How Safecracking Works

The combination lock remains the number-one method for securing a safe door. There are a variety of combination locks available. Combination locks for safes are divided into two classifications: Group 1 and Group 2.

Group 2 combination locks are the most common type found on home safes today. They provide one-, two-, or three-number combinations.

Group 1 locks provide a greater degree of protection as they can offer combinations of up to six numbers. These locks are also sturdier, and have more wheels in the lock mechanism. This greatly reduces the probability of even a skilled professional "cracking" the safe.

Now, let's take a look at what happens inside a combination lock.

The central lock feature in a combination safe is the wheel pack; a collective set of devices that work together to 'know' the combination. While safe manufactures have come up with several variations on the wheel pack to deter cracking, they are all designed around the same principle.

The wheel pack comprises a combination dial that is attached to a spindle. Inside the lock, the spindle runs through several wheels and a drive cam. The number of wheels in a wheel pack is determined by how many numbers are in the combination - one wheel for each number. When you turn the dial, the spindle turns the drive cam. Attached to the drive cam is a drive pin. As the cam turns, the drive pin eventually makes contact with a small tab on the adjacent wheel called the wheel fly.

Each wheel has a wheel fly on each of its sides. The drive pin spins the first wheel until it makes contact with the wheel adjacent to it. This continues until all the wheels are spinning. This is known as picking up the wheels. Each wheel on the spindle has a notch cut into it. When the right combination is dialed, all the wheels and their notches line up perfectly.

Resting just above the wheels is the fence. The fence is a small metal bar attached to a lever. The fence prevents the safe door from being opened without the combination being dialed. It does this by resting on the wheels and blocking the path of the bolt that secures the safe door.

When all the wheels line up, their notches align to form a gap. The fence falls into this gap under the force of its own weight. With the fence gone, the bolt can slide freely past and the safe can be opened.

When all the wheels in the wheel pack are in the correct position, their notches align to form a gap. Under the force of its own weight, the fence falls into the gap allowing the safe to be opened.

Though this design is relatively straightforward, it is mighty in its simplicity. The wheel pack design has been used for almost 100 years and still proves difficult to overcome for even the most skilled safecracker. But, it is not fool-proof. In the next sections we will take a look at the various ways safecrackers defeat this design.

The easiest way to open a safe is to know the combination. Though this seems painfully obvious, knowing the combination is the most common way safecrackers open safes. But are they really cracking the safe if they know the combination? In a manner of speaking, yes. Combination deduction is the first step a safecracker takes in trying to get into a safe.

All safes are shipped from the manufacturer with try-out combinations. Ideally a safe owner resets the try-out combination after purchasing the safe. This doesn't happen as often as you would think. Many safe owners simply buy the safe and use the try-out combination; making their safe easy prey for safecrackers. The try-out combinations for most safes are an industry standard and widely known by both locksmiths and safecrackers. If it means not having to use more complicated methods to get in the safe, the few seconds it takes to test some of the more common try-out combinations are well worth the safecracker's time.

Time is the number one enemy of a safecracker. With that in mind, finding the combination is another preferred method of cracking. In addition to try-out combinations, safecrackers may use some poking around or a little research to try and get or guess the number before breaking out the tools.

Surprisingly, many people write the combination down near the safe, if not on the safe itself. Simply searching the room the safe is in is likely to get the safecracker the numbers he needs. A lot of safe owners will either scribble the combination on a wall or write it on a nondescript note.

Numerous businesses keep their safes on what locksmiths call day lock. By dialing all the numbers of the combination, business users unlock the company safe. Then when closing it, they do not cancel out the combination. This means someone can open the safe by simply opening the door or, at the most, just entering the last number of the combination. If a safecracker is lucky enough to come across a safe that has been day-locked, then at the very worst he need only guess at the last number.

The professional safecracker is well researched in both the type of safe he is cracking and the type of person who is using it. But when deduction fails, the safecracker must dig in and attempt to defeat the safe or lock.

Let's take a look at how safecrackers do this.

Lock manipulation requires a certain level of acumen that other methods of safecracking do not. You may be familiar with the concept of taking either the high or low road. Among many safecrackers, lock manipulation is considered to be "taking the high road." This is because lock manipulation represents safecracking at its most pure form. Technically, lock manipulation is the process of opening a locked safe without drilling or defacing the safe in any way. As the name implies, you use the lock against itself to discover the combination.

This method is ideal because it requires few, if any, tools and is, by far, the most discreet way to crack a safe. It does, however, require tremendous patience. The safecracker must also possess a clear understanding of the mechanical actions of locks in the various forms they take and/or some knowledge of the characteristics of the safe owner.

The art of lock manipulation is based largely on the scientific approach created in 1940 by Harry C. Miller. Just as in the movies, the safecracker uses sound to discover the combination. But what you don't see in the movies is that a safecracker needs more than a few seconds and a good ear to pull it off.

Miller put forth a three-step process to manipulate the lock into revealing its combination:

You must first determine the contact points on the lock. The drive cam also has a notch in it like the wheels in the wheel pack. But this notch is sloped to allow the lever and fence to pass through when it comes around. When the nose of the lever makes contact with this slope there is a small click. This is the first thing the safecracker wants to find. By listening for the click, the safecracker can determine which numbers on the dial face correspond to the left and right side of that sloped notch. That space is called the contact area and is the first step in discovering the combination.

Parking the Wheels

The combination can be made up of anywhere between one and eight numbers. Each one of these numbers has a corresponding wheel. The next thing the safecracker wants to do is determine how many wheels are in the wheel pack. By knowing the contact area, the safecracker dials the number on the lock that is in an opposite position from the numbers of the contact area. The safecracker lets the dial rest here. This is called parking the wheels.

For example, on a one-hundred-number dial if the contact area is between 10 and 20 the safe cracker would park the wheels around 60. When the safecracker turns the dial slowly to the right, the drive cam is re-engaged to begin spinning the wheels from that position. Now every time the dial passes 60, the drive pin will click as each wheel in the wheel pack is picked up one at a time. The safecracker counts each click until there are no more, and this indicates how many wheels are in the pack: three clicks = three wheels.

Graphing the Results

Knowing the contact area and number of wheels, the safecracker resets the lock by turning several times to the right. Then parking the wheels at zero, the safecracker turns the dial slowly to the left. The safecracker listens for the tell-tale clicks that indicate the position of the left and right sides of the contact area. Making note of this on a graph, the safecracker repeats this step, only this time parking the wheels three numbers to the left of zero. Each time the process is started from a different position, the contact area will vary slightly. The safe cracker repeats this process in intervals of three until all the positions on the dial have been graphed. You don't see that in the movies!

The final graph representing the left and right contact points for all the positions will converge on itself at several points. These points of convergence should match the number of wheels that were determined by parking the wheels. They will also represent a range of numbers that hold the combination.

Though the graph will reveal where the wheels are in the proper position, it won't reveal in what order the wheels are to be lined up. The safecracker must now dial the numbers, in all possible variations, until the safe opens. A three-number combination could have six possible variations. Let's say the three numbers the safecracker must use are 4, 37 and 61. Therefore, the six possible combinations are:

By trying all these variations the safe will eventually open.

Lock manipulation is used more by locksmiths than safecrackers because of the skill and time needed to pull it off. Most safecrackers use far less subtle methods -- let's take a look at those now.

The most common method safecrackers use to manipulate the safe itself is drilling. There are several ways to use a drill to open a safe. The most direct method is to drill into the face of the lock in order to reach the lever or drive cam. After accessing the lever or cam, the safecracker can use a punch rod to push them out of the way or bend them until they are no longer obstructing the path of the bolt.

As a countermeasure to this, many safe manufactures have installed heavy cobalt plates to prevent or slow down drilling into the front of the lever and cam housing. Whether the cobalt actually prevents the drilling or simply slows it down depends on the type of drill bit the safecracker is using. Most any conventional drill bit will spin against the cobalt plate without ever penetrating it. However, if the safecracker is armed with say a titanium or diamond bit, it could eventually penetrate the cobalt. But, this would probably cost the cracker several drills (as the bits will outlast the motors) and, more importantly, too much time. As you know, time is enemy-number-one to a safecracker -- so, some other method would be employed.

Any skilled safecracker will, of course, know most everything about the safe he is drilling -- including any countermeasures put in place by the manufacturer. So, to counter this countermeasure, safecrackers can drill in at an angle above the cobalt plate and go straight for the wheel pack. The cracker's aim here is not to destroy the pack, but to see it. Using a small fiber-optic viewer called a borescope, the safecracker can watch the wheels spin as he turns the dial. Then it's just a matter of lining up the notches and watching the fence fall into place.

Now, you may be wondering, "If there are ways around the cobalt plate -- what's a safe maker to do?" Additional protection is provided by systems called relockers. Though the designs vary from manufacture to manufacture, the relocker is tripped when the safecracker's drill bit breaks a sheet of glass or plastic while drilling into the lock. Once this material is breached, it triggers a set of auxiliary locking devices which will lock out the safe completely. Even the proper combination will not open the safe once the relocker has been activated. The safe owner must call a safe technician or locksmith to retrieve the safes contents.

Side drilling is a method used to reach the bolt itself. The safecracker bores a hole into the side of the safe using a long nine- or ten-inch drill bit. A borescope is used to see the position of the bolt. Next, the safecracker takes a long punch rod and pushes the bolt out of the way.

Drilling holes in the rear of the safe is another method of attack. The safecracker drills two holes: one for the borescope and one for a special extra-long screwdriver. The safecracker uses the borescope to see the screws that attach the plate covering the wheel pack. Then he removes this plate and uses the screwdriver to move the wheels into position to allow the bolt to pass.

When drilling a safe, the thing safecrackers have to bear in mind is that even the smallest mistake could damage the safe beyond any hope of opening it at all.

These are just some of the more commonly used drilling methods. But, drilling is not the only way. Next, we'll look at some ways to open a safe that are even noisier than drilling.

At a certain temperature, all metals will burn. There is nothing safe manufacturers can do about that. Safecrackers can use methods of burning to create a hole in the side of a safe large enough to remove its contents. Safecrackers accomplish this by using a variety of torches. Oxy-acetylene torches can operate at temperatures of up to 4500 F, but that isn't hot enough to bore through the side of a large safe in a timely manner. So, what's a safecracker facing a really large safe to do?

Plasma cutters and thermic lances are both capable of creating enough heat to burn through a large safe. These tools are quickly replacing the oxy-acetylene torch as the tool of choice for safe burning. In either case, the safecracker uses the heating instrument to bore holes into the safe either exposing the lock mechanism or the contents of the safe. The downside of safe burning is the large amount of heat and smoke produced by the process. Also, both plasma cutters and thermic lances are expensive and take skill to operate properly.

Another popular method of safecracking is to use explosives. This method is high on success and low on discretion. But so long as the burglar knows the contents of the safe can survive the explosion and that he can escape after the explosion has alarmed authorities, this method is quick and effective.

Safecrackers use jam shots to blow the doors off of safes. Jam shots use nitroglycerin as the explosive. Nitroglycerin [C3H5(ONO2)3] is a mixture of glycerin, nitric and sulfuric acids. This highly explosive concoction, often referred to as "grease," takes the form of a jelly-like substance.

To use a jam shot, the safecracker needs:

The safecracker starts by folding a piece of cellophane into the space between the safe door and frame. Next the safecracker kneads a cup and funnel shape out of soap around the cellophane. Soap is used because it is malleable and has a consistency that will not allow the nitroglycerin to leak out of the funnel. Once the soap is in place, the safecracker carefully removes the cellophane, leaving a channel in the soap cup for the nitroglycerin to pass through. Next, he places the blasting cap and the wires connected to the battery igniter in the cup. The last step is to pour in the nitroglycerin. About one ounce is usually enough to remove a safe door. Once safely out of the way, the safecracker touches the wires to the battery terminals, which sets off the blasting cap. The blasting cap then ignites the nitroglycerin. Now, all that's left to do is make off with the loot.

In addition to nitroglycerin, C-4, PETN, or RDX are all used by professional safecrackers to blow open a safe. Though harder to come by, the advantage of these explosives is that they come in castable clay-like forms that are much easier and safer to use than nitroglycerin.

Electronic locks are becoming more and more prevalent in the construction and design of modern safes. This is especially true in commercial safes. The electronic lock offers many improvements and enhanced security. It allows for combinations of more possible number groupings, personalized combinations assigned to different users, as well as the ability to log all records of entry -- tagging the entry to a user by recording what combination was used to open the safe.

Leaps in technology have only slowed the modern safecracker but not stopped him. The most common way to bypass an electronic lock is by acquiring the combination through means of coercion or computer hacking. Another successful method for bypassing a keypad-style electronic lock is for the safecracker to cover objects housed in the same building as the target safe with ultraviolet ink. During the course of the day, the safe owner will touch ink-covered objects such as doorknobs or handrails before opening the safe. After the safe owner punches in the code with the ultraviolet ink residue on his fingers, the burglar need only return later and shine a black light on the keypad to discover which keys were pressed. A detective's fingerprint dusting kit can also reveal the most commonly pushed keys.

Worthy of a James Bond film, another more high-tech method of safecracking utilizes software developed by JD Hamilton of the Mas-Hamilton Group. This software and many of its clones can interface with the lock at its programming port using a wireless connection. The software, when run on a high powered laptop, will simply run a sequence of numbers until it hits the right combination. However, the cost of the software and hardware is often greater than the contents of most safes. This method is more likely to be used in industrial or political espionage. U.S. government agencies are currently studying this software to create effective countermeasures.

Don't Try This at Home

Even armed with the right knowledge and tools to do it, safecracking is a highly risky crime that carries severe penalties under law. The risks alone are enough to deter most thieves. That is why safecracking remains one of the rarest crimes. Most skilled safecrackers use their abilities under the shingle of a locksmith or other authority for legitimate reasons. They also help safe manufactures test their designs. To this day, the contents of safes are more often lost to fire rather than burglary.

For more information on safecracking and related topics, check out the links on the next page.