Campus Grand Master Key Compromise During Construction
A university has 12 buildings, 4,800 keyed cylinders, and a six-level master key system. The grand master key opens every exterior and office door. A construction contractor was issued a temporary sub-master for a science building renovation; the key was signed out to a superintendent who left the job. Two weeks later, the key was reported lost. The lock shop's records show the sub-master was pinned to open 640 cylinders, including two vivarium doors and the central receiving dock. The university uses a restricted keyway with a patent, but the local hardware store has duplicated the blank for at least one departmental key. The campus police want all 4,800 cylinders rekeyed immediately; facilities has budget for only 900 cylinders this fiscal year. The vice president asks for a risk-based plan.
1. Characterize the exposure and recommend the scope of rekey.
Read the worked answer
The lost sub-master is a serious but bounded compromise: by the record it opens 640 cylinders, not the entire 4,800-cylinder system. The grand master itself is not automatically compromised unless it was on the same ring, was duplicated, or was used to originate the sub-master. Treat the 640 as exposed, with the vivarium and receiving dock as immediate high-risk because they involve controlled substances, animals, or receipt of valuables. The duplicate departmental key means the restricted keyway is not fully trustworthy; assume at least that department is exposed. Do not spend the entire budget on a blanket rekey. Phase the work: first rekey or replace cylinders for the 640 sub-master group and all doors on the duplicated departmental key, starting with high-risk areas; second, audit the remaining system for keys issued under the lost sub-master; third, rekey additional groups as budget allows, prioritizing exterior, pharmacy, IT, and cash-handling areas; fourth, use temporary electronic access or portable locks for high-risk rooms until rekey is complete. Document the risk decision.
2. The contractor's key was a temporary sub-master pinned into the system. What changes to key control and system design should follow?
Read the worked answer
Move from a paper sign-out to a key-control program: serialized keys, signed issuance and return, a key cabinet with audit, and a named key control officer. For construction, use a construction key system or removable-core cylinders so the construction master can be voided at turnover; never issue the grand master or a permanent sub-master to a contractor. Require background checks, daily sign-in and sign-out, and immediate reporting of lost keys. Use a patented restricted keyway with controlled distribution, but do not rely on the stamp alone. Separate high-risk departments onto their own keyway or master group. For the future, put high-traffic doors on electronic access control with audit trails and keep mechanical override keys under strict control. Build an annual audit and a written lost-key procedure.
3. A local hardware store duplicated a departmental key despite the restricted keyway. How should the institution respond?
Read the worked answer
Treat the duplicate as evidence that the restricted keyway is compromised for that department. Recover and inventory all keys in that department; rekey those cylinders to a new keyway or new pinning, and issue new keys only with signed receipts. Notify the keyway manufacturer or distributor and ask about patent enforcement and restricted distribution. If the store duplicated a patented blank, refer the matter to legal counsel; do not rely on a 'do not duplicate' stamp. Use the incident to justify a keyway upgrade and a written key-control policy. If the duplicate was for a low-risk department, the rekey scope may be limited, but the process failure must still be corrected.