Securoseal

Source: security.org

Date: 24/7/2009 - originally released 13 September 2004

Description:  Report on TSA approved locks

Link: [Click here]

REPORT ON TSA-APPROVED LOCKS
TSA-APPROVED LUGGAGE LOCKS
Issued September 13, 2004 by Marc Weber Tobias

Overview

Increased security measures after 9/11 prevented passengers from utilizing padlocks to secure their luggage, because TSA required complete access to the contents of all baggage. As a result, a group was formed to coordinate between manufacturers and TSA to develop locks that could be locked by a passenger, but opened and relocked by TSA without disturbing the combination as set by the passenger. Travel Sentry has the responsibility of working with different manufacturers, TSA, retail vendors, and standards organizations.

The Transportation Security Agency has approved certain locks to be used by passengers to secure their luggage against theft of contents. An investigation by the author has determined that these locks are not designed to provide any measure of security and should not be relied upon to do so. There are five basic variations of locking mechanisms. Four of the five locks employ dual locking systems: combination and key.

Each passenger can set a unique three or four digit code, while each basic type of lock utilizes a bypass key, identified as TSA 001-005. Keys are carefully controlled by TSA staff at each airport. Each of the mechanisms that were examined in this report can be easily bypassed without any special tools or expertise, often in a few seconds. Passengers should not rely on these locks to provide any security.

Although baggage handling specialists point out that luggage can be easily opened by cutting outer material or circumventing the zipper, the real issue in the view of the author is the introduction of contraband by a third party, or a delayed detection of the theft of contents. This report examines each type of lock and its vulnerability to surreptitious entry.

ASTM Standards

The American Society of Testing and Materials developed a special standard to cover luggage locks, because the standards contained within specification F 883-04 for padlocks did not apply. Travel Sentry was instrumental in getting ASTM to adopt standard F 2348-04, which identify these devices as Privacy Locks.

The manufacturers must meet minimal requirements for resistance to forced entry, manipulation and decoding. In other words, the user should not expect nor rely upon any level of security in any of these padlocks. The devices that are discussed in this report should really be classed as resetting seals, rather than locks.

Baggage Security

There has been a significant problem with theft from baggage from the 1,500,000 bags that travel through our nations airports each day. Many arrests have been made of baggage handlers, and to a lesser extent, TSA employees. Although baggage security experts agree that it is virtually impossible to protect luggage from pilfering, there are certain precautions that make theft more difficult. The lock, as they point out, is not the weakest link in the chain. Soft material and zippers are. Approximately seventy percent of all baggage utilize zippers. Baggage handlers can use ball point pens to rip apart the zipper instantly, even if the bag is locked. They can steal contents, then slide the zipper back together. Another tactic is to use a nail file to pry up the base of the slider, detach the zipper pull, open and close the bag, then reattach the zipper pull.

One answer has been luggage designed with “kissing sliders.” This is a system with two small loops that intersect at the zipper junction. Padlocks are placed through the loops, making it more difficult to pry apart the teeth of the zipper. Protection is afforded because it is virtually impossible to open a bag between two sliders, or at the end of zipper pulls.

The author interviewed a baggage security expert with Travel Sentry to prepare this alert. He advised that the mission of his organization was to bring together baggage manufacturers with the lock industry to work toward the common goal of providing a lock that would allow bags to meet TSA criteria as to access and protect the public. The organization does not have any exclusive arrangement with TSA, but advises that one hundred percent of the industry works with Travel Sentry. There were no standards for locking devices used to protect luggage, so Travel Sentry was able to get ASTM to create one. They point out, however, that these locks should not be represented as a security devices by vendors. Essentially, the availability of these locks brings the passenger back to pre-9/11 standards, allowing them to better secure their luggage.

The public does not want to pay a lot for their locks, but they want protection. None of the locks that were evaluated in this report cost more than about ten dollars, and none provide any real security against surreptitious or forced entry.

Lock Manufacturers in the Travel Sentry Program

There are five original manufacturers that produce locks that carry the Travel Sentry logo. Each has adopted a different design philosophy, and each type of mechanism has a unique key that will function in an independent dual locking system that allows the passenger to use a key or combination and TSA to use a different key to open the lock. There are four combination locks and one key lock, identified with key codes TSA 001-005.

The TSA 001 was not tested for this report because it is a simple brass padlock that is set to an individual change key and one master key. The other four padlocks all utilize combinations for the consumer and keys for TSA. Some of the locks had three thumb-wheels, and some employed four wheels.

Interestingly, their designs were similar to the Targus Defcon CL, used as a computer cable lock and which was the subject of a security alert in August, 2004 on this site. The key locks for three of the five mechanisms utilizes pin tumblers; the TSA 002 utilizes four wafers, and the TSA 004 utilized no security at all, just a T-bar to turn a cam to the open position.

Each of the designs were found to be easily decoded through the use of a piece of paper or thin plastic, and would require little to no skill in doing so. The keys for these locks, shown in this report, were quite easy to replicate. TSA 002 and TSA 005 were extremely simple to simulate. As will be shown, the TSA 002 only requires a piece of plastic to be inserted into the pin tumbler lock to open it.

The original five lock manufacturers that produce the basic padlocks that are sold by virtually all vendors have been identified as follows:

TSA 001 NING BO XIANFENG ( China )
TSA 002 SINOX ( Taipei , Taiwan ) and Master Lock
TSA 003 Fullyear Brothers ( Taiwan )
TSA 004 CCL PRESTO LOCK and ILLINOIS LOCK COMPANY
TSA 005 SUNLOCK COMPANY ( Hong Kong )

Keys for TSA-Approved Locks

In fairness to TSA, there are strict inventory guidelines for controlling keys for these locks at our airports. All keys are numbered and controlled, which may reduce the ability of TSA employees to obtain or use keys improperly. Unfortunately, baggage handlers can obtain keys without any difficulty by purchasing a lock and making a key for it, or possibly taking it to an individual that has a minimal familiarity with locks and the procedure to make keys. It is doubtful if legitimate locksmiths would do so. The TSA 003 keyway requires nothing more than a 1/8” x .016” piece of brass to be properly cut. There is no real keyway, so no need to obtain the special blank that would be required. In the case of TSA 002, a ¼” x .016” piece of brass will suffice. The author actually used the plastic from a credit card (.030” thick) to simulate the proper blank and was able to easily open the lock. The TSA 005 keyway is the standard Master Lock M2 (small profile) that is used on millions of padlocks that are produced by the manufacturer. Finally, the TSA 004 is simply a square slot, requiring only a T-bar key, similar to that used in thousands of pieces of luggage. The author simply modified one of these keys to open the padlock. Interestingly, there are not statutes that prohibit the possession or trafficking in keys for these locks. Similar statutes do exist for postal and defense department locks, as well as for other security devices.

SPECIFIC LOCKING MECHANISMS

Common characteristics

All combination locks utilize either three or four wheels. All are programmable by the user. This is usually accomplished by dialing the correct combination, opening the lock, turning the shackle a half revolution and depressing it into the lock body while turning the wheels to the desired new combination. The wheel design for all four locks is essentially identical. That is, each wheel has ten slots shaped like the teeth of a gear. A rotating cam fits within each of the wheels and has a protruding tab that locks into one of ten notch positions. In all cases, the rotating inner cams are fixed to the shackle and must clear the tabs or gates that block vertical movement unless the correct combination is entered. Generally, these locks cannot be easily decoded by applying end pressure to the shackle. However, they can all be decoded by inserting a thin piece of paper or shim at the correct point on each wheel and feeling for the gate or protruding tab. Although each design is unique, they all share the common problem of shim decoding, as shown in the photographs for each lock.

Each of the key locks could be easily picked or manipulated open, although small picks are required because of the design of the keyway. In the case of the TSA 003, no tension wrench is required, as torque can be applied directly to the tailpiece that is attached to the end of the pin tumbler lock and which allows the shackle to be moved to an unlocked position.

TSA 002

These photographs show the internal four wafer locking mechanism and release of the shackle. The proper key is inserted and turned. This allows the wafer lock to be pulled downward, thereby releasing the shackle. This lock utilizes four thumb-wheels and has a four wafer key lock for independent control. When the key is utilized, the guard around the shackle is withdrawn, so the shackle is free to rotate without disturbing the combination. The lock is easily picked, However, this lock was the simplest to open through the keyway, using a variety of techniques. As shown, a piece of plastic from a credit card can be inserted into the lock, slightly manipulated up and down, and the lock will open. A key was also produced in both brass and plastic that had the correct bitting values, but the tolerances are so poor in this lock that it really does not matter.

Keys for the TSA 002 lock were easy to simulate out of plastic and brass.

With regard to decoding the combination, each wheel has an internal cam with a notch toward the bottom of the thumb-wheel. As with the Targus Defcon CL computer lock, a paper or plastic shim is utilized to probe the position. The only difference between the Targus and the TSA 003 is the offset that is required between the decoded positional value and the actual value of each digit.

This lock utilizes four thumb-wheels with ten slots. The tab on the associated cam is locked into one of the notches, thereby setting the combination. Note the notch at the bottom of the inside ring. These must be aligned to allow the shackle to move.

To decode this lock, utilize the non-riveted side, oriented with the shackle up. An offset of 5 digits must be added to each decoded digit for the true combination. The shim is placed in the center of each wheel, but the value is read in the index window. If the decoded digits, for example, are read as 4020 in the window, then the actual code for the lock is 9575.

TSA 003

The four digit combination lock is a clever design. A movable tailpiece is controlled by the four pin tumbler lock and can release the shackle when turned by the key. This piece can also be utilized to apply torque to the plug for ease in picking.

The TSA 003 is a four-digit combination lock with a four pin tumbler mechanism for TSA access. The key lock has four pin tumblers and is very easy to pick. A key was generated for this lock with standard brass stock measuring .25” x .016”, available at any hardware store. There are no wards in the keyway, thus a special blank is not necessary to produce a key. This lock is marketed by Brookstone, Franzus and other companies.

The consumer enters the correct four-digit combination to withdraw the shackle from the body of the lock. When TSA uses a key, a tailpiece rotates in order that the shackle clears the obstruction. Each wheel contains ten possible numbers and positions (1-0). As shown, there is an internal ring that is associated with each wheel. All of the rings must be aligned so that the double-wide gate mates with the protrusions that are cast into the lock body, at two points. There are six ridges that correspond with individual numbers, and two gates that are double-width, as shown.

Four rings are associated with the thumb-wheels. Note the notches that are part of each, which is affixed to the shackle. The thumb-wheel is aligned with the wide gating that is present on each ring. The wide gating is shown for each ring and is oriented in this photograph toward the left.

Decoding Procedure

The lock is oriented vertically with the key lock at the bottom left. The index marks for the combination numbers will be facing the user. The protruding tabs in the lock body will be immediately to the left of the index marks. If the factory combination is used as the standard (0000), then the tabs that interact with the gates are between the digits 0-1.The opposite tabs are between 4-5. The wheels rotate clockwise from left to right as the number increase. Double-wide gates are present between 0-2. In order to properly decode this lock, we are looking for four adjacent single ridges as the wheels are turned. The next digit to the right would yield the correct combination number for that wheel.

These photographs show the tabs that are cast into the lock body and must mate with the double-wide slots within the rings that are associated with each thumb-wheel. Not that the tabs appear in two positions (center and offset). The photograph (right) shows the insertion of a piece of thin plastic that is used to probe each notch in order to determine single or double-wide gates.

These photographs show the lock with its four thumb-wheels in the normal, locked position. At the left, note that each wheel makes contact with the internal rings that define the combination. As the wheels are rotated, the double-wide gates are aligned with the internal tabs on the lock body. In the photograph (right) the shackle is pressed downward into the programming position, so that the thumbwheels would be allowed to rotate freely. Only when the shackle is withdrawn slightly will the ridges on each ring mesh with the notches in each thumb-wheel, resetting the combination of the lock.

In our example with factory present combination 0000, we would probe the lock with the edge of a piece of paper or plastic at the index mark, as shown. We would find the following:
0 no notch 0-1
1 no notch 1-2
2 notch between 2-3
3 notch between 3-4
4 no notch 4-5
5 no notch 5-6
6 notch between 6-7
7 notch between 7-8
8 notch between 8-9
9 notch between 9-0

The combination would read 0 for each thumb-wheel, because it appears immediately to the right of four single-width ridges.

This key was constructed from standard brass stock, available at any hardware store.

The pin tumbler mechanism was easily disassembled and decoded for the proper bitting values. A pieces of brass stock was obtained from the local hardware store, measuring ¼” x .016”. This was cut almost in half to form a blank key. As can be seen, the bitting is not complicated, and there is no ward pattern that obstructs the keyway.

TSA 004

This lock relies upon virtually the same locking principle as utilized in the TSA 003, with the exception that there is only one double-wide gate for each ring associated with a thumb-wheel. The TSA 004 is a three-digit combination with a key lock. The key actuates a movable obstruction through a type of worm-gear that moves in and out to block or allow movement of the shackle independent of how the thumb-wheels are set. Three protrusions, which can be compared to individual fences, interact with the fixed cams that are associated with each thumb-wheel. If the gates on each of the rotating cams are aligned with the fence, then the shackle can move, based upon the entered combination. Although the design is almost identical to that of the TSA003, there is only one double-wide gate, rather than two that must clear mating fences.

These photographs show the action of the key, in the locked (left) and unlocked position. Note that the movable platen makes contact with the shackle and will normally block its movement unless the correct combination is entered. The three ends of the platen, shown below, interact with the doublewide gates on each ring. When properly aligned, the shackle is free to move, based upon the proper combination.

The key to open this lock is quite simple, as can be seen. It is inserted and turned a full revolution, driving a worm-gear and moving the platen. This key was produced from a standard luggage lock blank. Decoding is done in the same fashion as with the TSA 003, except that the offset is 5. Each wheel is decoded from the bottom, at the index mark. A double-wide gate is found in only one position. When identified, 5 is added for the actual combination for each wheel for the true combination.

The key for this lock was made in about one minute from a standard luggage blank. To open with the key, simply insert and rotate one full turn. This will release the shackle and allow it to retract, as shown in the photograph.

TSA 005

This is a four-wheel combination lock that utilizes a standard Master Lock M2 (small profile) keyway. A fourpin tumbler mechanism controls the shackle in the same fashion as described in the TSA 003. The design is almost identical. This lock is sold by many companies, including Master Lock and Samsonite.

The combination lock utilizes protruding tabs on each internal rotating cam for each thumb-wheel. The tab, as shown in the photograph, is at the bottom of each thumb-wheel, and is indexed into one of ten slots within the wheel. The tab for each wheel must align with a slot, shown in the photograph, in order for the shackle to be withdrawn. All four rotating cams are fixed to the shackle. To program the lock, the shackle is forced downward to clear the notches within each of the wheels.

These photographs show the protruding tab associated with each internal ring that is controlled by a thumb-wheel. When each ring is rotated to the proper position, the tabs will clear the slot, shown in the lower photograph.

To decode the lock, a shim is placed at the bottom side of each wheel, at the index mark which is equal to the position of the shackle. Each wheel is rotated until a slight protrusion is encountered. An offset of 4 must be subtracted from each value to determine the true combination for each wheel. Thus, if the indicated combination is read as 5771, the actual combination would be 1337. The offset is the difference in rotation between the index mark and the slot that each gate must clear, as shown in the photograph.

SUMMARY

It is clear that none of the TSA-approved locks provide any measure of security against covert entry. The question for the user must be “what security is required to protect my luggage from pilfering”? The answer clearly involves more than just locks, and perhaps luggage can never really be secured. The real concern of the author is the false impression that may be left with the consumer that if they utilize one of these locks to protect their luggage, especially if the luggage was left unattended in a hotel or other area, that there is a reliable indication of entry. As has been shown, this is clearly not the case. Would baggage handlers or others with access to luggage be able to open these locks without detection? That, of course would depend upon a number of factors, but the basic answer is probably yes, especially if a key is utilized.

The conclusion of this report is quite simple: do not rely upon these locks for any level of security. They are simply a form of expensive seal that can be reset. A knowledgeable individual can open any of these lock by decoding the combination, with very limited training or expertise. And, one can purchase these locks anywhere, so practice before theft is not a problem. Use of a key, of course, makes the task quite simple, and would allow virtually anyone that has contact with a piece of luggage the ability to open it.