start	end	text
31550	37190	I'm an investigative attorney, and I do a lot of security work around the world.
37350	44710	My associate this morning is Matt Fidler, who is a security consultant and former military intelligence,
44710	49790	and does a lot of security work, both hardware and software.
50390	57870	The impetus for this discussion this morning grew out of last year, the conference in New York.
57870	66810	I was part of a panel involving vulnerability of locks issues, which is what I mainly deal with.
66870	79600	And as a result of that, there was a sense of security community with regard to the ethics of disclosure
79600	84100	of vulnerabilities of locking systems.
84100	90040	And so we decided that we'd put together a presentation and really would like,
90040	97560	at the conclusion of our PowerPoint, to solicit comments from you folks as to what your thoughts are
97560	102620	so these can be taken back to the hardware security community.
103700	112180	Essentially, the locksmiths and their organization have determined that there should not be any disclosure
112180	119100	of defects or vulnerabilities other than the security professionals and security management
119100	124460	and other locksmiths. I don't particularly subscribe to that theory, nor does Matt.
124460	127520	We want to go through why we do not.
127520	132640	It's obviously been dealt with in the logical security community a long time ago,
132640	135280	but not really in the hardware community.
135380	139820	And so we'll present a PowerPoint first. Matt will do that.
139820	145260	And then we want to solicit your comments and input.
145260	150060	Good morning, everybody. So as Mark said, we're going to run through this pretty quick.
150060	153260	Then we can hop down. We've got some swag to throw out.
165200	168760	So this quote goes back over 150 years.
169460	172880	A.C. Cox wrote the book Locks and Safes.
173040	181540	And you can read it, but it details that the unscrupulous individuals already have this bit of information.
181540	184980	They already know about the defects. They're already exploiting them.
184980	189660	And it's better to provide this information to the public and make it available.
190340	195820	This was a Usenet post in June 2nd of this year from a locksmith.
195820	201320	And again, you can read it, but basically they're indicating that providing this type of information,
201320	210460	and I think this was in response to top-level master key or Eric Michaud's multi-lock attack on a plate,
210460	215760	and just indicating that this is all secret information. It should not be published.
217100	219140	So clearly, there are no secrets.
219720	223160	We're going to talk about the importance of full disclosure.
223160	227720	We'll identify from a physical security perspective what defects are.
228200	230620	Mark will go into some of the legal issues of them.
235350	238190	And then we'll go into some case examples of the last year.
241030	245150	So again, locksmiths are the first line in most cases.
245150	251060	They have publicly come out and said that, like you said...
251060	252680	That would be all of you.
259840	261860	So defects, what are defects?
261860	265260	They're simple bypasses, really simple tools.
265260	268320	We're talking seconds of bypass.
287110	294130	We're talking about the type of bypass that does not require sophisticated tools, expertise, and time.
294130	296570	The type of tools that I routinely deal with.
296670	300630	Versus the ballpoint pen opening the tubular lock trick.
301470	305290	That's the type of bypass that we're really talking about.
305290	313430	The simple, really, defects or problems that lead to the ability to circumvent a locking system.
317530	320410	Okay, well, the legal issues are real simple.
320410	321630	The real question is...
322510	329030	What does the end user have a right to know about the security products that they're buying and using?
329030	338810	And what's the liability for the locksmith or architect or hardware vendor if they don't tell you about a vulnerability?
338890	342610	And you put in that system and then you suffer a loss.
342610	343590	Somebody gets injured.
343590	344690	Somebody gets killed.
344690	345750	There's a major theft.
345750	347890	There's a compromise of information.
348270	351830	Who's got the liability or is there any liability?
351830	360950	And especially involving federal and state statutes regarding the disclosure of protection of medical information, financial information.
360950	363730	These are serious legal issues.
363730	371030	The locksmiths really haven't come to grips with them and frankly don't understand a lot of the problems that can face them.
371030	379450	And as an end user security administrator or person responsible for physical security, the real question is...
379450	385310	How much information do you have a right to know in order to make the security assessment?
386070	392390	If you rely on a security consultant to make that assessment for you, that's fine.
392390	400630	But if you're charged with the responsibility and fail to have all the needed information, then you really can't make that assessment.
400630	402270	And then who is liable?
402390	404790	Those are really the critical issues.
405390	414850	So as far as statutory liability, I'm sure most of you out there in the IT world are familiar with HIPAA, SOX, GLBA, all the regulatory compliance issues.
414850	427070	HIPAA, over one quarter or almost one quarter of HIPAA statutes govern physical access control, access to facilities, file lockers, etc.
427070	429710	containing protected health information.
429710	434870	So clearly we're all in bed with these regulatory issues.
434870	440050	SB 1386, the loss of information, defamation assets.
441410	448870	It's incumbent on us to understand the physical hardware that protects these assets.
450770	453290	So we'll get into the ethical debate.
453290	457630	Again, the question we want to throw out there, we'd like to get your feedback.
457630	459570	Come on up, ask questions.
460390	463950	But again, if the manufacturer is notified, what should they do?
463950	464850	Should they admit it?
464850	466810	Should it be publicized?
466810	468870	We'll talk about some case examples.
468870	472310	We recognize some other vendors and how they use it.
472310	473630	Full disclosure.
473990	478410	And ultimately, what is the vendor's level of negligence?
478410	480350	And one other comment.
480350	492070	If you find a security defect or a vulnerability that allows a lock or system to be bypassed, do you take it to the manufacturer without making it public?
492210	494190	Or do you make it public?
494190	502950	And that's really an interesting question because if you take it to the manufacturer and they have a large embedded base of security products, do they make it public?
502950	505330	The responsible manufacturers will.
505330	506650	A lot of them will not.
506650	508830	So where does that leave the end user?
524100	525140	Anywhere.
525140	527180	In a closed group.
527280	529060	In a closed group, yeah.
529760	536700	So the second point, the reality is you disclose a defect but there isn't one really there.
541430	544030	Someone else may or may not find it.
545250	547690	So, again, we want to pose this question.
547910	556450	There's been a lot of public disclosures on non-physical vulnerabilities that haven't come to fruition.
556450	561730	They were one-time bypasses that someone was able to do in a controlled environment.
565030	579910	Well, the other issue is, and a lot of the locksmiths have propounded, okay, if there's a known vulnerability in a lock or a piece of hardware, okay, you can tell the public, yes, there's a vulnerability, but you can't tell them what it is.
579910	581350	What does that do for you?
581350	582950	In our view, nothing.
583150	588210	Because the minute you disclose there's a hardware defect, somebody's going to find it.
588210	590330	And if they find it, they're going to publish it.
590330	592810	A lot of locksmiths haven't heard of the Internet yet.
592810	596210	And so they still believe that there are secrets out there.
596210	599290	And as we keep trying to tell them, there are no secrets anymore.
600970	606230	So some considerations for thought, again, between the questions and the evidence here.
606410	608290	Need to know at full disclosure.
608910	623610	The level of expertise that we spoke about, you know, some in seconds, but little or no training.
649540	659900	So as far as UL ratings and other industry standard hardware ratings, point of danger feedback should be everywhere.
659900	661460	And what is enough to be secured?
661460	664020	What's too much or too little?
664500	666440	And what's a security defect?
666440	672940	A manufacturing defect versus an exposed vulnerability.
672940	679640	Because there's a continuum of vulnerability versus a real significant design defect.
709740	712940	Let me even take it farther.
713860	717320	The real question is, who has a need to know?
717320	721060	And let's talk about one of the security releases we did last year.
721060	725500	I found a vulnerability in gun lock, gun trigger locks.
725720	731400	A really serious vulnerability to the point that literally I shot a video in Toronto with an 11-year-old kid
731400	735400	removing three of the most popular gun locks off a rifle in seconds.
735500	739120	Should that vulnerability be disclosed to the public?
739120	741040	Or how should they be warned?
741040	746080	Because at some point, some kid's going to get hurt or killed by removing one of these gun locks
746080	750060	that their parents mistakenly believe provides security on that weapon.
750060	753600	It's a perfect example where there can be tragic results.
753600	755400	Do you disclose it? Do you not disclose it?
755400	758700	When I talked to one of the leading manufacturers in the industry,
758700	762380	who I did some work for a long time ago, they didn't want to disclose.
762380	764780	They didn't think it was a big problem, and they weren't talking about it.
764780	768140	And they haven't to this day, and they continue to manufacture the locks.
768220	772940	And these are major manufacturers that are putting this material out there.
772960	776700	Every hardware store and sporting goods store in the country sells them.
776700	780340	Should that be exposed in the national media?
785270	787270	Okay, and we'll talk about that in a minute.
787330	793450	Because, well, you say yes until you're the parent of a kid that reads a report on the Internet
793930	797890	and then goes and pulls a gun lock off a weapon and shoots one of his classmates,
797890	801170	and then you're going to be coming to me saying, what the hell did you publish it for?
801650	804990	Because my kid wouldn't have known about it if you didn't publish it.
804990	806310	That's the problem.
812050	814590	I agree. We'll talk about it in just a minute.
818930	820250	Right, well, that's the attitude.
820370	824050	Actually, we took the attitude that we didn't publish it directly.
824110	829250	We charged a $3 fee for the report so that you'd have to have a credit card to buy it,
829250	833550	which would eliminate virtually every kid from buying the report.
833550	835910	And that's how we control distribution.
835910	839190	All right, we're going to get some swag out.
839850	841070	Oh, yeah, that's important.
841070	844350	Let's, uh, and R.C. and, uh, ask Bob.
848890	851250	Yeah, that's it.
852650	854950	All right, R.C., now you can answer.
856330	860910	In the hardware, locked and hardware environment.
860910	861990	Okay, there you go.
861990	864910	Here's a copy of Make Magazine for you.
865770	868850	So you're all familiar with the controversy.
868850	873230	When we were in the New York Times two years ago on top-level master key,
873230	876830	as I've referred to it in my disk set, in my book,
876830	879210	extrapolation of the top-level master key.
879210	882230	Very, very serious security vulnerability.
882610	887670	Basically, anybody in an organization that has access to one key to one door
887670	892830	that is on the top-level master key system can compromise that system
892830	896790	unless they have the proper locks installed, they've been coded properly,
896790	901510	and they have the proper restricted type of blank with sidebar coding.
901510	903830	It's a serious, serious problem.
903830	907590	Yeah, so the, uh, the second quote I got from Bob,
907590	917570	about locksmiths being huge up in Arkansas,
921430	924170	and that we compromise national security.
924250	926790	Now, then, of course, they turned around and said,
926790	931470	yes, but every locksmith has known about this for 50 years, so it's no secret.
931470	935070	So, of course, there would be a slight inconsistency in that position,
935070	938970	but it shouldn't have been disclosed notwithstanding everybody knew about it.
939390	941250	Everybody except the consumer.
941250	962240	So, the tubular lock bypass, and then shortly after Hope published information on Weinstadt News,
962240	966660	got some, a little bit of, you know, attention.
966800	972680	It wasn't until an individual took that bypass technique and applied it to a kryptonite lock,
972680	980840	that bike users are, you know, a little bit more crazy than motor users.
980840	985800	Right, well, I can tell you the first two days that we posted that on our website,
985800	987860	we had 100,000 hits.
987860	995720	And I had thousands of emails from security administrators from colleges, governments, hospitals, schools,
995720	998960	wanting to know what to do about their laptop locks,
998960	1004940	which escalated into the bike lock issue and into gun locks that use tubular locks.
1004940	1007600	The problem isn't with the tubular lock.
1007600	1011940	The problem is with inexpensive tubular locks that aren't designed properly.
1011940	1021190	Now, as a result of that, and I can talk about kryptonite, they really did the right thing.
1021520	1034580	They woke up one morning to all the flood of media, and it was sort of, it was a big surprise for them.
1034580	1040460	And so, they spent a couple days looking at the issue, and then they finally made a corporate decision.
1040460	1046640	They were going to replace every lock, which I believe was the very responsible thing to do.
1046640	1048760	Frankly, there wasn't anything else they could do.
1051560	1059340	They, the management of kryptonite, which is a subcompany of Schlage Lock,
1059340	1062420	they made the decision to bite the bullet.
1062420	1069060	They admitted the problem, and they offered a free replacement no matter when you bought your lock.
1069060	1074040	They, to date, have replaced, to my understanding, about 350,000 of them,
1074040	1078040	at a cost of about $10 million or more to Schlage.
1078200	1081840	That is the responsible way to do it, and they've redesigned their lock,
1081840	1084700	and so now it is a very secure piece of hardware.
1084700	1088980	In fact, it has a security rating in Europe from the rating agency.
1089100	1091140	They're not going to be easily broken.
1091140	1107080	Now, that would never have occurred if, actually, we hadn't released our initial report,
1107080	1114500	and then one of the bikers picked up on it and described the vulnerability for kryptonite locks,
1114500	1119100	which have been and are the leader worldwide in the industry.
1119100	1121100	And so it's a prime example.
1121280	1124680	You know, the bottom line is don't kill the messenger for the message.
1124680	1130140	If you have a security defect or vulnerability in your hardware, fix it or don't sell it.
1130160	1131820	That's really the bottom line.
1131820	1137120	Now, obviously, a lot of lock manufacturers don't subscribe to that theory, but they should,
1137120	1139560	and the consumer really dictates that.
1139560	1142540	Right. So, again, kryptonite clearly did it right.
1142560	1148500	Other vendors, and we're not going to name names, but, again, engineers could not duplicate.
1148500	1150500	They couldn't take a big advantage.
1150500	1153720	For our people, we flexed Krypultra to bypass the lock.
1153720	1154380	It's amazing.
1154380	1158520	But I can also tell you that they are, because I'm in contact with a lot of them,
1158520	1161560	they are implementing design changes that frustrate the problem.
1161560	1164220	It's actually a very difficult problem to solve.
1164220	1166520	It's not quite so easy as everybody thinks.
1166520	1171880	But all of the vendors that I'm dealing with, they are taking a responsible approach now,
1171880	1173700	and they are solving the problem.
1174440	1177240	Okay, so bump keys or 999 keys.
1177240	1183320	This is where a key is cut to its highest position on all the fittings.
1183420	1188660	The inertia effect against all the pins.
1188660	1201990	The key is inserted blind, and turn the key and open it.
1201990	1205890	Yeah, actually, it's Mr. Newton from England, from 300 years ago,
1205890	1208630	that helped us out on that with his third law of motion.
1209030	1214350	He just didn't quite foresee it at that time, but that's exactly what it is.
1214350	1217010	For every action, there's an equal and opposite reaction.
1217070	1222930	And basically, when you wrap on the pins in a specific way, you create a few milliseconds of gap,
1222930	1224490	and you can open the lock.
1224490	1230910	I did some television interviews back at home demonstrating this,
1230910	1233870	because it is a very big security vulnerability.
1233870	1239670	Barry Wells has done a lot of work with it in Europe, and there's been a lot of publicity.
1239670	1242350	Not so much in America yet, but it is a problem.
1242350	1245450	It's a problem for every standard, conventional pin number lock.
1245450	1248130	Not for most of the high security locks.
1248130	1250590	But again, if the public doesn't know about it,
1250590	1255070	then literally somebody can walk up to your residence door, your business door,
1255070	1260310	and in two seconds open it with no damage and no real evidence of injury.
1276600	1279020	Yeah, let me just address that for two minutes.
1279020	1284300	About seven or eight years ago, I got a phone call from a locksmith in Hawaii.
1284500	1288640	L-Safe, which is the largest in-room safe manufacturer in the world,
1288640	1295080	they're owned by the Asa Abloy Group, has over a million safes in luxury hotel rooms,
1295080	1300240	and virtually all of them are insecure than they were at that time,
1300240	1302860	although they rated them as a high security safe.
1303140	1305800	I looked at it, documented the defect,
1305800	1310220	and frankly had a 16-year-old kid that was working for me in the office for the summer
1310760	1316600	open it with a screwdriver and a paper clip in about one minute.
1316920	1319340	And this was brought to the attention of L-Safe.
1319340	1321720	They really didn't fix it. They didn't acknowledge it.
1321720	1324080	They didn't acknowledge that I even existed
1325020	1328820	because of the massive lawsuits that would have flowed from it.
1328820	1332080	This is a perfect example. Hotel guests have no clue.
1332080	1335000	I've done a lot of work in the hotel liability area.
1335000	1340080	A lot of hotel locks are not secure. They should not be relied on.
1340080	1343340	And the hotels, they're concerned, but they're not concerned
1343340	1347480	because they have statutory exemption from liability and they have insurance.
1347600	1352280	And so it's a problem. And again, as a consumer, you ought to be aware of the problem.
1354120	1357800	So again, as Mark mentioned, we continue to do locks.
1357800	1361220	That extends across the whole host of applications.
1361220	1368440	Safes, Harley-Davidson brake locks, J.I.R. keys are compromised with that.
1368700	1369700	It's huge.
1369700	1374160	TSA luggage locks. Everybody's using them to lock their luggage when they fly.
1374160	1375700	They're very insecure.
1375880	1380580	We put out a security alert and demonstrated how you can take a piece of plastic from a credit card
1380580	1386300	and open the most popular ones just by sticking a little piece of square plastic in the keyway.
1386300	1387520	This is not security.
1387520	1393420	And the real problem in that area is not theft from your luggage because it's easy to rip open luggage.
1393420	1397920	The real issue, in my view, and I did a magazine article over in Europe on it,
1397920	1403360	is that contraband can be put into your luggage after you think it's locked.
1403360	1407520	And if it's not caught in security, then it can be a real serious problem.
1407520	1430750	And again, Mark, talk about the gun.
1430810	1435550	Well, multi-lock is a telescoping pin, very high security lock.
1435550	1436890	They're made in Israel.
1436890	1439090	I've been to their factory many times.
1439090	1442230	They're also part of the Assa Abloy group out of Finland.
1443170	1448890	Eric Michaud actually thought he came up with a compromise.
1449710	1454370	When you are talking about bypass of locks, especially high security,
1454370	1456450	one of the criteria is repeatability,
1457310	1462090	which I don't believe can be shown in this particular bypass.
1462510	1464710	Opening one lock doesn't mean anything.
1464710	1469390	Opening all of them or 99% of them reliably within a time frame means a lot.
1469390	1471950	That has not been demonstrated with multi-lock.
1471950	1473550	And frankly, I don't think it will.
1473550	1476750	I've done quite a bit of analysis on their locking system.
1476750	1478170	It's a very secure device.
1478170	1480150	But it was published.
1480170	1482650	And the flip side of this argument is,
1482650	1487050	it shouldn't have been published until it was truly documented.
1487050	1489510	Theoretical in the laboratory is one thing,
1489510	1492470	but you don't cause a manufacturer problem
1492470	1498630	or you don't cause the public a security concern unless you can document it.
1498630	1501770	And so that really is the flip side of this argument.
1501770	1504190	All right.
1504190	1508410	So, you know, we're really looking to empower you with your experience,
1508410	1514070	your vulnerability exposures, to go out there, to look at hardware,
1514070	1527060	and get all the information out there.
1527060	1528800	There's a lot of material on the net.
1528800	1531540	There's some on our website that's publicly available.
1531640	1533200	A lot of it's restricted.
1533380	1536180	But there's a lot of material out there.
1536180	1538440	You really have to understand these systems.
1538440	1541620	And again, it all comes down to what is your need to know,
1541620	1543880	which is where I think we ought to begin this discussion.
1543960	1548200	What is your need to know from manufacturers about vulnerabilities?
1549480	1552040	So if you want to come up, I'll bring a mic down.
1553620	1555880	And I think we ought to start off,
1555880	1558420	what do you all think about the gun lock issue?
1558420	1561080	And should we have disclosed it?
1561960	1564640	I thought that's almost unanimous.
1564640	1567540	Anyone for a free copy of LSS Plus?
1568280	1569520	Come on up!
1570680	1571960	I'm about to ask you a question.
1571960	1573740	Actually, Matt, maybe they ought to come up afterwards,
1573740	1576980	because otherwise it's going to take time into the presentation.
1578620	1581240	Maybe they ought to come up to get CDs afterwards.
1581240	1582100	Yeah, we'll do CDs afterwards.
1582100	1585760	Why don't we do this at 10 to 11 so that we don't take time into this?
1586200	1590240	Can you comment on electronic access control systems at all?
1591120	1591920	Vulnerabilities?
1592220	1596660	Can you comment on the vulnerabilities of electronic access control systems?
1596660	1605820	Actually, I just did a survey study of all of the access control technologies for one of the government agencies.
1606260	1610660	Some of them are secure. Some of them are marginally secure.
1610660	1614020	There's been a lot in the media about how things can be compromised.
1616060	1625900	Yeah, the real question is, if there's a security vulnerability on the electronic side, should it be published?
1626460	1627920	What's your attitude?
1630540	1632880	Okay, so should it be published?
1637250	1638870	That's exactly correct.
1638870	1641070	But the question is, should it be published?
1643370	1645950	Yeah, you didn't have to use the microphone.
1645950	1651710	I believe it should be, but manufacturers should be given some disclosure period so that they can react to it.
1651710	1656950	Yeah, that is the responsible way to do it, unless national security is involved.
1657190	1664830	Yeah, I mean, most manufacturers, us included, are working on preventing these things from coming out with new technologies.
1664870	1668890	And it would be unfair for it to be disclosed before we had a solution to the problem.
1668890	1671430	No, no, I agree with that. Okay, next question.
1674130	1677570	Hello, my concern is...
1677570	1678710	You have to speak up.
1678890	1688350	My concern is with the HID card systems that I installed, just about every server room I had a chance to work in.
1688570	1695010	And to date, I have not seen any published reports, any vulnerabilities on the system.
1695010	1700890	I'm sure they exist, but what I'm basically concerned about is electronic systems.
1700890	1705870	Well, obviously, Matt, maybe you should address that, but the old systems obviously were compromised.
1705870	1709630	The newer ones are a little bit more difficult. Matt?
1709630	1715910	So HID has their traditional proximity-based cards have been compromised.
1715910	1719230	There is public information out there to duplicate a card.
1719550	1725350	The new HID I-class cards defeat that capability.
1725350	1729490	But there is publicly available information on the HID cards.
1730350	1731230	Next.
1733130	1739430	What do you think about a peer-review system like they do in scientific journals for lock security?
1739430	1740090	Say that again?
1740090	1746250	So in scientific journals, what they do is they sort of publish them and let everyone verify before it's considered good.
1746250	1748310	Do you think that might apply well to lock?
1748310	1751090	I think that happens on the internet about locks.
1751090	1756510	It's just that it can really cause a manufacturer problem if you publish that there's a vulnerability.
1756510	1762430	Well, I mean, do you think we could sort of engineer a place where you could publish a possible vulnerability and people wouldn't lose their head?
1762430	1765370	I don't think... see, I think that would be all right.
1765670	1772570	My theory and Matt's theory in all this is the more people that are looking at locks, the better.
1772570	1776130	Because all it can do is improve the end product.
1776270	1779370	There's a lot of sports lock-picking clubs in Europe.
1779530	1784570	I go to some of them and routinely visit with them, speak and learn.
1784570	1788290	They're just starting in America, and Matt can address that more.
1788390	1795490	But I think it's a good thing because there are engineers, lawyers, doctors, teachers, kids, housewives.
1795730	1798510	To pick a lock is an intellectual challenge.
1798510	1800050	It's not just mechanical.
1800130	1801750	To me, it's much better than chess.
1801750	1803650	I've been doing it since I was 15.
1803770	1805190	And it's intriguing.
1805190	1807510	In fact, I'm doing a new book on the subject.
1807590	1810770	And it is really intriguing.
1810770	1818190	And so the more people that are looking at locks and finding potential exploits, in my view, the better.
1818190	1820970	And the responsible manufacturers will agree with me.
1820970	1826770	They want the input because at the end of the day, they want to make the best locks possible.
1826770	1828130	End of story.
1828490	1829270	Next.
1830050	1836690	Briefly, lockpicking101.com is the definitive source for information.
1836690	1841570	They've started some lock sports organizations.
1841630	1846330	There's one in Europe that very well runs its tool, tool.nl.
1846330	1848730	I think the URL was in the presentation.
1849410	1851910	But lock sports are picking up.
1851910	1854350	Clearly, we have the lockpicking competition here.
1854770	1855930	It's a blast.
1855930	1857010	It's a lot of fun.
1857990	1863070	So I'm curious to get the thoughts on going back to the tubular gun lock issue.
1863070	1871810	If you remove as far layers as you want to go, that also includes, say, store locks to gun stores.
1873210	1877810	Given the number of lawsuits that have come against gun manufacturers for what has happened,
1877810	1883090	do you believe there will be a change before there's a lot of lawsuits against gun lock manufacturers for the same thing?
1883090	1883850	No.
1883850	1886890	You know, it depends if they're negligent.
1886890	1890350	If it was purely a negligent design, yes.
1890350	1900990	The real problem in lockpicking and decoding and impressioning is one of expertise and skill level and time and tools required.
1901150	1910790	If a 10-year-old kid can open a gun lock by wrapping it on the floor or sticking an ice pick into it,
1910790	1915430	which is what I demonstrated, and pop it off the weapon in two seconds,
1915430	1919830	I think they're going to get sued if somebody gets hurt or killed.
1920930	1925070	It's a defective manufacturer and they all copied each other's defects.
1925250	1928530	If it's more esoteric than that, no.
1929090	1936670	Well, the reason why I mention that is a lot of the lawsuits that have been against manufacturers of guns have just been because of guns.
1936670	1937750	Yeah, that's right.
1937770	1947010	And so, going along those lines, if we do end up with something like a mandatory gun lock law, which could happen,
1948150	1955790	given the fact that the locks actually work and you're still able to use a weapon, do you see that going down the bad path?
1955790	1962390	Yeah, I mean, if the gun locks work, and I'm dealing with some manufacturers in Europe on this issue,
1962390	1968930	if they work and then there's a defect and you're able to fire the weapon, it puts them a lot closer to liability.
1969930	1974250	I'm not sure I... gun locks are a really complicated problem.
1974990	1975990	Next.
1977610	1984750	In the American patent system, we're dealing with software now, and it's stifling innovation left and right.
1984750	1994570	I was wondering about your opinion on whether or not the American patent system is stifling or helping innovation in the creation of locks, and better locks.
1995010	2001730	Yeah, I think it's helping. I mean, look, if you're inventive and create something that is unique and provides security,
2001730	2004990	and some of them do, some of them don't, the patent doesn't guarantee security.
2005150	2011970	I think our system rewards you for that, but it gives you a monopoly on that product for 20 years.
2013310	2017710	Every major design defect in locks is described as patentless improvement.
2018130	2026250	And so I've done a lot of research in the U.S. and in the patent offices to find out vulnerabilities from when I write books.
2026410	2029450	And so, you know, it's a positive thing.
2029450	2033990	So harder designs actually do make it into multiple vendors of locks.
2034170	2043310	Yeah. Oh, sure. Yeah, look, there's nothing new in locks. Everybody copies everything and modifies it for patents. Yes, sir.
2043310	2052230	Hi, you mentioned the full disclosure of 7 cases of national security.
2052290	2057750	If you found out that some government organization was using a certain brand of lock, do you know about the users?
2057750	2060330	You know, this audio system is not really good.
2061010	2067110	If you found out that some government organization, you know, like some base was using a certain brand of lock
2067110	2071430	and you knew there was a streaming vulnerability and you brought it to, you know,
2071430	2080290	either the attention of security forces or someone in charge of security on the base or organization,
2080290	2084790	and they didn't do anything about it, I mean, how do you normally handle that?
2086150	2095390	Well, that's a real judgment call. I've brought vulnerabilities to GSA's attention and did not publish them upon their request.
2095510	2100510	Even though their first comment was, if it's not covert, we don't care.
2100510	2103490	If you have to drill a hole in the lock, we don't care.
2103490	2107270	I said, okay, we're going to publish it. No, you're not. Why not?
2107270	2109810	Well, because it's a security problem.
2109810	2116050	Well, but these locks are used in the banking industry and everybody ought to know about it.
2116050	2120090	No, they really shouldn't know about it, and if you publish it, we'll classify it.
2120270	2122390	Now, that was the government's response.
2122390	2125570	I wasn't afraid of their response because I don't think they could sustain that,
2125570	2134370	but I didn't publish it because it was a responsible thing to do about five years ago.
2137030	2140890	Regarding the situation where you disclosed to the manufacturer first,
2140890	2144770	before the public giving them a chance to do like what Kryptonite did,
2145310	2149210	what kind of turnaround time is reasonable for a manufacturer to be able to...
2149210	2153790	Oh, I think Kryptonite was pretty reasonable. They did it in, like, two months.
2153850	2154330	Really?
2154330	2161910	Yeah. They had a huge problem, and they acknowledged it, and they fixed it.
2161910	2165390	I mean, they did what they were supposed to do, and it cost them $10 million to do it.
2165430	2168690	And with no questions asked, you know, they didn't depreciate the...
2168690	2172650	If you had had that lock for 10 years, they still gave you a new one.
2172670	2176390	They didn't depreciate the value like your insurance company would do on your homeowners
2176390	2180490	and say, well, that lock's only... you know, you paid $100 for it, but it's only worth $25,
2180490	2183670	so now we're going to give you a coupon for $25 to go buy a new one,
2183670	2185850	which would have been a marketing bonanza for them.
2185850	2187670	They didn't do that. They just replaced it.
2187670	2191350	They said, hey, you know, send us your lock or send us proof, we'll send you more.
2194150	2200710	I don't know if they... I don't know if they probably not. I don't know.
2200710	2205130	But they do have a better lock now. It's a tough lock.
2206230	2212490	I understand your argument about defective, you know, being something that maybe a 10-year-old could open
2212490	2217830	versus a skilled person, but, you know, I don't have any 10-year-olds running around my corporation,
2217830	2223230	and if I go to buy a lock to lock the data center door, you know, I want to be...
2223230	2228430	I think as a consumer, I'm surprised that the Consumer Product Safety Commission or somebody else
2229130	2236870	wouldn't go after manufacturers because, you know, we've had Firestone for the Ford tires on the SUVs.
2236870	2240290	People got killed.
2240290	2247310	You know, I mean, if I lock my house and a skilled burglar comes in and murders me, you know, I'm killed.
2247650	2252610	Vioxx, the anti-arthritis drug, it was, you know, clearly uncovered that they knew there was a problem
2252610	2256430	and swept it under the rug, and they're being punished for that fact.
2256950	2258730	Will this happen in the lock industry?
2258730	2261850	I don't think so. It's a different set of problems.
2261850	2268610	And frankly, the problem is, in all those cases you've named, you're not dealing with criminal actions.
2268610	2276930	Here you're dealing with somebody that's violating the law, and you really can't control that other than criminal statutes.
2276930	2283390	That's the sanction. And so the real question, again, that nobody's really addressed yet is,
2283390	2288190	what's your... how much information do you think you ought to be entitled to from the lock manufacturer,
2288190	2290090	and who ought to be entitled to it?
2290090	2294930	But isn't the lock's sole purpose to prevent criminal action in some ways?
2294930	2302790	Yeah, that's true, but... yeah, I agree, but it's a little more complicated.
2306410	2310330	That's right. Now, they're trying to sue the gun manufacturer.
2312610	2316590	Right. Well, yeah, okay, but that's not going to go anywhere.
2316990	2318990	Next question, because we're running out of time.
2320470	2328830	Instead of waiting for a lock manufacturer to invest marketing dollars and then pissing them off by releasing a security breach,
2328830	2336270	do you think the manufacturers would consider almost like a hardware open-source review of their design before going to market?
2336450	2339470	Why not? No.
2339470	2340910	But isn't it better than...
2340910	2347270	Well, first of all, until they receive a patent, they're not going to publish anything. That's the way things work.
2347270	2352890	And, I mean, part of the security of locks is you not knowing how they work.
2352970	2355910	But didn't you just prove security by obscurity doesn't work?
2355910	2359210	Yeah, well, actually, I prefer to call it security by ignorance.
2359750	2366210	And that's really what it is, because, look, if you're a security manager, IT professional,
2366210	2371110	you're charged with a physical security responsibility as well as logical security.
2371110	2381450	You can't make the risk assessment in your organization unless you know what the bypass techniques are and are shown what those are.
2381550	2387970	If they'll tell you that, I don't have a problem with their policy. I don't think we ought to be telling criminals how to bypass locks.
2387970	2395590	If you have a need to know because you have a protection responsibility, I think you have a right to know everything about that lock.
2395590	2406390	Now, unlike software and Bill Gates and everybody who doesn't give you the code, if you're smart, you can take a lock and it'll tell you everything about itself.
2406470	2410070	So if you're smart enough to figure it out, the information is there anyway.
2410110	2413430	But I think you have a right to know that information.
2413850	2417950	How can you differentiate between a consumer and a possible criminal?
2417950	2426150	Well, that's a real good question because if the consumer relies on his locksmith or their locksmith as their security professional,
2426150	2431990	then no problem. Let the security professional say, look, yeah, there's a vulnerability. You don't need to know what it is.
2431990	2437130	I mean, my mother, she puts new locks on their house. She doesn't need to know how to pick them or open them.
2437130	2442870	She just needs to know, is it secure and how long would it take a competent burglar to open it?
2442870	2447890	Well, first of all, burglars don't open locks by picking them. They use a crowbar or a brick.
2447970	2450590	Ninety-nine percent of the burglaries are done that way.
2450590	2457450	We're talking about more sophisticated burglaries and information theft and compromise of data and that type of thing.
2457770	2465190	Just a quick question about, you were saying that 50 years they knew how to circumvent the tumbler lock.
2465190	2470030	And I'm wondering if the information space in lock picking is a lot tighter than information security
2470030	2472990	because 50 years the public hasn't heard about this.
2472990	2476710	Honestly, they really haven't. It's really quite amazing.
2476710	2482290	This has been around for a long, long time, especially on plum keying and on master keying.
2483150	2486870	A lot of folks know about it. The locksmithing community was aware of it.
2486870	2490830	The problem was they weren't telling their end-user customers.
2490830	2495970	A lot of them didn't understand it. So the end-user customer had no way to assess their risk.
2495970	2501250	So the second part of the question I had is, for the kryptonite locks, I don't know a lot about locks, but I know about bytes.
2501250	2507890	And I haven't seen, before this vulnerability was published, anyone whose kryptonite lock ever was really knocked open.
2509410	2512250	I'm sure there are, but I'm wondering if you have any statistics.
2512410	2518110	Actually, what we published, a variance of that was published about 10 years before in the UK.
2518110	2519690	Nobody paid any attention to it.
2520550	2526310	If you understand lock-picking theory and impressioning theory, then it's a real simple deal.
2530710	2533830	Going to travel locks for a second.
2533830	2544910	About 10 years ago, actually maybe 12 or 13, we had an attempt by the government to put something into place called Keyestro in cryptography.
2545970	2552650	Would you consider the quote-unquote TSA safe locks to be a form of physical Keyestro?
2553730	2557330	No. First of all, they're $10 cheap locks.
2557330	2559990	And the problem is the public doesn't understand that.
2559990	2561890	They think they're buying security.
2561890	2563790	And it's a matter of convenience.
2563790	2565130	Look, you have two choices.
2565130	2569970	If you want to lock your luggage to prevent pilfering, allegedly,
2569970	2573790	then you put a lock that TSA can get into, because otherwise they're going to cut the lock,
2573790	2576710	because they have a legitimate interest in seeing what's in your luggage.
2576710	2577230	End of story.
2577230	2579310	I mean, that's why TSA locks were developed.
2579510	2586170	A trade organization got all the lock manufacturers together, established criteria for five different kinds of locks
2586170	2591990	that all have master keys or a bypass key that TSA can get into.
2592050	2593370	And that's their sole purpose.
2593370	2597150	But isn't that a... that's not a form of Keyestro?
2597150	2601290	It's not a form of giving them, here's the pattern for the key to get into the lock?
2601290	2602950	In that regard, yeah.
2602950	2607290	But I don't think anybody's going to disagree that TSA doesn't have the right to check your luggage.
2607290	2608430	No, I'm not disagreeing with that.
2608430	2609310	I'm just saying that this is...
2609970	2610310	Yeah, maybe.
2610310	2612330	I mean, it's a loose parallel.
2613110	2614790	I don't think it's exact.
2615370	2616090	Okay.
2616090	2616430	Yeah.
2616430	2617190	All right.
2619070	2620230	Yeah, actually, I would just...
2621250	2625290	I travel a lot, and I would recommend, instead of using a lock, use a penetration tag.
2625290	2627350	Use, like, the little wire tags or something like that.
2627350	2629530	Because at least that way you know if somebody broke into the bag.
2629810	2631110	You tagged it.
2631110	2633210	You know when you pull it...
2641510	2645030	Well, it's not TSA that I'm worried about sticking something back in there.
2645030	2645690	They'll steal it.
2645690	2646950	They won't put it back in.
2648450	2650350	Well, that's been documented.
2650350	2651490	There's been lots of arrests.
2651490	2656650	The problem is your hotel porter in London putting something into your locked luggage that you don't know is there,
2656650	2662330	either narcotics or explosives or whatever, and you think you're okay because it was locked.
2662330	2664050	That's where I think the problem is.
2664290	2666130	We've got time for one more quick question.
2666130	2666570	Yeah.
2672250	2676750	I'd love to do something with it.
2676750	2678650	I had some media interest, but nobody...
2678650	2679470	It's America.
2679470	2680590	Nobody does anything.
2680590	2682570	I think it's a great idea, though.
2683370	2684630	Are we out of time, Matt?
2684630	2685590	Yeah, we're out of time.
2685870	2687190	Thank you very much.
2689970	2690650	Pleasure.