Question of the Day - 24 September 2023

Hotel-room-door locks are standalone and not connected to the main computer system. That's why it's not possible for the front desk to remotely open a door. But in the case of the cyberattack against MGM Resorts, while most key cards worked, our understanding is that some didn't for one (undisclosed) reason or another. The ones that didn't got the publicity.

When the main computer system fails, such as in the MGM cyber event, the front desk can still program the plastic keys, but the system may be (and was) unable to send the electronic key to the guest's smartphone when checking in. Again, as far as we know, that's why employees manned the elevators with radio phones. After guests waited in interminable lines to check in, if the key didn't work, it meant having to go back to the chaotic front desk. The elevator people were there to help rectify the situation, for example by letting guests into their rooms with the master key.  

As far as the information on the key cards, it's enough only to unlock the door(s) they're programmed to open, plus a unique number to identify the holder of the key.

There's additional data for security purposes, but the basic info on the key consists of:

1) property ID, a unique code for the property to prevent using the key in a different hotel.
2) user ID, a number assigned to the card holder, either temporary for the guest or permanent for employees.
3) room number that the key will open; master keys for security and housekeeping can be programmed to open multiple rooms.
4) sequence number, with which the key for a new guest gets a new number, invalidating the key from the previous guest.
5) expiration date, which is usually the check-out date.

The user ID also allows the guest to use the key to pay for parking, dining, and other purchases on the property. 

The lock keeps a history of who opened or attempted to open a door and when. This log can be accessed by connecting a device to the lock for security purposes.

Some locks on the property, such as those for the pool or fitness center, are programmed to accept any valid key.

Some elevators have a sensor and will operate only after a guest scans a valid room key.

The MGM cyberattack is a definite cautionary tale, among others, in terms of the increasingly digital interconnectedness of our world.