Bypass: When a Lock Is Defeated Without Its Tumblers

Definition

The Lock Industry Standards and Training (LIST) Council's Professional Locksmith Dictionary defines a by-pass tool as "a device that neutralizes the security of a locking device, or its application hardware, often taking advantage of a design weakness." Two parts of that definition matter. The target can be the lock or its application hardware, meaning the door, frame, strike, and accessories it is installed with. And the usual route is a design weakness, not skill at working tumblers.

The same dictionary sorts entry methods by the evidence they leave:

• Forced entry: "entry or bypass techniques which leave obvious damage to the lock or enclosure."
• Covert entry: "entry or bypass techniques that can only be detected via disassembly and/or detailed inspection of lock components."
• Surreptitious entry: techniques "that cannot be detected via disassembly and detailed inspection."

A bypass can fall into any of the three groups. The term describes what is attacked, not how visible the result is.

Bypass Versus Picking

Picking, in the LIST definition, manipulates "tumblers in a keyed lock mechanism through the keyway." A bypass leaves the tumblers alone or makes them irrelevant. Two articles on this site cover specific bypass categories at the same conceptual level:

• Loiding, the trade term for slipping a spring latch, is a bypass of the latch rather than the cylinder.
• A comb pick attack, which the LIST dictionary describes as pushing the pin stack past the shear line, is often grouped with bypass because it exploits construction rather than aligning the pins.

Why Design and Installation Matter

Because bypass targets the weakest part of an assembly, the details of hardware selection and installation carry as much weight as the cylinder. Locksmith Ledger's guidance on electric strikes is a clear example. It states that "locks that don't have some version of deadlatch pins are really not designed for security applications," advises choosing an electric strike whose faceplate "maintains the deadlatch functionality," and describes pry guards and anti-jimmy plates, door accessories that cover the latch area to limit bypass of the latch.

Security researchers have made the same point about standards. In their 2007 DEF CON presentation "High Insecurity: Locks, Lies, and Liability," Marc Weber Tobias and Matt Fiddler listed "bypass methods not contemplated" by test standards among the problems with relying on ratings alone.

How Hardware Responds

Several standard features exist specifically to close off bypass routes.

• Deadlocking latches. The LIST dictionary defines a deadlocking feature as one that, "when fully engaged, resists attempts to move the latch or bolt in the unlocking direction through direct pressure." A spring latch, by contrast, has "no deadlatching feature." Allegion's Schlage lock-function descriptions specify, for functions such as the storeroom lock, that an "auxiliary latch deadlocks latchbolt when door is closed."
• Anti-rap design. The LIST dictionary defines "anti-rap" as "specifically designed to preclude bypass via attack based on sharp, repetitive blows to the mechanism."
• Reinforcing accessories. Latch guards, strikes, and reinforced frames address the application hardware the LIST definition mentions.

Standards

Several standards cover the hardware bypass targets, not just the cylinder:

• ANSI/BHMA A156.2 (Locks and Latches) and A156.13 (Mortise Locks) are the BHMA standards for bored and mortise locksets. BHMA's Hardware Highlights list them as A156.2-2022 and A156.13-2022.
• ASTM F883 (Padlocks) states that it includes "forcing tests, and surreptitious entry tests."
• UL 437 (Key Locks) includes timed covert and forced-entry tests, as summarized by Tobias and Fiddler.
• ANSI/BHMA A156.30 (High Security Cylinders) cautions that its tests "are performed under laboratory conditions" and that results in actual use vary with "installation, maintenance and environmental conditions."

That last caveat is the core lesson of bypass. A rating measures a product under defined tests. A secure opening depends on the whole assembly, installed correctly.

Ethics and Law

Bypass is studied by locksmiths, specifiers, and security researchers to find and fix weaknesses. Locksport clubs require permission. TOOOL Netherlands says its most important rule is "to only open locks that you have permission for to open from the owner." Possessing entry tools with criminal intent is an offense in many places. Nevada's NRS 205.080, for example, makes possessing a "picklock" or similar implement a gross misdemeanor when circumstances show intent to use it in a crime. Laws vary, and this article gives no legal advice.

Related Topics

• Loiding
• Comb pick
• Lockpicking
• Deadbolts
• Electric strikes
• Padlocks
• High-security locks
• Forensic locksmithing

Sources