Just got back from the ELF 2009 convention in Warsaw Poland. A great event!

I did follow quite a few classes as the schedule had some interesting topics. And besides meeting old friends I made quite some new ones too. Not to mention my collection of tools also grew considerably (and my wallet is empty). I will share with you these hand made hobb’s picks, used to manipulate (simple) lever locks.

The most interesting tools are the one with three handles. I do not even now what specific lock these ‘three in one’ picks are used for, but I do like the technique used to make them.

I wrote in a previous posting about the popular orenco lock in spain that uses a simple yet effective countermeasure against a classical hobb’s pick. It seems the kind of pick shown above will be able to open these kind of locka because of the shape of the fingers/tensioner. Although I still I wonder why it is ‘three in one’? Is the middle feeler used to tension the lock? Anyone got an idea what kind of lock this pick was designed for?

The other hobb’s picks are regular ones that vary in diameter and shape, but nothing special.

Unfortunately we did not have much time to see Warsaw, but did manage to shoot some images of a high security door there. The door is not only protected by a Gerda high security lock, but also uses seals for intrusion detection. I did not have much time to figure out the details of the sealing mechanism, but is sure is intriguing …

(* update 19/05: MH made a nice comment: Interesting seal, it seems to use the owner’s fingerprint – for “normal” intruders there would be some kind of psychological barrier to leave their own fingerprints behind…)

All over Amsterdam billboards are popping up saying: “from now on, all that deserve PUNISHMENT will get PUNISHED”. It is a ridiculous poster by the Dutch VVD political party. And good old Viola did not like to see the threatening words ‘punishment’ and ‘punished’ all over the place and decided to fix the problem. She made prints with the words ‘something sweet’ and put them over the billboards. So now it says: “From now on, all that deserve SOMETHING SWEET will get SOMETHING SWEET”.

Isn’t she sweet?

(Dutch video about Viola below, and she also made the Dutch newspapers)

One thing that always fascinates me is high security keys and restricted keyblanks. And I always keep an eye out for new techniques and profiles.

The image above shows two keys to the (relatively new) EVVA ALS system. As you can see EVVA removed some material from the tip of the key, making that part much thinner. Flattening the tip is done by more manufacturers, like the Nemef/CES on the Dutch KM profile, and I was really curious how they made the core more thin on the tip. So when a friend got his hands on an EVVA ALS demo lock I could not wait to take it apart.

The solution by EVVA is clever … as always. They just milled a thin slot between pin 4 and 5, and inserted a small metal plate with the ‘thin tip profile’. A simple and elegant way of making your keyway more narrow. The image above shows you the keyway with and without the plate inserted.

The interesting thing is that if you make a key that is entirely as thin as the tip part, it will get stuck at the plate. The wide part of the original key will align the thin part right in front of the plate, while a complete thin one will hit the walls of the plate and need some jiggling to enter all the way.

All in all a pretty clever design …

I am here at the safe opening weekend and can tell you some monster safes are being opened as I type. As always the weekend is a great success, with safe techs from all over the globe attending.

One person who is a safetech and brought some tools to sell (like the electronic stethoscopes people here are found of) at the little marketplace here is Gerald from Berlin. And Gerald also is the inventor of the Gemini set up key. With this tool we finally managed to open the Gemini shield in the Dutch lockpick competition, and I now had the opportunity to ask him some more details about it.

One thing he did show me is a fifteen year old prototype (more images here and here). And since I know blackbag readers are curious I shot some images of the latest generation tool and the internals for you. Here is an overview of the tool, and here you see the pins used to keep the inner and outer pins in place. The inner pin can be changed in height by turning the knobs at the back of the tool.

The depth of the outer pins are changed using a screwdriver and the inner pin goes straight trough it (and is also threaded). I hope the images speak for themselves.

Geralds stories are interesting. And a little mysterious too. The tool was available on the free market for one year (for around 500 euro), and later just more or less disappeared from the popular lock tools catalog. Maybe not enough demand?!?

Anyway, got to go now … Rob just fired up his (by now famous) BBQ ….

Last week at the Amsterdam Toool meeting Jos and I experimented with the so called ‘Gemini make up key’ (also called ‘the gemini egg’). It is the round object in the upper right corner of the image. We came quite far opening lock 26 of our competition. But ‘quite far’ does not count, only a real opening does. Last night I received an MMS message from Jos with the title ‘Offen!’, showing he finally managed to open the Gemini at the Toool Eindhoven meeting. And end up with a working key ….

For people who do not know this lock: Han wrote an excellent article on the Gemini (.pdf)

More details soon …

Kwikset Smart Key Decoder – Shane Lawson from Deviant Ollam on Vimeo.

Building a decoder for the Kwikset Smartkey lock for around US$ 5.00

Not bad for a couple of fools 🙂

* update: Steffen saved the video file and even upgraded the quality quite a bit.
http://www.lockpicking.org/tmp/Kwikset_Smart_Key_Decoder_by_Shane_Lawson.wmv

I have good memories about being in court … as an expert witness on locks.

It is nice to be able to shed some light on a difficult problem and make the difference. The few cases I have been in court it was all about the insurance company not willing to pay. They claimed cars could not have been stolen because of very advanced anti-theft immobilizers and locks that could not have been opened without any signs of damage. In all cases Han Fey and me were involved they lost the case or paid straight away after reading our testimony.

There is no such thing as opening a lock without a scratch, as all mechanical tools to do so will leave marks. The problem for people looking for marks is that they should be aware of all opening techniques and tools. Each tool or technique leaves a different mark, and some marks can be really really subtle! And since there are a lot of techniques (some more known then others!), the knowledge of the forensic expert should be very wide.

So I am always keeping an eye out for information on forensics, and recently received a link to http://www.lpforensics.com

It is a very nice source of information on this topic. Worth your time, so take a look …

A small challenge: do you have any idea what this key was used for?

If you need help: here is a little hint

And the answer can be found here

* I am not 100% sure about the facts in the article, but we can discuss about that in the comments …

** Thanks to Nicholas Lennox for the link to this nice article

Babak Javadi of Toool.us did it again. He improved the design of the ‘last hope’ credit card size emergency pickset, and came out with a version 2.0. The previous set was just fine to me, but some people complained the metal was a little too thin (read: people were bending their picks). And the previous card was made and designed in a rush, and Babak could not incorporate all his ideas in it yet.

This has all changed in version 2.0 of the credit card sized pickset. Excellent quality steel, very nice serrated tensioners(!) and broken out picks can be put on your keyring.

Jos Weyers of Toool Amsterdam was kind enough to be the guinea pig and try the set for you. See him pick a toool competition lock with the new picks and rake open another one in this youtube video.

As promised some information on the safe opening weekend organized by Paul Crouwel and friends:

As any safe technician can tell you, there are not that many ‘penetration parties’ where lots and lots and lots and lots of high quality bank safes are waiting to be opened. In that respect Paul Crouwels parties are pretty unique. Parties like that are the ultimate learning experience, better then any class on the subject. Sure, there are people giving classes in safe opening, but sometimes that is nothing more then a sales pitch for safe opening tools. A sales pitch you have to pay a lot of money for to attend.

Back to the safe opening event: in safe opening it is all about experience. The best safecrackers are the ones that have the most experience, or with the best connections to people who can tell you what the internals of the target safe most likely will look like. In previous events the strategy to open safes was to drill a hole on a strategical place in the safe. This sounds easier as it is, and I always admire the craftsmanship that is needed to pull it off. Just think about it: you need to picture what is inside the safe and then try to drill away the element that keeps the safe locked, or in case of a combination lock drill until you are inside the heart of the lock and set the code by looking into it with a scope. Being off by a millimeter can cause you big trouble, not to mention the glass plates that can set off ‘relockers’ if hit (shattered) by a drill. If this happens, the safe will lock up, and even the original key and combination will not open it anymore (a mechanism to win time, safes that have the relockers fired can take a looong time to open).

As I mentioned before, at this event we tried to shift from drilling to picking and decoding safes. Just as with opening standard locks, there is nothing like opening a high security safe without a scratch. To do so requires the right tools, and Jord Knaap is becoming really good at making safe opening tools. His hand made Hobb’s picks are just as good, and sometimes better, as the stuff that is available commercially on the market. And Paul Crouwel was the first one to pick open a safe at the weekend. In about fifteen minutes the door of this monster safe swung open without a scratch. Later Paul tried his luck (skill) on another safe, but when it did not open in fifteen minutes decided to go for a smoke. When he came back, master lockpicker Julian Hardt was kind enough to have picked it open for him. Later that day Julian would repeat the job and pick open the lock on a heavy rosengrens safe.

Now, picking safe locks is one thing, decoding them is another. We were intrigued by learning about a defect in a specific safe lock that will allow you to ‘decode’ (or ‘read’) the combination of the levers. In short: all levers have different shapes, and if you can see part of the lever you can tell its combination. This requires a thin scope and a so called set up key. A set up key is a key that can be set to combination by inserting little pins that will lift the levers to a specific height. The key on this image is hand made by Jord Knaap. All preparations to open a safe this way were done in the weeks/days before the event. So it was a highly experimental exercise, but a very successful one. Jord could see the image of the levers on a small screen, while the other people could see it on a big external screen. Because for them it was a new technique it took them two hours to pull it off, but the result was an open and undamaged safe. And knowing the code of the setup key, a new key can be cut easily.

I could go on for a long time, as the event went on for three days. A lot of safes were opened, and more important: people had a lot of fun while doing it. Antique safes were opened and some more modern ones were opened. Images and measurements of each opening were recorded, and hundreds of images were shot. Some of them will be available on Paul Crouwels website (behind a password, safe technicians only). Locks were removed from drilled safes and will be used for practicing or turned into cut-away models. Under strict supervision there even was half an hour were the next generation safecrackers was instructed how real men open safes. During the weekend around thirty people participated. I would especially like to thank our new Greek friends for their attendance. It is always a pleasure meeting new people who invest time and money to learn new techniques and make new friends. Hopefully we will meet them at the next penetration party in one month!

That is right: In one month there will be yet another penetration party (May 1-2-3). Over thirty closed high security safes will be waiting for you. Paul asked me to specifically say the party is not an open house for everyone to attend. The invitation is for safe techs and savta members only. They will verify before you are allowed in. And if you attend and do not want (your techniques) to be mentioned on this blog that is fine too. I am sure you will be pleasantly surprised by the level of expertise and fun atmosphere at the event. Mail crouwel@xs4all.nl if you want to attend …