Schneier on Security

Clive Robinson • July 25, 2012 6:44 PM

As has been noted by some above hand cuffs are not designed to be fool proof etc.

The earliest “turnbucle” devices did not even have a lock, but were slow to put on a strugling person, which is why some people still prefered a piece of rope with the simple “handcuff knot” (make a small loop, and then put a loop through from both free ends to make what looks like a bow). It was fast to put on and could be secured with as little as a half hitch.

The one aspect of handcuffs not mentioned here so far is “what hapens when a prisoner has got the cuffs off”. Well in a lot of cases you have given them a realy nice little weapon to flail you with and then lock you up with much to your embarrassment (and this does happen from timee to time). I’ve seen a demonstration of somebody “sliping the cuffs” in just a few seconds.

In many places the “police procedure” was “two officers for attending a prisoner” where one would be close in and the second there incase the prisoner got free and started to fight etc.

But with manpower getting expensive this is changing and this has implications…

For instance searching a prisoner properly is a fairly complex and slow process and I’ve rarely seen it done properly (one reason is common decency another danger/health risks) For instance searching the mouth or between the leg and the scrotum etc.

The soloution to the problems of speed and decency has often been one based on false assumptions one of which is prohibited objects are “metal or large” so the solution is “a wand and pat down”. Oh and another dangerous assumption that gets people into trouble is “the guy before has done his job properly”…

Thus a plastic key is small not metal and easily hidden away with little or no problem.

One hiding place of old is the “false heal” and it’s got a lot worse in recent years due to changes in the manufacture of “low cost clothing”. If you look at the low budget end of footware you will find “man made soles” that are usually welded or heat glued to the uppers, these one piece soles are usually made in an “injection mold” and this puts not just cost but mechanical constraints on the design so quite often the sole is a “honeycomb” design that is if you look at one they are effectivly lots of square or round holes / tunnels sharing walls. The tunnels are closed at the bottom but left open at the top, and these get covered up with the inner soles that often are easily removable.

So all a person who thinks they are in danger of being handcuffed has to do is wear cheap shoes with a plastic key hidden there, when sitting or kneeling slip the shoe partly off and pull the key out (all of which can be easily assisted by a small loop of ribbon similar to what you often see in battery compartments to help get the batteries out). Then just slip the shoe back on and wait for an appropriate time to use the key and run off etc.

All of which is a bit elaborate in some respects, as has been noted by others above the weak point of hand cuffs is the quick close ratchet. In many designs the “pawl” cann’t be “locked” so simply shoving an appropriatly shaped shim down there will lift the pawl and allow the ratchet to slide back thus “springing the lock”. The shim can be as simple as the top to a common brand of ball point pen or the pen insert, a “zip tie” or even parts of a belt buckle, shoe lace tip, shirt collar stifener etc etc, the list is almost endless.

Even with cuffs where the pawl can be locked it is often either to much effort to do so or innefective for various reasons. One reason is the old escapologists trick of “tensioning” or “bracing” where by holding their body parts in certain positions and tensing up the muscles they can make the diameter of their wrists etc larger than they are in the relaxed state thereby gaining themselves “wriggle room” to slip the cuff off of the hand. To see how little wriggle room you need hold your hand out flat, then keeping the thumb stiff bring it across so the tip touches the gap between your middle and ring finger then whilst keeping the thumb and fingers stiff try to trace around the ring finger and little finger. You will with even a little practice find a possition where you can slip a tight bracelet over the thumb joint. If in doubt ask a bracelet wearing young lady to show you 😉

Unless you are a “customs officer” or very well trained security officer you would probably be surprised at just how many places there are to hide small but valuable items in/on a person and their clothing.

But getting back to the keys and the demo, I’m a little surprised by,

Then he precisely measured them with calipers…

This realy is not necessary I used to “cut keys by sight” and you can do it from a photograph provided you have a point of refrence for scaling.

The reasons for this are “standard parts” and “bind”.

A lock manufacture wants to minimise component inventory thus if you have a five leaver lock it’s an almost certain bet the width of the leavers are all going to be the same. Likewise the “cut depth” is going to be in standard units of measure and this can often be seen just by looking at the hight/depth of cut on the key.

Because a lock has to be used in many environments and tempratures and sometimes where the temprature changes fairly rapidly by over 50 degrees C (think outside winter to feverish body heat gives -40 to just under +40 C in a few seconds) “mechanical bind” is a serious issue. Thus the “bi-metalic” effects need to be given either serious consideration or mitigation. Generaly the route chosen by the manufacturers is mitigation by “clearence allowance” or what is in effect “slop” and it’s this that gives the “wriggle room” for lockpicking and all other illicit working of the mechanisms in a pair of handcuffs. In some cases and dimensions the slop can be well over 1mm.

So you might not even have to buy a key just see a photo of it in a manufactures catalog or on an online sale or other site.

But prisoners have “time on their hands” which is why Prison Warders have to be vigilant to keep keys out of sight from prisoners. Because with just one good look for a second may be enough for quite a few prisoners to cut a key a few hours later in their cell etc. And yes this has been done by prisoners many many times over the years.

Some people may remember that Bruce had a page where a Prison put in “electronic locks” that had “bio-metrics” and within days prisonerss were getting through the doors into places they shouldn’t be in using very simple techniques.

There is an important security lesson there and even a life moral,

High Tech usually failes to Low Tech attacks, So High Tech Solutions are often more vulnerable over all.

Which is a fancy way of stating the “KISS principle” that “real world engineers” know oh so well and have the battle scars and war stories to prove it.