Files

T

n0mad1k 58c3b75e5e Add OPSEC Principles, Physical Access, and Cyber Implants manuals

2026-03-19 17:15:43 -04:00

19 KiB

Raw Blame History

Physical Access & Entry Manual

Synthesized from: CIA tradecraft manuals (declassified), physical security assessment resources, Grugq OPSEC analyses, FM 2-22.3, open-source tradecraft literature

Classification: OPEN SOURCE — compiled from publicly available materials

Principles of Physical Access
Target Assessment
Lock Bypass Techniques
Social Engineering for Access
Surreptitious Entry Operations
Postal & Logistics Operations
Counter-Forensic Discipline
Physical Access Checklists

Chapter 1: Principles of Physical Access

1.1 The Access Spectrum

Physical access operations range from the trivial to the extraordinarily complex. The skill is in choosing the right approach for the target, not in always using the most sophisticated technique.

The spectrum:

Social engineering — Talking your way in. Lowest technical skill, highest human skill. Works against most targets because people are the weakest link in any security system.
Opportunistic access — Exploiting unlocked doors, tailgating, maintenance windows. Requires patience and observation, not tools.
Technical bypass — Defeating locks, alarms, cameras, and access control systems. Requires tools, training, and practice.
Forced entry — Breaking in. Last resort. Leaves evidence. Appropriate only when covert access is not required or not possible.

The general rule: try the simplest approach first. A $5 clipboard and a confident walk will get you through more doors than a $500 lock pick set.

1.2 The Three Requirements

Every physical access operation requires three things:

Access — A way to get inside the target space
Time — Enough uninterrupted time to accomplish the objective
Cover — A plausible explanation for being there if discovered

If any of these three is missing, the operation should not proceed.

Chapter 2: Target Assessment

2.1 Pre-Operational Surveillance

Before any physical access attempt, the target must be thoroughly assessed. This is not optional. Skipping assessment is the primary cause of physical access failures.

What to document:

The physical space:

All entry and exit points (doors, windows, loading docks, emergency exits, roof access)
Lock types on each entry point (pin tumbler, electronic, magnetic, padlock)
Alarm system type and configuration (motion sensors, door contacts, glass break, keypads)
Camera locations, coverage angles, and recording method (local DVR, cloud, monitored)
Lighting conditions (interior and exterior, timers, motion-activated)
Neighboring structures and sight lines

The human element:

Guard schedules (shift changes, patrol patterns, break times)
Employee arrival and departure patterns
Cleaning crew schedule and access level
Delivery schedules (when doors are propped open, when loading docks are active)
Neighbor patterns (who might observe your entry)

The timing:

When is the target space empty?
When are guards least alert? (typically 2-4 AM, immediately after shift change)
What events create access opportunities? (maintenance windows, construction, deliveries)
How long can you be inside without discovery?

2.2 Security System Assessment

Alarm systems:

Panel location (usually near main entry)
Entry delay zones (which doors give you time to disarm)
Immediate alarm zones (which doors trigger instantly)
Monitoring method (central station, local siren only, or unmonitored)
Backup power (battery duration after power cut)
Cellular backup (does it phone home if landline is cut?)

Access control:

Credential type (key card, fob, PIN, biometric, combination)
Can credentials be cloned? (HID Prox cards are trivially cloneable)
Fail-safe vs fail-secure locks (fail-safe opens on power loss, fail-secure stays locked)
Anti-passback features (must badge in before badging out)

Cameras:

Real vs dummy cameras (look for indicator lights, cable connections, lens quality)
Recording retention period (most systems overwrite after 7-30 days)
Monitored in real-time or reviewed only after incidents?
Night vision capability
Blind spots in coverage

Chapter 3: Lock Bypass Techniques

3.1 Pin Tumbler Locks (Standard Door Locks)

The most common lock type in residential and commercial settings. Understanding pin tumbler mechanics is fundamental to physical access tradecraft.

How they work: A cylinder contains spring-loaded pins of varying heights. The correct key pushes each pin to the shear line — the boundary between the plug (rotating part) and the housing (fixed part). When all pins are at the shear line, the plug rotates and the lock opens.

Single Pin Picking (SPP):

Insert tension wrench at bottom of keyway, apply light rotational pressure
Insert pick above tension wrench
Feel for the binding pin (the pin with the most resistance)
Push binding pin to shear line — you will feel a slight click and the plug will rotate fractionally
Find the next binding pin and repeat
Continue until all pins are set and the plug rotates fully

Difficulty factors: Number of pins (typically 5-6), pin tolerances (tighter = harder), security pins (spool, serrated, mushroom — provide false sets).

Time estimate: 30 seconds to 5 minutes for a standard 5-pin lock. High-security locks may take 15-30 minutes or be effectively unpickable.

Raking: A faster but less reliable method. Insert a rake (a pick with a wavy profile) and rapidly move it in and out while applying tension. This randomly sets pins through manipulation. Best for low-security locks when speed matters more than stealth.

Bump keys: A specially cut key that, when struck with a bump hammer, momentarily bounces all pins above the shear line simultaneously. Simple to execute, works on most standard pin tumbler locks. Defeated by security pins and anti-bump features.

3.2 Other Lock Types

Padlocks — Shimming: Insert a thin metal shim (cut from a beverage can) between the shackle and the lock body. The shim pushes the locking pawl aside, releasing the shackle. Works on spring-loaded padlocks. Does NOT work on padlocks with anti-shim features (ball bearing locking mechanism).

Tubular locks (vending machines, utility panels): Defeated with a tubular lock pick — a circular tool that simultaneously manipulates all pins. Cheap, fast, minimal skill required.

Electronic/magnetic locks:

Proximity cards (HID Prox, iClass): can be cloned with $50 reader/writer
Magnetic stripe: trivially cloned
Smart cards with encryption: harder but not impossible
Biometric: requires different approach (replay attack, fake fingerprint, or bypass the controller rather than the sensor)

Impressioning: Insert a blank key, apply turning pressure, examine marks left on the blank by the pins, file the blank at mark locations. Repeat until the blank becomes a working key. Time-intensive (30-60 minutes) but produces a working key that can be reused.

3.3 Bypass Tools

Over-the-door tool: A flexible tool that reaches around the door edge to manipulate the interior handle or thumb turn. Works on many commercial doors where the interior handle is unlocked.

Latch slipping: Using a flexible card or shim to push back the spring bolt on a door. Only works on spring bolts (not deadbolts) and doors without strike plate guards.

Under-door tool: A rigid tool slid under the door to pull the interior handle down. Effective on lever-style handles with sufficient gap under the door.

3.4 Countermeasures to Know

Locks that resist most bypass techniques:

Medeco — Rotating pins, sidebar mechanism. Extremely difficult to pick.
Abloy — Disc detainer mechanism, no springs. Requires specialized tools.
Mul-T-Lock — Pin-within-a-pin design. Doubles the effective pin count.
Electronic deadbolts — No mechanical keyway to attack.

4.1 The Fundamental Principle

People want to be helpful. People defer to authority. People avoid confrontation. Social engineering exploits these tendencies to bypass physical security controls that cannot be bypassed technically.

A confident person in the right uniform with the right clipboard can walk into almost any building in the world.

4.2 Effective Pretexts

IT Technician:

Props: Laptop bag, cable tester, badge on lanyard (any badge — people rarely read them)
Script: "I'm here to check the network drop in [specific room]. We've been getting intermittent connectivity issues on this floor."
Why it works: IT issues are common, nobody wants to be responsible for blocking the fix, and few people understand IT well enough to question the request.

Fire Inspector / Building Inspector:

Props: Clipboard, camera, measuring tape, hi-vis vest
Script: "We're doing the annual fire safety inspection. I need to check the exits and extinguisher placement on this floor."
Why it works: Inspections are expected and periodic. Building code compliance is everyone's responsibility. Nobody wants to obstruct an inspector.

Delivery Driver:

Props: Uniform, hand truck, packages (can be empty boxes with printed labels)
Script: "Delivery for [name from LinkedIn/company directory]. Can you sign?"
Why it works: Deliveries happen constantly. The recipient's name adds credibility. People sign without thinking.

Contractor / Maintenance:

Props: Tool bag, hard hat, hi-vis vest, work boots
Script: "Facilities called us about the [HVAC/plumbing/electrical] issue on the third floor."
Why it works: Maintenance is constant in commercial buildings. Workers go everywhere.

New Employee:

Props: Business casual attire, slightly confused expression
Script: "Hi, I just started in [department]. I think I got turned around — can you show me where [room] is?"
Why it works: People empathize with being new. They want to help. They'll escort you past security checkpoints.

4.3 Tailgating

Following an authorized person through a secured door before it closes. The simplest and most effective physical access technique.

When it works best:

Shift change (many people entering at once)
Lunch hour (heavy traffic in and out)
When someone is carrying items (they can't hold the door AND challenge you)
Loading docks (constant traffic, casual atmosphere)

Counter the challenge: If someone asks "can I see your badge?" — pat your pockets, look frustrated, say "I must have left it at my desk. I'm [name], I work with [department]." Most people will let you through rather than make a scene. If they insist, leave gracefully and try another entry point.

4.4 Authority Exploitation

People obey authority figures reflexively. This can be exploited by projecting authority through appearance, behavior, and language.

Authority indicators:

Suit and tie (or appropriate professional attire)
Confident, purposeful walk
Giving directions rather than asking for permission
Name-dropping specific internal contacts
Using internal jargon and acronyms
Looking busy and slightly annoyed (important people are always in a hurry)

The key insight: Nobody challenges the person who acts like they belong. Security guards challenge people who look uncertain, who hesitate, who make eye contact and then look away. Walk in like you own the building and most people will assume you do.

Chapter 5: Surreptitious Entry Operations

5.1 Planning

A surreptitious entry — also known as a "black bag job" — is a covert entry to a target location for intelligence collection without leaving evidence of intrusion. This is the most complex physical access operation and requires thorough planning.

Team composition:

Entry specialist — handles lock bypass and alarm neutralization
Inside operator — conducts the search, photographs documents, plants devices
Lookout/communications — monitors the perimeter, provides early warning
Driver — manages transport, maintains escape vehicle

Minimum team: 2 (entry + lookout). Optimal: 3-4.

Pre-operation requirements:

Complete target assessment (Chapter 2)
Guard schedule confirmed through multi-day observation
Alarm system identified and bypass method determined
Entry point selected and lock bypass method practiced
Communication plan established (radios, signals, check-in schedule)
Time limit defined (30-60 minutes maximum for most operations)
Abort criteria defined (what triggers immediate withdrawal)
Escape routes planned (minimum 2 routes from target)

5.2 Execution Procedures

Pre-entry: Lookout confirms area is clear. Driver positions escape vehicle. Team approaches via planned route.
Entry: Bypass lock. Neutralize alarm (if present). Confirm interior is clear.
Document existing state: Before touching anything, photograph the room. Note the position of objects, papers, doors, drawers. Everything must be returned to its exact original position.
Conduct operation: Search systematically. Photograph documents in place. If planting a device, select a location that will not be disturbed.
Time checks: Lookout provides regular time checks. Operations cease at the pre-defined time limit regardless of completion status.
Exit preparation: Verify everything is returned to original position. Check for evidence of entry (footprints, disturbed dust, moved objects).
Exit: Re-secure lock. Restore alarm. Depart via planned route.
Post-operation: Separate departure by team members. Counter-surveillance on departure route. No post-operation communication for defined period.

5.3 Evidence Discipline

The entire point of surreptitious entry is that the target never knows it happened. This requires fanatical attention to evidence.

Wear gloves at all times (latex underneath, nitrile on top — double layer reduces print risk and tearing)
Wear shoe covers or shoes purchased for this operation only
Do not eat, drink, smoke, or spit inside the target space (DNA)
Photograph everything before touching it
Replace every object in its exact position (use the photographs as reference)
Check for hair, fibers, or other trace evidence before departing
If you move furniture or equipment, note its exact position and return it precisely

Chapter 6: Postal & Logistics Operations

6.1 The Postal Channel

Physical mail remains one of the most effective channels for covert material transfer. It is anonymous (no ID required to mail a package), ubiquitous (billions of packages annually), and relatively uninspected (inspection rates are very low for domestic mail).

However, postal inspection services have developed profiling criteria to identify suspicious packages. Understanding and avoiding these triggers is essential.

6.2 FBI/USPS Profiling Criteria

From leaked inspection guidelines (analyzed by the Grugq):

Packaging red flags:

Heavy taping along seams
Package reuse (old labels, previous shipping marks)
Uneven weight distribution
Poor preparation for mailing

Labeling red flags:

Handwritten labels (most business mail uses printed labels)
Misspellings
Person-to-person (not business-to-individual)
Return zip code doesn't match the accepting post office zip code
Fictitious return address
Sender/recipient names that are obviously generic (John Smith)
No connection between sender name and return address

Content indicators:

Weight approximately equal to round metric amounts (1 kg + packaging)
Express Mail for non-document items (Express Mail is primarily used for business document delivery)
Origination from known source locations

6.3 Countermeasures (Avoiding Profiling)

Packaging:

Use new, professional packaging (not reused boxes)
Minimal, clean taping — enough to secure, not suspicious
Use appropriate box size for contents (no excessive padding)
Package should look like normal commercial mail

Labeling:

Print labels (never handwrite)
Use a business-to-individual format
Include a plausible business name as sender
Return address must be real and verifiable (backstopped)
Return zip code must match the post office where you mail it
Recipient name should match someone at the delivery address

Backstopping:

The return address must correspond to a real location
The sender name should match someone who could plausibly be at that address
If checked, the address should not raise immediate flags
Research the identity — don't invent one. Borrow one.

As the Grugq notes: "Don't make shit up, do your research and steal an identity with a real address. The complexity and depth of that backstop are dependent on how deeply the cover will be investigated."

Chapter 7: Counter-Forensic Discipline

7.1 Tamper-Evident Awareness

Many targets employ passive tamper detection — indicators that reveal whether a space has been accessed:

Hair or thread across door crack — Falls when door is opened. Check before entry.
Dust patterns — Undisturbed dust on surfaces indicates no recent access. Your presence will disturb it.
Tamper-evident seals — Adhesive seals on containers, cabinets, or doors that show signs of removal.
Powder traps — Fine powder on floors or surfaces that captures footprints.
Hidden cameras — Motion-activated cameras in non-obvious locations (clocks, smoke detectors, power outlets).
Object positioning — Items deliberately placed to detect movement (paper at specific angle, pen position on desk).

7.2 Digital Forensic Awareness

If the operation involves accessing a computer:

Do NOT boot the target machine (creates forensic artifacts)
If the machine is already on, do NOT log in without understanding what logging is enabled
Photograph the screen before touching anything
Use forensic tools that minimize artifacts (live USB, hardware imager)
If planting a device, ensure it does not create detectable artifacts in system logs

Chapter 8: Physical Access Checklists

Pretext selected and rehearsed
Props acquired (uniform, badge, clipboard, tools as appropriate)
Target contact names researched (for name-dropping)
Internal jargon researched
Entry time selected (shift change, delivery hours, lunch)
Backup pretext prepared
Exit strategy defined
Communications plan established

8.2 Surreptitious Entry Checklist

Target assessment complete (layout, security, schedule)
Multi-day observation confirms patterns
Entry point selected and bypass method tested
Alarm type identified and bypass planned
Team briefed and roles assigned
Communication equipment tested
Gloves, shoe covers, and evidence discipline gear ready
Camera for documenting original state
Time limit defined (30-60 minutes)
Abort criteria defined
Primary and secondary escape routes planned
Counter-surveillance planned for approach and departure
Cover story prepared if intercepted
Post-operation communication blackout period defined

This manual is a living document. Content will be enriched as additional sources are collected and analyzed.

19 KiB Raw Blame History