Earlier this month, a retired New York City locksmith was selling a set of "master keys" on eBay:
Three of the five are standard issue for members of the FDNY, and the set had a metal dog tag that was embossed with an FDNY lieutenant's shield number, 6896.The keys include the all-purpose "1620," a master firefighter key that with one turn could trap thousands of people in a skyscraper by sending all the elevators to the lobby and out of service, according to two FDNY sources. And it works for buildings across the city.
That key also allows one to open locked subway entrances, gain entry to many firehouses and get into boxes at construction jobs that house additional keys to all areas of the site.
The ring sold to The Post has two keys used by official city electricians that would allow access to street lamps, along with the basement circuit-breaker boxes of just about any large building.
Of course there's the terrorist tie-in:
"With all the anti-terrorism activities, with all the protection that the NYPD is trying to provide, it's astounding that you could get hold of this type of thing," he said.He walked The Post through a couple of nightmare scenarios that would be possible with the help of such keys.
"Think about the people at Occupy Wall Street who hate the NYPD, hate the establishment. They would love to have a set. Wouldn't it be nice to walk in and disable Chase's elevators?" he said.
Or, he said, "I could open the master box at construction sites, which hold the keys and the building plans. Once you get inside, you can steal, vandalize or conduct terrorist activities."
The Huffington Post piled on:
"We cannot let anyone sell the safety of over 8 million people so easily," New York City Public Advocate Bill de Blasio said in a statement. "Having these keys on the open market literally puts lives at risk. The billions we've spent on counter-terrorism have been severely undercut by this breech [sic]."
Sounds terrible. But -- good news -- the locksmith has stopped selling them. (On the other hand, the press has helpfully published a photograph of the keys, so you can make your own, even if you didn't win the eBay auction.)
I found only one story that failed to hype the threat.
The current bit of sensationalism aside, this is fundamentally a hard problem. Master keys are only useful if they're widely applicable -- and if they're widely applicable, they need to be distributed widely. This means that 1) they can't be kept secret, and 2) they're very expensive to update. I could easily imagine an electronic lock solution that would be much more adaptable, but electronic locks come with their own vulnerabilities, since the electronics are something else that can fail. I don't know if a more complex system would be better in the end.