“The Evidence Show” is hosted by EMI Executive Director Shawn Henderson. Not to spoil the plot, but The Evidence Show is, well… a show about evidence management. In each episode, we will take a look at the unique issues that impact evidence managers, custodians, and the law enforcement community in general. In this episode, Shawn discusses achieving true access control over your evidence vault.
He began this webinar by saying, “We’ve literally got people from all over the country tuning in, so hopefully, we will make good use of your time.
Before we jump right into today’s topic, I’d like to mention that one of the things we created during the pandemic was the Facebook Evidence Management Community Forum. It is a private group, with over 600 members. It is designed to give evidence managers a place to discuss issues and find solutions. It’s a great way to crowdsource information and to understand that you’re not alone; people all over the country are dealing with the same type of issues as you are. So, be sure to check it out.
Okay… let’s get straight to it today. This is going to be a two-part show. In the first part, we’re going to talk about the Keys to the Castle – How to achieve true access control over your evidence room. We’re literally going to be talking about keys, and locks, and card readers specifically, to ensure physical security. I’ve been kind of fanatical about locking hardware for the past 15 years.
For an evidence custodian, the locks that you use are incredibly important. Also, the door hardware and the way that you control access into your facility is incredibly important. One of the first steps is taking a look at the doors.
Today, I’m going to give you 10 things to think about, related to key control and access control. In the next episode, we’re going to have guests on to discuss key control again, and they will show you some technology that is available which could really make a positive impact on your operations.
So, why even talk about this? Why discuss access control? This is an evidence show. Why are we talking about doors and locks? A secure chain of custody is predicated on the security of your facility. If you have poor security conditions, or substandard security conditions, you can’t really achieve the secure part of the chain of custody.
It is very important that we limit the number of people that have access to evidence. The best way to do that is with a locked door. A locked door that a limited number of people have a key to, is the other important component. If you review our standards and our best practices at the Evidence Management Institute, or another training platform out there, everyone speaks specifically to access control and key control. There are some very specific requirements and recommendations for key control.
So, today we’re going to discuss 10 things that you need to know about evidence management.
The first thing I’m going to talk about is: Internal Access Audits
This is something that you can do as an evidence custodian. Before you can limit access to your facility, you’ve got to know who has access to your facility.
That’s trickier than you might think. If you’re a really small agency and you change locks frequently, that might be achievable. But, for most agencies that have people filter in and filter out, access control can be a nightmare.
We recommend that you do two types of audits at least once a year. It’s similar to the audit process that we would recommend for evidence. It’s actually part of that larger audit process, but we suggest that you do a key control audit and an access control at least once a year. Now, what does that mean?
RELATED: AUDITS – CRUCIAL FOR PRESERVING THE INTEGRITY OF EVIDENCE
A key control audit is pretty simple. It’s an access control audit, but you’ve got to have a list of doors with specific keys. A key-way is just another way of saying, this key fits this door. So, if you’ve got five doors in your office area, and all five of them are keyed the same, then that’s one key-way that you have to worry about.
You also need a list of keys, not just keys that you have access to, but keys that are in the entire agency. That list should include people with master or grandmaster keys. There are a lot of agencies where executive-level leadership personnel have master keys; which means they can open any door in any part of the facility, at any time. You’ve got to factor that in while you’re doing your audit and include those people in the list of people that have access to your evidence.
The goal here is to figure out how many keys you’ve got, who has them in their custody, and what they can access right now. We can’t necessarily control a lot of the who part. Meaning, if your Chief or your Sheriff wants access to your evidence room, we can’t just tell them no.
But, it’s important to know if they have access because if something happens, and you’ve got drugs or firearms missing, or evidence stolen from your vault, you want a list of the usual suspects. And the usual suspects are going to be everyone with access to the vault.
RELATED: RETHINKING THE TRADITIONAL, LINEAR VIEW OF CHAIN OF CUSTODY IN EVIDENCE MANAGEMENT
Many of us have moved toward a hybrid system where we have keys and we have card reader access to certain doorways. I love card reader access. It can be a tremendous benefit to an agency. It makes things very simple, but the same problem exists.
I’ll explain… Before I retired from law enforcement, many moons ago, we did an access control audit. I wanted to find out how many people had card reader access to our vaults. I found out that in our department of about 170 officers, over 150 people throughout the city had card reader access to our evidence vault.
That is a huge number. And, there were only three or four people that worked in evidence management. So, that left 146 people who, whether they knew it or not, could access our evidence vault at any time, based on the access card that they had.
There were firefighters that had access because they had been given general access to the entire city. There were some civilians not working in the police department that had access.
One of the things about card readers is that they’re generally assigned by someone that doesn’t work for the police department. If you’ve got a card reader system, it’s a best practice to have an admin who works for the department control that access. Or better still, for the evidence custodian to be one of the administrators so that they can run these types of audits.
One of the things that people probably don’t know about access cards… there is a little box in the programming that can be checked, that grants full and completely unfettered access to every door in the system. That takes a lot of control away from the evidence vault. Not only does it give people access to the second floor of city hall, it gives them access to your drug vaults… if they’re ‘protected’ by card reader access in those areas.
So, that’s why we recommend doing an audit at least once a year, to find who has been given access to your vault, and then you can have control over your keys.
Number Two: After Hours Access
I mean, do we really need to provide after-hours access to our vaults? I would say probably not. What we teach is to have evidence custodians on callback status. That’s not possible everywhere, in every case, but I can’t think of a compelling reason for someone to go into your evidence vault after hours.
It’s much better to provide a temporary bulk storage area, or a callback staff, to get into the evidence vault after hours, if it’s absolutely necessary. But, I can’t think of too many reasons why we would give people access to that vault. Even if you’ve got a massive drug seizure, calling someone in is a best practice. There’s no reason to expose the rest of your evidence to that intrusion after hours.
Now, we don’t always have control of that. I will say this… if you have to give people access, the worst possible way to do that is by handing over that ‘secret key’ that the Lieutenant or the Captain has on a key ring in a ‘secret place’ in their office. The secret place is usually their top desk drawer. Or if they’re ‘clever,’ on a hook underneath their desk. I can’t tell you how many agencies I’ve been in, where that’s where the secret key goes. That’s not a secret. You might as well just leave the doors open.
There are other agencies that will leave a key hanging in the jail or behind the control room at the jail. That’s another terrible solution because we really can’t determine who has access to that key at any given time. It is an open secret, and therefore it is the same as an open door. It’s the worst possible solution for after hours access. So, I would encourage you to find another way.
RELATED: CHANGING THE CULTURE OF EVIDENCE MANAGEMENT – PART 1
At our agency, we had an outdoor storage area. If someone brought in a very large piece of evidence that didn’t need to come inside, like lawn equipment that still had gas in it. You don’t want to bring that stuff into your bulk storage area. So, we had an outdoor holding pen that we would allow officers to put evidence into.
Instead of giving them each key access, we had a trap key device, like you can see in the image above. They would put their key in to release the key to the storage bin. It would trap their user key for the rest of the facility until they returned it.
In that area, we also had 24/7 video recording. There was also a key log that they had to sign to get access to it. It was not an ideal situation, but it sure beat having a key in the jail that no one could know who accessed that area or when. After losing four or five keys to that area, a trap key system made a lot more sense. And, they can work with virtually any type of locker system that you use.
Number Three: Who Belongs in the Evidence Vault?
We teach that only evidence unit personnel really belong in the vault. Other than that, escorted persons can be in the vault provided that they’re escorted by evidence unit personnel. The only people that really need keys to your evidence vault are people that work in the evidence unit. There’s no compelling business case for a Chief to have keys to the vault, other than the fact that they feel entitled.
A good Chief of Police doesn’t want access to your vault, because they understand the liability in the evidence process. They understand that if something happens, they are responsible for it. So, who belongs in the vault is a very different question than who thinks they belong in the vault?
Number Four: High-Security Door Hardware
If you can buy it at Home Depot or Lowe’s, it’s not high security. If you can get a copy of a key made, it’s not a high-security lock. I would almost go so far as to say, if your city locksmith has the key, then everybody has the key to your evidence vault.
High-security door hardware is different than consumer, or even commercial grade, door hardware. With high-security door hardware, you can’t get copies made of the keys. They just don’t sell reproductions. You can’t even get them at a locksmith shop.
A true high-security door lock is going to come with a key that cannot be reproduced except by the factory. You don’t want to lose a key to a high-security door because it’s a pain to get a duplicate from the factory.
Most of us don’t have a lot of understanding about high-security door hardware. I didn’t until I really started getting into the topic, but here’s my recommendation… If you really want key control at your agency, go completely off the grid. Go completely off of the key system that the rest of your city or the rest of your department is on. More than likely, they are running a medium-security operation.
Another thing about high-security door hardware is you can’t drill it out. That’s because they use case-hardened steel. So, it is almost impregnable by common tools that you can just pick up anywhere off the street.
Number Five: High-Security Padlocks
I hate going to an agency and seeing Master Locks on temporary lockers or temporary bulk storage bins. If it’s a Master Lock, just leave bolt cutters on the table. There are much better alternatives.
I want to do a little test here. I’m holding a Master Lock and it says commercial on it, but they don’t really mean commercial. This experiment might fail epically because I’m trying to do it live. One of the reasons I don’t recommend that people use Master Locks is because they’re incredibly easy to pick. I’m not really great at picking locks, but I just picked this Master Lock in five seconds.
But, if you can’t pick locks, you can just cut through them with a pair of bolt cutters. And, I’m not talking about high-quality bolt cutters. I’m talking about Harbor Freight $5 jobs.
A high-security padlock has more features. The quality lock that I’m holding is solid case hardened steel from ASSA ABLOY, and it has got a lock that can’t be picked. It’s a wafer lock. It’s a very simple machine, but you can’t cut through this latch and you can’t drill out that core. It is an incredibly sophisticated piece of hardware, and it’s not too much more expensive than a Master Lock. A high-security padlock is incredibly important for evidence management.
Number Six: When to Re-Key?
Most evidence management training classes teach pretty much the same thing: when there are security breaches – and that includes if someone loses keys to the vault – we recommend re-keying your evidence facility. Also, we recommend that you re-key the evidence facility when there is a change in staff, including those in executive or command leadership roles.
RELATED: CHANGING THE CULTURE OF EVIDENCE MANAGEMENT – PART 2
There is an exception to the re-keying recommendation, that I think you will find interesting. It solves a lot of problems related to keys for evidence managers. But we’ll talk about that next week.
Number Seven: Standards and Best Practices
In any good standards or best practices guide, you’re going to find prohibitions and recommendations. Ours is no different. In chapter three of our standards and best practice guide under facility security and safety, you can find lots of guidance specifically about keys, hardware, what types of products to use, and audit practices and procedures.
For example, a lot of us will change the locks, but we forget to deactivate people’s card reader access. That creates problems years down the road. What if you have an employee that was terminated, but seven years later, when you’re doing an access audit, you found that this employee still has access to the building through their key card. It’s just something that you want to square away early on.
In the standards and best practice guide, we also address a lot of common security vulnerabilities, related to doors, keys, and card reader access. So, it’s worth a read.
Number Eight: Links in the Chain
I probably use this metaphor too much for everything, because we deal with chain of custody, but having a great door lock is just one piece of a much bigger security picture.
A project that we were working on a while ago had a security door with hinges on the outside of the door; like you can see in the image above, on the left. In order to access the evidence room from the building exterior, all you had to do was pop the pins and just let the door fall.
Nobody did that, fortunately, but that’s one of the things that you’ve got to think about with respect to high security. You can have a thousand dollar lock, but if the hinges are on the outside, that’s a worthless investment unless you make mitigations or changes to that. Frames are also important. We recommend steel frames on evidence vault doors. Wood frames can be kicked in by anybody.
You don’t want to put keypad locks, like the image on the right above, without additional controls like a card read or an additional key to access any vault, because anyone could access that room just by punching in a code. Once that code is known, then anybody in the agency can access that door.
Number Nine: One Myth About High Security
Some people think… if it’s too secure, and the captain doesn’t have a way to get in, I will die inside the vault. That is a myth for two reasons. One, because the fact is, if you’re depending on your Captain to survive, when you collapse inside the vault, you’re probably already dead.
The truth is if there is an emergency inside your shop or inside your operations, the evidence eradication team – our friends in the fire department – can get in. I have yet to see anything that a firefighter couldn’t get into. They are extremely determined, well equipped, knowledgeable, and they’ve got lots of time to figure out how to get into things on their off days. So, they’re going to be able to get into your vault, despite your best security practices.
Number Ten: There’s Got to Be a Better Way
There is. There is technology that is available that can control and document access to all of your keys, and all of your card readers, which eliminates the need to ever re-key a facility again. It will also provide remote access to people whenever they need it. Access that you can control.
If someone needs to get into the office area, you can grant them remote access to the keys through a technology system that is commonly available through multiple different vendors. And, it gives you a hundred percent accountability over access control, and over all of your keys and your card readers. And that is what we’re going to talk about next week, because… we had to have some reason for you to come back.”
Tracker Products and The Evidence Management Institute want to give you something productive to think about during this time of uncertainty… a series of free evidence management training and panel discussions. Watch and comment on the webinars here. Or – to get in on the discussion, with nearly 600 other evidence custodians – join the Evidence Management Community Forum on Facebook.