Cyclists (and others), beware Bic

[Dexter Rutecki]

I think NYC was exempted from the Kryptonite guarantee anyway (or used to be), but:

The Pen Is Mightier Than the Lock

September 17, 2004
By LYDIA POLGREEN

The cunning bicycle thieves of New York City always seem to
be one step ahead of lockmakers. Design a more
sophisticated lock and the thieves make a better pick. Make
a sturdier chain and they get bigger bolt cutters. And if
all else fails, they just dig up the parking meter or stop
sign to unshackle the bike from it. But to open some of the toughest
locks
on the market, a thief needs only to flick his Bic pen.

Many cyclists erupted in disbelief and anger this week
after videos were posted on the Internet showing how a few seconds of
work
could pick many of the most expensive and common U-shaped locks,
including
several models made by Kryptonite, the most recognized brand.

Mashing the empty barrel of a ballpoint pen into the cylindrical keyhole
and
turning it clockwise does the trick that has struck fear into the hearts
of
bicycle owners, especially those in New York, where thousands of bikes
are
stolen each year.

"There was murmuring on various Web sites, and so I decided
to go home and pick up a pen and see it if works," said Benjamin
Running, a
graphic designer who lives in downtown Brooklyn. "Sure enough, within 30
seconds I had broken into my $90 lock. I was in awe. My jaw literally
dropped to the floor. It was so easy."

And many Internet users had the same reaction this week
when they saw the homemade video he posted on his blog of
his Kryptonite NY Chain popping open.

The problem could have wider consequences. Lock experts
said the fault was with a particular type of cylindrical
lock that is used not just in bike locks but in vending machines, cable
locks for laptop computers, alarm system panels and countless other
places.

Not all such locks are vulnerable, because some are built
with more sophistication. Older Kryptonite locks made
before 2002 appear to be less susceptible, according to
bike shops that have tried to use the technique on them.

But this type of mechanism is used on most of the bicycle
locks that are used by millions of people around the
country, not just those made by Kryptonite (although the company said
yesterday that a new and better model was on the way).

As the news spread, bicycle shops across the nation pulled
the locks off their shelves and cyclists left their bikes
at home, wondering if anything could keep their wheels
safe.

"You would think for $80 for a bike lock it would be
secure," said Marc Weber Tobias, an investigative lawyer
and security expert, whose Web site, security.org, has
posted warnings about the flaws of cylindrical locks like
the ones used in U-locks. "But this doesn't surprise me at all."

The trick works because the pen has the right diameter and
is rigid enough to hold its general shape but pliable
enough to mold into a sort of key that opens the lock. Mr. Tobias said
the
vulnerability of such locks was well known in security circles.

"These are cheaply manufactured locks with serious design flaws," he
said.
"You can't possibly think your bike is safe with one of these locks."

The uproar appears to have started on Sunday, when Chris Brennan, a
cyclist
in San Francisco, posted an urgent message on the bikeforums.net
bulletin
board after he was able to pop open his lock with a pen.

Like many people, he had been skeptical, but doubts were quickly
dispelled
when users like Mr. Running started posting digital video clips of the
trick. By yesterday, 125,000 people had downloaded it from, his site,
thirdrate.com, he said. Meanwhile, nearly 170,000 had seen Mr. Brennan's
posting, starting a full-fledged panic.

"We are especially concerned because we thought these were
the best," said Noah Budnick, projects director at Transportation
Alternatives, an advocacy group representing bicyclists in New York
City.
"Our members get a discount on these locks. What is really shocking is
the
casualness with which someone could steal a bike with one of these locks
on
it."

Kryptonite, which is based in Canton, Mass., and was bought
by Ingersoll-Rand in 2001, is named for the only material
that can defeat Superman. The company has been making locks since the
1970's
and is recognized by most bicycle shops as the leading lockmaker.

It is so confident in the security of its locks that if a bicycle is
stolen
by someone who broke the lock, Kryptonite will pay up to $3,500 to
replace
the bike, depending on the model of lock, though there are several
caveats
to the policy. Bike shops in New York City overwhelmingly recommend the
company's locks, particularly the four locks that are designed
specifically
for New York riders.

In a statement sent by e-mail yesterday, the company said
that it was aware of the problem and was moving quickly to
get locks featuring a different mechanism to bike shops and that it was
designing a program to let users of compromised locks to upgrade to new
ones.

Donna M. Tocci, a spokeswoman for the company, stressed
that locks made by other manufacturers shared the same vulnerabilities.

Cyclists across the city marveled at how easy it was to
crack their locks. With a little practice, opening a
Kryptonite with a Bic barrel takes as little time as using
a key, said Arone Dyer, a mechanic at Bicycle Habitat in
SoHo. She produced the white plastic barrel of a Bic pen
from her pocket along with a Kryptonite brand lock and
provided a demonstration. In less than five seconds, the shackle popped
and
slid open.

"It is that easy," Ms. Dyer said.

The NY Chain lock, the
product most shops recommend for city cyclists, consists of
a heavy chain and small U-shaped lock. It weighs about six pounds, so
heavy
that many riders wear it slung around their waists. The chain is made of
squared links of hardened steel that is impossible to cut by hand, so
that
part of the lock is still sound.

Bike shops are recommending that customers replace the
small U-lock with a sturdy padlock, like the ones that
bodegas use to secure their roll-down gates. These padlocks cost less
than
$20 at most hardware stores.

In addition, Kryptonite has a line of locks that feature
flat keys; Transportation Alternatives recommended that its members buy
one
of those.

The group's Mr. Budnick said that most bike thefts could be prevented if
only office buildings allowed people to bring their bicycles indoors,
but
few do. A bill requiring buildings to allow bikes inside was introduced
by
City Councilman David Yassky but has been stuck in the Housing and
Buildings
Committee.

Will Wood, whose Spokes and Strings shop in Williamsburg
caters to the commuter market, said he was warning anyone
who would listen.

"I feel like a Cassandra, but for years I have said to my customers,
'This
is the industry standard, and this will keep your bike safe,' " Mr. Wood
said. "Now I tell everyone who comes in, 'Tell your friends before the
thieves tell theirs.' ''

[FNG]

Posted in the bike forum, but still good to know.