Topics:

Motion Detectors
Silent Alarms
Alarm Systems
Security Cameras
Jimmying Locks
Picking Locks
Breaking Locks
Doors with Electromagnetic Closures
Detex Locks and Other Isolated Alarm Systems
Windows
Elevators
Air Ducts
Steam Pipe Tunnels and Manholes

Motion Detectors

The most common sort of motion detectors are Passive Infra-Red (PIR). They detect thermal concentrations and changes. Granted that they are sensitive to heat, I don't think they would really work in a steam tunnel environment, although I have often heard reports that one college or another has installed motion detectors in a the steam tunnels. They are usually just small beige or white plastic boxes with a curved diffuser lens on the front and a single LED. Often, the response time to a motion detector going off is pretty slow.

Another more expensive kind of motion detectors are combination microwave/PIR. They send out a microwave signal and bounce it off of the various objects to form a "map" of the room, and then compare that with the previous "map." They have some mechanism in there to prevent them from being triggered by rodents or insects, I suppose. They are usually larger than the plain PIR boxes, have a similar diffusion lens on the front, and usually have 3 LEDs on the front instead of just one.

As someone once pointed out to me, if someone was concerned enough to go to the trouble of putting in expensive combination microwave/PIR motion detectors someplace, they probably REALLY don't want you there. Moreover, response time will likely be quick. So if you see a motion detector with three LEDs, then RUN; it may already be too late.
 
 
 

Silent Alarms

Most institutional alarm devices are silent alarms. If a door is opened or a motion detector goes off, then the main security offices (or in some cases the police) are notified. The alarm is conveyed along with the location. Sometimes the alarm stays on as long as the door is left open.

This means that if you go around opening doors without paying attention, you could be setting off alarms and never knowing it until a guard shows up, thirty minutes or thirty seconds later.

You can test response time by opening a door, running to somewhere innocuous, and then waiting to see how long it takes security to show up. In some areas, like college campuses, response time is really slow because itís always just kids sneaking onto a dorm rooftop to smoke cigarettes or something, and no one really cares. The guards donít really want to bust some kids for being on a rooftop, and so theyíll stroll over an hour later. You canít depend on this, though; the fifth time it happens, they might get irritated at being bothered so often, and run over to catch someone in the act.

Older alarm systems on doors and such are usually far from reliable, and the guards know this. Thus, one way to get around institutional door alarms is to trip the alarm, go away, wait for security to come check it out. They will determine that the door is indeed closed and no-one is there. Do that a few times in a night and they might decide a circuit is futzed or that the wind is just messing with the door and setting off the alarm.
 
 
 

Alarm Systems

I've been told that most security system devices from motion detectors to door alarms work as "normally closed" (NC) switches, which means that the main panel simply detects if the flow of current in a wire has stopped. If the current has stopped, it means that the device has been tripped, which means in turn that the alarm will go off. Thus cutting the wire is a bad idea; it will do the same thing as tripping an alarm device, and the alarm will go off. However, it also therefore makes sense that short-circuiting the signal and ground wires between the alarm device and the detector panel would effectively cut the device out of the system without setting off the alarm.

But be careful. I've also been told that in alarm systems, the separate alarm panels are usually connected with 4-strand wires. (Often something like a telephone cord.) Of these four wires, two carry the NC current, and two are "tamper wires" on another normally-closed switch. Sometimes these tamper wires might just be wired to each other inside the alarm panel, or with screws on the outside of the panel, and if they are then you can tell which ones they are.

Anyway, the best recommendation Iíve heard is to melt the insulation off the wires with a flame. Then you can connect the two main NC switch wires of the alarm device with crocodile clips, leaving the tamper wires untouched. (You melt off the insulation instead of cutting it off because if youíre cutting it and the knife cuts the wire as well, the alarm will go off.) Or you can just short all four wires together and hope for the best.

Now be warned, this theoretical discussion has nothing to do with the reality of even moderate security. This is more like what you might encounter after-hours at your university library building. Real security I'm sure is much tougher, although no system is perfect.
 
 
 

Security Cameras

Most cameras, most of the time, are unwatched. Even if they are watched it might not matter: monitors often show the views from four or nine cameras at a time, on a split-screen television, and the view from a camera overlooking a heavily-trafficked area might sit right next to the view from a camera where no one is ever supposed to be. So if an intruder walks right past the camera and actss like they belong there, the guard might not even notice them for the ten seconds that they are on-screen. Unless the guard is paying close attention, the intruder in the empty space will seem to be just an extension of the activitiy that's going on elsewhere on the monitor.

Of course you canít count on this. I am sure that some guards, somewhere, watch their cameras very carefully. You also canít count on seeing cameras before they see you; sometimes they are very inconspicuous, concealed in little dark plastic bubbles. Occasionally now you will also see cameras that have a rounded mirror set up in front of the lens that give them a 360-degre field of view, so even if they donít seem to be pointed at you they can still see you.

In some buildings, the guard at the entrance of the building is also the one who keeps an eye on all the security camera monitors. If youíre looking to gain access to a particular place, and you know that there is a camera along the way which is monitored at the front security desk, you can send a friend to go chat with the guard and distract him/her from the monitors while you walk past the camera.
 
 
 
 

Jimmying Locks

Sometimes, on older doors, you can just slide a bolt or latch back into the door. This requires that there be space between the door and the doorframe. You can use a thin knife blade. Another good thing is a bit of brick strap, a stiff metal strip about 1/2" wide and very thin. Whatever you're using, you dig the tip into the bolt, lever the bolt into the doorframe, then pull on the door so that the friction between the bolt and the doorframe will hold the bolt instead of letting it spring back. Then you lever it some more, etc, until you can open the door. Only works on the (mostly older) locks that are really low-security. Most new doors are set up so the bolt won't slide back. Many newer locks, actually, have about a half-inch of slide in the bolt before the lock mechanism stops it. This is a real pain because you keep on feeling the first bit of movement and thinking that you have it, only to eventually realize that it will never work.

If you have a bit of brick strap or thin wire, you can make a tool in an L-shape, with a right-angle bend. This is no good for real locks, but it is sometimes useful on doors with that automatically lock on one side only, and have a push-button lock or something built into the doorknob on the other side. (it's key that the bolt be of the type that has a 45-degree cutaway on the side opposite you-- but this is surprisingly common.) You slide the L through between the door and the doorframe and then pull it back, so the right angle is hooking the bolt. You pull the door toward you as far as it will go (1/8th of an inch or so) and then pull the L right up against the bolt, then push the door back so the bolt pushes against the L and, because the bolt is cut at an angle, forces the bolt into the door. You're just doing the same thing as you'd do with a credit card, but you're doing it from the other side and you're making the motion of the door do your work for you. 

Depending on the door and the lock, you might find other ways. Some doors (again, older ones) have little push-buttons on the inside latching surface. These buttons are switches. You push in the bottom one, and the door will automatically lock when it closes; you push in the top one, and the door WILL NOT automatically lock when it closes. If you can get a knife blade in there to push the top button, it will unlock.

There is little that can be done with newer security-conscious doors. Few of the tricks mentioned above work on more recent locking mechanisms. But there's always some way to get in. Go around and try doors, see if someone left something open. Look for open windows. 
 
 
 

Picking Locks

One of the most convenient lockpicking guides is the MIT guide to lockpicking. It's on the web at:

http://www.lysa tor.liu.se/mit-guide/mit-guide.html

The MIT guide and Richard Feynman both make lockpicking sound easy. I donít know; Iíve never successfully picked anything better then a cheapo three-pin lock. But itís definitely worth a try, if you have some time on your hands.

You can also purchase all sorts lockpicking gadgets, including both hand- and battery-powered little rotating ìautomaticî lock-pickers that jiggle the pins and tumblers for you. You still need to have some technique in your use of a torque key along with the ìautomaticî lock pick.

If you really want to learn more about locks and lockpicking, research locksmithing as well as lockpicking. There is at least one usenet newsgroup with pretty sophisticated locksmithing/lockpicking discussions, called something like alt.locksmithing.
 
 
 

Breaking Locks

See the discussion of boltcutters on the "tools" page. 

Also, some locks (locks with a U-shaped shackle; Iím not talking about locks built into doors) can simply be pounded open with a hammer, if you have a heavy enough hammer, enough time and space, no one is around to hear all the noise, and if you have no concern at all for the destruction you are wreaking on the lock, the hasp, and the door to which it is attached.
 
 
 

Doors with Electromagnetic Closures

Some institutional doors have electromagnetic locks, usually in the form of a rectangular plate up near the top of the door, paired with a matching plate on the doorframe. You see this a lot on fire exits and doors from the interior of buildings out to rooftops. They usually swing open from the inside out. 

These magnetic locks seem quite solid but they arenít really. If you slam the door hard enough with your shoulder, you can usually get it open. This is often useful for rooftop access. 

If you are outside the door trying to get in, and the door opens by swinging out toward you, itís a lot harder to get it open. (If youíre outside the door, often you canít tell if itís a magnetic lock or some other kind.) If thereís a solid doorknob and no deadbolt, sometimes you can yank hard enough on the doorknob to bust the door open. But the magnetic lock is usually strong enough that either your hand or the doorknob will give way first.
 
 
 

Detex Locks and Other Isolated Alarm Systems

Or ìEmergency exit onlyóalarm will sound if door opens.î

Note: this is only useful if youíre ALREADY INSIDE and youíre trying to get outside through the door, such as when youíre trying to gain access to a rooftop without setting off the alarm in the process. MAKE SURE that the doorís alarm device is isolated and is not connected to any larger system. If itís connected to a larger system, then tampering might set off a silent alarm and security will be on its way without you ever knowing it.

Generally the alarm WILL sound if you open the door, and it will be loud, and youíll have to run. So you donít want to set it off. But often you can disconnect the alarm and then open the door. (If, as I say, youíre already INSIDE the door. This doesnít help for trying to get into a secure building.)

On the Detex style locks, thereís a lock/alarm box, connected to a bolt and a lever. The idea is, in an emergency, you push the lever which simultaneously unlocks the bolt and sets off the alarm. 

Thereís also a keyhole, and with the key you can open the lock without setting off the alarm. Itís usually a good, solid lock with a complicated pin system and a firm bolt.

However, if it is a truly isolated alarm system, like the Detex locks, itís battery-powered. If you can detach the battery, then you can unbolt the door.

Thereís another keyhole which removes the battery cover. This is usually a much simpler lock, and perhaps it can be jimmied open. Also, in my (limited) experience, all these battery casings on the various fire exits of an institution share the same key- so if you can acquire the key to one, you can open them all. Finally, itís a lot easier to pry open the battery casing (with a crowbar or something) than it is to pry open the door. But, as the MIT guide points out, brute force is the last refuge of the incompetent.

Once the battery is out the alarm canít sound, and you can unlock it. If you replace the battery and replace the cover, it will look like it was just accidentally left unlocked by someone with the key.
 
 
 

Windows

Donít break them. But windows that have been accidentally left open are the best way- and sometimes the only way- to get into a locked building. Look around at the second-story windows; has one been left open a fraction? If not, can you tell if one is unlocked? Even in cold weather, people sometimes pop a window to cool down the overheated climate-controlled air. If you can climb up to it, youíre all set.
 
 
 

Elevators

From the city of Tempeís ìFire Department Policies and Proceduresî guide to elevators (http://www.tempe.gov/fire/docs/405.13.htm):
 

ìThe main [inner] doors have a metal bar (driving vane) that will unlatch the interlock of hoistway doors at a landing so both sets of doors will open in unison. This unlatching process takes place for the length of the driving vane and is called the landing zone. The doors operate by a small electric motor, usually on top of the car. For two speed type, the motor operates the inside with a cable attached to the outside. The types of doors match the hoistway doors. Usually car doors are not latched and can be pushed open from inside the car. Some places (ASU) have installed locking pins that are released at the landing zone to prevent tampering with the car doors during movement.
       There can be escape doors on top, to the side, or none at all. They may be hidden from the inside and take a removable handle to open.î

These ìescape doorsî are the easiest way to get into an elevator shaft. Usually the escape door is a small trapdoor in the roof of the elevator car.

The following excerpt gives various ways to get into the hoistway shaft. The ìFiremanís Key Holeî is a small hole in the outside doors. You donít see these keyholes as much on newer elevators.
 

ìIf the car is in the landing zone you can just push the hoistway doors open and easily access the car doors. If the hoistway door nearest the car has a key hole you can access the car doors and have a quick rescue. Make sure the main power is off to the drive motor as well as the emergency stop before opening hoistway. Multiple hoistways have keyed doors at the landing next to the pit and sometimes at the top floor. Using special door keys, the interlock can be released from outside the door. Each will operate the control rod for the interlock.

Lunar key- a straight rod with a groove. The hole resembles a quarter moon. Stick the key straight in the hole and pull down. If you do not have this key a screwdriver may work (phillips best).

Drop key- a rod type key with a flat hinged bar on the end. Insert in the hole until bar drops and rotate away from leading edge of door. Some keys have a double drop for a larger radius.

T key - a T shaped bar with a hole similar. Use like the lunar key. (older elevators)

If there is no key hole a hard rap at the top of the doors by the interlock may jar it open. This also may work if debris is in the door track.

Have the passengers open the car door. It should not be locked and can be pushed open by hand by overcoming the resistance of the door motor. Then if they can see the interlock connecting rod explain for them how to unlatch the hoistway doors, then push open. Again some car doors may have a clinoid locking pin to disengage first.

Use an adjacent elevator to access the interlock with a long tool. You may also be able to do the same from the hoistway door above or below the stalled car.î

There's another way to get into the shaft above or below the elevator that I've only heard about, never tried, but it seems to make sense. It depends on the fact that, as explained above, there are the inner doors (which move with the elevator) and the outer doors (on each floor), and only the inner doors are powered. The outside doors have a mechanism that's weighted to latch them shut, and they are unlatched when metal flanges on the interior doors catch against little plastic rollers on the mechanism of the exterior doors. Then the outer doors are pushed open by the inner ones.

What this means is that if you can manually undo the latch mechanism of the outer door, you can get into the shaft. It's a narrow space between the inner and the outer door, though, and so it's hard to see what's going on or to get at the latch mechanism. 

Call the elevator to your floor, open the doors, look between the inner and outer doors, figure out how the latch mechanism works, and figure out what part of the mechanism you would need to pull on to open up the outer doors. Then make a little hook out of coat-hanger wire or something. (little, like 1/2" diameter, plus a section to tie a cord to.) Tie a cord to the hook. Then use something sticky, like gum or tape, to attach the hook to a long straight piece of wire (like 18" long.) Use this to thread the hook into the latch mechanism. Hopefully there will be a hole or something hookable in there. Then pull away the straight wire, leaving the hook in place (that's why you needed something sticky-- so it would hold the hook for a while, but would release when needed). Then send the elevator away, and let the doors close while still holding the string, which now comes out between the closed outer doors. Then, by pulling up the string, you can open the latch and the doors will swing open.

Note that the interlock switch might be connected throughout the hoistway shaft; thus, opening the outer doors on any level, even if the elevator is somewhere else, will automatically freeze the elevator in the shaft. In some systems, the confused elevator will stay frozen even once the shaft doors are closed again, and will need a repairman to fix it.
 
 
 

Air Ducts

Air ducts are sometimes useful to get into locked floors of buildings or locked areas. Usually, the ducts that branch out on each floor are too small to be really useful for getting into one particular room. But if, say, an entire floor is locked off, sometimes you can go into the basement and find the main blowers where they attach to the main ducts. In big buildings these ducts are huge. You can chimney up the inside of the duct and exit through access panels. The sheet-metal ducts can support you if youíre not too heavy, although they might bend a bit. Be aware that the sheet metal of the ducts can make a hell of a lot of noise when it deforms under your weight, though, and so you canít count on being covert.
 
 
 

Steam Pipe Tunnels and Manholes

Multiple buildings of an institution or campus are often connected underground. These underground connections are often maintenance tunnels which contain steam pipes and other utilities. Sometimes you can get into these tunnels from another buildingís sub-basement, or sometimes you can find manholes in the environs that lead down into these tunnels. Thus if a particular building is locked or under observation, you can still sometimes enter it via these tunnels.