A RESTRICTED VERSION OF THIS POST IS AVAILABLE TO LOCKSMITHS, SECURITY PROFESSIONALS, RISK MANAGERS, AND CLEARSTAR MEMBERS. THE LINK TO CLEARSTAR IS PROVIDED. IF YOU ARE A SECURITY PROFESSIONAL YOU MAY ALSO CONTACT THE AUTHOR FOR ACCESS AT [email protected], or the webmaster at ClearStar for clearance.
This post is primarily for locksmiths and security managers of facilities that may have installed the KABA Simplex push-button locks. We will be releasing a second article shortly with regard to mechanical upgrades that KABA appears to have implemented to resolve the security issues that are documented in our video. Every facility that has installed these locks should be aware of the vulnerability and assess their risk and their potential damages.
It is likely that millions of Simplex locks (Series 1000, 2000, 3000, 6000, 7000, 9000) have been sold to commercial, government and even residential venues throughout the world and have been an extremely popular push-button lock for at least thirty-five years. Unfortunately, they are, in my opinion, insecure, and demonstrate a critical problem within the lock industry which I have repeatedly addressed and labeled as insecurity engineering.
Our office has produced a detailed video which has been made available to locksmiths and security professionals. It shows the precise security vulnerability of these mechanisms. If you presently utilize these locks, you should view this material to asses your risk, or speak with your local locksmith who is familiar with the locks and their security vulnerability.
Our analysis conclusively demonstrates the vulnerability of locks that were manufactured prior to at least September 19, 2010, and also graphically illustrates what can go wrong when design engineers are not properly trained in bypass techniques, or they fail to use their imagination as to potential methods of entry. While KABA is not the only lock that can be opened with a magnetic field, they are surely the largest target for legal action.
In Locks, Safes, and Security and LSS+, I describe at least fifty methods of bypass, including the use of magnetic fields. Unfortunately most design engineers are clueless with regard to many of these techniques, which mean they are incapable of designing locks that are secure against this and other forms of attack.
This lack of knowledge has and will lead to liability and potentially significant if not catastrophic damages and will likely force some manufacturers out of business. In my view, the KABA lawsuit and what it portends may have a devastating impact on lock manufacturers and the entire industry.
This is the combination chamber for a Simplex 1000 lock manufactured prior to September 19, 2010. A critical component can be moved with a strong magnetic field..
If they do not pay close attention and take steps to insure that their products provide the security which they directly or impliedly represent and which their purchasers rely upon, they will likely find themselves as defendants in similar actions. Any lock manufacturer, foreign of domestic that sells their products within the United States market can be subject to liability.
Be assured that KABA will not be the first to be the target of such litigation. Our office has been investigating several seriously defective or deficient products and will likely be involved in actions in the future for similar design deficiencies that adversely impact security and place consumers at risk.
Several of our legal and consulting clients asked that our law firm set up a testing laboratory to find “real world” vulnerabilities that UL, BHMA, VdS and other standards organizations and their laboratories either do not recognize or are not allowed to test for because of the way the standards are written. As a consequence, in 2009 we set up Security Laboratories to determine the vulnerability to covert and forced entry techniques of both mechanical and electronic locks. We established our lab through my law office to shield our clients from potential discovery of our test results in the event of litigation involving defective products that we may uncover.
As many of you know, I have been an outspoken critic of many lock manufacturers for their lack of competent security engineering skills, especially with regard to high security locks. All of our clients are vitally concerned about making secure products. They want to be certain their locks protect their customers and do not expose either the customer or manufacturer to liability claims, based upon defective or deficient engineering. We have secured several patents to remedy design problems and make the locks that are produced by our clients more secure.
Many of our clients have learned a very painful lesson about lock design: it is far less expensive to find and remedy design deficiencies before a product is released rather than doing it after the fact.
There has been much criticism of the stance I have taken as to my belief that not only should these engineering failures be documented, but the public, locksmiths, and security professionals should be made aware of the vulnerabilities. My rationale is simple: the possession of such knowledge allows them to properly assess and assume (or decline) the risks that may be inherent in utilizing a specific lock or piece of hardware.
In those cases where manufacturers are ignorant of bypass techniques that can render their locks insecure, I believe they may still be held liable. Why? Because ignorance is no excuse, especially if commercial tools, YouTube videos, or lock picking web sites are discussing different techniques to open the locks. One of the first things we do in our lab is to determine if anyone else has figured out how to open locks that are produced by our clients. Often, there is a wealth of information.
My opinion is that any lock manufacturer that ignores such publicly available information is culpable. The problem is that many manufacturers release products, then essentially forget about them and fail to make changes based upon current bypass techniques. If a company represents in its current technical manuals and advertising that a lock is secure, I do not think it matters whether it is a new or old design. I believe this is why KABA will not prevail.
Everyone is aware that we wrote the book about how we cracked the Medeco high security cylinders. Medeco’s response was to implement certain changes to counteract security vulnerabilities that we had discovered and exploited. This is precisely what is required of a manufacturer if they are to avoid liability and costly lawsuits. Other manufacturers, such as we disclosed at DefCon 18 last summer, chose to do nothing, or simply hide from their design defects.
I have always believed that full disclosure is the only viable policy, regardless of the possible consequences, and have so counseled my clients. Every lock manufacturer has, in my view, a special responsibility to its locksmith-dealers and to the end-users. Often, the locksmiths are left “twisting in the wind” by not being apprised of known or suspected security issues by the manufacturer. The lack of such information can adversely impact their customers and create an untenable legal and ethical position for the locksmith.
Perhaps the best example of a lock manufacturer taking responsibility for a deficient product is Schlage and their Kryptonite bike locks. When we made public the ball point pen attack in 2004, Schlage made the decision almost immediately to replace every lock, whether they were liable or not. That conduct should serve as a model to every other lock manufacturer. It cost them a great deal of money, but it was the right course of action and has ultimately paid dividends for them in terms of credibility with their customers.
The same course of action recently occurred in Europe by Uhlmann Zacher when their electronic cylinders were attacked with the magnetic ring that allowed them to be opened in seconds. They immediately shut down their production line, recalled all of the locks, and fixed them at no cost to their customers.
About six years ago, I wrote a detailed two-part article for ALOA Keynotes with regard to locksmith liability issues, after becoming involved in the exposure of the insecurity of master key systems in the New York Times. Little attention was paid to the issue at the time in regard to potential liability. The KABA lawsuit has brought the matter to the fore, and now every locksmith and manufacturer should be paying attention because of the potential liability issues involved.
As a result of the exposure of lock bumping as a serious method of covert entry, the manufacturers have begun to address the problem, as have the standards organizations. I believe that the public benefited from the disclosure and is better off for it.
I am constantly asked “why is a lawyer picking locks?” The answer has always been simple for me to explain: All security is about liability. For many years, I have been cautioning about the nexus between security and liability and defective or insecure products. It would appear that now everyone is beginning to understand the connection. If a product is improperly designed and insecure and results in injury, loss, or other damages then the lock manufacturer will likely be held liable.
For everyone wondering if I am connected with this lawsuit, the answer is no. However, I have met with counsel in New York for the Plaintiffs. As a result, our office is working an independent investigation with regard to certain issues that have been raised in this litigation.
As a lawyer, it is my opinion that KABA is in serious trouble on two fronts. If the case is not dismissed based upon a motion for summary judgment for failure to state a legally actionable claim, then I would bet the case will be settled and will never see a courtroom. My opinion is that KABA will not risk a fifty million dollar verdict for what I perceive as their inept design and potential misrepresentation and false statements by their employees.
KABA, in my view, has not only manufactured and marketed a defective product, I believe they knew it or should have known it for quite some time.
My opinion: this is a lie, or at best a half-truth, and is liable to cost them dearly.
I find this particularly interesting in light of the Motion that KABA filed with regard to where this case should be heard. They stated that the design has been modified as of September 19, 2010, but there is no information to indicate that the problem has in fact been remedied. Further, one would assume that technical support staff would be warning customers to have their locksmith replace the critical parts, which may include the combination chamber and front housing with the upgraded version. Instead, the individuals I spoke with denied any knowledge of any specific vulnerability.
All but one of the dealers I spoke with was comfortable in recommending these locks for use, even in secure environments, boasting that “the military” uses them. Each of the dealers and locksmiths I spoke with were wrong, and could potentially be held liable for making such statements if a customer relied upon them and were subsequently injured.
There are four critical questions that must be answered in relation to the KABA lawsuit: (1) whether the design of the Simplex is defective, (2) if the company misrepresented the security of its product, (3) whether their design engineers, on a continuing basis, should have known or determined whether the lock was subject to a magnetic attack. Even more importantly, (4) did they have prior knowledge of the security vulnerability and failed to correct it and warn their thousands of customers?
A manufacturer is clearly not liable for a state-of-the-art attack which could not or should not have been foreseen when the lock was designed and first manufactured. A sophisticated decoding tool, for example, which requires a great deal of skill, expertise, and introduces new methods of bypass technique would not give rise to a cause of action.
An example is the John Falle shim-wire decoder that was introduced about twenty years ago to open high security pin tumbler locks. This was classified as a state-of-the-art attack and used a wire that was a few thousandths of an inch in diameter, delivered through a syringe-type tool to probe and measure the length of each bottom pin within the lock. It was only available to government agencies for many years. No manufacturer would have been deemed to be liable at the time if their locks were attacked in this manner.
A similar and more current and relevant example would be the picking and bumping techniques that we developed to open Medeco cylinders with code-setting keys. These state-of-the-art techniques would not give rise to liability upon the part of Medeco, because the manufacturer clearly could not have foreseen the attacks that we developed, even though the ultimate result constituted a relatively simple method to open many of their locks.
At the other end of the spectrum are attacks that require little to no skill or training, nor the use of sophisticated tools. To be blunt, these types of attacks are based upon stupid engineering by the manufacturer. The KABA attack, (and hundreds of others that we have documented in LSS+ and DAME), are neither sophisticated nor complicated, and certainly not state-of-the-art. In my view, reasonable design competence in security engineering would dictate that a properly educated engineer would understand the vulnerability and design around it. I think the KABA bypass is a classic example and failure in this regard.
Anyone familiar with magnetic attacks would recognize the threat and never use a ferrous material that could be influenced by a magnetic field for a critical component, as was done by KABA in their combination chamber. Reading their Motion, KABA is evidently claiming that a rare-earth magnet was “not commercially feasible” at the time the lock was developed, and thus constitutes a sophisticated or state-of-the-art attack. They further claim that these magnets, (which can be held in the palm of your hand), are not easily transportable, and may cause bodily injury when used. In addition, they represent that opening the Simplex by a magnetic field may be difficult and not a reliable technique, and may not even result in the lock being opened.
This begs the question, because I believe that a manufacturer has a duty, especially if they are on notice of a technique to bypass the security of their locks (or other locks that may have similar components that control critical functions), to constantly update their current products to prevent or minimize such vulnerability. KABA evidently did neither. I would assume that the concept of magnetism was known to KABA at the time they developed the Simplex lock! Any contention that because rare-earth magnets were not available at the time of the initial design and therefore KABA is not liable is simply nonsense. I would be willing to bet that magnets that could open the locks were available or could have been constructed at the time these locks were first introduced and subsequently.
Locks are security-rated in terms of time, tools, and training and whether specific bypass techniques are reliable and repeatable. We call it the 3T2R rule. They are designed to keep criminals out for a specific period of time and are measured against certain types of attack tools and techniques. Claiming that no liability accrues if a lock is opened with any but the correct key is ludicrous, arrogant, and connotes a total lack of understanding of security. KABA has lumped all locks and their bypass together and has conveniently omitted any mention of standards or the security of their products to resist such attacks.
The magnetic attack on the Simplex fails on all three counts. Claiming that the use of a rare-earth magnet is a sophisticated, unknown, or “not commercially feasible” attack does not, in my view, pass muster either, because the magnets are readily available from several venues today, and have been for some time.
If KABA was correct in its assertion, then why bother spending any money for a more secure lock. Here is my suggested solution for KABA: let them place verbiage on every Simplex that states “Warning: this lock can be opened in two seconds with a strong magnet by an idiot!” How many locks do you think they will sell? The answer is zero!
Many have asked if locksmiths that have sold these products can be held liable. The answer is not simple and depends upon whether the locksmith was aware of the defect and failed to warn their customers. However, before talking about the KABA Simplex case, there is a threshold issue that must be addressed, and that involves the locksmith holding himself or herself out as a security expert.
However, if you hold yourself out as an expert in security, recommend a specific lock as secure (either directly or by implication), and as a result the customer relies upon your representations and subsequently suffer a loss, you may be deemed liable.
Once you represent, either directly or by implication, that you have expertise in physical security and that your customers should rely upon your advice, then I believe you also have a duty to be aware of current methods of bypass for the locks you sell. You have a commensurate duty to warn your customers of such issues before they purchase the lock, or, for a reasonable period of time subsequent to the purchase and installation of such products. It is the ethical thing to do, will foster good customer relations, and should shield you from any liability.
The answer is simple: advise every customer of the specific problem, so they and not you make the risk assessment and the determination as whether the locks should be replaced or upgraded. In my view, you should stop selling the locks until they are fixed and the manufacturer repairs or replaces every one of them that is in service. You should also demand that KABA upgrade all locks and compensate you for any expense incurred in connection with servicing your customers. If KABA is unwilling or unable to fix their locks, then you should require them to refund the purchase price of your entire inventory.
The obvious question as to the time period for which KABA could be liable is unclear. Locks that were sold several years ago may not be covered in this lawsuit unless it can be proved that KABA was aware of the problem and failed to warn their customers. If KABA does the right thing, they will replace or upgrade every lock that is at risk, just like Schlage did with the Kryptonite.
The KABA Simplex lock was evidently rated as Grade 1 security level by ANSI/BHMA at one time (156.20). Unfortunately, these standards, in my view, are woefully deficient in what they cover. They do not adequately protect the consumer. I have been meeting with BHMA for the past two years in an effort to get them to revise ANSI/BHMA 156.5 and 156.30 (the commercial and high security standards) so that they actually test for “real world’ bypass techniques. The KABA case is typical and demonstrates the total failure of standards to determine or measure real security in locks.
In September, 2010, our office filed a very detailed complaint to BHMA, seeking to challenge the certification of the Kwikset Smartkey lock as non-compliant with the standards. This lock, also rated as Grade 1 security, as many of you know can be opened in fifteen seconds with little more than a small screwdriver. I think it is junk security, and I have publicly said so on many occasions. Just about every locksmith in the country knows the Kwikset story. Now, KABA Simplex can be placed in the same class with regard to security, or perhaps it is even worse and more insecure, (at least until secure upgrades are in place to prevent the magnetic attack). At least the Kwikset Smartkey is bump and pick resistant and is not affected by a magnetic field!
In my view, the consumer should not rely upon either the standards or the results that are certified by these testing labs with regard to methods of covert and forced entry until the standards are written in such a way as to specify real-world attacks. Testing labs should understand that they may share in liability for defective or deficient products which they certify as compliant and which are not.
On January 24, 2010 I met with BHMA to discuss the current situation with regard to the standards and why they should be upgraded. I suggested that an expedited procedure be adopted by BHMA to address security issues such as KABA, Kwikset and other companies, where locks are certified as compliant with Grade 1 standards but are clearly not secure. I was assured that the issue is now being considered in an effort to further protect the public.
I suspect that the KABA lawsuit will be the first of many to be filed and will set a new standard for security engineering within the industry. Any manufacturer, large or small, that fails to grasp the nexus between liability and security engineering will be subject to potentially lethal lawsuits which ultimately may force them out of business.
While most engineers are competent to make mechanical locks function properly, few understand how to circumvent their security. The premise is simple: you cannot design secure locks unless you understand the methods to break them. Most manufacturers only have a cursory familiarity with the latter.
As a manufacturer you may claim that you rely upon the standards and are compliant with them. Such an argument may not shield you from liability, however. If your lock can be opened in fifteen seconds by a kid, I think you will be deemed to be liable. More importantly, if members of a jury can open your locks in seconds, it is over! End of story.
If you are on notice of a significant vulnerability and fail to act upon it, both in terms of design changes and notification to critical customers, you may suffer the consequences. That means that if there are tools on the market to open your locks, or verifiable accurate YouTube or web videos that illustrate how to break them, then you have a problem. I can assure you that the legal community will take note, and where appropriate, pursue such design issues in expensive lawsuits.
KABA has stated that modifications were completed on or about September 19, 2010 in order to minimize the security vulnerability to the Simplex. However, this does not mean that locks which were purchased after that date are in fact secure. This is because old stock may still be sold by dealers. You should determine whether any locks that were purchased after that date have been modified to thwart the threat from strong magnetic fields.