view:  full / summary

Gun locks 101

Posted on June 23, 2017 at 1:35 PM

I’ve been investigating the industry of firearms safety products since 2015. Since the results of my investigations have turned out to be useful to gun owners, I established to share findings. I never anticipated that I would be approached for consultant work as a result. Usually I limit myself to working with industry people, if I agree to do consulting at all, though I’ve answered questions for others—including Allison Anderman, an attorney with California’s Law Center to Prevent Gun Violence.

In the interest of confidentiality, I won’t go into most of Allison’s questions. However, one matter Allison raised pertains directly to the breakdown in communication between the gun-owning world and the non-gun owning world, and I want to address the issue for people on all sides of gun ownership.

Gun-store thefts in California have caused some gun-control advocates to ask what might be done to enhance firearms storage requirements for gun dealers in California. Allison wanted my opinion regarding a portion of California Penal Code Section 26890. This body of law addresses how gun dealers are required to secure inventory. The statute describes three methods of securing inventory, and dealers are to use at least one.

The method Allison was curious about is in subsection (2), which reads as follows: "Secure the firearm with a hardened steel rod or cable of at least one-eighth inch in diameter through the trigger guard of the firearm. The steel rod or cable shall be secured with a hardened steel lock that has a shackle. The lock and shackle shall be protected or shielded from the use of a boltcutter and the rod or cable shall be anchored in a manner that prevents the removal of the firearm from the premises." Precisely what the locks are to be fastened to is unspecified.

Allison’s question: Would the above method of securing firearms be enhanced by the use of trigger locks?

She didn’t know what a trigger lock was. I suggested that some introductory educational material was in order. Allison dismissed my concern, forcing me to explain that a trigger lock clamps to both sides of a gun’s trigger guard, precluding the passing of any cable or rod through the trigger guard. Allison then conceded that some educational material might be useful, and I put together a simple video on the subject.

The video was a hurried effort, and didn’t address the wide variety of gun locks on the market. After a few weeks, I deleted the video from my Vimeo channel and started working on a series of videos to introduce the subject more thoroughly. The videos divide the subject into three parts looking at padlock-styled locks, trigger locks, and other miscellaneous gun locks.

Gun locks sold in the United States are made in China and Taiwan, and most of them are imported by Regal Industrial Sales. The majority of the gun locks I have examined rely on cheap wafer locks for their security. For readers who know nothing about locks, simple wafer locks are probably the easiest locks in the world to pick. Videos highlighting the vulnerability of this type of lock abound online, and anyone with a degree of mechanical aptitude and Internet access can open the locks I opened.

Which I opened using brass paper fasteners, screwdrivers, and coffee stirrers—despite California’s Department of Justice (DOJ) having approved the locks. Which brings us back to safe-storage laws, and their authors.

California’s concept of the firearms safety device (FSD) is an early byproduct of safe-storage law efforts, an area of ongoing concern for the Law Center to Prevent Gun Violence. The requirement that guns sold by licensed dealers in California need to be accompanied by a California DOJ-approved FSD went into effect at the beginning of 2002. At the time, the Roster of Approved Firearms Safety Devices numbered slightly over 40 items.

Today the roster numbers over 1,300 items. There are more approved gun-safety products on the market in the State of California than there are approved firearms for sale in that state. While the roster of approved FSDs continues to grow, the approval process has not been significantly updated since 2002. Therefore I’m not surprised that most approved gun locks are weak. But I’ve wondered why lawmakers are so inept when addressing the practical details of gun safety.

Then Allison came along and clarified the problem with one simple question.

Proposed legislation on gun safety often comes from people who know almost nothing about guns. While some of these activists would like to legislate guns out of people’s hands, quite a few of them simply have no idea what they’re talking about. Add to the mix those attorney-activists who are dishonest about their real intentions behind proposing bills, and you end up with inept half-measures like California’s laws regarding so-called firearms safety devices.

Maybe you’re thinking, “So Allison didn’t know what a trigger lock was. So what?” Keep in mind that the Law Center to Prevent Gun Violence represents itself as having the knowledge to address gun violence and gun safety. These people claim to know what they’re talking about, and Allison has been involved in proposing city ordinances regarding safe-gun storage.

But people who dislike guns tend to learn nothing about them. Attorneys like Allison will never buy a gun or learn to shoot one, and therefore the business of fitting a gun with a lock remains an exercise of the imagination. This is no foundation for gun safety law.

A reality check

Posted on May 19, 2017 at 1:20 PM

Recently, I looked at a new product Gardall is importing, the model PS96BE, a top-opening handgun safe. It’s a Chinese-made generic product nearly identical to another safe I looked at in January of 2016, the P-20 Security Case imported by Bighorn Safe Co. When I examined the P-20, I found that the decorative cover for the bypass lock snapped into holes I was able to exploit. I inserted an unfolded paperclip around the bypass lock and actuated the release.

After I exposed how vulnerable the P-20 Security Case was, Bighorn Safe Co. decided to recall the product.

Therefore you can imagine that when I saw how similar the new Gardall safe looked online, I just had to examine it. I contacted the Safe & Vault Store, based in Spokane, Washington, and asked if they could give me a good deal on the item. They did, and within days I had the PS96BE in front of me for examination. To my surprise, the Chinese manufacturer producing it had improved the product since Bighorn Safe Co. imported it. Shielding was now being installed to prevent the attack I performed on video.

However, Gardall’s product was still a generic knock-off of the same safe the Bighorn Safe Co.’s import was, Sentry Safe’s Quick Access Pistol Safe, model QAP1E. This meant I could switch gears and attempt the same attack I performed on the QAP1E back in February of 2016. To open the QAP1E, I inserted a small screwdriver into a gap in the housing of the locking mechanism, then inserted a piece of metal shim to knock the spring from the latch. After that I was able to pick up the safe and throw the latch.

In an article I had published at the time, I reported that my attack on this safe wouldn’t work if the safe was properly bolted down. I was pleased with myself for having found what I thought was a perfect example of just how important it is to bolt down a handgun safe. I thought I’d performed a great demonstration, and in doing so had also developed a cautionary tale from which gun owners everywhere might learn.

So I was feeling fairly clever when I addressed Gardall’s new product with a screwdriver and metal shim. Then my shim went under the latch, pushed the release, and the lid popped open.

I hadn’t replicated my Sentry Safe attack at all. The Gardall product was completely undamaged. I’d opened the safe without picking it up, and the attack would clearly work whether or not the safe was bolted down.

In the world of physical-security hacking, I’d executed a clean hack, covertly, without leaving a scratch. But I wasn’t happy. This Gardall product was a direct knock-off of Sentry Safe’s QAP1E, which I had been suggesting to people who were looking for a handgun safe; it seemed one of the less vulnerable devices on the market. And the attack I had just performed on the Gardall PS96BE should, in theory, work on the Sentry Safe QAP1E.

I needed a new Sentry Safe. The one I owned was damaged from my previous exuberant testing. I went to the nearest Home Depot, where I knew they had Sentry Safe products, and bought another QAP1E. Once I had it home, I put in batteries, made sure it was functioning properly, and applied my metal shim—this time with less force.

The Sentry Safe Quick Access Pistol Safe sprang open. A clean hack, entirely covert, accomplished without leaving so much as a scratch.

Since then, I’ve thought about how I had been so wrong. Because I was quite wrong about the QAP1E, wrong about its vulnerabilities, wrong to insist the safe was reasonably secure if it was bolted down, wrong to suggest people consider using the product. Part of the problem was simple carelessness. I’d made exactly the kind of oversight one makes when he is in a hurry to finish a project and move on to the next.

But there was another more important contributing factor, which I no longer allow myself to be influenced by. Early in January of 2016, I had an article published in Ammoland called Lawfully Defective Gun Safes. Shortly after that, Ammoland published another piece of mine on the Bighorn Safe Co. product I just mentioned. By the end of January, 2016, I was receiving nothing but grumpy email from people wanting recommendations on decent handgun safes. They’d seen the articles, been to my website, and they thought—wrongly—that I was holding out on them, that I had actual recommendations to make if they only pressured me a bit.

But I had no recommendations, and what unfolded next was a behind-the-scenes fiasco I thought I would never confess to publically. I began frantically testing handgun safes in an effort to find something to recommend to all the gun owners convinced I was exacerbating the problem rather than trying to fix it. Among other safes, I tested GunVault’s GVB1000, Fort Knox’s Original Pistol Box, and Sentry Safe’s QAP1E. I also attacked Liberty Safe’s Home Defender Series. (I would ultimately sit on my findings regarding the Home Defender Series until later in the year, though I was compromising the safes as early as January, 2016.)

What I uncovered in my hurry was mostly bad news. My findings regarding the GunVault GVB1000 had to wait; Ammoland wanted a “positive” news story on safes and I didn’t submit the article until March. The Fort Knox Pistol Box was a good enough product that I submitted an article on that right away. Then there was my careless job with Sentry Safe’s QAP1E, which Ammoland published shortly after the Fort Knox story.

Don’t misunderstand me. I don’t blame my correspondents for my oversights during this period. It was my fault for letting myself be influenced by their complaints. What I should have done was ignore the complaints, because the situation wasn’t my creation. I only exposed the firearms safety device industry for what it is, an industry of generic Chinese-made imports, poorly-designed gadgets, and savvy marketing campaigns that use the stamp of California DOJ-approval as an advertising ploy.

I don’t blame people for being disappointed at having misplaced their trust. But gun owners should know this is what has happened to them. The firearms safety device industry appears to have their needs in mind, though in reality the industry is mostly supported by—or rides piggyback on top of—the gun sales industry.

The day that California started implementing its firearms safety device standards at the beginning of 2002, an ugly little industry was born. Firearms safety devices became required by law in that state, and companies began producing needed product. The companies were never motivated by some idealistic desire to make gun ownership safer, but by a desire to supply products that gun owners are increasingly required to have.

Yes, their gadgets offer “Guaranteed Protection” (Fortress), are made of “Thick 16-gauge steel!” (Snapsafe), are at least “30% Heavier Than Most” (Bulldog Vaults), provide “.20 Cubic Feet Storage Capacity” (Harbor Freight Tools), allow for “Fast, touch-free entry” (Hornady), and reaffirm our rights as gun owners by “Protecting Our Values” (Artemis). But companies aren’t selling these gadgets to make the world a safer place. They’re selling them because lawmakers created the industry.

How to frighten people with kids and guns

Posted on April 20, 2017 at 1:35 PM

On April 7, 2017, so-called security expert Marc Tobias published an article in Forbes in which he warned that a Bellock-brand trigger lock could be opened by a child. Tobias coached a young boy to perform this trick using a paperclip and a screwdriver. Then Tobias recorded video of the child removing the lock from a snub-nosed revolver. The boy performed the trick on camera as instructed while pointing the gun in every direction, including at himself.

Marc Tobias claims to be deeply concerned for the safety of children, though he didn’t trouble himself to instruct the child in safe gun handling before recording his “shocking” video, called BELLOCK TRIGGER LOCK. The boy does warn viewers not to try this at home, but the warning is irrelevant. The video establishes quite clearly that the boy doesn’t know how to handle a gun safely. In fact, the child underscores the gravity of Tobia’s oversight once he removes the lock from the gun. He puts his finger on the trigger and points the gun at the camera.

Any time a child handles a firearm must be viewed as a chance to teach and reinforce safe gun handling. Anyone serious about the responsibility of gun ownership knows this. And any self-proclaimed “security expert” insisting he is concerned about child safety should also know this.

Whether or not the Bellock trigger lock in question poses any real danger to children is debatable. I doubt that a 5-year old or even a 10-year old would independently uncover the method for opening the lock that Tobias taught the youngster. On the other hand, failing to teach safe gun handling does definitely put children at risk.

From my perspective, as a gun owner who works hard to inform fellow gun owners about gun safety products, Tobias’ shock video is particularly embarrassing, because he named me in his article. Tobias referred to me as “a colleague.” To set the record straight, I have never collaborated with Marc Tobias. I have never worked for him, or with him, either as an employee or contract worker. He cannot claim ownership in any of my research.

Tobias states in his article that he discovered the vulnerability of this trigger lock back in 2012 and that he sat on the finding for a time before deciding to go public with it. However, if you Google “DO NOT get the Bellock Trigger Lock” you will find a posting on North Carolina Gun Owners left by one “tpham32,” who made this discovery public on January 20, 2014. This individual pointed out that all the keys for this trigger lock, which he bought at Dick’s Sporting Goods, were the same. He posted a snapshot of the keys, and noted that anyone who buys one of these locks will have a key allowing access to any guns locked with this trigger lock.

Tobias included these same details in his article, and maybe he did uncover this issue on his own. But it raises a glaring problem with Tobias’ shock video. Between the two vulnerabilities of this trigger lock, that all copies of the lock are keyed alike and that they can be opened with a paperclip and a screwdriver, which is more likely to happen? Is a small child more likely to stumble upon the trick to opening this lock with a paperclip and screwdriver, or is an adult more likely to notice that the Bellock trigger locks at Dick’s Sporting Goods are keyed alike?

Obviously, no Bellock trigger lock has been implicated yet in an accidental shooting involving a child. Tobias would have reported on that. He wouldn’t have been able to shut up about it, actually. On the other hand, we do know that an adult noticed the locks are all keyed alike and made the discovery public on January 20, 2014, long before Tobias did.

One might argue that I have no right to be critical, given that I expose the vulnerabilities of popular handgun safes on But I don’t coach children on how to compromise safes so that I can record shock video. I also review improved products. Liberty Safe, Stack-On, and Vaultek Safe have all updated products I’ve examined, and I’ve posted video covering the improvements. I’ve also highlighted the positive qualities of safes made by Fort Knox and Sentry Safe.

Tobias, in contrast, does no follow-up once he’s posted one of his shock videos, leaving concerned parents at a loss for what to do. I know they’re at a loss, because I’ve received email from concerned parents.

One of Tobias’ shock videos, “THREE YEAR OLD TOBY OPENS DIFFERENT GUN SAFES,” has terrified parents for years now, since the video was posted in 2012. Tobias and his colleague Tobias Bluzmanis put the video together after examining a number of Stack-On safes. The two were hired to uncover how a particular Stack-On safe was accessed by a couple of children, one of whom died when the kids got hold of a handgun. What Tobias and Bluzmanis found was that the safe could be bumped open by lifting it by a corner and dropping it; the safe the children accessed was not bolted down.

In one segment of the video, Bluzmanis’ 3-year old son is seen poking a metal shim into the Stack-On QAS 710. Once the safe opens, the boy pushes the door closed. The viewer can then see that the brass shim he’s been given to use has been bent into a slight hook at the end, making it easy for him to reach into the safe and actuate the release, something he would not have been able to do otherwise.

In another segment, the boy is seated behind a Stack-On QAS-1000 drawer safe. He has a lock pick in hand (his father happens to be a locksmith). He pokes the keyed bypass lock, asking, “¿Aquí, Papí?” Toby is speaking Spanish. He’s saying, “Here, Daddy?” (“Papí” is just an affectionate form of “Papá.” Bluzmanis says something unintelligible and removes the rubber fitting from the top of the safe, upon which the boy shoves the pick down the hole he’s been shown to use. The safe pops open. Viewers who know nothing about the safe don’t realize the latch mechanism inside has been compromised already, allowing the safe to be opened easily.

This approach to shock journalism is not only irresponsible it betrays Tobias’ real motivation to get attention. Why would he work so hard at that? Tobias sells a consulting service. He’s also a hired “expert” in court proceedings. In the legal world, the hired expert—the physician who doesn’t practice medicine, for example—is called a prostitute.

But Tobias didn’t stop at producing shock journalism in order to promote himself. He also referred to me as a “colleague,” which might suggest to readers that I support the nonsense he publishes. I certainly don’t. Worse, by calling me a “colleague,” Tobias seems to suggest that he has a hand in my work. A colleague is a professional associate, and Tobias and I have never collaborated or worked together in any way. And why try to suggest that we have? Maybe the consulting service isn’t doing so well.