Amateur lock pickers assure us they're only looking for a challenge.
The attraction of lock picking for IT professionals is a natural, according to Douglas Chick. “Finding and locating weak spots and vulnerabilities are what computer people enjoy best,” he writes in the 114-page book, which also defines lock-picking terms such as jigglers, pins, plugs, tension wrenches and tumblers.
Douglas Chick swears he isn’t trying to teach anyone to break into your house.
The IS director’s self-published book, Steel Bolt Hacking, is his way to share his knowledge about and cash in on a growing “sport” among computer and network professionals: lock picking.
“Thieves are more inclined to use a hammer and crowbar than they are a lock pick,” says Chick, who lives and works in the Orlando area but keeps the name of his employer under lock and key.
The attraction of lock picking for IT professionals is a natural, according to Chick. “Finding and locating weak spots and vulnerabilities are what computer people enjoy best,” he writes in the 114-page book, which also defines lock-picking terms such as jigglers, pins, plugs, tension wrenches and tumblers.
Certified locksmiths say they are wary of the ethical ramifications of the general public learning to pick locks, though they aren’t surprised that IT pros are gravitating toward the skill.
“Hackers by their original definition are problem solvers, so it is a logical evolution,” says David Lowell, associate executive director for the Associated Locksmiths of America trade group.
Others, such as attorney and author Marc Tobias, say it’s hard these days for computer and network professionals not to think about physical security – including sophisticated master-key systems that feature unique keys for each lock but a master key that can open all locks – given the measures most organizations take to protect their equipment.
“IT people get into physical security by default. Their computers, networks and servers are not sitting in the middle of nowhere,” says Tobias, who created a stir earlier this year by calling attention to flaws in certain laptop computer locks. “They are locked in rooms that are generally [part of a master-key system]. If I can get access to your server, I can do a lot of damage.”
Chick’s no-frills book is one many instructional lock-picking references available, many of them online. These include the seminal Guide to Lock Picking, which also is known as the MIT Guide to Lock Picking, although the hacker community from that school has pleaded for those distributing and posting the manual to take “MIT” out of the title because they say their intention was never to have the guide distributed widely. Rather, they say it was meant to aid those carrying on the time-honored tradition of slipping into and exploring tunnels and roofs on campus.
Network administrator Grant Siebrecht, who works for an ISP in western Iowa, says he recently got turned on to lock picking after coming across a Web site called lockpicking101.com. “I bent some paper clips, took the clip off a mechanical pencil and proceeded to pick the lock on my filing cabinet. I was hooked,” he wrote on the site.
A network administrator and lock-picking enthusiast who goes by the online name RenderMan says he has participated in each of the first two lock-picking contests held at DefCon, an annual hackers’ convention in Las Vegas. In this year’s contest he popped a doorknob lock in 12 seconds to move on to the second round, but the 48 seconds it took him to solve a deadbolt lock in that round proved not nearly fast enough. “An overlap with one of [DefCon’s] war-driving contests left me fatigued and my hands shaking going into the second round,” he says.
Lock picking is a mix of technical know-how and feel. “Lock picking is accomplished by the manipulation of the lock by using your touch and listening to the bounce of pins and sometimes the smell of oil to the turn of the plug,” Chick writes in his book. He says it can take him a few minutes to undo a box of locks one day, then “struggle until my fingers hurt” another day.
Chick, who regularly dishes out his thoughts about the IT industry on his Web site – www.thenetworkadministrator.com – says he timed the book’s publication to coincide with this past summer’s DefCon 12 convention.
But the popularity of lock picking as a hobby among computer pros is hard to measure because those involved tend to keep quiet about it. They point to a patchwork of laws concerning the shipment and possession of lock picks. (One Network World contributor says French authorities recently confiscated his lock picks in Guadeloupe.)
Lock-picking hobbyists are more open outside the U.S. in countries such as Germany and the Netherlands, where clubs dubbed Sportenthusiasts of Lockpicking and TOOOL even have their own Web sites. (The group’s Web site says the three O’s stand for practicing Over and Over and Over.)
“Locksport events in the Americas are still really at the grass-roots stage, and little official management is done at this time,” says a Canadian locksmith who goes by the handle Varjeal at lockpicking101.com, where he is a forum moderator.
However, the overseas groups are starting to make their presence felt in the U.S. Eric Michaud, a junior at Ramapo College in Mahwah, N.J., and his friend Sandy Clark, a Linux systems administrator at Princeton University, say they expect to have a TOOOL spin-off club up and running in the next month or two. Among those interested in joining are a pianist and a dentist, Michaud says.
“We need to protect ourselves. We need to make sure people don’t join for the wrong reasons,” says Michaud, who has been prepping for this past weekend’s “Dutch Open,” an annual lock-picking event in the Netherlands.
In addition to treading carefully near law enforcement, computer-savvy lock pickers are learning to co-exist with traditional locksmiths.
“Locksmiths in North America take a pretty dim view of” the newcomers, attorney Tobias says. “Locksmiths still seem to think that everything is a secret.”
Marty Arnold, a certified master locksmith, says the Greater Philadelphia Locksmith Association limited the lock-picking contest held last month at its annual conference to locksmiths. “For security purposes we try to keep the art of lock picking from the general public,” he says.
Chick rewrote his book with the help of a couple of locksmiths, including Varjeal, after taking heat for an initial version that locksmiths denigrated as inaccurate and for bastardizing the terminology.
“They believe . . . that lock picks should remain in the hands of locksmiths and computer people should just stick to Internet porn. I don’t agree, of course,” he says.
