Who Authors Unauthorized Access?

by Daryl Furuyama

The method for picking pin tumbler locks is widely known: use a torque wrench to slightly turn the plug while using a pick to either rake or individually set the pins into place.

What I find more intriguing is the implications of the existence of such a method.  The very precise pressure applied by the torque wrench allows for the pins to be individually set into place by the pick.  Still, it simultaneously prevents the pins from resetting after losing contact with the pick.  The expected process is to use a key to synchronously set and hold the pins in the correct position before attempting to turn the plug to unlock the lock.  Yet, this method disrupts the order of the expected process by first turning the plug and then asynchronously setting the pins, creating an unexpected behavior.

The existence of such a process reveals a discrepancy between the conceptual framework of how the lock works compared to the actual physical operation of the lock.  The conceptual framework is that all the pins must be aligned before the plug can be turned to unlock the lock.  The real-world phenomenon is that imprecision in the construction of the lock allows the plug to be turned slightly without the pins first being aligned in their proper location.  The tolerated play of the object allows it to enter into an unnamed third state of neither locked nor unlocked, holding the pins in stasis until they can all be manually aligned.

Something meant to be binary (locked or unlocked) is discovered to have a small analog range where it is somewhere between the two states.  This is hardly surprising for those who interact on the material level, with even transistors that form the binary basis of computing having some detectable voltage leakage while in the off position.  However, since that state is not in the conceptual framework of operation, it is often unseen and without a name.  It is an uncaught exception.  Who, then, is the one to give it a name?  Does the outsider who discovers something previously unseen have the right to give it a name?

The question then arises of who really is the one with authority over the system.  Is it the one with the key or the one who does not need a key?  To be without a key and still be granted access by the system requires a deep level of understanding of the system itself, whereas the possession of a key requires no understanding of the system at all for access.  The only time the key holder becomes interested in the functioning of the system is when it ceases to do what it ought to do.  Is authority something that must be bestowed upon you by another, or can a system recognize you as an authority because you know it so well?  Does it matter what one is willing to risk in order to gain that access?

Picking a pin tumbler lock really is not that difficult, and it can be done with two paper clips, so the use of such locks is not really about physical restriction of access.  Instead, they are physical signifiers of symbolic authority.  The one with the unique key is meant to signify the one with unique access and the exclusive right to enter.  However, what is the value of that supposedly unique key if it grants the same access as what is given to one who holds two ordinary paper clips?  Maybe that authority is not as exclusive as once believed if the symbol of such authority can so easily be defied.

So, who authors unauthorized access?  The truth is that there is no such thing as unauthorized access because all actions have an author.  The real question is how someone gained the authority to do what they did.  If the mechanism for access remains in that unnamed state outside of the conceptual framework, it would appear as if it was unauthorized and spontaneously happened.  However, we know that is not true.  It is just that the author was not recognized by the conceptual framework, so they remain unseen despite being recognized by the system itself.