I'm an investigative attorney, and I do a lot of security work around the world.
My associate this morning is Matt Fidler, who is a security consultant and former military intelligence,
and does a lot of security work, both hardware and software.
The impetus for this discussion this morning grew out of last year, the conference in New York.
I was part of a panel involving vulnerability of locks issues, which is what I mainly deal with.
And as a result of that, there was a sense of security community with regard to the ethics of disclosure
of vulnerabilities of locking systems.
And so we decided that we'd put together a presentation and really would like,
at the conclusion of our PowerPoint, to solicit comments from you folks as to what your thoughts are
so these can be taken back to the hardware security community.
Essentially, the locksmiths and their organization have determined that there should not be any disclosure
of defects or vulnerabilities other than the security professionals and security management
and other locksmiths. I don't particularly subscribe to that theory, nor does Matt.
We want to go through why we do not.
It's obviously been dealt with in the logical security community a long time ago,
but not really in the hardware community.
And so we'll present a PowerPoint first. Matt will do that.
And then we want to solicit your comments and input.
Good morning, everybody. So as Mark said, we're going to run through this pretty quick.
Then we can hop down. We've got some swag to throw out.
So this quote goes back over 150 years.
A.C. Cox wrote the book Locks and Safes.
And you can read it, but it details that the unscrupulous individuals already have this bit of information.
They already know about the defects. They're already exploiting them.
And it's better to provide this information to the public and make it available.
This was a Usenet post in June 2nd of this year from a locksmith.
And again, you can read it, but basically they're indicating that providing this type of information,
and I think this was in response to top-level master key or Eric Michaud's multi-lock attack on a plate,
and just indicating that this is all secret information. It should not be published.
So clearly, there are no secrets.
We're going to talk about the importance of full disclosure.
We'll identify from a physical security perspective what defects are.
Mark will go into some of the legal issues of them.
And then we'll go into some case examples of the last year.
So again, locksmiths are the first line in most cases.
They have publicly come out and said that, like you said...
That would be all of you.
So defects, what are defects?
They're simple bypasses, really simple tools.
We're talking seconds of bypass.
We're talking about the type of bypass that does not require sophisticated tools, expertise, and time.
The type of tools that I routinely deal with.
Versus the ballpoint pen opening the tubular lock trick.
That's the type of bypass that we're really talking about.
The simple, really, defects or problems that lead to the ability to circumvent a locking system.
Okay, well, the legal issues are real simple.
The real question is...
What does the end user have a right to know about the security products that they're buying and using?
And what's the liability for the locksmith or architect or hardware vendor if they don't tell you about a vulnerability?
And you put in that system and then you suffer a loss.
Somebody gets injured.
Somebody gets killed.
There's a major theft.
There's a compromise of information.
Who's got the liability or is there any liability?
And especially involving federal and state statutes regarding the disclosure of protection of medical information, financial information.
These are serious legal issues.
The locksmiths really haven't come to grips with them and frankly don't understand a lot of the problems that can face them.
And as an end user security administrator or person responsible for physical security, the real question is...
How much information do you have a right to know in order to make the security assessment?
If you rely on a security consultant to make that assessment for you, that's fine.
But if you're charged with the responsibility and fail to have all the needed information, then you really can't make that assessment.
And then who is liable?
Those are really the critical issues.
So as far as statutory liability, I'm sure most of you out there in the IT world are familiar with HIPAA, SOX, GLBA, all the regulatory compliance issues.
HIPAA, over one quarter or almost one quarter of HIPAA statutes govern physical access control, access to facilities, file lockers, etc.
containing protected health information.
So clearly we're all in bed with these regulatory issues.
SB 1386, the loss of information, defamation assets.
It's incumbent on us to understand the physical hardware that protects these assets.
So we'll get into the ethical debate.
Again, the question we want to throw out there, we'd like to get your feedback.
Come on up, ask questions.
But again, if the manufacturer is notified, what should they do?
Should they admit it?
Should it be publicized?
We'll talk about some case examples.
We recognize some other vendors and how they use it.
Full disclosure.
And ultimately, what is the vendor's level of negligence?
And one other comment.
If you find a security defect or a vulnerability that allows a lock or system to be bypassed, do you take it to the manufacturer without making it public?
Or do you make it public?
And that's really an interesting question because if you take it to the manufacturer and they have a large embedded base of security products, do they make it public?
The responsible manufacturers will.
A lot of them will not.
So where does that leave the end user?
Anywhere.
In a closed group.
In a closed group, yeah.
So the second point, the reality is you disclose a defect but there isn't one really there.
Someone else may or may not find it.
So, again, we want to pose this question.
There's been a lot of public disclosures on non-physical vulnerabilities that haven't come to fruition.
They were one-time bypasses that someone was able to do in a controlled environment.
Well, the other issue is, and a lot of the locksmiths have propounded, okay, if there's a known vulnerability in a lock or a piece of hardware, okay, you can tell the public, yes, there's a vulnerability, but you can't tell them what it is.
What does that do for you?
In our view, nothing.
Because the minute you disclose there's a hardware defect, somebody's going to find it.
And if they find it, they're going to publish it.
A lot of locksmiths haven't heard of the Internet yet.
And so they still believe that there are secrets out there.
And as we keep trying to tell them, there are no secrets anymore.
So some considerations for thought, again, between the questions and the evidence here.
Need to know at full disclosure.
The level of expertise that we spoke about, you know, some in seconds, but little or no training.
So as far as UL ratings and other industry standard hardware ratings, point of danger feedback should be everywhere.
And what is enough to be secured?
What's too much or too little?
And what's a security defect?
A manufacturing defect versus an exposed vulnerability.
Because there's a continuum of vulnerability versus a real significant design defect.
Let me even take it farther.
The real question is, who has a need to know?
And let's talk about one of the security releases we did last year.
I found a vulnerability in gun lock, gun trigger locks.
A really serious vulnerability to the point that literally I shot a video in Toronto with an 11-year-old kid
removing three of the most popular gun locks off a rifle in seconds.
Should that vulnerability be disclosed to the public?
Or how should they be warned?
Because at some point, some kid's going to get hurt or killed by removing one of these gun locks
that their parents mistakenly believe provides security on that weapon.
It's a perfect example where there can be tragic results.
Do you disclose it? Do you not disclose it?
When I talked to one of the leading manufacturers in the industry,
who I did some work for a long time ago, they didn't want to disclose.
They didn't think it was a big problem, and they weren't talking about it.
And they haven't to this day, and they continue to manufacture the locks.
And these are major manufacturers that are putting this material out there.
Every hardware store and sporting goods store in the country sells them.
Should that be exposed in the national media?
Okay, and we'll talk about that in a minute.
Because, well, you say yes until you're the parent of a kid that reads a report on the Internet
and then goes and pulls a gun lock off a weapon and shoots one of his classmates,
and then you're going to be coming to me saying, what the hell did you publish it for?
Because my kid wouldn't have known about it if you didn't publish it.
That's the problem.
I agree. We'll talk about it in just a minute.
Right, well, that's the attitude.
Actually, we took the attitude that we didn't publish it directly.
We charged a $3 fee for the report so that you'd have to have a credit card to buy it,
which would eliminate virtually every kid from buying the report.
And that's how we control distribution.
All right, we're going to get some swag out.
Oh, yeah, that's important.
Let's, uh, and R.C. and, uh, ask Bob.
Yeah, that's it.
All right, R.C., now you can answer.
In the hardware, locked and hardware environment.
Okay, there you go.
Here's a copy of Make Magazine for you.
So you're all familiar with the controversy.
When we were in the New York Times two years ago on top-level master key,
as I've referred to it in my disk set, in my book,
extrapolation of the top-level master key.
Very, very serious security vulnerability.
Basically, anybody in an organization that has access to one key to one door
that is on the top-level master key system can compromise that system
unless they have the proper locks installed, they've been coded properly,
and they have the proper restricted type of blank with sidebar coding.
It's a serious, serious problem.
Yeah, so the, uh, the second quote I got from Bob,
about locksmiths being huge up in Arkansas,
and that we compromise national security.
Now, then, of course, they turned around and said,
yes, but every locksmith has known about this for 50 years, so it's no secret.
So, of course, there would be a slight inconsistency in that position,
but it shouldn't have been disclosed notwithstanding everybody knew about it.
Everybody except the consumer.
So, the tubular lock bypass, and then shortly after Hope published information on Weinstadt News,
got some, a little bit of, you know, attention.
It wasn't until an individual took that bypass technique and applied it to a kryptonite lock,
that bike users are, you know, a little bit more crazy than motor users.
Right, well, I can tell you the first two days that we posted that on our website,
we had 100,000 hits.
And I had thousands of emails from security administrators from colleges, governments, hospitals, schools,
wanting to know what to do about their laptop locks,
which escalated into the bike lock issue and into gun locks that use tubular locks.
The problem isn't with the tubular lock.
The problem is with inexpensive tubular locks that aren't designed properly.
Now, as a result of that, and I can talk about kryptonite, they really did the right thing.
They woke up one morning to all the flood of media, and it was sort of, it was a big surprise for them.
And so, they spent a couple days looking at the issue, and then they finally made a corporate decision.
They were going to replace every lock, which I believe was the very responsible thing to do.
Frankly, there wasn't anything else they could do.
They, the management of kryptonite, which is a subcompany of Schlage Lock,
they made the decision to bite the bullet.
They admitted the problem, and they offered a free replacement no matter when you bought your lock.
They, to date, have replaced, to my understanding, about 350,000 of them,
at a cost of about $10 million or more to Schlage.
That is the responsible way to do it, and they've redesigned their lock,
and so now it is a very secure piece of hardware.
In fact, it has a security rating in Europe from the rating agency.
They're not going to be easily broken.
Now, that would never have occurred if, actually, we hadn't released our initial report,
and then one of the bikers picked up on it and described the vulnerability for kryptonite locks,
which have been and are the leader worldwide in the industry.
And so it's a prime example.
You know, the bottom line is don't kill the messenger for the message.
If you have a security defect or vulnerability in your hardware, fix it or don't sell it.
That's really the bottom line.
Now, obviously, a lot of lock manufacturers don't subscribe to that theory, but they should,
and the consumer really dictates that.
Right. So, again, kryptonite clearly did it right.
Other vendors, and we're not going to name names, but, again, engineers could not duplicate.
They couldn't take a big advantage.
For our people, we flexed Krypultra to bypass the lock.
It's amazing.
But I can also tell you that they are, because I'm in contact with a lot of them,
they are implementing design changes that frustrate the problem.
It's actually a very difficult problem to solve.
It's not quite so easy as everybody thinks.
But all of the vendors that I'm dealing with, they are taking a responsible approach now,
and they are solving the problem.
Okay, so bump keys or 999 keys.
This is where a key is cut to its highest position on all the fittings.
The inertia effect against all the pins.
The key is inserted blind, and turn the key and open it.
Yeah, actually, it's Mr. Newton from England, from 300 years ago,
that helped us out on that with his third law of motion.
He just didn't quite foresee it at that time, but that's exactly what it is.
For every action, there's an equal and opposite reaction.
And basically, when you wrap on the pins in a specific way, you create a few milliseconds of gap,
and you can open the lock.
I did some television interviews back at home demonstrating this,
because it is a very big security vulnerability.
Barry Wells has done a lot of work with it in Europe, and there's been a lot of publicity.
Not so much in America yet, but it is a problem.
It's a problem for every standard, conventional pin number lock.
Not for most of the high security locks.
But again, if the public doesn't know about it,
then literally somebody can walk up to your residence door, your business door,
and in two seconds open it with no damage and no real evidence of injury.
Yeah, let me just address that for two minutes.
About seven or eight years ago, I got a phone call from a locksmith in Hawaii.
L-Safe, which is the largest in-room safe manufacturer in the world,
they're owned by the Asa Abloy Group, has over a million safes in luxury hotel rooms,
and virtually all of them are insecure than they were at that time,
although they rated them as a high security safe.
I looked at it, documented the defect,
and frankly had a 16-year-old kid that was working for me in the office for the summer
open it with a screwdriver and a paper clip in about one minute.
And this was brought to the attention of L-Safe.
They really didn't fix it. They didn't acknowledge it.
They didn't acknowledge that I even existed
because of the massive lawsuits that would have flowed from it.
This is a perfect example. Hotel guests have no clue.
I've done a lot of work in the hotel liability area.
A lot of hotel locks are not secure. They should not be relied on.
And the hotels, they're concerned, but they're not concerned
because they have statutory exemption from liability and they have insurance.
And so it's a problem. And again, as a consumer, you ought to be aware of the problem.
So again, as Mark mentioned, we continue to do locks.
That extends across the whole host of applications.
Safes, Harley-Davidson brake locks, J.I.R. keys are compromised with that.
It's huge.
TSA luggage locks. Everybody's using them to lock their luggage when they fly.
They're very insecure.
We put out a security alert and demonstrated how you can take a piece of plastic from a credit card
and open the most popular ones just by sticking a little piece of square plastic in the keyway.
This is not security.
And the real problem in that area is not theft from your luggage because it's easy to rip open luggage.
The real issue, in my view, and I did a magazine article over in Europe on it,
is that contraband can be put into your luggage after you think it's locked.
And if it's not caught in security, then it can be a real serious problem.
And again, Mark, talk about the gun.
Well, multi-lock is a telescoping pin, very high security lock.
They're made in Israel.
I've been to their factory many times.
They're also part of the Assa Abloy group out of Finland.
Eric Michaud actually thought he came up with a compromise.
When you are talking about bypass of locks, especially high security,
one of the criteria is repeatability,
which I don't believe can be shown in this particular bypass.
Opening one lock doesn't mean anything.
Opening all of them or 99% of them reliably within a time frame means a lot.
That has not been demonstrated with multi-lock.
And frankly, I don't think it will.
I've done quite a bit of analysis on their locking system.
It's a very secure device.
But it was published.
And the flip side of this argument is,
it shouldn't have been published until it was truly documented.
Theoretical in the laboratory is one thing,
but you don't cause a manufacturer problem
or you don't cause the public a security concern unless you can document it.
And so that really is the flip side of this argument.
All right.
So, you know, we're really looking to empower you with your experience,
your vulnerability exposures, to go out there, to look at hardware,
and get all the information out there.
There's a lot of material on the net.
There's some on our website that's publicly available.
A lot of it's restricted.
But there's a lot of material out there.
You really have to understand these systems.
And again, it all comes down to what is your need to know,
which is where I think we ought to begin this discussion.
What is your need to know from manufacturers about vulnerabilities?
So if you want to come up, I'll bring a mic down.
And I think we ought to start off,
what do you all think about the gun lock issue?
And should we have disclosed it?
I thought that's almost unanimous.
Anyone for a free copy of LSS Plus?
Come on up!
I'm about to ask you a question.
Actually, Matt, maybe they ought to come up afterwards,
because otherwise it's going to take time into the presentation.
Maybe they ought to come up to get CDs afterwards.
Yeah, we'll do CDs afterwards.
Why don't we do this at 10 to 11 so that we don't take time into this?
Can you comment on electronic access control systems at all?
Vulnerabilities?
Can you comment on the vulnerabilities of electronic access control systems?
Actually, I just did a survey study of all of the access control technologies for one of the government agencies.
Some of them are secure. Some of them are marginally secure.
There's been a lot in the media about how things can be compromised.
Yeah, the real question is, if there's a security vulnerability on the electronic side, should it be published?
What's your attitude?
Okay, so should it be published?
That's exactly correct.
But the question is, should it be published?
Yeah, you didn't have to use the microphone.
I believe it should be, but manufacturers should be given some disclosure period so that they can react to it.
Yeah, that is the responsible way to do it, unless national security is involved.
Yeah, I mean, most manufacturers, us included, are working on preventing these things from coming out with new technologies.
And it would be unfair for it to be disclosed before we had a solution to the problem.
No, no, I agree with that. Okay, next question.
Hello, my concern is...
You have to speak up.
My concern is with the HID card systems that I installed, just about every server room I had a chance to work in.
And to date, I have not seen any published reports, any vulnerabilities on the system.
I'm sure they exist, but what I'm basically concerned about is electronic systems.
Well, obviously, Matt, maybe you should address that, but the old systems obviously were compromised.
The newer ones are a little bit more difficult. Matt?
So HID has their traditional proximity-based cards have been compromised.
There is public information out there to duplicate a card.
The new HID I-class cards defeat that capability.
But there is publicly available information on the HID cards.
Next.
What do you think about a peer-review system like they do in scientific journals for lock security?
Say that again?
So in scientific journals, what they do is they sort of publish them and let everyone verify before it's considered good.
Do you think that might apply well to lock?
I think that happens on the internet about locks.
It's just that it can really cause a manufacturer problem if you publish that there's a vulnerability.
Well, I mean, do you think we could sort of engineer a place where you could publish a possible vulnerability and people wouldn't lose their head?
I don't think... see, I think that would be all right.
My theory and Matt's theory in all this is the more people that are looking at locks, the better.
Because all it can do is improve the end product.
There's a lot of sports lock-picking clubs in Europe.
I go to some of them and routinely visit with them, speak and learn.
They're just starting in America, and Matt can address that more.
But I think it's a good thing because there are engineers, lawyers, doctors, teachers, kids, housewives.
To pick a lock is an intellectual challenge.
It's not just mechanical.
To me, it's much better than chess.
I've been doing it since I was 15.
And it's intriguing.
In fact, I'm doing a new book on the subject.
And it is really intriguing.
And so the more people that are looking at locks and finding potential exploits, in my view, the better.
And the responsible manufacturers will agree with me.
They want the input because at the end of the day, they want to make the best locks possible.
End of story.
Next.
Briefly, lockpicking101.com is the definitive source for information.
They've started some lock sports organizations.
There's one in Europe that very well runs its tool, tool.nl.
I think the URL was in the presentation.
But lock sports are picking up.
Clearly, we have the lockpicking competition here.
It's a blast.
It's a lot of fun.
So I'm curious to get the thoughts on going back to the tubular gun lock issue.
If you remove as far layers as you want to go, that also includes, say, store locks to gun stores.
Given the number of lawsuits that have come against gun manufacturers for what has happened,
do you believe there will be a change before there's a lot of lawsuits against gun lock manufacturers for the same thing?
No.
You know, it depends if they're negligent.
If it was purely a negligent design, yes.
The real problem in lockpicking and decoding and impressioning is one of expertise and skill level and time and tools required.
If a 10-year-old kid can open a gun lock by wrapping it on the floor or sticking an ice pick into it,
which is what I demonstrated, and pop it off the weapon in two seconds,
I think they're going to get sued if somebody gets hurt or killed.
It's a defective manufacturer and they all copied each other's defects.
If it's more esoteric than that, no.
Well, the reason why I mention that is a lot of the lawsuits that have been against manufacturers of guns have just been because of guns.
Yeah, that's right.
And so, going along those lines, if we do end up with something like a mandatory gun lock law, which could happen,
given the fact that the locks actually work and you're still able to use a weapon, do you see that going down the bad path?
Yeah, I mean, if the gun locks work, and I'm dealing with some manufacturers in Europe on this issue,
if they work and then there's a defect and you're able to fire the weapon, it puts them a lot closer to liability.
I'm not sure I... gun locks are a really complicated problem.
Next.
In the American patent system, we're dealing with software now, and it's stifling innovation left and right.
I was wondering about your opinion on whether or not the American patent system is stifling or helping innovation in the creation of locks, and better locks.
Yeah, I think it's helping. I mean, look, if you're inventive and create something that is unique and provides security,
and some of them do, some of them don't, the patent doesn't guarantee security.
I think our system rewards you for that, but it gives you a monopoly on that product for 20 years.
Every major design defect in locks is described as patentless improvement.
And so I've done a lot of research in the U.S. and in the patent offices to find out vulnerabilities from when I write books.
And so, you know, it's a positive thing.
So harder designs actually do make it into multiple vendors of locks.
Yeah. Oh, sure. Yeah, look, there's nothing new in locks. Everybody copies everything and modifies it for patents. Yes, sir.
Hi, you mentioned the full disclosure of 7 cases of national security.
If you found out that some government organization was using a certain brand of lock, do you know about the users?
You know, this audio system is not really good.
If you found out that some government organization, you know, like some base was using a certain brand of lock
and you knew there was a streaming vulnerability and you brought it to, you know,
either the attention of security forces or someone in charge of security on the base or organization,
and they didn't do anything about it, I mean, how do you normally handle that?
Well, that's a real judgment call. I've brought vulnerabilities to GSA's attention and did not publish them upon their request.
Even though their first comment was, if it's not covert, we don't care.
If you have to drill a hole in the lock, we don't care.
I said, okay, we're going to publish it. No, you're not. Why not?
Well, because it's a security problem.
Well, but these locks are used in the banking industry and everybody ought to know about it.
No, they really shouldn't know about it, and if you publish it, we'll classify it.
Now, that was the government's response.
I wasn't afraid of their response because I don't think they could sustain that,
but I didn't publish it because it was a responsible thing to do about five years ago.
Regarding the situation where you disclosed to the manufacturer first,
before the public giving them a chance to do like what Kryptonite did,
what kind of turnaround time is reasonable for a manufacturer to be able to...
Oh, I think Kryptonite was pretty reasonable. They did it in, like, two months.
Really?
Yeah. They had a huge problem, and they acknowledged it, and they fixed it.
I mean, they did what they were supposed to do, and it cost them $10 million to do it.
And with no questions asked, you know, they didn't depreciate the...
If you had had that lock for 10 years, they still gave you a new one.
They didn't depreciate the value like your insurance company would do on your homeowners
and say, well, that lock's only... you know, you paid $100 for it, but it's only worth $25,
so now we're going to give you a coupon for $25 to go buy a new one,
which would have been a marketing bonanza for them.
They didn't do that. They just replaced it.
They said, hey, you know, send us your lock or send us proof, we'll send you more.
I don't know if they... I don't know if they probably not. I don't know.
But they do have a better lock now. It's a tough lock.
I understand your argument about defective, you know, being something that maybe a 10-year-old could open
versus a skilled person, but, you know, I don't have any 10-year-olds running around my corporation,
and if I go to buy a lock to lock the data center door, you know, I want to be...
I think as a consumer, I'm surprised that the Consumer Product Safety Commission or somebody else
wouldn't go after manufacturers because, you know, we've had Firestone for the Ford tires on the SUVs.
People got killed.
You know, I mean, if I lock my house and a skilled burglar comes in and murders me, you know, I'm killed.
Vioxx, the anti-arthritis drug, it was, you know, clearly uncovered that they knew there was a problem
and swept it under the rug, and they're being punished for that fact.
Will this happen in the lock industry?
I don't think so. It's a different set of problems.
And frankly, the problem is, in all those cases you've named, you're not dealing with criminal actions.
Here you're dealing with somebody that's violating the law, and you really can't control that other than criminal statutes.
That's the sanction. And so the real question, again, that nobody's really addressed yet is,
what's your... how much information do you think you ought to be entitled to from the lock manufacturer,
and who ought to be entitled to it?
But isn't the lock's sole purpose to prevent criminal action in some ways?
Yeah, that's true, but... yeah, I agree, but it's a little more complicated.
That's right. Now, they're trying to sue the gun manufacturer.
Right. Well, yeah, okay, but that's not going to go anywhere.
Next question, because we're running out of time.
Instead of waiting for a lock manufacturer to invest marketing dollars and then pissing them off by releasing a security breach,
do you think the manufacturers would consider almost like a hardware open-source review of their design before going to market?
Why not? No.
But isn't it better than...
Well, first of all, until they receive a patent, they're not going to publish anything. That's the way things work.
And, I mean, part of the security of locks is you not knowing how they work.
But didn't you just prove security by obscurity doesn't work?
Yeah, well, actually, I prefer to call it security by ignorance.
And that's really what it is, because, look, if you're a security manager, IT professional,
you're charged with a physical security responsibility as well as logical security.
You can't make the risk assessment in your organization unless you know what the bypass techniques are and are shown what those are.
If they'll tell you that, I don't have a problem with their policy. I don't think we ought to be telling criminals how to bypass locks.
If you have a need to know because you have a protection responsibility, I think you have a right to know everything about that lock.
Now, unlike software and Bill Gates and everybody who doesn't give you the code, if you're smart, you can take a lock and it'll tell you everything about itself.
So if you're smart enough to figure it out, the information is there anyway.
But I think you have a right to know that information.
How can you differentiate between a consumer and a possible criminal?
Well, that's a real good question because if the consumer relies on his locksmith or their locksmith as their security professional,
then no problem. Let the security professional say, look, yeah, there's a vulnerability. You don't need to know what it is.
I mean, my mother, she puts new locks on their house. She doesn't need to know how to pick them or open them.
She just needs to know, is it secure and how long would it take a competent burglar to open it?
Well, first of all, burglars don't open locks by picking them. They use a crowbar or a brick.
Ninety-nine percent of the burglaries are done that way.
We're talking about more sophisticated burglaries and information theft and compromise of data and that type of thing.
Just a quick question about, you were saying that 50 years they knew how to circumvent the tumbler lock.
And I'm wondering if the information space in lock picking is a lot tighter than information security
because 50 years the public hasn't heard about this.
Honestly, they really haven't. It's really quite amazing.
This has been around for a long, long time, especially on plum keying and on master keying.
A lot of folks know about it. The locksmithing community was aware of it.
The problem was they weren't telling their end-user customers.
A lot of them didn't understand it. So the end-user customer had no way to assess their risk.
So the second part of the question I had is, for the kryptonite locks, I don't know a lot about locks, but I know about bytes.
And I haven't seen, before this vulnerability was published, anyone whose kryptonite lock ever was really knocked open.
I'm sure there are, but I'm wondering if you have any statistics.
Actually, what we published, a variance of that was published about 10 years before in the UK.
Nobody paid any attention to it.
If you understand lock-picking theory and impressioning theory, then it's a real simple deal.
Going to travel locks for a second.
About 10 years ago, actually maybe 12 or 13, we had an attempt by the government to put something into place called Keyestro in cryptography.
Would you consider the quote-unquote TSA safe locks to be a form of physical Keyestro?
No. First of all, they're $10 cheap locks.
And the problem is the public doesn't understand that.
They think they're buying security.
And it's a matter of convenience.
Look, you have two choices.
If you want to lock your luggage to prevent pilfering, allegedly,
then you put a lock that TSA can get into, because otherwise they're going to cut the lock,
because they have a legitimate interest in seeing what's in your luggage.
End of story.
I mean, that's why TSA locks were developed.
A trade organization got all the lock manufacturers together, established criteria for five different kinds of locks
that all have master keys or a bypass key that TSA can get into.
And that's their sole purpose.
But isn't that a... that's not a form of Keyestro?
It's not a form of giving them, here's the pattern for the key to get into the lock?
In that regard, yeah.
But I don't think anybody's going to disagree that TSA doesn't have the right to check your luggage.
No, I'm not disagreeing with that.
I'm just saying that this is...
Yeah, maybe.
I mean, it's a loose parallel.
I don't think it's exact.
Okay.
Yeah.
All right.
Yeah, actually, I would just...
I travel a lot, and I would recommend, instead of using a lock, use a penetration tag.
Use, like, the little wire tags or something like that.
Because at least that way you know if somebody broke into the bag.
You tagged it.
You know when you pull it...
Well, it's not TSA that I'm worried about sticking something back in there.
They'll steal it.
They won't put it back in.
Well, that's been documented.
There's been lots of arrests.
The problem is your hotel porter in London putting something into your locked luggage that you don't know is there,
either narcotics or explosives or whatever, and you think you're okay because it was locked.
That's where I think the problem is.
We've got time for one more quick question.
Yeah.
I'd love to do something with it.
I had some media interest, but nobody...
It's America.
Nobody does anything.
I think it's a great idea, though.
Are we out of time, Matt?
Yeah, we're out of time.
Thank you very much.
Pleasure.