I was recently in Norway, staying at Oslo’s Christiana Hotel, a modern four-star property with the latest in electronic door locks. They installed the RFID-based system that is finding wide acceptance throughout the world because of its ease of use and customer convenience. Traditional card locks use magnetic stripes and must be inserted into the lock, or swiped through it. Errors and unreliability of operation can occur due to wear of the internal read heads, or the stripe can be inadvertently demagnetized by the guest, preventing the lock from opening. This often occurs when the card is placed in close proximity to a cell phone, because some phones have internal magnets that can scramble the magnetic particles on the card.
The locks in this particular hotel were manufactured by TrioVing in Moss, Norway, about fifty miles from Oslo. TrioVing is one of the world’s largest suppliers for the hotel and cruise ship markets. The RFID locks only require the guest to tap the card anywhere against the lock and it opens. It is a much more secure and sophisticated technology than the older mag-stripe, and virtually immune to security breach by cloning or reading the card.
Because I constantly work with locks and security systems I am attuned to minute sounds and feel in door locks. While that may sound a bit odd, it is often these minute indications that allow us to compromise locks or determine design problems. So the first time I left my room and walked toward the elevator in this hotel, I did not hear a faint click that would indicate to me that the mechanism had reset, as is customary in virtually every electronic lock in the world. No click means that the internal solenoid that controls locking was not functioning. It was time to investigate further.
I walked back to my room to determine if I was correct. After approximately 45 seconds, I could still open the door without a card. This was very strange and an invitation to burglars or other guests near a room where the rightful occupant had just left. So I ran a series of tests to determine the length of time that the door would remain unlocked, even though it was closed and from all indications, was indeed secure. It turned out there was a one minute delay between the time you left the room and when the door actually locked.
There had to be a programming error or something wrong with the lock, I reasoned. So, the next day I was at the TrioVing factory. I asked their technical staff if they were aware of this issue. I was told that Norway is unique in the world and has a legal requirement that all electronic hotel door locks must be programmed to remain open for times that are defined by local fire ordinance. It was not a malfunction in the lock, but the law.
The reason: in the early morning hours of September 5, 1986, fourteen people lost their lives and fifty were injured in a terrible hotel fire in Kristiansand in the south or Norway. Many guests initially left their rooms in this hotel to go out into the hallway at about 4:40 A.M. when the alarm was sounded. They could not return because they were locked out, having not taken their keys with them in smoke, flames, and the confusion. Many died or were injured as a result. The damage to the hotel was about five million dollars.