Master Key System Compromise in a University
A university has a master key system with 5 levels: grand master, master, sub-master, and change keys. A student finds a master key in a lost and found and posts a photo on social media. The key is stamped "Do Not Duplicate" but the stamp is worn. The university is concerned about a security breach. The system has 2000 locks and 5000 keys. The keyways are restricted (patented). The university wants to rekey only the affected areas but is unsure of the key's level. You are the institutional locksmith. You have the key and can examine it. The university has a key control policy that prohibits unauthorized duplication. The key is a master key that opens multiple buildings. The university wants to avoid a full rekey due to cost and time. You need to determine the key's level and recommend a course of action.
1. How can you determine the level of the found key within the master key system?
Read the worked answer
Examine the key's bitting and compare it to the master key system's hierarchy. The key may have a stamp or code indicating its level, but the stamp is worn. You can use a key gauge or calipers to measure the cuts. Compare the cuts to the system's master key charts. In a well-documented system, each level has a distinct bitting pattern. For example, a grand master key might have all cuts at the deepest level, while a change key has cuts that differ. You can also test the key in various locks: if it opens multiple buildings, it is likely a master or grand master. If it opens only one building, it may be a sub-master. Use the university's key records to see which keys are missing or unaccounted for. The key's bow may have a code or number. If the keyway is restricted, the key blank may have a unique profile that indicates the level. Consult the system's keying chart. Since the key was found, it may be a lost key from the system; check the key control log for lost keys.
2. What rekeying strategy would you recommend to balance security and cost?
Read the worked answer
If the key is a grand master or master key, the entire system may be compromised, requiring a full rekey. However, if it is a sub-master or change key, you can rekey only the affected area. First, determine the key's level. If it is a master key that opens multiple buildings, you need to rekey all locks that the key opens. But you can use a layered approach: rekey the most sensitive areas first (e.g., labs, offices with valuables) and then gradually rekey others. Alternatively, you can use a keyless access control system for high-security areas. Since the keyways are restricted, you can also change the keyway for new keys, but that requires new cylinders. The cost of rekeying 2000 locks is high, so prioritize based on risk. Also, consider that the key was found and posted on social media; the exposure is limited if the key is not duplicated. But you cannot assume it wasn't. Recommend a full audit of key control, reissue keys with new keyway for high-security areas, and rekey the rest over time. Document the incident and update policies.