by Unknown
50 mm (min)
Cheek
plates
Figure 4.24 Anatomy of swivel-chain handcuffs.
Figure 4.25 Illustration of picking handcuffs.
Defenses against Methods of Entry
77
Figure 4.26 Handcuff shim pick and hinged cuffs.
Forced entry
Figure 4.27 Forced entry.
withdraws the series tumblers and forces the combination tumblers out of
the plug. Exert slight clockwise turning tension to the pick key with the soldered lever and withdraw the wire pick. Slowly reduce the turning force until you hear the combination tumblers click back into the plug. The plug will now turn clockwise and open the lock.
How do you get to Carnegie Hall? Practice, practice, practice!
Forced Entry into
Buildings
5
Aside from picking the locks, expedient forced entry into building can be accomplished by jimmying or shimming the door. If done well and with some luck, no marks will be detectable. Otherwise, the door, door frame, or nearby windows may be broken or marked.
Door Jimmy
The jimmy method involves prying the door jam or jacking it apart far enough (about an inch with mot locks) that the lock bolt no longer engages the striker plate. If a pry bar is used, the door stop is pried or slit away. A small auto jack may also be used by placing short pieces of 2 × 4 wood across the door, near the knob, and jacking the frame apart.
Door Shimming
Shimming is a method that uses a steel blade, wire, shim, or other tool to work the bolt back from the frame and striker plate enough to free the door.
A curved linoleum knife or putting knife can work well. Once the dead-
latch plunger is no longer engaged, the bolt can be forced back. The bolt plunger can be depressed ¼ inch or more, enough to move the bolt back
and allow opening. Spreading can be done with a pry bar, but will prob-
ably leave marks. Simple wooden wedges leave less scarring and detec-
tion of entry. Wider wedges spread the force over a larger area and leave some marks. Commercially available wedges may also be used (Figures 5.1
through 5.3).
Inward opening doors usually have a spring latch bolt that can be
opened with a Z-wire tool, which can be made from a piece of 0.062 wire.
Hold the tool flat against the door and slide it under the stop and weather stripping (if any). When the 2-inch end of the Z wire is under the stop, it can be rotated back toward you at the top. The 2-inch end will rotate between the door and the jam to contact the beveled edge of the bolt. The bolt must not be binding in the striker plate. It may be necessary to apply pressure on the knob and to force the door up, down, in, and out. If the bolt is free and not bound, the Z wire will retract the bolt enough to allow the door to open.
79
80
Advanced Criminal Investigations and Intelligence Operations
Figure 5.1 A common linoleum knife and door jam.
Dead latch
plunger
Figure 5.2 Door lock and dead-latch plunger.
Figure 5.3 Door wedge and door lock.
Forced Entry into Buildings
81
Cylinder Drill
If jimmying and shimming are not practical or possible, another method is to either drill or wrench out the cylinder. These methods will cause damage and are either last resorts or used for expedient forced entry. There are three common ways to drill the cylinder.
• First, drilling out the entire cylinder with a drill bit of that size (usually ½ inch).
• Second, drilling down the shear line (with a 1/8-inch drill bit) to drill through the pins.
• Third, inserting an uncut key blank into the keyway and lifting all
the pins to the top, then drilling a 1/32-inch hole about 1/8 inch
above the shear line. The hole must be perpendicular to the front
surface and pass through all the top pins. A small wire can be inserted
into the hole to hold the top pins when the key blank is extracted.
When the bottom pins drop down, the shear line is unpinned and the
cylinder will turn using a screwdriver.
Cylinder Wrench
The other method of expedient forced entry is wrenching. Again, this will cause damage and is a last resort. A rim cylinder is usually held by two
screws, and a twisting force will shear off the screws or wrench off the cylinder, allowing the retaining plate to rotate and operate the lock. Large pliers, channel locks, or wrenches may be used to twist the cylinder. If a wrench-resistant steel collar is used, drill two 3/16-inch holes 7/8-inch apart on the face of the cylinder. Drive in two 3/16-inch by 1½-inch dowel pins. With
about 1 inch protruding out, use a large pry bar or screwdriver between the dowel pins for leverage to wrench them.
Window Entry
Breaking glass is quick, but not very covert. However, in older windows with wooden frames, glass may be removed after chiseling away the putty and
replacing the pane after completing the mission. Latches may be unlocked
using a knife, putty knife, or similar tool between the upper and lower
panes. Drilling a hole up, at an angle, through the wood frame, allows a
wire or thin rod to be inserted through the hole to work the latch. A glass
82
Advanced Criminal Investigations and Intelligence Operations
cutter can cut a hole in the glass and duct tape or suction cups can be used to remove the piece, allowing you to reach through. It can then be replaced, but is likely to be discovered eventually.
Office Equipment and Furniture
Office equipment and furniture, such as file cabinets and desks, may require surreptitious entry. If the filing cabinet is empty, it may be able to be unlocked by turning it upside down to release the locking mechanism. This is usually only practical if it is empty, but if it is empty, there would be little reason for covert entry.
There are many types of locking mechanisms for file cabinets and
furniture, but most are similar. The locking bar is either moved up or down to engage vertical or horizontal ramps on the drawers. The locking bar is coupled to the lock by a link mechanism or cam. The locks usual y have a spring-loaded bolt that engages when pushed in. The bolt is retracted by turning the cylinder in the lock. The primary difference in such locks is the position of the bolt. Some are up, some down, and some to the side. This can be determined by inserting a shim, feeler pick, or 1/8-inch diameter rod along the side of the lock (Figures 5.4 and 5.5).
Figure 5.4 File cabinet locking systems vary greatly.
Forced Entry into Buildings
83
5/8''
Max 5/16''
29/32''
A
Padlock
Figure 5.5 File cabinet locks also vary greatly.
Once you determine the position and distance of the bolt, you can
bend the rod so that it can push the bolt in and pop the lock out into the unlocked position. However, some cabinets have brackets designed to prevent this method of covert access. An 18 inches tool that is ½–1 inch wide and 0.020 inch thick, made of flat spring stock, can be made so that the end will fit between the drawer ramp and the locking bar, allowing the ramp to ride over the locking bar.
If the bolt is in the top position and cannot be reached with a hooked
tool, you may try drilling a hole downward through the top of the cabinet over the bolt. A thin rod or stiff piece of wire can be inserted through the hole to retract the bolt. A 0.025 inch by 3/16 inch wide flat spring stock with a beveled end can be used to access the bolt through the cylinder’s keyway. The beveled end is used to engage the bolt and, with slight upward manipulation, should be able to retract the bolt enough to pop it out.
Most office desks, other furnishings, and home furniture with l
ocks
have conventional disc tumbler locks and can best be opened by tradi-
tional lock picking, as described earlier. Sometimes, the locks will actually have a code number stamped on the face identifying the key code.
(How convenient!) If the lock on any of these is damaged, the drawers
may have to be jimmied or the bolt may need to be sawed off. This, of
course, is not very clandestine, but then neither is a cabinet or piece of furniture with an inoperable locking mechanism. Finally, the lock can be
drilled. This is even less covert, but by this time stealth and secrecy may not be an option.
If you encounter a lock or locking mechanism that is beyond your skill
level, you may seek advice or contract the services of someone (like a professional locksmith) who is more skilled. Auto dealers, apartment managers,
and hotel managers may be able to supply keys to what you need to gain
84
Advanced Criminal Investigations and Intelligence Operations
entry to. Keep in mind that they may want to share this adventure by telling someone (everyone) and may not be as confidential as you need. If the dealer or apartment complex has a security officer (often an off-duty police officer) or the hotel has a house detective (hotel detective who is often a retired cop), they may be bit more reliable and eager to help. We stayed at the Watergate Hotel once and one of the bellhops from the days of the infamous Watergate break-in scandal was still employed there. You might be surprised to find how eager some of the folks will be to share stories (and information) with you. Store detectives and mall security may be equally helpful. (It pays to have contacts.)
Oh, while we are on the topic of Watergate and history (at least while
I am), it may be appropriate to provide at least one sobering reminder of the gravity of clandestine operations and the consequences of failing to
comply with all the legal requirements of such operations. During the
infamous Watergate scandal, when I was very young, I wrote a note to
President Richard Nixon. He wrote back a very congenial letter, which I
did not have the foresight to save. To avoid what he called a constitutional crisis, he wrote another letter not long after that. A copy is included here (Figures 5.6 and 5.7).
Figure 5.6 The infamous and still luxurious Watergate Hotel. (This book just would not be complete without mentioning the Watergate.)
Forced Entry into Buildings
85
Figure 5.7 President Richard M. Nixon’s letter of resignation following Watergate (initialed by Secretary of State Henry Kissinger).
Impressioning
Before discussing lock bumping it may be appropriate to take a moment to mention impressioning as an alternative. Impressioning can take two forms.
The first is the use on a key impression pad, used to press a key to reveal the key pattern and copy it (Figure 5.8).
Key-based (copying) impressioning focuses on obtaining a key for a lock
to duplicate it. A negative image of the key is created in a soft material, usual y clay or silicone, and a duplicate key is cast using the negative image. The casted key can be used to open the lock or duplicated further into a stronger material (Figure 5.9).
The second type of impressioning involves impressing a mark on a key
blank by twisting it firmly in the plug and moving it up and down to cause the mark on the blank. This action causes the marks to show on the top edge of the key blank blade. It is helpful to use a C-clamp, vise grips, or similar device to hold the key blank firmly. These impression marks are made by
86
Advanced Criminal Investigations and Intelligence Operations
Figure 5.8 Key impression pad and impressioning tools.
Figure 5.9 Master key to the White House (on display in Key West, Florida).
Forced Entry into Buildings
87
binding the pins in the chamber as you twist the key side to side. The points of the bottom pins dig into the top edge of the key blank blade when moved up and down. Then the marks are filed down two or three strokes at a time, using a Swiss number four file. Be sure not to cut too deep, keeping the cuts smooth and only where the marks show. If the marks disappear, the pin is no longer binding and you look for where the next bind occurs. Continue the file cuts as each mark appears until the key is completed and works. This takes considerable time. Do not make the cuts too narrow or the pins may rest on the slope of the notch instead of the bottom (Russell, 1979, pp. 11–12).
Lock Bumping
Lock bumping is a lock picking technique for opening a pin tumbler lock
using a specially crafted bump key. Bump keys are easy to make and can be created very quickly. They are keys in which all the cuts are at the maximum depth (999). They can be cut for standard pin tumbler type locks as well as dimple locks. The bump key pushes the pins up for a split second so that the plug can turn and the lock is opened. One bump key will work for all locks of the same type. With a bump key it will take only 1 minute or less for intruders to turn the lock and open the doors.
A 29-key complete bumping set (Figure 5.10) is available from various vendors, such as Bump-J (see http://bumpj.com/shop/product_info.
php?products_id=62&osCsid=b3d3737c9f0914017e3978877595cd65) for
about $50–$90. The vendor’s ad (on the mentioned web page) says as follows: This is the Complete 29 Bump Key set. This bump key set has been cut slightly deeper then the factory deepest specs, and uses the pull back method. This set includes all keys listed on www.bump-j.com. Keys included: Schlage SC1 Bump Key Schlage SC4 Bump Key Schlage SC20 Universal Keyway Bump Key Arrow
AR1 Bump Key Arrow AR4 Bump Key Kwikset KW1 Bump Key Kwikset
KW10 Titan Bump Key Ilco IN3 Bump Key Ilco IN33 Bump Key Corbin-
Russwin RU46 Bump Key Dexter DE6 Bump Key Yale Y1 Bump Key Lockwood
L1 Bump Key Master M10 Bump Key Segal SE1 Bump Key National NA6 Bump
Key S22-6 Bump Key S31 Bump Key WK2 Bump Key Weiser WR5 Bump Key
Weiser WR4 Bump Key Master M1 Bump Key Best BE2 Bump Key Master M16
Bump Key American AM3 Bump Key American AM7 Bump Key National
NA12 Bump Key Master M2 Bump Key Yale Y11 Bump Key.
From the earlier 29-key list (which is a little difficult to read, as is), the set includes the following:
1. Schlage SC1 bump key
2. Schlage SC4 bump key
3. Schlage SC20 universal keyway bump key
4. Arrow AR1 bump key
88
Advanced Criminal Investigations and Intelligence Operations
Figure 5.10 Twenty-nine (29) key set of bump keys.
5. Arrow AR4 bump key
6. Kwikset KW1 bump key
7. Kwikset KW10 Titan bump key
8. Ilco IN3 bump key
9. Ilco IN33 bump key
10. Corbin-Russwin RU46 bump key
11. Dexter DE6 bump key
12. Yale Y1 bump key
13. Lockwood L1 bump key
14. Master M10 bump key
15. Segal SE1 bump key
16. National NA6 bump key
17. S22-6 bump key
18. S31 bump key
19. WK2 bump key
20. Weiser WR5 bump key
21. Weiser WR4 bump key
Forced Entry into Buildings
89
22. Master M1 bump key
23. Best BE2 bump key
24. Master M16 bump key
25. American AM3 bump key
26. American AM7 bump key
27. National NA12 bump key
28. Master M2 bump key
29. Yale Y11 bump key
Bumping is not difficult, but as with most locksmith skills, it takes practice.
Here are the four (or so) basic steps to follow:
• First, get a key blank or a spare key for the type of lock you want to bump, making sure the key you
choose fits the lock you are attempting to defeat. If the key fits in the lock, there’s a good chance it will work for this purpose.
• Most locks of a particular model will accept all keys from that
model because only the teeth of the keys are different.
• That is, when you have a bump key for a lock manufactured by
ABC, it may well open all other ABC-model locks.
• Second, choose a bump key. You have two options:
• Buy the type of key for the model lock you are attempting to
defeat and have a locksmith (or yourself, if you are skilled and
have a lathe) lathe a 999 key, where all the valleys are at the deep-
est possible setting.
− Asking for a 999 key might be a little obvious to an attentive
locksmith.
• Cut your own bump key.
− Start with a copy of the key in question and use a metal file
to create your own bump key by filing all the valleys down so
that they are even with the lowest point in the teeth.
− This homemade bump key may not necessarily open all locks
for the model in question because a different lock may need a
key with even lower valleys.
• Third, insert the key into the lock and pull it out one click, so it is almost in all the way, but not quite.
• Finally, push or pull on the edge of the key (applying tension or torsion) in the desired turning direction and strike ( bump) the back end of the key with something solid (a tool or something handy).
• The amount of tension required is equal to the amount of tension
required to open the lock.
If done correctly, the key will turn in the direction it is being pushed or pulled in and the lock can then be opened. If not, repeat this procedure until it works.
90
Advanced Criminal Investigations and Intelligence Operations
Garage Door Openers: High-Tech Burglary
Most garage door openers are control ed by switches on the garage wall or remote controls. The electric overhead garage door opener was invented by C.G. Johnson in 1926 in Hartford City, Indiana. The first garage door opener controls were simple and consisted of a very simple remote and receiver, which control ed the opener mechanism. The transmitter transmitted on a designated frequency and the receiver received the signal and opened or closed the garage door.