passlock - Rob Painter

TThhee TTrruutthh aabboouutt PPA
K bbyy R
Roobb PPaaiinntteerr,, A
Applications: 1998-2005 GM Truck, SUVs, Hummer, 1997-1999 Buick Skylark, 19992004 Cadillac Escalade, GM Astro Vans,1996-2003 Chevy Cavaliers, Pontiac Vibe,
Grand Am and many other GM vehicles……..
Over the last year I have found many problems with this factory installed anti-theft
system. PASS LOCK is known commonly to locksmiths in the insurance industry as
MRD (Magnetic Rotation Device). It is quite common for the examiner inspecting a
vehicle with such a system to ASSUME that this system is very effective against theft.
This system is controlled only by the rotation of the ignition lock cylinder. If the ignition
lock can be rotated, that is the end of all security aspects of this system.
By design, if the ignition lock is ripped from the housing the magnetic field is broken. By
design if the ignition lock cylinder is force rotated with a tool such as a screwdriver the
magnet in the ignition lock is supposed to be damaged and in turn the engine will not
start due to the fact, that the vehicle’s computer will not be able to read the rotation of the
ignition lock. As stated, this is by design and is not what actually happens in real life. The
ignition lock in some cases can be force rotated and the engine will run.
Another consideration on this style lock in GM trucks was a production problem. In 2000
there was a bulletin out stating that it was common for the ignition lock to hang up
making rotation of the lock with a key difficult. The correction from the lock
manufacturer was to leave out the second and third wafers (tumblers) from these GM 10
cut locks which employed 9 wafers. Now you have only 7 wafers in this lock. The wafers
for these locks only came with 4 heights and differed by .025 of an inch. In contrast in
order to understand hall small a tolerance this is: A human hair is from .004 to .007 of an
inch. Put 4 to five human hairs together one on top of each other and you come to about
.25 of an inch. By design these wafers were in what would be considered half cuts. In
other words a 3 cut on the key would operate a 4 cut wafer or a 2 cut wafer. Taking wear
into consideration, there is a whole combination of 10 cut keys that would operate this
I was involved in a case where a Forensic Locksmith working for the insurance company
was dispatched to examine a reported stolen vehicle that had no ignition lock present. In
such a case, different hypotheses could not be ruled out because the ignition lock was not
present. When examined, the expert attempted to start the engine by jumping the ignition
switch wiring. His report stated that the PASS LOCK system was enabled causing the
engine not to start. This is what he found when examining the vehicle once recovered
without the ignition lock and switch assembly. The problem here is although the PASS
LOCK was working at the time of his examination, unless he had the lock and wafers to
examine under a microscope, there is no way he could come to the conclusion as to how
the vehicle was last operated. A jury also found this to be true and awarded for the
insured. Plaintiff Counsel went back to the judge for a consumer fraud issue and was
awarded treble damages. The ignition key for the PASS LOCK system is a common
ordinary key blank. It has no security chip embedded in it. The security or “R” code is
built into the ignition lock assembly.
Duplicate ignition keys can be made at any hardware store.
When a locksmith looks at such a vehicle, it is very common for him to state service
procedures as they relate to a theft. Thieves are not out there removing the lock and
housing and spending the half hour programming it takes to steal the vehicle.
To service this style lock, there is a one in 10 chance that the correct lock with an
electronic code is being installed. If the lock is not programmed in order for the vehicle’s
computer to see the rotation of the lock, there is a process that needs to be followed to
program the system if a Tech II scanner is not available.
Once replaced, the ignition lock cylinder must be left in the RUN position for 10 minutes.
The ignition lock is turned to OFF and the process is repeated for another 10 minutes.
The lock is then turned to OFF and the process of turning the ignition lock to ON for 10
more minutes is now repeated. The ignition lock is now programmed to start the engine.
The problem in this case using a locksmith to opine on the theft of a PASS LOCK
equipped vehicle is that, this process is the only way known to him for stealing a PASS
LOCK equipped vehicle. Thieves do not have the luxury of time that the locksmith does.
A locksmith knows how to pick this lock. A locksmith knows how to impression a key.
These methods all take time and yet the insertion of an incorrect key, or the possibility
due to wear of the lock rotating without a key is still present.
I am seeing many Suburbans and like kind vehicles that are totally stripped (including the
vehicle’s computer) where the locksmith is stating the vehicle could not be stolen
because of this highly sophisticated system.
Many insurance experts from my experience are not aware of GM Bulletin# 26 (May of
1999) of how to defeat the PASSLOCK for remote start. This same process as defined in
the bulletin can be used to over ride the PASS LOCK by a thief. The security light will
stay on steady in the dash in this instance, but the engine will still run. One of the
questions an insurance investigator must ask of the insured is: Were there any lights
illuminated in the dash before the reported theft? If recovered burned and the insured in
trying to help the investigator in the cause of the fire or theft, may say the security light
was on before the theft. If this is the case; the system was not functioning properly before
the fire and in that case, it should be considered a good steal.
It gets worse when the vehicle is totally burned. There are many out there that will make
absolute statements regarding the security of this system.
In March of this year a locksmith was sent out to examine a burned Yukon to determine
if it was stolen. The insured was charged criminally. The locksmith took an un-cut key
blank and inserted it into the lock. He then impressioned the lock and made a key for it in
order to start the engine. His conclusion was that there were no signs of tampering to the
lock. This vehicle had minor burn damage on the interior. Soot had built up over the key
lands (where the key goes when inserted into the lock). Since the locksmith inserted a key
un-cut key blank into the lock, he had created new tool marks over riding the soot. He
stated the lock showed no signs of tampering and yet he made a key for it! The
prosecution’s case was dropped.
Then there was the locksmith that stated the 2002 Yukon revealed no signs of stripping.
He had recovered 6 out of 9 wafers and stated that the other wafers must have been
destroyed in the fire.
He did not even consider that the other three wafers may have not been present before the
fire. The vehicle had burn damage to the interior, but the paint was still present on the
outside of the doors. There were no seats in this vehicle when it burned! The situation
was settled before suit was brought against the insurance company.
At many seminars it will be stated by the experts that if the vehicle is equipped with a
factory installed anti theft system, the vehicle can’t be stolen. In fact, there are insurance
companies denying payment of theft claims on vehicles that were never recovered
because that is what they are being taught by the experts in theft.
Since PASSLOCK has so many problems, a very thorough exam must be performed. All
theories have to be ruled out until one fits. Examination of the wafers in the ignition lock
as well as the total picture on theft has to be considered. A key should never be inserted
into the lock because of potential spoliation of the evidence. The only way the last key
used theory is going to work 100% of the time is when the key is already installed in the
lock which can be very common when located at a body shop. Keys must be examined
for duplication marks, but just because there are no such marks does not mean the key
was not duplicated. Keys can be cut off of code. The codes are available by supplying a
dealer with a VIN.
Other considerations in real life are wear. When the ignition lock has been used many
times with a correctly cut key after time, the key will come out in any lock cylinder
position. If the ignition lock is not put into the LOCK position, the lock can rotate
without force and without a key and the engine will run. In order for the driver to make
sure that steering column is locked (2000 and older equipped with a locking steering
column) he would need to check the steering wheel for being locked each and every time
when parked. In real life, that does not happen.
In California I have done an experiment more than once. I would have keys made off the
VIN of a vehicle I had not seen. Then I would have 5 more keys made that were not close
in cut. If they were held together, it was obvious they were keys of different cuts. I then
went to California and tried all of these keys on these vehicles. They all worked the lock
with no effort and the PASSLOCK equipped vehicle would start and run each and every
time. If I were to remove the ignition lock from these vehicles and disassemble, chances
are very good that I would see freshly made tool marks related to the use of one of the
new improper cut keys.
In forensics, assumption should not be made. These locks and keys have to be examined
under a microscope for newly made tool marks. If not, it is purely speculation on the part
of your expert and you have the potential of losing a case.
Its one thing to know what happened. It’s quite another to prove what happened.
I have seen reports from the insurance experts on reported stolen and recovered totally
burned. One such report on a PASS LOCK equipped vehicle that comes to mind from a
“Forensic” report was this: “The steering column suffered extreme fire damage and the
wafers to the ignition lock were not recovered. This means that the ignition lock was
most probably forced from the steering column before the fire.” Since when is “Most
probably” forensics? Even more interesting on this vehicle, the report stated the ignition
lock side bar was located on the upper layer of driver’s floor burn debris. If this statement
was true, that means “most probably” was an assumption.
The side bar is part of the ignition lock cylinder and since it was allegedly present in the
top layer of burn debris, it means the ignition lock cylinder was in its factory designed
location in the steering column at the time of the fire, because it was one of the last
components to fall to the floor. Without having any wafers (tumblers) to examine, there is
no way that a conclusion can be made as to how this PASS LOCK equipped vehicle was
last operated. Instead of assuming the system was working at the time of the fire, the
actual conclusion should have been undetermined because any type of lock rotation
cannot be ruled out if the scientific method was used.
This is just a small sample as to how the last operation of a vehicle equipped with PASS
LOCK can be refuted.
Will this system deter a joy rider who just ripped the lock out of the steering column?
Yes. Is it the highly sophisticated electronic theft deterrent we have been told? As to the
design? Yes. The total system is only as good as the ignition lock however. If the lock
has flaws (which it does) all those flaws need to be taken into consideration before
arriving to a conclusion as to how the vehicle was last operated. In 2001 and up on GM
trucks the locking steering column was eliminated.
It is now common place to send out a locksmith to examine reported stolen GM trucks.
Many of these trucks are completely stripped missing interiors, engine components and
the like, but have no steering column/ignition damage. Since there is no damage to the
column, it is assumed by the locksmith that the reported stolen vehicle was not stolen. It’s
good to remember a locksmith (and he can be a very good locksmith) is limited to his
experience as a locksmith when looking at these vehicles. Since the steering wheels no
longer lock and it takes merely seconds to take the transmission out of gear, without
having to unlock the transmission shifter interlock, these vehicles are much easier to steal
than they once were by means of a tow truck. It is not necessary to use a flat bed. A tow
truck with a wheel lift works wonders. Many GM truck parts are interchangeable over
many years.
I had the opportunity to see an affidavit prepared by an expert regarding a PASS LOCK
equipped reported stolen vehicle recovered burned.
He stated that a person would not risk his 30-40 thousand dollar tow truck to take a
vehicle from a mall. Would you be asking the tow truck driver if he was stealing the
vehicle or taking the vehicle for service? Of course not. Even if you did ask; how would
you know he was telling the truth?
All this article is meant to o is to make you not take your expert’s conclusions for
granted. Can he prove he eliminated different hypotheses before arriving to a conclusion?
For seminar information I can be contacted at [email protected] and the website is at
Rob Painter,ASE,CFL,CFEI
Forensic Vehicle Component Analyst
Diplomate, American Board of Forensic Examiners
ASE Certified Auto, Collision, Med/Hvy Duty Truck Technician
Certified Forensic Locksmith
Certified Fire and Explosion Investigator
Certified Vehicle Fire Investigator
Certified Forensic Auto Theft Examiner
Certified and Federal Court Qualified Auto Theft and Fraud Expert
As per federal court rules of evidence (702) (Daubert) my testimony has qualified me as:
Auto Theft and Fraud Expert
Forensic Vehicle Analyst
Fire Origin and Cause Expert
© Copyright 2005 Robert Painter. All rights reserved.