Lock bumping is a lock picking technique for opening a pin tumbler lock using a specially crafted bump key, rapping key or 999 key.[1] A bump key must correspond to the target lock in order to function correctly.[2]
History
A US patent first appears in 1928 by H. R. Simpson called a rapping key.[3] In the 1970s, locksmiths in Denmark shared a technique for knocking on a lock cylinder while applying slight pressure to the back of the lock plug. When the pins would jump inside of the cylinder, the plug would be able to slide out freely, thus enabling the locksmith to disassemble the lock quickly.[4] The use of a bump key was not introduced until some time later and was first recognized as a potential security problem around 2002–2003 by Klaus Noch, who brought it to the attention of the German media.[5] After further examination of the procedure, a white paper was drafted in 2005 by Barry Wels & Rop Gonggrijp of The Open Organization Of Lockpickers (TOOOL) detailing the method and its applicability.[6] A patent exists for a lock device following the same principle as the bump key from 1926–1928.
Marc Tobias, an American security expert, began to talk publicly in the United States about the technique and its potential security threats. In 2006, he released two further white papers regarding the technique and its potential legal ramifications.[4]
Mechanics
In a pin tumbler lock, when the correct key is inserted, the gaps between the key pins (red) and driver pins (blue) align with the edge of the plug, called the shear line (yellow).
A pin tumbler lock is composed of a series of spring-loaded stacks called pin stacks. Each pin stack is composed of two pins that are stacked on top of each other: the key pin, which touches the key when it is inserted, and the driver pin, which is spring driven. When the different length key pins are aligned at their tops by the insertion of the correspondingly cut key at their bases, the tops of the key pins and, consequently, the bases of the driver pins, form a shear line, so that the cylinder can be turned, rotating the key pins away from the driver pins. When no key or the wrong key is in the lock, pin misalignment prevents the cylinder from turning.[7][8]
To bump a lock, a person inserts a bump key into the key way one notch (pin) short of full insertion, then bumps the key inward to push it deeper into the key way. The specially designed teeth of the bump key transmit a slight impact to all of the key pins in the lock. The key pins transmit this force to the driver pins; the key pins stay in place.[9] This is the same physical phenomenon seen in the desktop toy Newton's cradle. Because the pin movements are highly elastic, the driver pins "jump" from the key pins for a fraction of a second, moving above the cylinder (shear line of the tumbler), then are pushed back by the spring. With no other forces applied, the driver pins would come back to rest against the key pins once again, but the person applies a light rotational force to the key during the process and this causes the cylinder to turn during the short time that the driver pins are above the shear line, thus opening the lock. Lock bumping takes only an instant to open the lock. The lock is not visibly damaged, although the force of the bump can leave an indentation on the front of the cylinder. Certain clicking and vibrating tools designed for bumping can also be used. These allow for rapid repetition of bumping. Though some locks have advertised "bump proof" features, only a rare few key-pin locks cannot be bumped.
A different tool with a similar principle of operation is a pick gun.[3]
Use by criminals
Lock bumping is a trend in burglaries,[10][11] as the technique can make it easy and fast to break into homes without needing too much special equipment or leaving any trace of forced entry. It works almost as well as having a key,[12][13] and a set of ten rapping keys can make the criminals capable of opening 90% of common tumbler locks.[citation needed]
High-quality locks may be more vulnerable to bumping unless they employ specific countermeasures. More precise manufacturing tolerances within the cylinder make bumping easier because the mechanical tolerances of the lock are smaller, which means there is less loss of force in other directions and mostly pins move more freely and smoothly. Locks made of hardened steel are more vulnerable because they are less prone to damage during the bumping process that might cause a cheaper lock to jam.
In the United Kingdom, a British standard TS007 Kitemark has been legislated which benchmarks the effectiveness of bumping at 1-star level and 3-star level. The former implies a minimum bump time of 1 minute while the latter offers much greater protection at a minimum bump time of 10 minutes.[14]
Security pins (e.g. spool or mushroom pins)—even when combined with a regular tumbler mechanism—generally make bumping somewhat more difficult but not impossible.
Because a bump key must only have the same blank profile as the lock it is made to open, restricted or registered key profiles are not any safer from bumping. While the correct key blanks cannot be obtained legally without permission or registration with relevant locksmith associations, regular keys can be filed down to act as bump keys.
Trap pins that engage when a pin does not support them will jam a lock's cylinder.
Another countermeasure is shallow drilling, in which one or more of the pin stacks is drilled slightly shallower than the others. If an attempt is made on a lock that has shallow-drilled pin stacks, the bump key will be unable to bump the shallow-drilled pins because they are too high for the bump key to engage.
Locks that only use programmable side bars and not top pins are bump-proof. BiLock is an example of this technology. Many bump-resistant locks are available which cannot be easily opened through the lock bumping method.
Time locks, combination locks, electronic locks, electromagnetic locks, and locks using rotating disks, such as disc tumbler locks, are inherently invulnerable to this attack, since their mechanism does not contain springs. However, some electronic locks feature a key backup that is susceptible to bumping. Warded locks are not vulnerable to bumping, but they are vulnerable to a similar attack called a skeleton key, which is also a filed-down key.
Changing the spring tension can help reduce bumping. A few sources inside the industry offer stronger top springs for conventional pinned locks. Changing one or two top springs to a firmer spring changes the ricochet tuning of the top pins, making it hard to bump.
