{"id":1255,"date":"2009-03-13T20:39:07","date_gmt":"2009-03-14T04:39:07","guid":{"rendered":"http:\/\/cubist.cs.washington.edu\/Security\/?p=1255"},"modified":"2009-03-13T20:39:07","modified_gmt":"2009-03-14T04:39:07","slug":"how-to-break-into-a-vault-with-10-layers-of-security","status":"publish","type":"post","link":"https:\/\/secblog.cs.washington.edu\/Security\/2009\/03\/13\/how-to-break-into-a-vault-with-10-layers-of-security\/","title":{"rendered":"How to break into a vault with 10 layers of security"},"content":{"rendered":"<p>In 2003, Leonardo Notarbartolo and a team of Italian thieves broke into the Antwerp Diamond Center and made off with $100 million worth of \u00a0diamonds, jewelry and other valuables. \u00a0The vault was protected by 10 layers of security including a combination lock, Doppler radar, \u00a0infrared heat detectors, and more. \u00a0For six years, he has refused to speak with any journalists regarding the crime until now.<\/p>\n<p>Wired magazine has published an <a href=\"http:\/\/www.wired.com\/politics\/law\/magazine\/17-04\/ff_diamonds?currentPage=1\" target=\"_blank\">article<\/a> detailing Notarbartolo&#8217;s story and how him and his team were able to circumvent all the various \u00a0security measures. \u00a0It was interesting to see that despite having 10 different high-tech security measures, when each problem was \u00a0considered individually, the exploit seemed simple yet ingenious.<\/p>\n<p>For example, the infrared heat detector could be momentarily insulated using a thin layer of hairspray, buying enough time to physically \u00a0deactivate the detector. \u00a0Polyester shields could also insulate heat signatures, giving balcony access to the team. \u00a0Even though a forged \u00a0key was made, it turned out to be unnecessary because the guards simply kept it in a nearby supply room.<\/p>\n<p>The question is, how could something like this have been prevented? \u00a0As I mentioned, when each individual security measure was considered, \u00a0each work-around seemed possible. \u00a0Considering all 10 security measures would be a daunting task. \u00a0What was interesting to note was that \u00a0each security layer protects the vault from becoming compromised, but there didn&#8217;t seem to be any specific countermeasures for preventing \u00a0someone from tampering with the security devices. \u00a0Considering how each security measure could be defeated and how security measures might \u00a0complement each other (i.e. protect each layer from tampering) would be a good way to prevent future break-ins.<\/p>\n<p>Also, the thieves were able to break in because they were able to defeat predictable electronic devices. \u00a0Prior to the heist, they \u00a0gathered detailed information about the vault&#8217;s technologies, and they duplicated the vault and all its devices in order to simulate the \u00a0heist. \u00a0Once working details were confirmed, the same technology could be cracked consistently over and over. \u00a0At night, the security was \u00a0entrusted entirely to technology &#8212; no guard stood by at night to protect the vault. \u00a0Posting a guard would add a layer of uncertainty \u00a0that increases the risk of attempting a heist.<\/p>\n<p>So that seems to beg the question, how much should we entrust technology to handle our problems? \u00a0From a security stand-point, probably \u00a0all technologies are fallible and are likely to fail in some way or another eventually. \u00a0At the same, the article brought up the issue of \u00a0possible insurance fraud. \u00a0There was the possibility that some of the diamond dealers were in on the heist and pulled out their inventory \u00a0secretly prior to the heist, collecting on the insurance money while keeping their diamonds. \u00a0That suggests that there wasn&#8217;t much of a \u00a0system for keeping track of where the diamonds were and whether they were really lost in the heist or not. \u00a0There needs to be a reliable \u00a0system for tracking safety deposit transactions while maintaining privacy.<\/p>\n<p>This also brings up the eternal security question &#8212; how much security is sufficient? \u00a0You would suppose 10 layers of high-tech devices \u00a0would be enough to deter thieves from an attempt. \u00a0Does there need to be more security? \u00a0Or perhaps the security could be used in a more \u00a0efficient and effective way. \u00a0Who are the stakeholders? \u00a0It seems like the bank, the customers with the safety deposit boxes, and the \u00a0insurance companies should have an interest in answering these questions.<\/p>\n<p>Overall, the article told an interesting story, almost as if it were out of a movie. \u00a0I highly suggest reading it just for entertainment \u00a0at the least.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>In 2003, Leonardo Notarbartolo and a team of Italian thieves broke into the Antwerp Diamond Center and made off with $100 million worth of \u00a0diamonds, jewelry and other valuables. \u00a0The vault was protected by 10 layers of security including a &hellip; <a href=\"https:\/\/secblog.cs.washington.edu\/Security\/2009\/03\/13\/how-to-break-into-a-vault-with-10-layers-of-security\/\">Continue reading <span class=\"meta-nav\">&rarr;<\/span><\/a><\/p>\n","protected":false},"author":102,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[4],"tags":[193,199,195,198,196,201,197,194,200],"class_list":["post-1255","post","type-post","status-publish","format-standard","hentry","category-current-events","tag-bank","tag-belgium","tag-diamonds","tag-heist","tag-italian","tag-notarbartolo","tag-thieves","tag-vault","tag-wired"],"_links":{"self":[{"href":"https:\/\/secblog.cs.washington.edu\/Security\/wp-json\/wp\/v2\/posts\/1255","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/secblog.cs.washington.edu\/Security\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/secblog.cs.washington.edu\/Security\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/secblog.cs.washington.edu\/Security\/wp-json\/wp\/v2\/users\/102"}],"replies":[{"embeddable":true,"href":"https:\/\/secblog.cs.washington.edu\/Security\/wp-json\/wp\/v2\/comments?post=1255"}],"version-history":[{"count":2,"href":"https:\/\/secblog.cs.washington.edu\/Security\/wp-json\/wp\/v2\/posts\/1255\/revisions"}],"predecessor-version":[{"id":1260,"href":"https:\/\/secblog.cs.washington.edu\/Security\/wp-json\/wp\/v2\/posts\/1255\/revisions\/1260"}],"wp:attachment":[{"href":"https:\/\/secblog.cs.washington.edu\/Security\/wp-json\/wp\/v2\/media?parent=1255"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/secblog.cs.washington.edu\/Security\/wp-json\/wp\/v2\/categories?post=1255"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/secblog.cs.washington.edu\/Security\/wp-json\/wp\/v2\/tags?post=1255"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}