Share This article

For years, the US TSA (that’s the Transportation Security Agency, a division of Homeland Security) has recommended that travelers in the United States buy and equip their luggage with a TSA-approved lock. The ostensible reason for this is because it allows the agency immediate access to your bag in the event that it needs to inspect your luggage rather than requiring agents to cut the lock physically in order to inspect its contents. Now, a team of hackers have demonstrated that the seven master keys that collectively open every TSA-approved lock ever manufactured have been broken.

First, some background. In 2003, Travel Sentry introduced a new type of TSA-approved lock with a built-in backdoor. A TSA agent armed with the appropriate tools could open the lock, inspect the item, and then send the luggage on its way. The entire system was meant to ensure that officials could still search luggage without forcing consumers to give up all of their security in the process.

The TSA has recommended that passengers use these locks on multiple occasions, despite growing concern that the devices might be compromised. This week, Ars Technica proved that 3D printing could be used to print new master keys, thereby obviating the entire point of buying a TSA key in the first place (at least, as far as security is concerned). Granted, luggage isn’t particularly secure, with or without a key, since soft-sided luggage can be cut or the zipper compromised, but it’s still embarrassing for an organization that holds itself forth as the gold standard in security theater safe travel.

Oops

The Intercept   reached out to the TSA to discover how the organization intended to respond to the news and discovered it really doesn’t care. “The reported ability to create keys for TSA-approved suitcase locks from a digital image does not create a threat to aviation security,” wrote TSA spokesperson Mike England in an email to The Intercept.

“These consumer products are ‘peace of mind’ devices, not part of TSA’s aviation security regime,” England wrote.

It goes without saying that the TSA has never listed “peace of mind” as a reason for purchasing a specific, TSA-approved key. But there’s more at stake here.

Backdoor metaphor

The problem with the TSA key is that it relied on the idea that only the “right” people (read: TSA officials) would have access to the proper keys. So long as that was true, luggage was arguably secure (though the TSA has acknowledged its own problems with theft in various blog posts over the years). Once a single photograph showed how the key teeth were patterned, however, the cat was out of the bag.

This is why backdoor encryption of the sort espoused by various government agencies is so incredibly dangerous. In the real world, keys get photographed, spies discover and leak codes, and even top-level cryptographic systems like the German Enigma of WW2 can be brought down by poor security practices, imperfect operation, or strokes of luck. Hackers have proven adept at chaining together personal information to create attacks against individuals by exploiting weaknesses of multiple services. Airport luggage may seem pedestrian compared to the advanced hacks that swarm across the modern web, but spear phishing — the practice of fooling users into revealing critical data about themselves to a person they think represents a legitimate business — is alive and well. The devices we lock down may be radically different, but the principles that ensure their security haven’t changed so very much.

Discovering that the TSA locks are just as worthless as you likely thought they were won’t change your life — but it’s a practical example of how backdoors can immediately destroy the security of a system.