One recent facility security assessment started with the question below, and after encountering this vulnerability in every assessment for the past 15 years, it became obvious that it was time to write about it. The problem is easily remedied.
Q: We installed a good quality lock industrial, yet someone was able to bypass it using a credit card. How could this be?
A: Most likely the door latch installation somehow kept the deadlocking plunger (also called a deadlock latch) from being engaged, or allowed it to be disengaged. It is the purpose of this part of the door lock mechanism to prevent doors from being opened in this fashion.
Over the past 15 years, when I started tracking this particular vulnerability in our facility security assessments, in every commercial facility security assessment I performed, I found that at least one door could be easily opened (5 seconds or less) with a credit card, screwdriver or hair comb.
Facility managers have been amazed to see strong commercial and industrial locks bypassed this way. Recently at one facility, after a big name company installed card + pin electronic access control (card reader plus keypad) for a half-dozen very critical internal doors, I was able to slip my comb out of my pocket and pop open each door. IT departments take note: this vulnerability is common for IT equipment room closets, especially where the closet originally served another purpose, and was later given to IT without upgrading the door to a security grade installation.
What is a Deadlocking Plunger?
For convenience in closing doors, many types of door latch bolts have a beveled tip shape as below shown in Figure 1. The purpose for the angle is to enable the latch bolt to be pushed in automatically as the door is closed, otherwise you’d have to manually twist the doorknob to retract the latch and be able to close the door.
However, that feature is a security weakness. When the door is closed you can push the latch back bolt using a screwdriver, metal ruler, plastic card, and so on as shown in Figure 2.
To keep the latch bolt from being push-retractable once the door is closed, a second mechanism is incorporated into the latching mechanism—called a deadlocking plunger (the entire mechanism sometimes called a deadlock latch), as shown in Figure 3.
When the plunger is kept pushed in by the strike plate, the latch bolt will not retract. However, security assessments commonly find that the strike plate is the wrong type of strike plate or the wrong size, allowing both the latch bolt and the deadlocking plunger to be fully extended. In such an instance, the bolt can be pushed back as shown in Figure 4.
of the deadlocking plunger mechanism.
Sometimes the deadlocking plunger mechanism simply doesn’t work, and I have found about 10% of the type of plunger illustrated to fail in security assessments. (To test: with the door open, push the plunger back and see if you can still retract the latch bolt.)
How a Deadlocking Plunger Works
Photographs of Defeating a Locked Door
This door's deadlocking plunger feature could be made to fail because the wrong size strike plate had been installed.
Here are photographs from a Time-to-Target assessment in which we easily defeated a number of doors using a small screwdriver. What's worse, we discovered that when the door shown below was forced open, it did not alarm.
If you pushed a little on this particular door from the outside of the restricted room, the deadlocking plunger would slip into the opening of the door latch, because the door latch opening was too big. When that happened, the deadlocking plunger extended fully, allowing the door latch bolt to be pushed back into the door—enabling the door to be opened from the outside of the room.
Exanple of a Strong Security Door Lock
Commercial and industrial security locksets of a higher rating use an improved design. One such design can be seen in the Simplex 900 Lockset shown above in Figure 8, in which the deadlocking plunger is separated vertically from the latch bolt.
If the latch is closed, there is no possibility of the deadlocking plunger being extended in a well-built and properly installed security door.
One example of a poor door installation is one where a crowbar can be inserted between the door and the strike plate and turned to push the strike plate away from the plunger. Once the strike plate is pushed away the deadlocking plunger is extended, and the latch bolt can be easily pushed back.
There are many residential, commercial and industrial grade door lock designs. Some of them can be defeated by a knowledgeable individual with ordinary household or simple workshop tools.
Knowledge of these aspects of door design is well understood by most locksmiths, but not by enough security practitioners and facility managers.
Good advice is to check the lock and door latch mechanisms of every building perimeter door and every door leading to critical facility areas containing critical assets.