The handgun safe, or "lock box"
Nearly all handgun safes are advertised as being approved by California’s Department of Justice (DOJ), meaning they meet California Firearms Safety Device Standards as set down in Section 4094 of California Penal Code, Title 11, Division 5, Chapter 6. The emphasis of the statute is on gun locks, though a firearm safety device (FSD) is defined to include what the statute calls a “lock box.” The list of key-term definitions under Section 4082 of Chapter 6 defines an FSD thus:
“(l) ‘Firearms safety device’ means a device that locks and is designed to prevent children and unauthorized users from firing a firearm. The device may be installed on a firearm, be incorporated into the design of a firearm, or prevent access to the firearm.”
California’s Gun Safe Standards comprise Section 4100 of Chapter 6. The standards are divided into two parts—part (a), which describes material and construction standards, and part (b), an alternative standard. None of the lock boxes I’ve examined meet the standards of part (a). The devices lack most of the required attributes, like having three separate 1/2-inch diameter locking bolts. However, a gun safe is acceptable if it satisfies the requirements of the alternative: “(b) A gun safe that is able to fully contain firearms and provide for their secure storage, and is certified to/listed as meeting Underwriters Laboratories Residential Security Container rating standards by a Nationally Recognized Testing Laboratory (NRTL).”
This alternative standard seems to describe a lock box. A lock box can “fully contain firearms and provide for their secure storage.” But UL testing of a Residential Security Container (RSC) is more forceful than the testing performed by California’s Certified FSD Laboratories, and UL listed RSCs are tested by technicians who test products professionally, unlike the non-expert testers required by California law to examine FSDs. None of the lock boxes I’ve examined meets the standards of a UL listed RSC. Not one of them has had the appropriate label inside indicating that they are UL 1037 Section 54 Residential Security Containers.
This means that lock boxes are not gun safes, by either definition. A gun safe may meet the standards of a firearms safety device, but a lock box does not meet gun-safe standards. A lock box is a firearms safety device, like a trigger lock.
The fundamental problem with California’s concept of the firearms safety device is that lawmakers were attempting to devise a single comprehensive testing process to evaluate too many different kinds of products, including gun locks, lock boxes, gun cabinets, wall safes, and other items.
Gun locks may seem easy enough to address with a set of testing procedures, but a lock box is composed of more than a simple keyed lock. As described in Handgun Safe Design, a lock box (handgun safe) will usually have five separate elements of construction: 1) A container, 2) mechanical components of the locking mechanism proper, 3) electronic components of the locking mechanism proper, 4) a processor controlling the electronics, and 5) a keyed bypass lock. Each of these areas of construction will need to be examined and tested if one is going to establish how secure a device is.
Despite these realities, lock boxes need to meet only a few standards in order to receive California DOJ approval. California’s Firearms Safety Device Standards comprise Section 4094 of Chapter 6. The standards for lock boxes are that they be designed to prevent deactivation except by use of a key or combination or some other unique method intended by the manufacturer. Combination locking mechanisms must permit at least 1,000 different combinations, and a keyed locking mechanism must be unique to the manufacturer’s FSD. A lock box must prevent removal of, or access to, the enclosed firearm, and it needs to be capable of repeated use. Finally, a lock box must pass the testing procedures described in the regulations.
Having a combination locking mechanism permitting 1,000 different combinations is a good requirement. But what precisely is a keyed locking mechanism “unique to the manufacturer’s FSD?” The statute doesn’t say. As for preventing deactivation except by use of a key or other intended method, few lock boxes are able to do so. Clearly, a device has a better chance of preventing unauthorized access if an attacker feels obligated to restrict himself to following the testing procedures outlined in the statute.
The main problem with Section 4094 is that Firearms Safety Device Standards for lock boxes are only functionality standards. The standards for lock boxes do not establish mechanical requirements relating to material strength or the design of their electronic locking mechanisms. Nor do the standards address resistance to forced entry and covert entry.
TESTING AND APPROVAL
A manufacturer, or importer, seeking California DOJ approval for a firearms safety device must submit four of a given model to one of California’s Certified FSD Laboratories, listed on the DOJ website. The manufacturer must also provide the name and model number of the device, a description of the device, a description of the product’s intended use, including a description of safe operation, and the type, make, or model of firearm(s) the device is designed to secure.
Testing procedures are outlined in Section 4095. Because many gun locks are padlock styled, the ASTM Standard Performance Specification for Padlocks is incorporated into Section 4095. No other standards drafted by a recognized standards organization are incorporated into this section.
As a result, every firearms safety device, whether lock box, gun cabinet, wall safe, trigger lock, or other device, is subject to a series of tests designed specifically for padlocks.
Testing is intended to replicate forces exerted through the use of common household tools for approximately ten minutes. However, the definition of “common household tools” in Section 4082, subsection (d), describes a random, limited assortment. Screwdrivers, for example, are defined as being “8 to 10 inches in length, flathead or Phillips, flathead sizes up to 5/8 inches,” excluding many smaller, commonly used screwdrivers. Crescent wrenches are limited to being 10 inches in length, though 6 and 8-inch crescent wrenches are common. (“Crescent” is actually a brand name. The tool referred to in the statute is likely an adjustable wrench.) Drills are limited to “1/3 horsepower corded/9.6 volt cordless,” which speaks to how old the statute is.
In addition to describing the conditions under which tests are performed (at temperatures between 16 and 27 degrees Celsius, with a primed case installed in a locked firearm, etc.), Section 4095 describes a series of tests to be performed on padlocks. A tensile loading device is used to test a lock’s resistance to being pulled open. A shock impactor is used to test a lock’s resistance to impact. A shackle-cutting fixture is used test a padlock’s shackle or cable.
Only subsection (e) describes a test for what it calls “lock box type devices.” Lock boxes are dropped onto a concrete slab. They are dropped from a height of one meter plus one centimeter with the locking mechanism facing up and with the locking mechanism facing down. The test does not include dropping the box on its side or at an angle.
This is the only test designed specifically for lock boxes, which reveals how little thought was given to lock-box design. A bewildering number of latching mechanisms have been designed for lock boxes, though these mechanisms are not described in any standards. Legally, they do not exist. Therefore, they are subject to no testing.
The AmazonBasics PS75EF,
defective and CA DOJ approved
Following completion of the required examinations, the lab submits test results to California’s DOJ, which performs no additional testing. Approved devices are then listed on California’s Roster of Approved Firearms Safety Devices, which includes gun cabinets, cabinet locks, lock boxes, padlocks, safes, trigger locks, and wall safes. Again, the diverse items on this list are all subject to the same tests designed for padlocks.
Having gained DOJ approval for their products, U.S. importers are free to cite the approval in product advertising. Some companies even sport official-looking seals to draw attention to the DOJ approval, though California has no official seal to designate this. The seals shown in the picture here were created by GunVault (top left), Homak (bottom), and Hornady (right).
Since neither the FSD standards of Section 4094 or testing procedures of Section 4095 address the design or construction of lock boxes, the approval process outlined above is meaningless regarding lock boxes. The parts of a typical lock box—the container, the locking mechanism proper, its mechanical and electronic components, the processor controlling the mechanism, and the bypass lock—are never described in Chapter 6. Therefore no reason exists to include tests of these components. Whatever design weaknesses a lock box may have will go unnoticed unless one of the statutory gun lock tests accidentally reveals a problem.
California’s Certified FSD Laboratories
Independent laboratories that test FSDs do standards compliance testing on a variety of equipment and materials for civilian, law enforcement, and defense-related industries. These labs have multiple accreditations and certifications to meet the needs of agencies such as the U.S. Department of Justice, Federal Communications Commission (FCC), Underwriters Laboratories (UL), and others. Only a handful of labs are licensed by California’s DOJ to provide testing of FSDs, and personnel who do testing are re- certified every two years by a California DOJ representative.
Personnel in these labs often have backgrounds in materials engineering, chemistry, electrical engineering, and forensic investigation. On the surface, these laboratories would appear to have the right people for testing FSDs. However, California’s testing guidelines require that tests be performed by lab personnel with no skills in lock picking, which guarantees that they have no background in physical security. Given that a youth in the United States has access to nearly limitless information on YouTube concerning the hobby of lock picking, which is a competitive sport (Lock Sport), FSD testing standards ought to anticipate knowledgeable attackers.
Should a rare lab technician have an aptitude for security and give a lock box or gun lock a failing report, his work can be undone by another lab. Nothing in the approval process prohibits an importer or manufacturer from submitting a failed product to another lab for testing. Labs do not ask if an FSD has failed testing elsewhere, and California’s DOJ does not collect information on products that fail testing.
Statutory oversights and loopholes
Whereas tests performed by Certified FSD Laboratories on gun locks are done to specific purpose (for example, manipulating cylinders to determine their resistance to picking), the final test described in Section 4095, subsection (e)—the business about dropping lock boxes on a concrete slab—is done to no specific purpose. A lock box is simply deemed to have failed the dropping test if it is disabled or if the firearm discharges the primed case during the test.
“Disabled,” according to the statute, means the firearm can be accessed and fired. As for guns discharging when dropped, a modern striker-fired handgun will not discharge when dropped from a height of one meter. This has been the case for decades. Therefore a technician learns nothing from dropping a lock box with a striker-fired handgun inside it.
This lack of a clear rationale for the dropping test of Section 4095, subsection (e), is what security experts call a failure to contemplate methods of attack. One might suppose the dropping test is designed to replicate the impact resulting from a lock box being dropped accidentally or being pushed from a nightstand or desk. But then to replicate an accidental dropping, one should drop the lock box from different angles—on all six sides, and on its corners.
That lock boxes are tested with handguns inside them—explained in subsection (b) of Section 4095—is equally meaningless. Testing the accessibility of a lock box requires no firearm inside the device. The firearm is not the issue. The matter in question is the vulnerability of a lock box to unauthorized access. (These devices are just as likely to be used for securing medications, and are often advertised as being appropriate for that purpose.)
One might also ask whether a lock box is properly tested if it is not bolted down. Nothing in Section 4095 requires that lock boxes be secured to an immovable surface prior to testing, though manufacturers of lock boxes recommend bolting their products down before use. Assuming gun owners generally follow this instruction, any realistic test of a lock box should be designed to evaluate how vulnerable the device is when properly bolted down. Testing a lock box by dropping it on concrete is a meaningless gesture.
Finally, Chapter 6 has a loophole that compounds the danger posed by every defective product approved by California’s DOJ. Subsection (c) of Section 4093 allows the DOJ discretion to approve an FSD without any testing. If a product is like another product already marketed by the same manufacturer and differs only in minor ways immaterial to the locking mechanism or its function, the lock box can be approved. Security vulnerabilities that go undetected by a Certified FSD Laboratory are incorporated into lines of related products, multiplying the danger to the public exponentially.
The meaning of California DOJ Approval
California’s firearms safety device standards have become default standards in many parts of the United States. Since no manufacturer wants to produce a separate line of gun-safety products for customers in the State of California, manufacturers have settled on the strategy of securing California DOJ approval for their products and then marketing them nationwide as approved. Not surprisingly, California DOJ approval has become a marketing ploy, which reinforces nationwide acceptance of California’s standards. But California’s lawmakers, as a body, do not constitute a recognized standards organization, and their firearms safety device standards cannot substitute for properly developed standards.
To summarize the current situation: A lock box is not a smaller version of a floor- standing safe, and a lock box does not meet UL standards for safes. Nor does a lock box meet UL standards for a residential security container (RSC). Nor is it a gun safe by California’s gun safe standards. The primary locking mechanisms installed in lock boxes are unrelated to pin-tumbler locks, making the ASTM Standard Performance Specification for Padlocks non-applicable to anything other than the bypass cylinders installed on lock boxes. Because of this situation, lock boxes are not required to meet any relevant standards before going on the market, regardless of whether a manufacturer seeks California DOJ approval for a given product or not.
By approving the devices, California’s DOJ represents itself as having the statutory machinery in place to make pronouncements on lock boxes. Independent testing labs, certified through California’s DOJ to perform FSD testing, are represented to the public as being competent to evaluate the efficacy of lock boxes. Yet the representations are false. The certified laboratories are entirely unable to evaluate lockboxes, and California’s DOJ remains ignorant of critical design flaws in products while approving them to secure firearms.