Key bumping has created quite a buzz lately and a huge opportunity for locksmiths and security professionals. I can speak from first hand experience that consumers are quite aware that there is a problem and they want answers. As I field phone calls in the Medeco/Arrow Technical Support Department, I hear the same question from John and Jane Q. Public; “Are your locks bump proof?”
So, in order to understand this recent bump-mania, I’ve started to ask callers how they’ve heard about key bumping. Most have seen one of the many TV news stories that have highlighted how easy it is to obtain the necessary tools and skills to make and use a bump key. Then, concerned for their own security, they proceed to the internet where they are greeted by an unbelievable amount of information on how to successfully bump through most common pin tumbler locks. They call us because they are worried.
Although this by-pass technique has been around for many years, the internet has helped to spread information that was once privy to only those trained in locksmithing. Free to anyone in cyberspace, this information could easily be used to exploit the weaknesses inherent in the vast majority of standard pin tumbler locks.
Now I have two choices. I can tell them it’s an over-exaggeration of the facts and that bumping really isn’t a threat to them, or I can tell them the truth. The truth is we don’t know exactly how prevalent key bumping has become. We do know how easily anyone can obtain detailed, step-by-step instructions on how to create and use bump keys. Do a little internet surfing for yourself. Try “key bumping how-to” as your search key words. Alarming, isn’t it?
The notion that this information isn’t being used by criminals is reckless and irresponsible. It’s low-hanging fruit for those with bad intentions. It has been proven that the instructions you can find online for bumping are accurate and can be used to easily create a functioning bump key. Some will learn to bump their way into places they shouldn’t be, and they will leave no trace. The fact is that everyday more and more people are learning this technique whether we want them to or not. It is our responsibility to make accurate and helpful recommendations to worried consumers when they seek our help.
I see the key-bumping media frenzy as an opportunity for locksmiths to educate the general public on the value of high security locks. Standard pin tumbler locks have always been more vulnerable to certain attacks than their high security brethren, but our industry has relied on restricting the sale of locksmithing tools and the guarding of information to maintain some “sense” of security. However, bumping requires no special, hard-to-acquire locksmithing tools, and the how-to knowledge in text and video form is all over the internet. In fact, to the untrained eye, a bump key doesn’t look much different than any other key. So now that the cat is out of the bag, how do we as responsible security professionals ensure that our customers are getting the protection they deserve?
First, we must acknowledge that these fears about key bumping are warranted. This is a real problem, but it’s not the only problem. Picking, drilling and the unauthorized duplication of keys are also just as severe of a threat, but are not as sensationalized right now. You, the professional locksmith and public’s educated security advisor are in a unique position to use this opportunity to educate the public about the solutions that lead to better security, including high security locks. Armed with the proper knowledge, consumers can make informed decisions when choosing how to secure their homes and businesses. They will not find this knowledge at the local do-it-yourself big box retailer. The only place that they can get this advice is from you, the security professional.
Second, law enforcement must become more involved in dealing with this problem. Right now bump keys are available for sale online to anyone, and can be shipped through the U.S. Mail with no restrictions whatsoever. Bump keys are burglary tools and should be recognized as such. Trouble is, the authorities are generally unaware of what bump keys look like and how they operate. More education in the law enforcement community is urgently needed. To their credit, ALOA, the Builders Hardware Manufacturer’s Association, and The National Crime Prevention Council are taking steps to educate their members, law enforcement, postal authorities, and the public to this emerging threat.
Third, we must find ways to encourage change within the security industry. Recognition of the bump attack in high security standards would be a great step forward. UL, ANSI and BHMA do not currently test locks to determine if they can be bumped. A benchmark level of resistance needs to be established in order rate high security locks for susceptibility. The addition of bump resistance testing to the current ANSI/BMHA 156.3-2003 and UL 437 standards would provide consumers with information necessary to make a more informed decision when choosing a lock for their home or business.
With all that said, let’s look at how high security locks can thwart bumping attempts. Perhaps the biggest advantage that high security locks have is that they offer several layers of protection which all work in conjunction with each other.
One of the key ingredients in the bumping recipe is the key itself. Most instructions on the internet start by modifying a key blank into a bump key. The majority of locks out there do not offer any type of protection from unauthorized key duplication and key blanks are readily available on the open market. High security key blanks are not as widely distributed as standard key blanks. Those protected by utility patents are even more limited in their distribution. If you can’t get the blank, it’s harder to make a bump key.
How about modifying an existing key into a bump key? Again, without the proper key cutting equipment this would be difficult. Using a file to modify a high security key is theoretically possible, but usually doesn’t produce the accuracy that high security locks require – especially when you are trying to make a key function properly when it is not designed specifically for that lock.
Besides, the key is only one part to the high security puzzle. Secondary locking mechanisms such as rotating discs, angled cuts, side bittings, pin-in-pins, sidebars and security pins are extremely difficult to defeat using a bumping attack. This is because these mechanisms typically do not use the same type of motion that is used to split the pin tumblers as the bumping attack. For example, bottom pins in a Medeco 3 cylinder must not only be elevated to the proper height, their spacing is variable and they must be rotated into a specific position in order for the legs of the secondary locking sidebar to engage a special slot in each pin. The chaos of a bump attack is in direct conflict with the accuracy required to properly elevate and rotate these pins into the correct position.
High security locks are built to fend off a variety of attacks.
Some high security locks also contain additional mechanisms that make bumping (and many other attacks) even harder. Sliders, check pins, special keys and keyways that “snake” into a cylinder, and even magnets are all being employed by various high security lock manufacturers. High security locks are designed to foil many surreptitious entry attempts. Since bumping takes advantage of a fundamental weakness in standard pin tumbler locks, choosing high security locks is the first step in beating the bump.
Realize that as a security professional, you have an immense amount of value to your customers because of the knowledge you possess. An opportunity to educate the public about the advantages of high security locks has been placed right on our doorsteps. The news stories are just going to keep coming, and the internet is going to continue to spread bumping knowledge. If we chose to ignore key bumping, it will not go away.
