Illegal Engineering

This post has been automatically generated. I use this blog to collect links that I have bookmarked. All activity is automated.

An illustrated lecture about the history of Safes and Safe breaking. The lecture is based round a large wooden safe with a video camera inside, projecting the inside of the door mechanism on a screen.
This is currently my favourite lecture to perform. There’s something very satisfying about the simple ingenuity of safes and locks. Its also an area of engineering design that has not been transformed by science or maths, and to me illustrates intuitive aspect of the subject, which often now gets forgotten.
illegal engineering.gif (8278 bytes)

In the last twenty years, the craft of safe cracking has tragically declined. It is no longer the glamorous activity featured in every other detective film, and the number of real criminal attacks on safes has fallen dramatically. So I’m delighted to see so many children in the audience as its time to start training up a new generation of safe crackers or it will become a lost art. I suspect this decline is linked to the general loss of practical mechanical skills – children today are no longer taught metalwork, just DT. A sound knowledge of metalwork would be very useful in breaking into a safe, but DT is no help at all.

At first glance a modern safe does look totally impregnable. The two locks, (one key and one combination) do not themselves open the door, they merely release the elaborate bolt mechanism. This pushes 50mm steel bolts out in all directions, securing every side of the safe door, even the hinge side. It is no use chopping the hinges off a safe, the bolts will still hold it as firmly shut as ever. If it looks virtually impossible to get in through the door, getting in through the walls or the back is no easier. They are about four inches thick, an inner and outer skin of steel, with the cavity between filled with extra strong concrete. The enormous weight of a safe makes it very difficult for thieves to carry it off, whole – it also makes the door very dangerous. Its extreme weight gives it such momentum when closing that it becomes a guillotine, chopping any fingers caught between door and frame.

Larger bank vault doors are often circular, with bolts that shoot out all round the edge. The reason for circular doors is simply that they are easier to make. Both door and frame can be cut accurately round on a large lathe to make them a snug fit. Getting a rectangular door to fit closely at every point is more difficult, particularly with its enormous weight, which can cause distortion.

Behind the door, bank vaults are massive, built in concrete structures. Criminals have had some success tunnelling their ways in. Adam Worth, a cerebrated Victorian criminal, made his initial fortune tunnelling into a bank in Boston. He then moved to England with his accomplice Piano Charlie where they both fell for an irish barmaid prostitute called Kitty Flynn. She eventually married Piano Charlie, but continued to sleep with both. Worth masterminded a huge variety of crimes in Britain, including stealing an entire diamond shipment from the Kimberley mines, and was not caught until 40 years later. He then, with his exploits publicised, became the inspiration for Sherlock Holmes’ adversary Moriarty. Both Worth and Piano Charlie died in poverty, but Kitty became a rich and litigious widow in New York.

Anyway, to counter the threat of tunnelling bank vaults started to incorporate ‘patrol passages’ round the outside to check no one is attempting to tunnel their way in. The invincibility of bank safes is so convincing that they are quite often left on open display (less so in Britain than most other parts of the world) as proof of the security of your money. Mies Van Der Rohe designed a particularly elegant bank in Torronto called the ’Transparent Bank’.

The need to keep precious and valuable possessions ‘safe’ is nothing new. The modern safe is directly descended from the medieval chests, now often found in museums and churches, used as collecting boxes. These chests were beautifully decorated, at first mainly made of wood, with iron hinges, locks and strappings. Later ones were entirely made of iron. The lids often had elaborate bolt work, like a modern safe. For extra security the keyhole would often be hidden under a secret flap, or disguised as part of the decoration. A few even had knives which shot out if the lock was tampered with. I’ve always admired these chests, they were obviously such important objects, so when my sister, who lived in Brixton, got burgled some years ago, I decided to make one for her. Large locks are great things to make, turning the key makes a wonderfully satisfying clunk, much better than any modern mass produced lock. To surprise the burglar, I incorporated a device that released a small explosive charge inside the lock when the key was turned, unless one of the side handles was first lifted. My hope was that this would be so unnerving that he would then run away. Unfortunately I never found whether it worked, my sister moved out of Brixton and hasn’t been burgled since.

 Building elaborate chests continued well into the 19th century. The price dropped dramatically as they started to be made of cast iron, an idea which dates from 1780, following the craze for cast iron coffins. There are some records of complaints as wrought iron was replaced by cast iron, the artistry of the blacksmith replaced by crude mass production, but that’s progress. Early in the 19th century one key idea was introduced, the double skin. It was realised that 100mm of insulation between the outer wall and the inner wall would provide great thermal insulation and protect the contents if caught in a fire. The most common insulation used was sawdust, though even greater protection came from filling the gap with water, an idea patented by Thomas Milner in 1830 (Milner is to this day one of the main British safe companies). The name ‘safe’ came from these new fireproof cabinets. At the time it was seen as astonishing that the contents of these safes could survive the heat of a fire (they were sometimes called Salamanders) and safe companies often staged public demonstrations, mounting their safes on large bonfires. Strauss was actually commissioned to write some music for one of these events, he called it the ‘Feufest Polka’. In fact, sitting on top of a bonfire is not a particularly severe test for a safe, real fires in buildings are often much larger and leave the safe buried under hot rubble for hours. Most modern safes will protect the contents against almost any fire – there is a famous example of a safe 300 metres from the centre of the atomic blast at Hiroshima, whose contents survived intact.

Cast iron was not the ideal material to use for victorian fireproof safes, it was too brittle. If a safe fell any distance in a fire it would certainly shatter. For this reason most safes came to be made of flat iron plates, riveted together into a box. This was a very strong form of construction, practically all large Victorian engineering feats used rivets – bridges, steam engines, ships etc. Even boilers with high pressure steam inside, were riveted together. Used in safes though, rivets had a fatal flaw. In the 1860s there were a series of robberies, particularly one in the city of London from the Cornhill Insurance Company, in which the thieves simply broke the rivets and peeled open the top of the safe. Breaking the heads off rivets is surprisingly quick and easy – you simply insert a cold chisel under the head and hit it with a large hammer. Fortunately the quality of steel was gradually improving, (it was becoming more ductile), and by 1900 a method of bending the outside walls of a safe from a single sheet of steel had been perfected. This bending process, which could be done with up to 12mm thick steel, produced the rounded edges and corners that have characterised safes ever since, even though safes today are square boxes again, made of flat plates welded together.

With the structure of the safe improved, attention turned to the locks. The medieval chests had very impressive looking locks, and even more impressive looking keys. Inside the lock, the key passes through a ward, a plate cut to a negative of the profile of the key. The top edge of the key then pulls the lock’s bolt back, opening it up. Although it would be very difficult to make an exact copy of the real key, anything the right height that will fit through the ward will open the lock. Minimal fake keys like this came to be called skeleton keys. Because of this weakness more secure ‘lever locks were introduced in the 18th century, culminating in the ‘unpickable’ lock invented by Joseph Bramah in 1784. Bramah was a prolific inventor, he invented the hydraullic press and the WC amongst other things. Amazingly, his lock is still manufactured today, virtually unchanged, in the UK, I recently bought one for about 」100. The key is a cylinder with tiny grooves cut in it. No skeleton key could open his lock and it remained infallible for 67 years, until it was finally opened at the 1851 Great Exhibition by an American locksmith called Hobbs. Instead of a skeleton key Hobbs used a selection of picks. The principle of picking a lock is to insert two thin springy strips of metal into the keyhole, one applies a small turning force, while the other ‘feels’ the various pins or levers, lifting them inside the lock. When one reaches the right height, a small ‘give’ can be felt in the turning pick. With luck, as long as the turning force is maintained, the pin will stay raised while the feeler pick works on the next pin. This is not easy to do – the process has been described as being like Sysiphus; you just get to the last pin and then something slips and they all fall back and you have to start all over again. I have never managed to do it. 

It took Hobbs 51 hours to pick Bramah’s lock. The reason for Hobbs perseverance was to convince people of the superiority of his own ‘Champion Parautoptic Bank Lock’ (Paraupoptic means preventing internal inspection). In fact Hobb’s lock did less well than Bramah’s, it was picked within 5 years by another American locksmith called Linus Yale, simply using a wooden key. One distressed bank manager wrote; ‘ Mr Yale picked my ten tumbler (Hobbs) lock, the finest of its kind, for which I paid $300. He cut a wooden key solely from inspection of the lock through the keyhole, which turned the bolt back as readily as my own key would have done. And then, to complete my discomforture, he cut away one bit of his wooden key and locked it so I could have never again unlocked it with my own key.’ Like Hobbs, Yale had his own design of Champion bank lock. (This game, revealling the lack of security of the rivals products is very similar to today’s game, cracking computer encryption software). Yale’s son, another Linus Yale, wanted to become a portrait painter, but eventually followed his father, inventing the standard ‘Yale’ lock used on front doors ever since.

Though Yale senior’s champion bank lock was never picked, he later decided that it was in theory pickable, as is any lock which leaves its pins or levers exposed through sight or feeling through the keyhole. For this reason, he changed tack and invented a combination lock – with no keyhole. Perhaps because it was an American invention, combination locks are to this day more popular in America than in Europe.

A combination lock is elegantly simple inside, I made a crude model of one in a couple of hours. There’s no way of picking a lock like this without any keyhole. It also obvious that there’s no click or other noise as the tumblers reach their correct position, the only noise is when the lever finally descends into the slot, once the right combination has been dialled in. I used to think the use of stethoscopes was a big myth of safe cracking, until a couple of years ago when a real safe cracker introduced himself at the end of my lecture. He told me the stethoscope is only useful when used in conjunction with a large dial and pointer fixed to the safe (something I’ve certainly never seen in the movies) Its a slow process which takes hours, listening to the slight noise of the lever touching the tumblers and marking where the pointer is on the dial, then moving the tumblers a bit between each reading. With hundreds of readings, its possible to ‘map’ the very slight eccentricity of the tumblers – the lever is unlikely to touch all three simultaneously. Once you know which of the tumblers the lever is touching, its relatively simple to find the exact combination. The safecracker I met was an electronics engineer who had been automating the process for a gang.   

However, there are other less elaborate ways to crack a combination lock. The nobel prize winning physicist, Richard Feynman, became very interested in combination locks while working on the atomic bomb in Los Alomos during the second world war. The scientists were rarely allowed to leave the site, so there wasn’t much to do when he wasn’t working, and safe cracking became a sort of hobby. As the project was all top secret, every office had combination locks on its filing cabinets. Feynman first discovered, playing with the locks on his own filing cabinet, that the numbers did not have to be that precise, each one could be up to two digits either side of the true number and the lock would still open. This enormously reduced the number of possible combinations (from 1,000,000 down to 8,000). With practice he found he could try 400 different combinations in half an hour, so trying every single combination it would take on average 4 hours to open the lock. A modern version of this, advertised on the internet, is a motorised German device that turns the dial, trying every combination in turn, for use by locksmiths trying to get into a safe whoes combination has been lost.

Feynman’s next technique depended on his visiting an office during the day, while the lock was open. While chatting to the occupant of the office he would idly fiddle with the lock. He turned the simply turned the dial back and forth, going one number further each time. After each number he would turn the dial back to see if the lock would still open. The number he reached when the lock first refused to open again was the first number of the combination. With a slightly more lengthy version of this he could find the second number as well.

Feynman’s final approach was to use psychology. Surprisingly often combination locks are left on their factory settings, (usually 100, 50, 100). However, when a new combination is chosen the person entrusted with it lives in fear of forgetting it. So, people tend to use numbers they know, like their birthday, or their phone number. At Los Alamos the scientists often used mathematical constants like pi. If anyone does choose random numbers, they are almost certain to write them down somewhere, often thinly disguised in address books. By the end of the war Feynman had a record of almost everyone’s combination and a fearsome reputation as a safecracker. 

Although it is possible to ‘crack’ a combination lock, its rarely a method used by criminals, or even by safe manufacturers called to open a safe whose combination has been lost. Many safes have time locks, so even if the combination is cracked, the safe will not open outside office hours. All post offices have time locks on their safes. Many safes also have a simple microswitch inside the combination lock connected to the alarm system to trigger it whenever the dial is turned. For these reasons, most attempts to break into safes by-pass the lock altogether. One method is to ‘drill’ the door. With engineering drawings of the bolt mechanism, it is possible to find a point on the safe door to drill through. A screwdriver can then be pushed through and manipulated to release the bolt mechanism – by-passing the combination lock altogether. Without precise knowledge of the mechanism, it is almost impossible to find the right place to drill, particularly because special extra hard, drill resistant materials are used around the vulnerable lock area. These extra hard materials include Tungsten carbide and ceramics – the materials used as cutters in modern machine tools. There’s also sometimes a layer of ordinary steel washers or ball bearings. These aren’t particularly hard, but they spin round when a drill bit touches them, so are almost impossible to cut through. There’s one story of a bungled attack on a safe in which the thieves kept having to fetch cans of coke from a nearby drinks machines to pour over the drill bits in an attempt to keep them cool. The safe was discovered, unopened, the next day, surrounded by empty cans and broken drill bits embedded in the door.

The extra hard layers could quite easily be incorporated over the entire lock area, making drilling completely impossible. However ,drilling is the normal method used by safe manufacturers when called to open up their safes, so I suspect manufacturers must deliberately leave a gap somewhere.

A popular alternative to ‘drilling’ safes is to use explosives. Gunpowder was used with some success in 19th century America, simply pouring it in through the keyhole. The shock burst the front plate of the door open, making the bolt mechanism accessible. There was a simple solution to this form of attack, the ‘powderproof’ lock. This was a close fitting tin box round the lock which simply limited the amount of gunpowder that could be poured in. With only a small amount of gunpowder, the force of the explosion was not great enough to burst open the door. The introduction of much more powerful ‘high explosives’ presented more of a challenge, particularly after the first world war, when many soldiers with first-hand experience of using them returned to civilian life. It was during the 20s and thirties that safecracking gained its notoriety. Perhaps the star safecracker of this golden age was a man called Chapman. He started simply prising the back off an old riveted safe in the Fyffes banana factory, but soon progressed after robbing a welsh quarry of gelignite and detonators. Gelignite was a commercial high explosive of the same family as nitroglycerine and trinitrotoluene. It was a plastic explosive (mouldable), with the consistency and smell of oily marzipan. (All the older high explosives smelt similar, semtex was the first to have no smell).

Chapman’s technique was ingeniously simple. He kept to relatively basic safes, (particularly keen on robbing those in those in Odeon cinemas). He first tied the office typewriter to the boltwork handle. He then wrapped a tiny amount of Gelignite with a detonator inside a condom, pushed it through the keyhole, and held everything in place with chewing gum. A few grams was all that was needed, he said his most common mistake was to use too much. Retreating to a safe distance, the small explosion, pushing everything momentarily outwards, was enough to lift the levers restraining the bolt mechanism. The weight of the typewriter would then simply turn the mechanism, opening the safe. Chapman robbed about 40 safes up and down the country through the thirties and was finally caught in Jersey in 39, just before the outbreak of war. Jersey was invaded by the Germans before he had been brought back to Britain and he was recruited as an agent, but he told the British authorities of his new role and became a double agent. After the war he was pardoned, for ‘services to his country’, and started a successful health farm (he eventually bought a castle in Ireland on the proceeds).

By the 1950s safe manufacturers had started fitting devices to counter high explosives. A steel cable running round the inside of the door was connected to the lever that released the boltwork. Along this cable were several small plates of toughened glass. Any explosion would shatter the glass, releasing the cable and jamming the lever in the closed position. All high quality safes have been fitted with ‘anti-explosive’ devices like this ever since and explosives are no longer a practical method of getting into a safe.

If opening a safe door by drilling or explosives is impractical, perhaps a better technique is to ignore the door and to and break straight through the walls. When the rounded one-piece steel casing was introduced at the turn of the century, it was virtually impregnable, but many new cutting tools have since been invented. The latest weapon of the 1920s was the oxyacetylene cutter. The oxyacetylene flame itself was the hottest flame ever achieved, but the extra jet of oxygen blown through the cutter onto preheated steel caused the steel itself to ignite, enabling plates of any thickness to be effortlessly sliced through. The hardness of the steel makes no difference to the ease of cutting. Safe manufacturers increasingly relied on the concrete in between the inner and outer steel skin for security, though it wasn’t long before the introduction of a device that could even burn through concrete. This was the thermic lance, which is simply a long tube filled with steel rods, connected to an oxygen supply. Once preheated, the steel at the end of the tube can be ignited (just as in oxyacetylene cutting) and will gradually burn away, producing extremely high temperatures, enough to melt concrete.

.On high security safes manufacturers today usually incorporate a layer of cast aluminium. This conducts heat very well, dissipating the heat of the lance, and slowing down the cutting process. (A twelve inch thick plate of copper dissipates heat so effectively it is impossible to cut through, but would cost so much the safe would probably be worth more than its contents). Some safe manufacturers incorporate a material that gives off lots of smoke when heated, at least making working conditions uncomfortable

Fortunately for safe manufacturers there is a more serious snag about using thermic lances. A few years ago, there was a rash of crimes in which thieves removed entire safes to open them at leisure without fear of being disturbed. The safes were found, abandoned, having been attacked with thermic lances, but the theives had obviously not got away with anything, because the contents were still inside, completely incinerated. Paper burns at quite a low temperature, 180c or more famously 451f of Ray Bradbury’s novel. (Incidentally, its no use trying to use a thermic lance on a safe door, the steel cable, in addition to its glass plates, also has fusible links, (low melting point alloys) so any heat inside the door jams the opening mechanism.)

It probably is a good idea to try and remove the whole safe however you try to break into it, but it isn’t easy. Safes are very heavy, partly for this reason. With older safes it was possible to put a car jack under the hinges. With wedges and levers it was then possible to it onto a pallet truck. Today, the hinges are made with sloping bottoms, so there’s no jacking point.

Another useful tool, introduced in the 1950s, is the angle grinder. Hard particles, embedded in the disk, will cut through any steel, however hard, and also concrete. Angle grinders can cut through any padlock in seconds. Safes are more secure, simply because there’s more material to cut through, but also because manufacturers have been relatively successful in finding materials that take a long time to cut. The concrete used in safes is extra hard, made with extra finely ground sand and cement, incorporating fine high tensile steel wires to give it tensile strength and bonded to the concrete by the addition of a wetting agent. High security safes also include lumps of a mineral called aloxite (a form of Aluminium oxide) that is particularly difficult to cut through.

Despite the difficulties, a considerable number of criminal attacks on safes have been successful. Many of the skills of safebreaking were handed on from one generation to the next (a sort of informal apprenticeship system). However, there was also a published American Commission report (from the 1890s) on the best methods of safe construction, which went into great detail has to how each model of safe could be tackled. In the twenties the Los Angeles Wayne Strong school of Safework ran courses in safe repairing and opening. More recently in the 60s, Canadian police found a classroom in a Toronto garage full of safecracking equipment and a home printed textbook, divided into instructional ‘modules’.

In the last ten years a brilliant new tool has appeared called the diamond core drill. This is simply a tube embedded with industrial diamonds, rotated by an ordinary electric drill. Diamonds, (the hardest material known) will cut through anything. I’ve seen perfect cores cut straight through the extra hard concrete, through the aluminium, through the aloxite. (The highest rated safes are now given some protection against the core drill – lots of angled mild steel plates embedded in the concrete. The diamonds tend to get clogged by the relatively soft steel.)

This tool did have the potential to create a renaissance in safe breaking, but it somehow never happened, the art of Safe breaking has been in continual decline since the 60s. A 1997 Home Office report shows that attacks on banks decreased 46% in 1994 and a further 19% in 1995. Lone criminals, acting on the spur of the moment, are replacing meticulously planned ‘professional’ operations, and the ‘craftsman’ criminal has virtually disappeared.

I suspect the main reason for the disappearance of the craftsman criminal is simply that there are fewer and fewer people with the practical skills and confidence to even try to break into a safe. Engineering apprenticeships have been decimated, and even the old metalwork shops in schools have gone, replaced by ‘craft, design and technology’, which seems to mainly involve making things of cardboard.

Today’s criminals tend to favour relatively crude techniques. If you are really only interested in the loot, its usually easier to bribe or torture someone who knows the safe’s combination. To overcome the latest home security system the favoured criminal tool is simply a brick. Throw the brick through the window, see if anyone comes, and if not, follow it in, either letting the alarm ring (or pulverising it with the brick).

To some extent the most clever and sophisticated safebreaking and lockpicking feats have always been performed by legitimate locksmiths to prove the weaknesses of their rivals’ products, or, like Richard Feynman, out of intellectual curiosity. In a similar way almost all the sophisticated computer hacking is done out of intellectual curiosity, or by companies marketing improved security systems, and not by criminals.

Another factor contributing to the decline in safebreaking is that the rewards are relatively modest. The average haul from bank raids in 1993 for example, was only 」3,743, in contrast to the average haul from security vans of 」378,479. The insurance companies give every safe a rating for the value that they are prepared to insure the contents for. This is surprisingly low – 」5,000 for an older standard safe, up to 」50,000 for the most sophisticated modern safe. To determine a safe’s rating, the insurance companies have a research laboratory at Boreham Wood (called the Loss Prevention Council). Members of the council, sitting round a sort of bullring, dressed in safety visors, take notes while watching engineers attempt to break into each safe. Points are awarded for the number and sophistication of tools employed, and the length of time taken. It is performed in strict privacy, but would obviously be great entertainment. I hope that as the criminal incentive and appetite for safe breaking has largely disappeared, it could be revived as a hobby and competitive sport. The trophies for winning contestants could simply be put in every safe beforehand.


Since putting this lecture up on my site, I’ve received a number of interesting comments. In particular from a retired locksmith called John Mitchell. His website contains much more information about safes and their history. He wrote to me particularly about locksmiths’ techniques for getting into their own safes. this is his reply:

“Drilling as you rightly say was always the preferred method of opening safes. Minimal damage was done and an easy repair could be made if necessary. When quality safes with good drill resistance were encountered it was then normal practice to use oxy-acetylene to access the vital parts. This practice I believe is now forbidden in business premises.

I’ve been away from the tools since I retired in 1990 but occasionally get asked to help open a safe here and there. If I can’t pick the lock (which I’ve only managed twice recently) I have to call in the experts. The current methods which the top safemen employ is to use a magnetic limpet drill with specially ground drill bits to penetrate the hard plates. The same final opening technique as before still applies in exposing the bolt stump of the lock at the point where it enters the gates of the lever pack and manipulating the retaction of the bolt
through the keyhole.

With keyless combination locks the lever fence is likewise exposed and the wheels aligned via the dial. If glass plates and multiple relockers are encountered, side, and even back drilling would be the practice. This is where the fibre optic scopes and extended tools come into play. One safeman even reads the position of the wheels of a KC lock with a scope through the change-key hole in the back plate of the lock after side drilling. Now that’s clever.

This type of modern safe expert, of whom I only know three, have the ability to pick most of the keylocks likely to be encountered today. Most make their own picks to suit each different lock and some of these can be as long as 15 inches.

We’ve come a long way from the breast- brace and ratchet drill.”










via Hacker News


Leave a comment

Filed under Auto

Leave a Reply

Fill in your details below or click an icon to log in: Logo

You are commenting using your account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s