The first lock I ever picked was my own: one day in my sophomore year of high school I came home to find that my bedroom door wouldn’t budge. I must have grazed the lock button with my thumb as I closed the door that morning, or else the internal springs had become loose and excitable from overuse.
I’d gotten into the habit of locking my door before going to sleep. Stories of murders were dominating the local news at the time; two girls about my age whose bodies and bones had turned up by a lake not far from where I lived. It wasn’t clear or logical, even to me, what protection locks were supposed to afford: both victims had been killed while out jogging during the daytime, not snatched out of their beds, and the attacks had taken place along a nature trail and not in a quiet suburb. Still, the steady drip of stranger danger messaging I’d absorbed over the last decade or so meant that any new threat could be absorbed by osmosis and incorporated into the faceless, ever-present figure of the Kidnapper. In this context, my door-locking was less practical than ritual, one that brought me some inchoate sense of safety and wellbeing, like a psychic sugar pill.
I passed the better part of the afternoon jabbing and scraping a straightened paper clip into the hole in my doorknob, waiting for whatever happened inside locks to happen. At one point, nearing defeat, I asked my stepmother if we could go to the hardware store to buy a lockpicking kit. There’s no such thing, she said firmly. I frowned; I was sure I’d heard the phrase before, but it was true that the more I turned the words over in my head the more implausible they sounded. A box full of tools purpose-built for break-ins? That you could just buy like it was a candy bar? Surely that couldn’t be right. But then I heard a click, and I felt the door give way, and suddenly the question was moot, and I allowed it to submerge itself in the lower depths of my subconscious for another decade or so.
*
I don’t know why, exactly, YouTube’s algorithm first shepherded me to LockPickingLawyer’s videos, but I do remember that what jumped out to me immediately was how short they were: two minutes, maybe three, in which he promised to accomplish something that had taken me multiple hours all those years ago. More amazing still: only after clicking on one of the links did I realize that, short as they were, the majority of the videos’ time was taken up with explanatory patter. The actual picking, when all was said and done, was over in a matter of seconds.
LockPickingLawyer’s videos have an almost unvarying formula: they open onto a shot of his chosen quarry on a grey desk. He will introduce himself and in a steady, professorial voice explain the order of the day. Perhaps he has received a package from a fuming locksmith who doubted the veracity of his claims. Perhaps the owner of some upstart channel, hungry for clicks, has attempted to foil LPL with a custom keyway of their own devising. Perhaps he’s decided to demonstrate yet another hopelessly flawed design from Master Lock, which frequent viewers of the channel will quickly come to recognize as a byword for alarmingly shoddy workmanship. Only after the preliminary remarks are out of the way will LockPickingLawyer actually get down to the picking. “Nothing on one, click out of two, three is binding,” he’ll say, narrating the unseen drama unfolding within the device as he runs down the pins until all of them have at last been pushed into place.
He will open the thing once and then once again to show us, as he always says, that the first time wasn’t a fluke. It never is.
On occasion, if presented with a particularly interesting challenge (and any lock that takes more than a couple of minutes for him to subdue would fall out of the ordinary for LPL), he will follow his picking with a kind of autopsy: sliding the keyway out, he will shake loose all the pins and springs it contains, classifying them as he goes—spool pin, serrated pin, modified driver pin—and slot them into the grooves of a tray created specifically for the dissection and study of lock parts.
LPL has catholic taste in subjects: he picks gun cases and front doors and sports cars and hotel safes and school lockers. He unclicks security tags on clothing and booze bottles with the swipe of a magnet. His personal collection of historic locks spans eras and continents: an Indian lock featuring a sculpture of Shiva and a Venezuelan motorbike lock and a bulky Soviet dual-custody padlock requiring two bureaucrats with two sets of keys to open. In one video, he gives us a window into his training routine: a carabiner as thick with locks as a Parisian bridge, which he picks idly while watching TV like others reach for handfuls of popcorn, the movements so smoothly automatic at this point that he can do it all by touch and sound alone.
LPL never shows his face; all we see are his hands working as his voice explains their every movement. Whenever I’ve watched him pick I am always reminded, eerily, of dentistry: delicate unseen instruments probing a void, feeling for where something sticks or another thing wiggles and gives way. Even the little sounds are the same. The resemblance is so uncanny that it’s hard not to half-imagine, as you watch, the sensation of a cold metal hook grazing the ridges of your backmost teeth.
*
But LockPickingLawyer is not merely a dab hand with a shim; he’s at the top of the field in what practitioners refer to as “covert entry” or “locksports,” a man who’s found his strange singular talent and rocketed to the front of the pack. Though for privacy reasons he rarely participates in official contests, LPL won the first competition he ever entered in 2019 and has picked multiple locks that those in the community consider to be “black-belt” level.
But most of the locks LPL demonstrates on his channel present no challenge to him at all. Disconcertingly often, in fact, the products he tests are either so badly designed or so carelessly put together that they can be bypassed in less than the time it would take to fish out the key from your pocket. In capable hands, anything can become a pick: a clothes hanger, an orange juice carton, a twig, even the plastic packaging of the lock itself.
LockPickingLawyer’s fans are many, and they are rabid. In November of 2019, he became the first lockpicking YouTuber to garner more than a million followers (that figure now sits at over four million), and it’s not uncommon for individual videos on his channel to crest that number of views. This popularity has not come without its downsides. In one video, he opens up a locked box sent to him by an avid viewer only to find (to his embarrassment and, presumably, his wife’s displeasure) that a lonely woman has mailed him her lingerie. Delivering the keynote address at SAINTCON, an eerily named cybersecurity conference in Utah that assented to LPL’s stipulation that he be allowed to hide his face, LPL revealed that he’s also been threatened, sometimes less credibly and sometimes more so. He’s had “fans” send packages to his PO box with secret tracking devices inside in the hopes that he’ll carry them home with him and reveal his address. He’s had multiple people hire private investigators to tail him, usually concocting oddball excuses for doing so: that he’s faking a disability for insurance money, that he's a deadbeat dad shirking child support, even that he’s kidnapped a child. The reason he knows about these stories is because nine times out of ten the PIs these people approach are friends of his. The security community is small, and apparently it defends its own.
*
The “Great Lock Controversy,” as it would later come to be called, occurred in 1851: Alfred Charles Hobbs, an American locksmith who had traveled to London for the heady fanfare of the Great Exhibition, announced at the Crystal Palace that “all the locks made in this country up to that date admitted of being very easily picked.” As proof, he placed a top-of-the-line Chubb lock on the table and got the thing open in minutes. Over the course of his English sojourn, Hobbs would repeat the performance again and again to shocked audiences, reducing locks that trumpeted their “unpickability” to little more than decorative paperweights without breaking a sweat. The story was in all the papers: nothing under lock and key was safe.
But Hobbs had not journeyed across the Atlantic merely to boast of his virtuosity with a rake: he came bearing a vision for a new way of thinking about security. As it was, he said, all locks available for purchase at the time were vulnerable to some form of attack or another. “Wherever a key can go,” he would later write, “instruments of a suitable size and form could follow.” The only thing that was keeping things orderly was that people had yet to realize this. This concept—that what makes a particular security measure work is not its flawlessness so much as the general public’s ignorance of its flaws—is known to people in the industry as security through obscurity, and since Hobbs’ day critics have pointed out its essential dangers. Instead of jealously guarding the secrets of locks’ inner workings—and, crucially, the vulnerabilities that they engender—those who reject security through obscurity hold that any design that depends upon ignorance to safeguard it is a failure from the start. Instead, they argue, systems of security must be so rigorous that they can serve their protective function even if everything about them became general knowledge. Indeed, many go a step further and do away with that final hypothetical, arguing that through radical openness about the flawed devices currently on the market we can force change from manufacturers who would otherwise drag their feet, creating a world that is not only safer but more knowledgeable about risk as a whole.
And yet for many in the audience at Hobbs’s displays, what was most appalling was not so much the problems he exposed as the fact that he exposed them at all. Hobbs was playing a dangerous game, these opponents countered, arming criminals with the information they needed to break into any home, any vault, any treasury in the country. To this, however, Hobbs had a wry answer at the ready: “Rogues are very keen in their profession, and know already much more than we can teach them respecting their several kinds of roguery.”
Over a century and a half on, LPL has positioned himself as starting from roughly where Hobbs left off. Design in the industry has changed little, he asserts, since the founding of Yale Lock some 160 years ago. This applies even to supposedly high-tech security devices, which despite fingerprint scanners and slick keypads are often as poorly thought out as their analog predecessors. The locks LPL effortlessly pops open on his channel every week have the same basic faults Hobbs was pointing out to Victorian audiences—and they are often among the most popular and well-known models on the market.
This latter point has been a major driver of LockPickingLawyer’s popularity among mainstream viewers. When LPL first started his channel, he focused his time and energy on niche, challenging pieces, the kinds that real locksports devotees might labour on for months before they hit upon the right line of attack. Solving the puzzles these locks presented was a real feat of ingenuity and skill—but one that few outside of the covert entry community could really appreciate. Eventually, however, LPL discovered a new avenue for his efforts, one with potential for broader appeal: leveraging YouTube to get the word out about flimsy consumer locks with the goal of shaming their producers into making something better. It was a romantic notion, one that positioned his channel as the catalyst for change in a global industry. As he told his listeners in Utah, “People tend to notice when you say, ‘I can open your front door in thirty seconds.’”
Millions of people did indeed take notice, as LPL’s soaring viewership numbers attest. And so did the makers of these locks—but not necessarily in the way LPL had originally hoped. When he exposed a major design issue with one of Key Kop’s products, the company responded not by fixing the issue but by demanding he take the video down. It was a disheartening blow, one that struck at the fundamental assumption underpinning his strategy: that these brands simply hadn’t known how bad their products are. “How do you fix a mistake,” LockPickingLawyer asked the crowd of security experts at SAINTCON, “when they know about it and just keep making the same mistakes over and over?”
*
If you watch enough of LPL’s videos—if you see the same mistakes by the same big-name manufacturers year after year, product after product, and if you then start to notice these locks in your real life on door after door, building after building—it’s hard not to come away with a vision of the world that’s a little wobblier and worse for wear. “Pick-proof,” boasts the lock that gives up the fight after a few seconds of fumbling; “pick-proof,” claims the lock whose hatch pops open with a single sharp bash from a rock. And the key to the warehouse gate can open the rooms in the motel that’s down the street, and the key to the hydraulic press switchboard can turn on the airplane’s engines, and the key to one slot machine works for all the rest on the casino floor so if you really wanted you could open up their bellies one by one and cash them all out at once. Everything is open, the message seems to be, everything is already open if you know, and you have only to lay your hands on it to feel for the difference between the true gate and the false.
But here’s the thing: after you have made your first successful pick, you break something that simply resetting the mechanism can never fix. The lock’s magic aura is shattered, and with it much of the (largely imagined) protection it offered. Instead, the sense it will always give you now is one of vulnerability, of danger. If I could do that, you think, what’s stopping someone else from doing the same? When you learn to pick locks, the first and most important thing you steal is your own sense of security.
*
On the subreddit devoted to lockpicking, there are plenty of commenters who credit their start in the sport to LPL, but there is also a minority who seem to despise the guy. He’s a shill, they say, who’s only out to promote his business. (In 2020, LPL launched his own brand of picks and frequently demos the products—which critics allege go for inflated prices that sucker beginners—in his videos.) Some feel that LPL’s channel was better in the old days, back when he only had a couple hundred followers and concentrated on specialty pieces that presented a real challenge even to serious pickers. Lately, they say, LPL is just chasing clicks, tackling party-trick locks that are only impressive to those outside the field. In other words, LPL’s gone mainstream.
But there’s another line of criticism that sometimes comes up, one which holds that the problem with LPL’s increasing focus on commercial locks is not that it’s gimmicky but that it’s unethical. In February of this year, LPL posted a video on what he called “the most significant security flaw in North America,” which featured a lock common on storefront doors that could be opened with a simple tug of a thin hook (a tool that he noted was available for purchase on his site). In response, a user called nivek_c, who claimed to be a black-belt picker himself, blasted LPL on Reddit: “That video has nothing to do with locksport,” he wrote. “It's basically promoting the use of a tool that no one other than locksmiths and maybe LEO [law enforcement officers]/fire fighters should even own, to do things that are likely illegal for anyone outside of the previous two professions to do. That's a really really bad look for our community.”
It’s easy to see in this line of reasoning an echo of the Great Lock Controversy and the debate it inspired about the virtues of ignorance. But security through obscurity, at least as a complement to other strategies, continues to have its advocates. For these people, the argument in favor of their position is really very simple: what if we jettison the flawed locks we have in the quest for a perfect one, only to find that a perfect lock can never exist? What if something better never comes along?
*
When I lived in Kyrgyzstan, my boss was a sport shooter and would sometimes bring her equipment to the university where we worked so that she could go directly from her classes to the range. She liked to tell the following story: that one day she’d arrived at work to see a huge line outside the entrance to the main building, something that never happened under normal circumstances. For some reason, the university had ratcheted up its security literally overnight: extra guards, a metal detector, bag searches. Then it hit her: John Kerry, who was serving as US Secretary of State at the time, was due to visit campus that afternoon for some grandiose bit of American soft-power theatre or another, and in advance of his arrival everything and everyone needed to be scrutinized. My boss had completely forgotten, and as luck would have it she was carrying her shooting gear; if she went through the security check with it, what could they possibly conclude but that she was a would-be assassin? Just as she was mentally preparing to cancel her morning classes and schlep home, one of the guards recognized her and waved her to the front of the line. “Let me get that for you,” he said, “that looks heavy.” With that, he proceeded to carry the duffel bag with her gun in it around the metal detector before returning it to her on the other side with a smile.
I think about that story whenever I watch a video in which LPL opts for what he calls a “destructive entry” technique—that is, a technique that doesn't require any picking skills to execute. Often, these involve skirting around the locking mechanism entirely, going instead for a weak point that has escaped the notice of the lock’s installer. (These sorts of attacks often involve LPL pulling out a special yellow mallet whose head bears an uncanny resemblance to crystallized urine.) A padlock, however formidable, is useless if exposed hinge pins mean that the door to which it’s affixed can simply be lifted out of its frame. Any security measure is only as strong as its weakest point, whether that’s a gap around the tumblers of a combination lock big enough for a paperclip to slide in or a well-meaning security guard who sees a familiar lady shouldering a heavy burden and bypasses the system just this once to give her a little relief.
It’s easy to laugh at these little oversights until you realize their full ramifications. Watch enough picking tutorials and you may well start to seriously think about changing out the lock on your front door for something sturdier—but what about the windows, surely a far likelier point of entry for would-be break-ins? (A riposte to the flak that LPL caught for his storefront lock video, for example, might be that the lock is typically used on automatic glass doors—meaning that any criticism lobbed at LPL for arming would-be 7/11 robbers could be leveled with equal validity against brick manufacturers.) Compounding this is the fact that the more unusual and ostentatious a security measure is, the more likely it is to tip off potential thieves that it’s guarding something of value worth their time and effort. Sometimes the best bike lock isn’t the one with the strongest chain, as he noted in a video testing a device put out by Supreme, it’s simply the one that attracts the least notice.
So what’s the solution? A home with iron shutters, a steel door, its chimney welded shut, its connections to sewage lines guarded by metal caging? The futility of striving for absolute security was something that W.G. Sebald captured in Austerlitz in a scene where the narrator contemplates the history of Western European fortress architecture:
The frequent result . . . of resorting to measures of fortification marked in general by a tendency towards paranoid elaboration was that you drew attention to your weakest point, practically inviting the enemy to attack it, not to mention the fact that as architectural plans for fortifications became increasingly complex, the time it took to build them increased as well, and with it the probability that as soon as they were finished, if not before, they would have been overtaken by further developments, both in artillery and in strategic planning, which took account of the growing realization that everything was decided in movement, not in a state of rest.
It’s very easy to come away from LPL’s channel with a frigid jolt of fear: the realization (whether new or renewed) that so much of what we think is secure is unsafe, that our sense of day-to-day wellbeing depends heavily on what are ultimately poor assessments of what is risky and what is without risk. But there’s another way of looking at it, which is that despite the shoddiness of all the locks I have ever used, in all of my time on Earth I have never once experienced a break-in. I don’t think it’s naïve to say that this is something more than a miraculous stroke of luck. Theoretically, armed with the knowledge gleaned from LPL’s videos, I could probably force the lock on my neighbors’ apartment. But they can breathe easy because even if I could, I neither want nor—more to the point—need to take their things. If LPL’s channel presents a masterclass in lockpicking, it offers other lessons as well: that security lies not, as the frigid-to-lukewarm reactions of lock manufacturers attest, in a libertarian fantasy of earnest corporate responsibility, nor in the individualistic and ultimately futile construction of personal fortresses of solitude, but in the things that make us secure in each other. These too are factors that keep us safe, whether in conditions of obscurity or not. Everything is open.
