Noam Galai / noamgalai.com//Getty Images
In a scene straight out of a spy movie, an elderly couple reportedly escaped from an assisted living facility using some cunning military expertise—and an antiquated telecommunications method.
In 2020, a resident of a secure memory care unit in Elmcroft of Lebanon, a Tennessee nursing facility, “eloped” with his wife from the premises, according to a state report on the incident. The man was admitted to Elmcroft with a diagnosis of dementia, while the woman was admitted with Alzheimer’s disease.
A stranger spotted the residents, who were safe, walking two blocks from Elmcroft about 30 minutes after they left and picked them up.
After the couple returned to Elmcroft, the staff asked them how they pulled off their stunt, since employees must type a numeric code on a keypad to exit the locked memory care unit. The man said he had previously worked with Morse code in the military, and his ear was trained enough to figure out the code on the pad from the noise it made. He reportedly duplicated the numbers to unlock the door.
The staff has since revised the residents’ care plans with more outdoors time to decrease the “exit-seeking behaviors,” the state report says. (Elmcroft didn’t respond to an email from Popular Mechanics seeking comment.)
Though the publicly available information doesn’t indicate how the man used his specific knowledge of Morse code to break out of the facility, security experts say the hack fits more broadly into the category of “side channel attacks,” in which bad actors commit security breaches by gleaning information they observe from information transfers.
In a side channel attack, the person committing the breach may not see the “main channel”—the actual information being transferred—but by using other side channels, they can figure out what that information is.
Trained observers can deduce what people are typing on a computer keyboard just by listening to the keystrokes—specifically, how closely the strokes follow each other, says Vyas Sekar, an assistant professor of electrical and computer engineering at Carnegie Mellon University, home to the CyLab Security and Privacy Institute. It’s even possible to pick up what two people are saying in a conversation if they’re talking near a bag of potato chips, based on the bag’s vibrations, he says.
The man at Elmcroft likely listened to the sounds the facility’s keypad made when the staff struck certain keys—a major security risk on outmoded technology.
A Western Electric model 66A3A DTMF keypad. (Lexlexlex/Creative Commons)
Keypads that still make noise are a throwback to the era of dual-tone, multi-frequency (DTMF) technology. This tech, which made touch-tone phones possible, was once cutting-edge, but now it’s mostly around for the sake of the tradition more than anything else, says Swarun Kumar, head of the Emerging Wireless Technology Lab at Carnegie Mellon.
Think of an old phone as its own coding machine. You enter numbers, which the phone encodes and transfers to reach someone else, who is then alerted to the transfer and picks up the phone, establishing a connection. It’s called in-band signaling, because the same line is used for the encoded communication and regular communication.
1960s-era LM Ericsson Dialog rotary phone. (Diamondmagna/Creative Commons)
Rotary phones encoded their numbers through pulses. The number 1 was one pulse, 2 was two pulses, and so on, all the way up to 9, which had nine pulses. But that could be time-consuming, and in the 1960s, the tech was supplanted by DTMF, which gave each number on the keypad—including the now-omnipresent star (*) and pound (#) keys —its own unique tone. (Remember trying to play “Mary Had a Little Lamb” on the phone keypad?)
But DTMF also brought its own security concerns. Proto-hackers called “phreakers” used devices called “blue boxes” to mess with the in-band signaling, making prank calls and routing phone calls around the world. (A pair of Steves from the Bay Area, Jobs and Wozniak, famously assembled such blue boxes from common electronic parts.
An early blue box of theirs sold at auction for more than $31,000.)
Steve Wozniak and Steve Jobs constructed this electronic "blue box." (Anthony Warnack/Flickr)
While DTMF eventually faded out due to these concerns, there are still instances when touchpad sounds are necessary. Vision-impaired people need them, for example, and automated systems (“Press 1 for…”) use the technology as well.
Thus, the sounds of the touchpad remain, becoming a standard for security systems because they’re convenient. Keypad codes can be short and easy to remember, as well as easy to change, which is what Elmcroft was forced to do after the escape.
And there’s another advantage to keypads: they’re decidedly low-tech. Unlike more secure biometric measures like facial recognition, keypads don’t need a database of available information, and you can run them in settings without a wireless network.
But mostly, Kumar says, we’ve used keypads for long enough that they endure because people are simply comfortable with them.
“Dialing a phone today mostly doesn’t use DTMF, but the mapping has remained,” says Kumar. “There’s sort of a legacy connection. Human beings intuitively remember this and sort of expect it.”
The tech is so ingrained that even memory loss can’t take it away.
Vince Guerrieri is a writer based in the Cleveland area. He's the author of two books, and his byline has appeared in Deadspin, Jalopnik, CityLab and POLITICO, among other places.