ATM Security, Part 2: Intelligent Locking Systems and Brute-force Defense
March 7, 2002
Security has been a concern of ATM machine owners since the first one was installed in a Long Island branch of Chemical Bank in September of 1969. The co-patentee, Don Wetzel, installed a five-eighths-inch stainless steel housing and a mechanical box that would require eight hours of blowtorching to cut through one-quarter of an inch.
In the past 30 years security has evolved, along with all other aspects of ATM technology. Now, the machines use everything from steel reinforcement to the latest in electronic technology to protect the cash inside.
ATMs require the latest in technology because of the evolution of the machine from a single unit in a secure bank to a host of machines in convenience stores, malls and flea markets.
Thieves smash and grab the lighter, less secure and free-standing units, or pop them open to grab the cash box for later dissection. Physical restraints help, but technology now provides electronic locks to protect the machines from those who would steal cash boxes.
Buzz Siler, president of SafePak Corporation of Portland, Ore., designed and built ATM security restraints for full-service and cash dispensers. He started with a Cashbar restraint that allows maintenance access, but not for anyone to take the cassette.
"You can literally just grab a cassette from a drawer and get away with it in seconds," Mr. Siler said. "This is what encourages robbers because the crime is such a quick one."
The Cashbar system, with its separate lock for the cassette, allows store employees or maintenance people to fix bill jams or clean parts.
The Cashbar also prevents smash-and-grab-robberies that have become increasingly prevalent. Last year ATM thefts or attempted thefts increased even as the number of bank robberies fell.
"ATM chests are not like safes; they're just not strong," Mr. Siler said. "If somebody takes a crowbar and breaks into the ATM, this cash bar stares them in the face and causes them another 15 minutes of work. The time delay alone will deter the robbery."
The surprise factor is another deterrent, he said. "When you get somebody who breaks into an ATM who's done it before and expects to see a cash cassette and be able to run away, and suddenly is faced with this gigantic metal bar and a high security lock, he's going to look at that and ask, 'Did I bring the equipment I need to break through this second level of security?'"
He also designed electronic locks to protect the deposits in full service cash machines.
SafePak's smart locks can prevent convenience store thefts by creating time-consuming delays for robbers. Theft at gunpoint situations can occur as quickly as having a thief vandalize the ATM, so SafePak has designed tools to slow the thieves down.
A Time-Delay Lock Box allows store owners to put their ATM maintenance keys in an accessible location that still offers security. The box can be opened with a time delay of five to 15 minutes.
"You don't find too many criminals willing to wait around for 15 minutes and wait for that key," Mr. Siler said. "That's a simple way for the independent owners to foil robberies."
Locks can do more than prevent unauthorized access. Mas-Hamilton, of Lexington, Ky., markets a lock that audits entries into the machine.
For ATMs, Mas-Hamilton makes the Cencon System 2000, which has three electronic locks that can control a single mechanical one, said Bill Nevitt, vice president of customer service. The company also developed the Cassette Locker, a bar that works in conjunction with their electronic lock system.
The Cencon System 2000 uses three audit trails -- one within the key, one written by the lock that audits the time and date of entry, and one created by the personal computer that runs the Cencon software.
The key used by first-line maintenance people is initialized at the dispatcher, then issued to each person. This allows access to the ATM to perform any necessary function. Once the call is complete, the closed lock gives a seal number that is reported back to the dispatcher, which closes out that call.
Currently, NCR and Diebold use the Cencor System 2000 on their maintenance contracts, and 95% of the independent armored car carriers are using it with customers with whom they have cash and carry contracts, Mr. Nevitt said.
Even as physical security needs have increased, so have electronic security needs. Software encryption keys protect transaction records and prevent hackers from getting into an ATM.
Core Data Resources developed a key code system available for ATMs placed in casinos, hotels, restaurants and convenience stores. The system is available through marketing agent Cross International Technologies Inc.
Jay Buckner, director of marketing and communications for Cross, said their Mini-Bank 2000 ATM uses the Core Data master key remote system to provide encryption on the front and back end, preventing an outside source from breaking the master key code and tampering with funds.
Master keys have to be changed frequently to prevent hackers from breaking the encryption key. Using a remote master key enables the processor to change the master codes faster than the hackers can break them, increasing the security and integrity of the system.
"We're not altering the nature of a master key; we're making it more convenient to change it with greater frequency," Mr. Buckner said.
The original ATM machines couldn't have taken advantage of such systems. They may not have had to. As long as cash dispensers continue their rapid penetration into convenience stores and malls, however, they will have to adopt increasingly more sophisticated methods to counter theft.
Buzz Siler, president of SafePak Corporation, can be reached at phone (503) 620-8718, fax (503) 684-0491, e-mail: firstname.lastname@example.org, URL: http://www.teleport.com/~safepak.
Bill Nevitt, vice president of customer service for Mas-Hamilton, can be reached at phone (800) 950-4744, fax (606) 255-2655, e-mail: email@example.com, URL: http://www.mas-hamilton.com.
Jay Buckner, director of marketing and communications for Cross International Technologies, can be reached at phone (888) 340-2484, fax (650) 969-1211, e-mail: firstname.lastname@example.org, URL: http://www.cross tech.com.