Schneier on Security

Roger • March 25, 2009 6:50 AM

I took the URL of this story and read it later — which inspired me to write a long, scathing essay and come back here to comment. Alas, I see that many posters have already covered a lot of my points, thereby saving you from my really, really long post! So in greatly truncated form:

1. I also noticed that the story given by Notarbartolo [hereinafter "N"] is riddled with anomalies, most of which concern the roles of "the King of Keys" and the supposed diamontaire conspiracists. The only major anomaly that no-one else has pointed out yet is that if N's story is completely correct, then the numbers don't stack up. If most diamontaires have only one safe deposit box (which is logical, as you could fit hundreds of kilos of diamonds in each box), and if conspirators' boxes normally hold an average value broadly similar to non-conspirators' boxes, then the conspiracy would have had to involve over 80 people, which is not plausible. You can get these numbers down slightly by assuming that the conspirators comprised a cartel of only the wealthiest and most succesful diamontaires, but to get them below, say, half a dozen people, they would each have to control 70 times as much diamond trade as the industry average. This creates numerous additional problems: a) no motive: these are guys dripping with success who stand to face total ruin from a highky risky venture which will at best increase their income by a tiny fraction of what they get by preserving the status quo; b) easy identification: if N's story is true, and the trade distribution really is skewed enough to make it make sense, there will be hundreds of people who can immediately and easily identify the people behind it; c) no means to profit: whether or not the police are happy, you can be sure the insurance companies will not close their investigation until they get every single one of their darn diamonds back. As part of their policies and relationships with diamontaires, it will be easy to audit their transactions. Which will make it nearly impossible for a small group of highly suspect conspirators to move this large volume of unaccountable stones, so they will be sold for a pittance and little profit can be realised.

Taken with the several other anomalies that others already pointed out, N’s diamontaire conspiracy story is clearly bunk. So why did he spin it, and why wait till now to do so? One possibility is that it may sow confusion and dissent among the ranks of the victims, which might help him if they were campaigning against him getting parole before revealing the location of the loot. That would explain why the story is being released now, when it surely didn’t take 6 years to cook it up and square it with his cronies. But it could also be diverting attention from the real “fifth man” by nominating a suspect who might have provided inside information, but is as different as possible from the real accomplice. If we look at the type of information the inside man seems to have provided, it actually looks a lot like a guard. And a guard would have far more motive for doing it, especially if employment conditions were bad, as I suspect they were (more on this later.)

So as others have concluded, I suspect there were only 3 men on the entry team, with N in the car outside, and the 5th man detected by cell phone records but not caught was in fact their inside man, who was more likely than not a guard. The whole baloney about a diamontaire conspiracy is to shake suspicion off the real fifth man because N still hopes to collect his cut, and maybe to rattle victims who are trying to pressure him in to giving back the loot.

2. While N tries to spin the story to display himself as a master criminal, in fact the whole gang seem to be comical blunderers. It is truly remarkable they got in at all, but of course, they didn't get away with it. Their most obvious screw up was the utterly inept garbage disposal, but there were numerous other points where they did the wrong thing and got away with it only by sheer luck, or perhaps inside assistance. I don't want to enumerate them for fear of giving advice to burglars, but one in particular is worth discussing. As has already been mentioned, when "the Monster" shorted the wires on the photosensor, this should have immediately tripped a line impedance monitor and activated the alarm. The fact it did not do so may be because it was a very cheap system that didn't have line impedance monitoring, or it may be because it was a faulty installation where the line terminating resistor was too close to the controller, or even missing.

Either way it doesn’t matter, the interesting point is that they took the very considerable risk even though the sensor was already defeated. This would seem to indicate one of two possibilities: either “the Genius” was a fool who didn’t really understand modern alarms, and happened to get lucky because his opponent was just as incompetent as himself; or else they had somehow found out that this sensor could be safely shorted. In large commercial systems, where the controller is completely separate from the keypads, you cannot reliably determine the presence of impedance monitoring by visual inspection of parts visible to the public. Thus to discover this flaw, it seems certain that someone told them. Now the other customers using the vault would not be privy to such details. The other options would be the alarm company, or the site guard force. In a well ordered system, even the guard force should not be privy to such technical details, which implicates the alarm company. But on a slack site with a poor security culture, the information may have found its way to a guard, and as we noted, a lot of the other signs point to a guard. Another possibility is that N had corrupt contacts both in the alarm company and in the guard force. If he was working alone such a coincidence would seem quite unlikely, but if he was indeed working for organised crime it is plausible.

3. Like several other commenters, I was astonished at just how slack security was at this high risk facility. However some people seem to think it was just a case of too many holes in the Swiss cheese lining up, or management errors overriding a basically sound design. I would like to emphasise that in fact the place seems to have had an endemically poor security culture. In every aspect we see abject violation of well-known techniques and even written standards: from basic design principles through to routine drills, almost nothing was done right. Rather than reiterating a lot of points that have already been made, I'll just highlight some points that show fundamental violation of well-understood principles:

• Lack of time locks. As previously mentioned, time locks are such a good thing that they are almost universal on high security vaults, and failing to have them is understood as creating a severe personal danger to the key custodian. If you have a business model which absolutely requires short notice access at odd times, then you can do without time locks — but only if you replace them with a 24 hour armed guard presence, which is extremely expensive. There is no option ‘C’; having neither time locks nor continuous guarding is slack, unprofessional design that shows contempt for the safety of your staff and the security of the vault contents. (As the key custodian was apparently a low ranking guard, the lack of time locks may reflect a culture lacking respect and consideration for junior employees.)
• Putting a vault two storeys underground is NOT a good design as it makes a low probability attack (tunnelling) only slightly harder but makes monitoring much harder. When vaults were extremely heavy, for structural reasons they would be put one storey underground, with the roof in a high visibility, high traffic area like the lobby. Modern vaults are made from tougher but lighter construction and so can be put on the ground floor or even in an elevated position, sited so all 6 surfaces are under constant observation. This makes slow covert attacks like tunnelling completely impossible. Putting the vault in a deep basement level suggests it was an inconvenience that had to be tucked away somewhere it didn’t intrude.
• The most important goal of vault design (and secure storage in general) is to detect an attack in progress before the attackers commence breaching the main physical barrier. If you can achieve that you almost certainly win, since even the most violent attacks cannot move through the building, breach the barrier, collect the loot and leave faster than the response force arrives. Hence, it becomes apparent that the most important part of the vault isn’t its walls or doors, but the alarm design in the outer periphery of the secured area. These intruders needed to bypass only two cheap, moderate security sensors (a PIR and a window perimeter switch) to get from the street all the way to the vault door. That’s the level of security I expect in a coffee shop, not in a diamond vault!
• As has already been mentioned, the described method of bypassing a sensor by shorting its wires will not work on most modern sensors that are better than budget grade, because it will immediately trigger the line impedance monitors. One commenter noted that even if you have line impedance monitors, they sometimes may not work if they have been installed incorrectly. Fair enough, but it still suggests that, similarly to the alarm sensors outside the vault, the inside ones are either very cheap models and/or sloppily installed. Combined with all else we have noted, and combined with the fact they had so few sensors (mostly using sensing technologies that are very cheap but relatively easy to defeat) continues to paint a picture of very poor security culture.

• Their morning routine seems to have involved a solitary guard deactivating the alarm, unlocking and dialling the combination. This is outrageous. Even in tiny rural bank branches this is a two man job, and for high security it should be a three man job, with the key custodian rotating through a secret roster of trusted guard supervisors. Leaving it to one man is not only a serious security risk to the property of the vault users, but also endangers that man’s personal safety and family. This once again indicates not only that the whole site has a endemically poor security culture, but a poor treatment of their guard force, who might thereby be considered easier to corrupt.

There. Pretty darn long, but I assure you the original version was much worse!!

Roger • January 19, 2010 1:54 AM

@Flawless:
I had a look at the website of your book, and I have to say — I’m a little disappointed. As you would find from a quick read of the comments on this blog entry, most of the commenters here think that Notarbartolo’s version of the story was a load of baloney; that the heist was much less skilled than appeared at first glance (it was certainly not “flawless”); and that the crooks got as far as they did because the vault, far from being an impenetrable fortress, was actually quite poorly built and poorly managed.

Yet so far as I can tell from the excerpts and reviews on your site, you largely accept Notarbartolo’s story, and heap praise on both the impregnability of the vault and the extreme skill required to defeat it. If that is the case I’m going to have difficulty summoning any interest in buying the book just to read Notarbartolo’s waffle again.

Oh, and a small aside: your list of “World’s Ten Biggest Heists” suffers from not being inflation adjusted. For example in inflation adjusted terms the 1963 Great Train Robbery is somewhat larger than the Graff Diamonds and Northern Bank heists.