Winterizing Your Security -- Locks
In the Northern Hemisphere many of our airplanes hibernate in their hangars sometime between November and March, maybe even longer depending on how far north we live. Oh, we probably pay them a monthly visit and run the engines a bit so we keep them at least minimally lubricated. But our faithful aerial steeds typically remain stabled more when the weather is cloudy and cold than clear and warm.
Having inspected many aircraft hangars for security for nearly a decade, I can report that the most common device keeping the outsides world away from our airplanes is a keyed lock. We turn the key in that door knob and figure that our airplane—our investment in fun and transportation—is secured against those who want it, the radios inside it, or anything else having to do with our flying machine. Or perhaps we close the hasp and attach a beefy looking padlock, figuring that the metal body of the lock will discourage sufficiently those who want what's inside.
My grandfather once told me that locks are only good for keeping honest people honest. Let me tell you why his country farmer's wisdom continues to be true today.
Locks in general are a good part of a security program that makes use of multiple forms of detection, and intervention. Locks provide delay. Locks improve the opportunity for others to observe a burglar's actions. But most locks won't provide more than a 30-second delay. The primary vulnerability is the lock mechanism itself. The two primary means of defeating a lock mechanism are duplicated or lost keys and bumping.
If you have multiple hangars that have locks installed, you probably have a process whereby multiple keys are distributed to those who have a valid reason to have access to a particular hangar. You give those people keys. The problem with multiple keys is that once you've distributed a key, you no longer have positive control of that key; therefore, you no longer have positive control over the normal access using that lock. Why?
People make mistakes—we're all human. It happens. People lose or misplace keys. Having people sign documents which make them responsible for the key doesn't change human nature. When that key is out of their possession, there is an opportunity for the key to be taken and used or taken and duplicated and eventually returned—the legitimate user of that key may be none the wiser. People may also have duplicates made of their issued keys to minimize the embarrassment of admitting its loss or to further distribute access to those they think should have one.
A first step in reducing the risk of unauthorized key access is instituting a key control program. A good key control program has three basic elements. The first is a regular key audit to make sure that those issued keys are still in possession of them. Do it annually, semi-annually, quarterly, or at whatever interval gives peace of mind.
The next element is marking the keys. The keys for your locks should have a distinguishing, unique mark etched into them. If you are presented a key without that mark at the next key audit, you know the key has been duplicated, or "duped." That duped key is proof positive that you no longer have control over that lock.
The final element is to talk with your local locksmiths. Make sure they know what your etched mark looks like. Ask them to call you if they are asked to duplicate a key with your mark. Every locksmith I've met is happy to do this. You just have to make the request.
Bumping locks, also known as vibration picking, is a means to defeat many, if not most, locks. It is typically done using a key that fits your locks. Most mechanical locks make use of the traditional pin-and-spring mechanism within the inner cylinder. A bump key is inserted into a lock and given a light rap with a small weight—like the handle of a screwdriver. These actions cause the pins to align and allow the bump key to turn and open the lock. Here is a 3-minute video on YouTube™ in which WMC-TV, a TV station in Memphis, did a story on lock bumping: Click here. There are many other videos on the Internet about lock bumping.
My point here is not to get you to throw away your locks and keys, buy new and more expensive locks and keys, or throw your arms up and just give up. My intent is to make clear some of the vulnerabilities with keyed locks. There are locks out there that are bump-resistant. You can spend lots of money trying to turn a hangar into a fortress. But why? As my grandfather would say, "Don't put all of your eggs in one basket."
A keyed lock is a fine part of a multiple-layered approach to security. Understand the limitations of your lock. Don't expect any single lock to be the silver bullet in your plan to secure and protect your aircraft.
If you are interested in learning more about locks, their strengths and weaknesses, and bumping, here are some resources (PDFs):
- Bumping locks by Barry Wels & Rop Gonggrijp, January 2005
- MIT Guide to Lockpicking by Theodore T. Tool , September 1991
Fly safe and be secure!