This article was written by guest contributor David Langhorn.
As a father, one of the most frightening hotel security incident reports that came across my desk involved poor guest room key control. It was an incident that could have had horrendous consequences. A couple in a major city in Europe left their hotel room to get a drink, leaving their 4-year-old daughter asleep in bed. While this might not have been the best course of action, it happened. When they returned to their room 30 minutes later, they found a middle-aged man standing over their daughter’s bed, staring at her. The mother went into hysterics and the father started to assault the man, obviously thinking the worst. Security was called and the situation was taken under control.
It transpired that the stranger in the room was entirely innocent and shocked to find a child in his room, and even more shocked to be assaulted. The cause of this situation? The hotel reception had issued a room key card for a room that was already occupied. Likewise, cases where guests have had valuables stolen from their rooms because receptionists had issued replacement room key cards without checking identification are too numerous to mention.
Note: For the purposes of this article, the term “key” refers to both mechanical/metal keys and electronic key cards.
Questions for Consideration
Do you have a key control policy?
Do you know where all your master keys are as you read this?
Have you issued more master keys than the hotel strictly needs to operate?
Locks & Keys
It often seems that establishing and maintaining an effective key control system is one of the biggest challenges faced by security teams. Locks are probably the most ubiquitous piece of security equipment in a hotel and are found in all areas. Because of this, it’s easy to forget that locks serve to protect valuable “things” from harm; guest room locks protect guests, storeroom locks protect valuable stock, IT server room locks protect data, and so on.
Of course, the protective qualities of a lock are nullified by keys — which is a good thing if the key is in the possession of and used by an individual with legitimate reasons or permissions to access areas protected by the lock. The problem comes when the key falls into the hands of someone who doesn’t have either and has malintent towards whatever is being protected.
Furthermore, problems can occur if a physical or metal key is lost because, unless there is a duplicate, access to the locked area will also be lost. Nonetheless the lock should normally be replaced in case the key has fallen into the hands of a threat actor. Thus, keys pose a potential vulnerability to the lock and lost or mismanaged keys pose a threat to the lock.
Types of Locks
Most locks in hotels in 2022 will be an electronic key card type, which is often used for securing guest rooms and controlling access between public areas, guest accommodation areas, and Back of House. In many hotels, mechanical locks may still be used to secure sensitive areas such as plant rooms, valuable storerooms, and safes. A big advantage of electronic key card locks is that a record is maintained of who used the lock and when; this is a vital capability that enables security incident investigations to identify suspects and exonerate the innocent.
Looking forward, it’s likely that hotels will increasingly adopt cyber key locks — or “Mobikeys” — where keys will be transmitted to guests’ personal devices and subsequently used to unlock guest room doors. Security protocols for these Mobikeys have yet to be fully examined.
Master Keys
It should be clear by now keys that can unlock multiple locks are extremely valuable from a security perspective, and their loss or misuse could pose a threat to multiple areas of the hotel. Such keys include:
Grand master: Usually issued to the hotel manager, security manager, and manager on duty
Sub-master: Usually assigned to heads of department relevant to their department
Handheld Service Units: Usually assigned to the security manager; effectively a grand master key for electronic locks
Floor: Usually used by housekeepers
The value of master keys is obvious as should be the requirement to prevent their loss and/or misuse. Therefore, they should be subject to the highest levels of protection and control.
To access content with more specific guidance, upgrade to a paid subscription.
Keep reading with a 7-day free trial
Subscribe to Keep Travel Safe to keep reading this post and get 7 days of free access to the full post archives.