Nobody does anything.

520
00:44:40,590 --> 00:44:42,570
I think it's a great idea, though.

521
00:44:43,370 --> 00:44:44,630
Are we out of time, Matt?

522
00:44:44,630 --> 00:44:45,590
Yeah, we're out of time.

523
00:44:45,870 --> 00:44:47,190
Thank you very much.

524
00:44:49,970 --> 00:44:50,650
Pleasure.