what you should know before buying a handgun safe
The handgun safe, or "lock box"
Nearly all handgun safes sold in the United States are advertised as being approved by California’s Department of Justice (DOJ), meaning they meet California Firearms Safety Device Standards as set down in Section 4094 of California Penal Code, Title 11, Division 5, Chapter 6. The emphasis of the statute is on gun locks, though a firearm safety device (FSD) is defined to include what the statute calls a “lock box”—that is, a handgun safe. The list of key-term definitions under Section 4082 of Chapter 6 defines an FSD thus:
“(l) ‘Firearms safety device’ means a device that locks and is designed to prevent children and unauthorized users from firing a firearm. The device may be installed on a firearm, be incorporated into the design of a firearm, or prevent access to the firearm.”
The phrase “prevent access to the firearm” gives the lock box its place among FSDs. A lockbox is designed to prevent access, so it also satisfies key-term definition (y), which states that a lockbox is “a firearms safety device that fully contains and encloses the firearm(s).” Where this gets confusing for anyone trying to understand California’s concept of an FSD is in sorting out the difference between a firearms safety device and another statutory concept, the gun safe.
​
California’s Gun Safe Standards comprise Section 4100 of Chapter 6. The standards are divided into two parts—part (a), which describes material and construction standards, and part (b), an alternative standard. Lock boxes typically do not meet the standards of part (a), since they lack most required attributes, like having three separate 1/2-inch diameter locking bolts. However, the alternative gun-safe standard, part (b), appears at first glance as though it might apply to lock boxes. The alternative standard reads as follows: "(b) A gun safe that is able to fully contain firearms and provide for their secure storage, and is certified to/listed as meeting Underwriters Laboratories Residential Security Container rating standards by a Nationally Recognized Testing Laboratory (NRTL)."
This alternative standard seems to describe a lock box. A lock box does indeed "fully contain firearms and provide for their secure storage." But UL testing of a Residential Security Container (RSC) is more forceful than the testing performed by California’s Certified FSD Laboratories, and UL listed RSCs are tested by technicians who test products professionally, unlike the non-expert testers required by California law to examine FSDs. Therefore, a California DOJ-approved lock box does not necessarily meet the standards of a UL listed RSC, and only rarely does a lock box have the appropriate label indicating it is a UL 1037 Section 54 Residential Security Container.
This means that lock boxes are not gun safes, by either definition. A gun safe may meet the standards of a firearms safety device, but a lock box does not meet gun-safe standards. A lock box is a firearms safety device, like a trigger lock.
The fundamental problem with California’s concept of the firearms safety device is that law writers were attempting to devise a single comprehensive testing process to evaluate too many different kinds of products, including gun locks, lock boxes, gun cabinets, and other items.
​
Gun locks may seem easy enough to address with a set of testing procedures, but the lock box is composed of more than a simple keyed lock. A lock box will often have a separate locking mechanism proper for the device, the mechanism composed of both mechanical and electronic components with a small processor controlling the electronics. The lock box will also have a container with structural issues of its own, and will often have a bypass cylinder.
Despite these realities, lock boxes need to meet only a few standards in order to receive California DOJ approval. California’s Firearms Safety Device Standards comprise Section 4094 of Chapter 6. The standards for lock boxes are that they be designed to prevent deactivation except by use of a key or combination or some other unique method intended by the manufacturer. Combination locking mechanisms must permit at least 1,000 different combinations, and a keyed locking mechanism must be unique to the manufacturer’s FSD. A lock box must prevent removal of, or access to, the enclosed firearm, and it needs to be capable of repeated use. Finally, a lock box must pass the testing procedures described in the regulations.
Having a combination locking mechanism permitting a minimum of 1,000 different combinations is a good requirement. But what precisely is a keyed locking mechanism "unique to the manufacturer’s FSD?" The statute doesn’t say. As for preventing deactivation except by use of a key or other intended method, few lock boxes are able to do so. A device has the best chance of preventing unauthorized access if an attacker restricts himself to following the testing procedures outlined in the statute.
The main problem with Section 4094 is that Firearms Safety Device Standards for lock boxes are only functionality standards. The standards for lock boxes do not establish mechanical requirements relating to material strength or to the design of their electronic locking mechanisms. Nor are electronic locking mechanisms even discussed beyond acknowledging their operation by access codes.
TESTING AND APPROVAL
A manufacturer, or importer, seeking California DOJ approval for a firearms safety device must submit four of a given model to one of California’s Certified FSD Laboratories, listed on the DOJ website. The manufacturer must also provide the name and model number of the device, a description of the device, a description of the product’s intended use, including a description of safe operation, and the type, make, or model of firearm(s) the device is designed to secure.
​
Testing procedures are outlined in Section 4095. Because many gun locks are padlock styled, the ASTM Standard Performance Specification for Padlocks is incorporated into Section 4095. No other standards drafted by a recognized standards organization are incorporated into this section.
​
As a result, every firearms safety device, whether lock box, gun cabinet, wall safe, trigger lock, or other device, is subject to a series of tests designed specifically for padlocks.
​
Testing is intended to replicate forces exerted through the use of common household tools for approximately ten minutes. However, the definition of “common household tools” in Section 4082, subsection (d), describes a random, limited assortment. Screwdrivers, for example, are defined as being “8 to 10 inches in length, flathead or Phillips, flathead sizes up to 5/8 inches,” excluding many smaller, commonly used screwdrivers. Crescent wrenches are limited to being 10 inches in length, though 6 and 8-inch crescent wrenches are also commonly used. (“Crescent” is actually a brand name. The tool referred to in the statute is likely an adjustable wrench.) Drills are limited to “1/3 horsepower corded/9.6 volt cordless,” which speaks to how old the statute is.
​
In addition to describing the conditions under which tests are performed (at temperatures between 16 and 27 degrees Celsius, with a primed case installed in a locked firearm, etc.), Section 4095 describes a series of tests to be performed on padlocks. A tensile loading device is used to test a lock’s resistance to being pulled open. A shock impactor is used to test a lock’s resistance to impact. A shackle-cutting fixture is used test a padlock’s shackle or cable.
Only subsection (e) describes tests for what it calls “lock box type devices.” Lock boxes are dropped onto a concrete slab. They are dropped from a height of one meter plus one centimeter with the locking mechanism facing up and with the locking mechanism facing down.
​
This is the only test designed specifically for lock boxes, which reveals how little thought was given to lock-box design. A bewildering number of latching mechanisms have been designed for lock boxes, though these mechanisms are not described in any standards. Legally, they do not exist. Therefore, they are subject to no testing.
The AmazonBasics PS75EF,
defective and CA DOJ approved
Following these examinations, the lab submits test results to California’s DOJ, which performs no additional testing. Approved devices are then listed on California’s Roster of Approved Firearms Safety Devices, which includes gun cabinets, cabinet locks, lock boxes, padlocks, safes, trigger locks, and wall safes. Again, the diverse items on this list are all subject to the same tests designed for padlocks.
Having gained DOJ approval for their products, U.S. importers are free to cite the approval in product advertising. Some companies even sport official-looking seals of their own design to draw attention to the DOJ approval, though California has no official seal to designate this. The seals shown in the picture here were created by GunVault (top left), Homak (bottom), and Hornady (right).
​
Since neither the FSD standards of Section 4094 or the testing procedures of Section 4095 address the design or construction of lock boxes, the approval process outlined above is meaningless regarding lock boxes. The parts of a typical lock box—the container, the locking mechanism proper, its mechanical and electronic components, and the processor controlling the mechanism—are not described in Chapter 6. Therefore, no reason exists to include tests of these components. Whatever design weaknesses a lock box may have will go unnoticed unless one of the statutory gun-lock tests accidentally reveals a problem.
California’s Certified FSD Laboratories
Independent laboratories that test FSDs do standards compliance testing on a variety of equipment and materials for civilian, law enforcement, and defense-related industries. These labs have multiple accreditations and certifications to meet the needs of agencies such as the U.S. Department of Justice, Federal Communications Commission (FCC), Underwriters Laboratories (UL), and others. Only a handful of labs are licensed by California’s DOJ to provide testing of FSDs, and personnel who do testing are re- certified every two years by a California DOJ representative.
​
Personnel in these labs often have backgrounds in materials engineering, chemistry, electrical engineering, and forensic investigation. On the surface, these laboratories would appear to have the right people for testing FSDs. However, California’s testing guidelines require that tests be performed by lab personnel having no skills in lock picking, which guarantees that they have no background in physical security. At the time that California’s FSD standards were implemented in 2002, the rationale for restricting lab personnel from having knowledge of lock picking was that FSDs should be able to resist the attacks of unskilled attackers.
​
What California’s Department of Justice had not anticipated was that three years from implementing its FSD standards, an online resource called YouTube would be launched. From that date, 2005, YouTube became the leading online resource for entertainment, news, and educational video. It is now second in popularity of use only to Google. The relevance of YouTube to the limitations placed on lab personnel testing FSDs is that young people throughout the United States have access to information that was not widely available in 2002—a nearly limitless quantity of instructional video about lock picking, safe cracking, and all manner of digital-hacking. Given the situation, California’s FSD standards, and the testing performed by independent labs, can only become relevant again by anticipating knowledgeable attackers.
​
Currently, should a rare lab technician have an aptitude for security and give a lock box a report indicating that it failed required testing, his work can be undone by another lab. Nothing in the approval process prohibits an importer or manufacturer from submitting a failed product to another lab for testing. Labs do not ask if an FSD has failed testing elsewhere, and California’s DOJ does not collect information on products that fail testing.
Statutory oversights and loopholes
Whereas tests performed by Certified FSD Laboratories on gun locks are done to specific purpose (for example, manipulating cylinders to determine their resistance to picking), the final test described in Section 4095, subsection (e)—the business about dropping lock boxes on a concrete slab—is done to no specific purpose. A lock box is simply deemed to have failed the dropping test if it is disabled or if the firearm discharges the primed case during the test.
“Disabled,” according to the statute, means the firearm can be accessed and fired. As for guns discharging when dropped, a modern striker-fired handgun will not discharge when dropped from a height of one meter. This has been the case for decades. Therefore a technician learns nothing from dropping a lock box with a striker-fired handgun inside it.
This lack of a clear rationale for the dropping test of Section 4095, subsection (e), is what security experts call a failure to contemplate methods of attack. One might suppose the dropping test is designed to replicate the impact resulting from a lock box being dropped accidentally or being pushed from a nightstand. But then to replicate an accidental dropping, one should drop the lock box from additional angles—on all sides, and all corners.
​
That lock boxes are tested with handguns inside them—explained in subsection (b) of Section 4095—is equally meaningless. Testing the accessibility of a lock box requires no firearm inside the device. The firearm is not the issue. The matter in question is the vulnerability of a lock box to unauthorized access. (These devices are just as likely to be used for securing medications, and are often advertised as being appropriate for that purpose.)
One might also ask whether a lock box is properly tested if it is not bolted down. Nothing in Section 4095 requires that lock boxes be secured to an immovable surface prior to testing, though manufacturers of lock boxes recommend bolting their products down before use. Assuming gun owners generally follow this instruction, any realistic testing of a lock box should evaluate how vulnerable the device is when properly bolted down. Testing a lock box by dropping it on concrete is a meaningless gesture.
Finally, Chapter 6 has a loophole that compounds the danger posed by every defective product approved through California’s DOJ. Subsection (c) of Section 4093 allows the DOJ discretion to approve an FSD without any testing. If a product is like another one already marketed by the same manufacturer, and if the product differs only in minor ways immaterial to the locking mechanism or its function, the lock box can be approved. Security vulnerabilities that go undetected by a Certified FSD Laboratory may then be incorporated into lines of related products, multiplying the danger to the public exponentially.
The meaning of California DOJ Approval
California’s firearms safety device standards have become default standards in many parts of the United States. Since no manufacturer wants to produce a separate line of gun-safety products for customers in the State of California, manufacturers have settled on the strategy of securing California DOJ approval for their products and then marketing them nationwide as approved. Not surprisingly, California DOJ approval has become a marketing ploy, which reinforces nationwide acceptance of California’s standards. But California’s lawmakers, as a body, do not constitute a recognized standards organization, and their firearms safety device standards cannot substitute for properly developed standards.
To summarize the current situation: A lock box is not a smaller version of a floor- standing safe, and a lock box does not meet UL standards for safes. Nor does a lock box meet UL standards for a residential security container (RSC). Nor is it a gun safe by California’s gun safe standards. The primary locking mechanisms installed in lock boxes are unrelated to pin-tumbler locks, making the ASTM Standard Performance Specification for Padlocks non-applicable to anything other than the bypass cylinders installed on lock boxes. Because of this situation, lock boxes are not required to meet any relevant standards before going on the market, regardless of whether a manufacturer seeks California DOJ approval for a given product or not.
By approving the devices, California’s DOJ represents itself as having the statutory machinery in place to make pronouncements on lock boxes. Independent testing labs, certified through California’s DOJ to perform FSD testing, are represented to the public as being competent to evaluate the efficacy of lock boxes. Yet the representations are false. The certified laboratories are entirely unable to evaluate lockboxes, and California’s DOJ remains ignorant of critical design flaws in products while approving them to secure firearms.