It's entirely understandable that the TSA would want to have its own "brand" of approved locks. It's a simple concept: give the TSA a shortcut into a luggage lock in case the need for an inspection arises. It makes a lot of sense, especially if you don't want to be stuck in line while an officer fumbles with a luggage lock. However, the problem with a master key is that it only takes one to open everything — and in today's Internet-centric world, it doesn't take long for one thing to become many.
Sadly, that's exactly what happened: last month, a photo of TSA master keys was accidentally published by the Washington Post. While the picture was removed within minutes, that's more than enough time for the Internet to grab it — and now, we're seeing the results of that one picture.
A full set of 3D-printable designs was published to GitHub on Wednesday. With these plans, anyone who has a 3D printer or a computer-controlled mill can reproduce exact copies of the TSA's master keys. What's worse is that the GitHub plans include models for all of the TSA's master keys — basically, anyone who downloads the models can get into just about any TSA-approved lock on the market.
OMG, it's actually working!!! pic.twitter.com/rotJPJqjTg
— Bernard Bolduc (@bernard) September 9, 2015
Speaking with Wired, GitHub user Xylitol also revealed that getting the keys to work didn't take much effort once the photos were published online:
"Honestly I wasn't expecting this to work, even though I tried to be as accurate as possible from the pictures....But if someone reported it that my 3D models are working, well, that's cool, and it shows...how a simple picture of a set of keys can compromise a whole system.
I didn't do any modifications. It worked on the first try."
While the leaked designs do represent a serious breech in policy, the TSA-approved locks were never known for being all that secure. In fact, noted lock-picker and University of Pennsylvania professor Matt Blaze stated that "it's actually quicker to pick the TSA's locks than to look for my key sometimes."
At this point, it's hard to tell if anything will come of the 3D-printable designs: the TSA-approved locks are far from a universal system, and it's not as if modern airports are lax when it comes to security. At the very least, the TSA will likely change its key and lock designs soon — though they should probably update their photography policies as well.
