Teaching Lockpicking at hacker spaces

[renderman]

Found myself in some drama today.

I want to teach lockpicking at the recently opened hackerspace here at home. I have ordered 10 beginner sets and am ready to start teaching.

Several directors have raised concerns about legality (it's a felony possession province) and public perception (hackerspaces are a hive of scum and villainy). I am licensed as a locksmith so I'm in the clear, but they are wanting to prevent me from teaching something that the membership overwhelmingly seems to want. The lengthy emails back and forth are something I won't inflict here.

I'm seeking arguments as to the benefit of teaching LP skills in how they raise the bar for security and that they are not in fact useful in real world burglary scenarios.

Mostly the issues seem to be about legal indemnity and public perception.

Any suggestions from other spaces and how you may have gotten around these issues?

[TheCotMan]

Re: Teaching Lockpicking at hacker spaces

Any suggestions from other spaces and how you may have gotten around these issues?

What is the process to become a licensed locksmith in canuckistan?

In the US, it is something that is controlled by the states. Many states only require people to submit fingerprint cards, pay some money and maybe pay for a background checks -- often simple wants and warrants. You can check into becoming a, "locksmith company," and make everyone your employees, too. This may provide them with provisional status as legal lockmiths. After the class, you can fire them. (You'll need to check the laws licensing, and if this would even work with the laws in your country/province/city.)

Once you require everyone to be a legally licensed locksmith, you can satisfy both the public and the directors with your course as a, "class for legally licensed locksmiths taught by a legally licensed locksmith."

I know people that have obtained their own licenses in their home state, not because it is illegal to carry picks, but so that they can quickly dispell illusions stuck in the minds of uninformed Law Enforcement Officers -- especially when they try to use the existence of lock picks as a claim for "professional burglary tools" and sufficient for, "reasonable cause," to search/fish for other incriminating evidence. These people don't want to have their own time wasted, and simply presenting a paper license as a claim to being a locksmith puts most officers at ease. Treat the class like people getting licenses with the FCC in the US. Your first class could be on how to get a license, and you could bring in all of the paper work for people to fill-out and sign.

[theprez98]

Re: Teaching Lockpicking at hacker spaces

There is no licensing process for locksmiths here in Maryland (even though the bill is brought up every year in the legislature, it never passes).

Maybe there is a professional association, with a code of ethics, that could add some credibility to the argument. It could help deal with the legal issues and the public perception.

If there isn't such an association, starting one might help.

[renderman]

Re: Teaching Lockpicking at hacker spaces

In Alberta its easy and not at the same time.

It's free, but you have to be sponsored by an employer who is licensed as a locksmith business. My license does not allow me to sponsor 'sub licenses'. To become a business license you have to have a million bucks insurance and also submit paper work about your services. I will obviously not be operating a locksmith business, so it's not gonna happen.

I already contacted the licensing department and they won't issue 'sport' licenses, so there goes that idea.

[streaker69]

Re: Teaching Lockpicking at hacker spaces

I don't know what the requirements are here in PA, but I did use my LP skills to pick several locks on our properties to prove the point that bad choices were made in selecting locks.

I picked the padlock that we use everywhere in about 10 minutes and told them that I have friends that I'm sure could have done it in much less time. I believe that's a reason to teach it to people if they're in the field and need to prove a point to their employers.

[theprez98]

Re: Teaching Lockpicking at hacker spaces

To become a business license you have to have a million bucks insurance and also submit paper work about your services. I will obviously not be operating a locksmith business, so it's not gonna happen.

From what I have read, the $1M insurance policy is common; although I have no idea how much that would cost out of pocket. Either way, it is probably cost-prohibitive for someone who isn't in a full-time locksmith business.

[xor]

Re: Teaching Lockpicking at hacker spaces

Found myself in some drama today.

I want to teach lockpicking at the recently opened hackerspace here at home. I have ordered 10 beginner sets and am ready to start teaching.

Several directors have raised concerns about legality (it's a felony possession province) and public perception (hackerspaces are a hive of scum and villainy). I am licensed as a locksmith so I'm in the clear, but they are wanting to prevent me from teaching something that the membership overwhelmingly seems to want. The lengthy emails back and forth are something I won't inflict here.

I'm seeking arguments as to the benefit of teaching LP skills in how they raise the bar for security and that they are not in fact useful in real world burglary scenarios.

Mostly the issues seem to be about legal indemnity and public perception.

Any suggestions from other spaces and how you may have gotten around these issues?

You are marketing this all wrong. It's all semantics, you are not teaching locking picking, you are teaching locksmithing. It's the difference between hacking and security research. We know better, but most folks don't. They have a negative association with lock picking. Lock picking sounds like you want to teach people to break into my house. Lock smithing sounds like you want to teach people how to help me get into my house, once I'm locked out.

Turn that frown upside down!!!!!!

xor

[theprez98]

Re: Teaching Lockpicking at hacker spaces

You are marketing this all wrong. It's all semantics, you are not teaching locking picking, you are teaching locksmithing. It's the difference between hacking and security research. We know better, but most folks don't. They have a negative association with lock picking. Lock picking sounds like you want to teach people to break into my house. Lock smithing sounds like you want to teach people how to help me get into my house, once I'm locked out.

Turn that frown upside down!!!!!!

xor

I think his problem is that even teaching locksmithing he cannot sponsor sub-licenses so even going the "high" road is still questionable.

[xor]

Re: Teaching Lockpicking at hacker spaces

I think his problem is that even teaching locksmithing he cannot sponsor sub-licenses so even going the "high" road is still questionable.

Call it a license prep course. Someone has to teach locksmithing in Canada, otherwise there wouldn't be any locksmiths.

xor

[TheCotMan]

Re: Teaching Lockpicking at hacker spaces

How much interest is there in this skill in your area? Are people willing to pay to learn the information, and start the process to get licensed?

People that like to fire off toy rockets pay for licenses and with time and effort and money can get larger and larger capacity rocket motors/fuel-containers. Perhaps this can be "sold" to the public in the same way.

If so, you might be able to create a NonProfit Origanization, or some kind of LLC, and require "dues" from people looking to attend classes and get and keep their licenses. The payments can go directly to paying for a business license and insurance (all associated costs.) If you have a large number of people that are committed and interested, paying for a $1,000,000 policy may not be that costly. Looking into costs to becoming a bonded/insured locksmith. If a $1,000,000 insurance policy for locksmith business that is an NPO and registered as a *school*, so liability and risk to insurance companies for failures with commercial work would be non-existent, then you might find $1,000,000 insurance may cost only $1,000 to $5,000 per year. If you get 20 people, and make them part of your class and share the expense, then costs can be shared, and you could still be 100% legal.

You might even be able to have fund raisers in the form of locksport competition. Charge the media and spectators to watch some of your contests.

Any money beyond what is required to keep the NPO running could be donated to some other locksport group, or maybe used locally to sponsor people locally to join your group as a scholarship for tuition.

[sintax_error]

Re: Teaching Lockpicking at hacker spaces

I think xor touched on a good point as far as public perspective goes. I assume you'll be teaching much more than manipulation, but the technology and mechanics behind it, the inner workings of locks, etc. I'd advertise that aspect of it moreso than anything else. Call it a "Mechanical Security" or "Physical Security" course. And as we all know, the first step in teaching security, is to teach how said security is defeated.

[renderman]

Re: Teaching Lockpicking at hacker spaces

Found a number of compromises that should make things easier to run.

One concern was implicit endorsement of picking by the society that runs the space. But if it's an 'outside' group just borrowing the presentation space, that's fine. So I start a Toool chapter, which I wanted to do anyways. This also limits their liability since it's an outside organization that they are just letting have access to the space.

The public perception issue was alleviated a bit when I sent them Deviants slides (which will be the bulk of my training material) and they saw that it was very professional and more about the security mindset than how to break into stuff.

There was also issues with having practice boards at the space full time, again for endorsement issues until I pointed out that boards can be for picking or double as installation practice since installation greatly affects how a lock will perform under attack.

Has anyone else had any issues like this in thier spaces or is it just me and the local laws around here.

[Agent X]

Re: Teaching Lockpicking at hacker spaces

Render

Fight the indemnity issue with a nice fat waiver. Find a friendly lawyer and make is general enough that the hacker space in question can use it for other classes that are "risky". Then it's an asset. Have all the people in the class sign it.

Fight the public perception issue by getting a local reporter (from the local alternative weekly?) to write a piece about the physical security class. Remember it's lock sports and it's fun. Talk about the contest at Defcon, and other places...show funny video of Gringo warrior!

Finally get a local member of the Law Enforcement Community to come to class, and see that it's not evil! Maybe even get this person to talk about the relevant laws and such. It's hard to be a super secret criminal gang of baddies, if you invite the police to your parties! Beside it might be a good eduction for the police.

The way to make it not look nefarious is to make it not nefarious. Make is public,honest and fun! Which is what it is.

[streaker69]

Re: Teaching Lockpicking at hacker spaces

Finally get a local member of the Law Enforcement Community to come to class, and see that it's not evil! Maybe even get this person to talk about the relevant laws and such. It's hard to be a super secret criminal gang of baddies, if you invite the police to your parties! Beside it might be a good eduction for the police.

Plus, if any baddies happen to show up and see a uniformed officer there, they might just find someplace else to be.