The story begins in November 2014, when a high-resolution photograph published in an article in The Washington Post revealed seven of the eight master keys used by the Transportation Security Administration (TSA) to open and inspect passenger luggage. Those keys were quickly converted into 3D-printable formats, but the so-called “eighth key” remained a mystery—until now. Three hackers known as DarkSim905, Johnny Xmas, and Nite 0wl managed to recreate that final key by taking the long way: analyzing multiple locks.
The Master Keys and the Backdoor
The TSA employs various automatic and manual methods to closely inspect luggage that has been flagged as “suspicious” in earlier steps. If a bag or suitcase reaches the final stage of the chain and needs to be opened, TSA personnel possess a set of eight master keys that open every lock “approved” by the administration. From a computer perspective, it is one of the best definitions of a “backdoor” we can find: the user (or rather, their luggage) feels “safe” while authorities inspect it from top to bottom. Naturally, the backdoor requires the cooperation of a third party—in this case, two companies: Travel Sentry, whose standard applies to seven of the master keys, and Safe Skies, which covers the remaining key.
The Hunt for the Eighth Key
In November 2014, some intergalactic genius at the TSA decided it was a brilliant idea to allow The Washington Post to take a high-definition photograph of the seven Travel Sentry master keys. Within months, three experts known as DarkSim905, Johnny Xmas, and Nite 0wl transformed the keys into models compatible with 3D printers, though one key was incomplete (the pattern of its holes remained hidden on the other side). Several enthusiasts tested the plastic copies with great success, but the eighth key from Safe Skies still remained. With no images or specifications available, this trio of hackers decided to finish the job the hard way: they legally acquired several locks from a single model sold by Safe Skies, which had a fatal design flaw. The lock does not come with user keys and can only accept one type of key—so by extension, it is the TSA master key.
The Fallout
In summary: the claim of a “backdoor” by a higher authority, combined with the “escrow” concept that involves a third party, and the disastrous lack of care on the part of that third party, destroyed any idea of security for luggage on U.S. soil. As if that weren’t enough, the TSA declared that key cloning does not represent a threat to aviation security, nor does it cause a decrease in the physical security of luggage while it is under TSA control. In the end, the eight keys are out there. If you have a 3D printer and a compatible lock, you can now try it yourself.
Official site: TSA Travel Sentry master keys
