REPORT FROM THE U.S.—While guest security is commonly named as a top concern for hoteliers, industry owners and managers are taking varying approaches to ensuring their guestroom door locks are secure.
After independent security researcher Cody Brocious in July detailed a technique for entering locked doors equipped with Onity technology without a keycard, hoteliers—particularly ones who manage hotels equipped with Onity locks—were left scrambling to ensure their guests were safe. Brocious did not respond to messages seeking comment on why he chose to investigate Onity locks.
Then, once a series of thefts from hotels in Texas were traced to a burglar who allegedly unlocked doors with the same hack, the issue was moved to the front burner.
Joe Rook, former electronic lock salesman who worked for various suppliers but never with Onity, called the discovery of the vulnerability and subsequent breaches a disaster.
“For Onity, for the hotels that bought them, for the guests—there are no winners here,” Rook said.
Hoteliers who rely on Onity as a lock vendor have responded in numerous ways, from working with Onity to patch the locks to replacing Onity locks with those from another vendor.
Rosen Hotels & Resorts, which owns and operates seven properties representing 7,000 rooms in the Orlando, Florida, market, was an Onity customer for 21 years before the incident persuaded company executives to replace their locks with a product from another vendor.
“One rape, one kidnapping could bankrupt us, and we can’t have that,” said Rosen’s Corporate Controller Jim Bina. “From a security perspective, I can tell you we assess employee and guest security as the highest priority, and for that reason (founder and president) Harris (Rosen) said, ‘Get them out.’ I wasn’t given a choice.”
Banyan Investment Group, which operates 14 hotels in Georgia, Florida and Kentucky and uses a variety of lock manufacturers, including Onity, said the company worked with Onity to retrofit all Onity locks by installing new corrective software and a special security cap, said VP of Operations John J. Zaccari.
“There was no cost—Onity provided the software upgrades with instructions on how to easily make the corrections in-house,” Zaccari said. “The company offered to send personnel to the property at no charge, but that proved not to be necessary.”
In a statement to HotelNewsNow.com, Onity’s global marketing manager Suzanne R. Fritz said the company as of 30 November had shipped 1.4 million solutions for its locks to hotel properties.
“Onity places the highest priority on the safety and security provided by its products,” she said. “We will continue to support and augment our customers’ security strategies.”
One fix Onity is offering is a mechanical solution that involves using caps and security screws that block physical access to the lock ports hackers were using to break into hotel rooms. The mechanical solution is offered free to customers, Fritz said.
During the next several weeks, Fritz said Onity will ensure all properties in its database receive the mechanical solutions.
Technical solutions vary depending on the age, model and deployment of locks at properties. Fritz suggested Onity clients contact its customer assistance line at 1-800-924-1442 where representatives can help answer questions related to the mechanical and technical solutions. Onity did not reveal costs associated with the technical solutions. The company also declined to disclose how its overall business was affected by the issue.
Rosen’s Bina said the decision to immediately upgrade locks with another vendor—installation begins 7 January—was two-fold. First, many of Rosen’s locks were nearly 20 years old, and the company had been contemplating upgrading from magnetic-stripe technology to radio frequency identification technology before the incident.
Second, the decision to partner with a different vendor, he said, was related directly to how Onity handled the situation. Rosen first received a letter from Onity suggesting a plug that fits over the port on the bottom of the lock where the hardware is vulnerable.
“That might work in a 200-room property, but anytime you want to do a lock interrogation (for everyday purposes) you have to remove that plug,” Bina said. “So that fix was just kind of feeble.”
Shortly after suggesting that fix, Bina said Rosen received more communication from Onity suggesting alternative fixes—at varying costs—depending on the age of the locks.
“One thing they never said was, ‘We’ll help you,’” he said. “They had a small trade in place but it was still not an offer from them to come and fix it. They said, ‘We’ll send you the new board; the new board cost $20; and when you send us the old board, we’ll send you $10 back.’
“They were just looking out for themselves.”
The final straw, Bina said, was when he and others heard rumors that Onity knew of the problem before it was brought to light by Brocious in July.
“That’s the main reason for jumping ship,” he said.
Rook, the former lock salesman who now works in another hotel technology market, said he is unsure of the exact cost of replacing a circuit board, but even estimating $25 a board for nearly a million boards might illustrate why Onity has not offered to replace all of the units at cost.
Onity declined to comment on when it first discovered the alleged vulnerability and the financial implications fixing it would have on the company.
Since the alleged security vulnerability was brought to light and reported by multiple media outlets, hoteliers said more and more guests have been asking questions on property.
Bina said Rosen has been fielding questions at front desks, through social media sites and earlier this month fielded questions from two group clients that will hold child-focused events in early 2013. Rosen was able to guarantee to the groups that new locking systems will be in place by the time of the events.
The company also is training front-desk staff on how to answer questions about lock security.
“We say we’ve done our homework, and we’ve selected a new lock vendor,” Bina said. “It took us five months to do that, and fortunately only now we are getting those questions.”
“We also ask guests to please use the latch, lock up their valuables, and we inform them that we have 24-hour security at all of our properties,” he said.
At Banyan, executives used the situation to add a comprehensive new section about security to the operations manuals at each hotel, Zaccari said.
“There is a renewed emphasis by our staff to actively remind guests about the many on-site safety features that are an integral part of every hotel, regardless of brand or location—features such as hotel safe deposit boxes, in-room safes, dead bolt and secondary room locks and well-lit entry ways,” he said. “In addition, we encourage both staff and guests to report suspicious behavior or objects.”
HotelNewsNow.com reached out to dozens of brands, owners and operators who either declined or did not return messages seeking comment on the issue.
Lori Holland, executive director of public relations at Fairmont Hotels & Resorts, said the company is “aware of recent reports around security vulnerabilities related to Onity guestroom door locks and can confirm that Fairmont does not utilize Onity technology.”
“According to the American Hotel & Lodging Association and industry figures for 2011, there are 4.9 million rooms and 52,000 properties in the U.S., which all use different lock vendors and models. In the 30 years since electronic locks were introduced, they have been a great asset to hotel security,” she said.
HotelNewsNow.com’s Shawn A. Turner and Patrick Mayock contributed to this report.