Fences

• Fences can be tunnelled, trenched, bridged, cut, jumped, climbed or lifted.
• Fences are alarm mountings but not barriers.

Mesh

Palisade

Unalarmed chainlink

• Attacks on chain link includes ungloved climb with helper (4s), gloved climb (4-12s), lifting (eg with 2×4) (5-12s), covering V overhang containing barbed wire with two 2″x2″s and carpet (8s), throwing over tarp to cover barbs and jumping (9s), cutting posts with disc grinder (9s), ripping the mesh away by hand (7s) (still needs a climb afterwards), cutting mesh and tension lines with boltcutters (12-24s) / vice grip pliers (12-47s), diagonal cutting pliers (9-17s) / linesman pliers (10-23s) / fencing combination tool / disc grinder (16-29s), portable ladders (28s), ripping wires out of the mesh with pliers (35-65s), snapping the post by mob (34s), cutting outriggers (1m7s)(still needs a climb afterwards). Chain link gate on 1.9″ metal pipe lasts 30s against a 6′ 16lb crowbar.

Alarmed fences

• If alarmed and there might be a response force then you need intelligence on which sensors you are facing. The usual rule that you do not do opposed entry applies, you are just trying to avoid an unopposed entry suddenly turning into an opposed one.
• If fence-mounted then tunnel or bridge, or as a last resort climb slowly, or cut slowly within the alarm wires if vibration or strain sensors, and hope you do not exceed the count setting for shocks per minute.
• If taut wire then tunnel, trench or bridge. In a pinch, taut wires might be bypassed by spreading (4” deflection might be allowed on top of the 4” spacing), or clamping and cutting, as long as the trigger of about 11kg pressure is not exceeded. If the wire follows undulating ground up and down it might not trigger anyway due to friction at coils.

• If electric field then crawl and tunnel from at least a metre away. As a last resort you might run past when a cloudburst starts while the processor is calibrating, or wear rubber shoes to prevent grounding.
• If capacitance then crawl or roll, then tunnel.
• If ported cable then walk slowly towards then bridge or tunnel, or duck-walk as a last resort. Sensitivity will typically be set from 2 to 700cm per second.
• If seismic then crawl or roll then tunnel or bridge.
• If microwave then crawl or roll or jump as last resort then tunnel. Look for spots at least 120m from transmitters or with at least 6” undulation. Check if the dead zone in the offset distance of about 10m from the transmitter is covered by another transmitter – if the designer made this schoolboy error then you can much more easily crawl under it, otherwise you would have to find the crossover between sensors which will be the thinnest point, although it will still detect down to a few inches off the ground. Jumping is less of an option if they are stacked, although it is not impossible that the mounting spike is still useable to spring from over the detection zone. When a cloudburst starts you may have a few seconds to run through it before the electronics recalibrate.

• If passive infra red then crawl or roll, although that will probably trigger, then tunnel or bridge. Ideally move in rain at the edge of the detection zone. If monostatic (the transmitter is also the receiver) then try re-aiming.

• If active infrared beams then tunnel to avoid the lowest beam. This would be disabled during snow, although snow footprints are a potential giveaway. Arrays are sometimes stacked up to 12 feet high. Even if stacked no higher than six feet so you can ladder over, they may be backed up by underground field sensors. They may also be protected by concrete sill or paving against trenching.

• If sensors are unknown then crawling before and after the fence is the best option but will probably trigger if there are non-fence mounted sensors, then once you reach the fence tunnelling is your best option, unless you can be sure there is no fence mounted sensor, in which case cut or lift.

• Rain degrades many sensor types.
• If there is no CCTV working then to maximise the chance of a guard dismissing it as a false alarm:
  • ported cable or electric field sensors are best challenged during rain,
  • fence mounted sensors are best challenged during wind,
  • infra red and laser are best challenged during fog, and wind may move grass enough to change signals,
  • capacitance sensors are best challenged during wind or rain,
  • pressure and electromagnetic sensors are more easily challenged under snow.

• If CCTV might be working then you need camouflage from clothes and weather and you could try conditioning guards by repeatedly sending large animals into the protected zone. Camouflage is unlikely to work for a fence, as if it has a response it is alarmed, and if it alarmed it usually is level and cleared and often is lit and hard landscaped in grey in contrast to greenery around it.

• Other than at infrastructure sites you are unlikely to encounter anything more than fence mounted sensors, although beware capacitance, seismic and microwave are still affordable for commerce. Taut wire is dear and hints there could be other nasties under and above ground and men with guns on speed dial. Balanced fluid tube underground sensors have telltale drain rodding style covers. Optical fibre is pretty secure against tampering especially if it uses technology like pulse injection to detect bridging or microbend speckles or interferometry to detect attacks and even vibration, so they can be used as pressure mats as well as in barriers. Fence and buried sensors are terrain following, whereas above-ground line sensors like microwave and infrared are usually line of sight so may have gaps above, below or around.
• If there is a second fence at least a metre from the first fence – creating sterile zone, or a warning sign or wires 4-8” inside the fence, then suspect it is electric fence. These are also alarms. A narrow sterile zone is also a hint that there may be high res video. The inner fence will typically be alarmed and stronger than the outer fence, which is just to stop you wandering in and causing a false alarm. The designer wants you to come through the outer chain link fence and into the trap of video, alarms and high security fence. If the sterile zone is less than 6m wide then it is unlikely microwave protects it.

• If the ground undulates but the fence line has been graded then suspect that line of sight above-ground sensors like microwave and infrared have been turned into terrain-following sensors.
• If there are horizontally spaced wires behind the fence then suspect a standalone electric field fence as they are the anti-false alarm mitigation.

• If the ground appears to have been sloped or inexplicably turned to gravel (for drainage to avoid false alarms from standing water and to stop rain bouncing off tarmac), or the fence is more rigid than chain link (to avoid false alarms from wind), then suspect microwave.

• If there is a path inside the fence then assume it is coupled to seismic sensors and bridge it.

• If barbed wires have apparently unnecessary flimsy poles between posts, and intermediate posts every 10 feet and sensor posts every 50/100m, then suspect they are taut wire.

• If posts are at least 4” below the top of the chainlink and it is tensioned, with no top rail, no sill and no outrigger then suspect fence sensors, although the lack of sill means trenching could be an option.

• Post-SHTF, maintenance may slip and vegetation may get out of hand, giving you cover and a source of false alarms from swaying roots or leaves for fence mounted or buried cable sensor.
• For critical infrastructure each sensor is expected to trigger 95% of the time it should.
• For the highest security installations assume they have spent £150k a pop on radar or thermal long range cameras with video analytics to spot or confirm you, although these are usually only for airports and borders.

• As with all prepping, one is none and two is one. Assume if there is a fence alarm there is a buried wire. Assume if there is a buried wire there is a freestanding sensor. Assume if there is a freestanding sensor there is video analytics. There will usually be two to four layers of defence.
• If there is a response force it may be slower than you think. Post-SHTF there may be nobody available or comms may be down even if they have a leased line to an ARC and a special URN for immediate armed police response like a nuclear base. Even UK intelligence bases like JARIC with MOD’s own AC12M alarm have at best 2 minute SLA on unarmed security response time, having been outsourced to the cheapest bidder.

• Anti ram barriers may be bridged, removed or disabled with one vehicle then finished off with another.

Walls

• You have to take one skin at a time for the tools to fit in to gain access. However, unless you know what is on the other side, do not mind tipping off your visit to subsequent passers-by and do not need the building, it is foolhardy. Unreinforced masonry holds itself up above a point-upwards triangle so unless you want to be crushed that is the hole you make in an emergency. You have to smash the bottom course then courses above that will fall down whole when you hit them.

• The effectiveness against walls of sledgehammers, cutting mauls, wrecking bars, rotahammers, steel punches, cutting torches, battering rams and abrasive wheels is dealt with under the posts on MoE tools and Walls, based on testing for military standards done for the US Defense Nuclear Agency in 1972, in Barrier Penetration Tests, US Department of Commerce, National Bureau of Standards NBS Technical Note 837, June 1974.
• Generally:
  • you would soften up masonry with a sledgehammer then gouge out hard to reach bits with a cutting maul or wrecking bar, or drill holes with a rotahammer into which you insert steel punches which you sledgehammer to spall the inside face.
  • battering rams bounce off masonry and drive shocks into operators,
  • electric saws might be able to get through masonry depending on size but are better for thinner panels like steel and/or plywood, especially exmesh, and
  • cutting torches are best for metal plate.
• Even if explosives were used a sledgehammer and boltcutter are needed to remove rubble and rebar.
• Floors and ceilings are effectively horizontal masonry walls with gravity assistance or hindrance or joists and boards. Cut wooden floors with floor saw, with hammer and chisel, axe, crowbar, screwdriver and wedges on hand.
• Roofs are either effectively horizontal masonry walls with gravity assistance or rafter and sheets or tiles. Tread on two tiles at once, try to line up with any chimney to fall back on and ideally lay a ladder. On pitched roofs axe or saw out a 2.5′ square hole about a metre from the gutter. On flat roofs roll up lead, copper or zinc sheets, or cut over boards with hammer and axe.

Doors

Your options what to attack are always panel/infill/glazing, leaf/sash/casement, frame and fixings/hinges/locks, ie how is the panel fixed in the leaf, how is the leaf fixed to the frame and how is the frame fixed to the wall? Your motto is ABC: always bash corners. Try to leave hinges alone, otherwise you cannot close the door behind you to secure it for, and conceal, yourself and you do not want it falling on you anyway.

Components

Essentially, your options how to attack are burn, cut, pry and bang. Other variants for hand tools include screwing, pulling, shearing, drilling, sawing, wedging. Aims for hand tools are to disassemble, break, deform, notch, shave, puncture, move or spall. Attacks for power tools include spreading, cutting and ramming. Aims for power tools are to deform, weaken, notch or spall. The attack for thermal tools is cutting. Aims for thermal tools include weakening, breaking, burning, cutting or melting.

Here are how the options fit together:

• Leaf profiles can be levered apart from each other or the frame, delaminated, cut or smashed, and a hole can give access to attack the vulnerable side of the cylinder, eg after unscrewing the handle or escutcheon. Leafs can be drilled to give access to mechanism. Locks can be cut out. Weak rim locks may be removed by lesser blows and softened up by levering up the door from underneath where the gap is greatest.
• Revolving door wings may be possible to fold flat for easier access.
• Sliding doors are usually best to lever up and scissor gates are usually best to break at the lock, but try to avoid distorting them if they need to slide into a recess or track.
• Folding doors need barging, failing which you will have to lever past bolts, cut off the heads of the through bolts that hold the bolt, or cut a hole to unbolt.
• Drop bars can be lifted up with a shovel through a gap or a hand through a hole made.
• Panic bars can be pulled in by wire or shovel or hand through a hole. Sometimes you can do this via drilling tiny holes in thick steel.

• Panels can be smashed or levered out or debeaded.

• Joints can be levered, whether it is the panel out of the leaf, the leaf out of the frame or the frame out of the wall. A wooden frame’s stop can be gouged off to give access to bolts.

• Hinges can have pins punched, levered, drilled or cut, or be smashed, ripped or cut away from the frame eg with nail puller, or screws chopped with a hammered axe, or the leaf cut around them.

• Locks can be cut out or their bolts cut, hit or levered, or the leaf can be cut to allow manipulation of the thumbturn, or punching out of the lock (eg crowbar hit through hole from removed cylinder by sledgehammer), or keeps can be cut out of the frame. Electric locks can be bypassed by cutting the power or replacing the power with a drill battery.

• Escutcheons or handles can be levered or smashed off to allow access to the cylinder. Escutcheons can be drilled or punched.

• Cylinders can snapped, drilled, punched or chiselled out.

On a metal door you probably do not want to spend hours with tin snips or use energy for power tools, so they probably need a combination of sledgehammer and crowbar like firemen would use an axe to ram in a halligan, securing progress with wedges. The damage it will do to your crowbar is why you need the Stanley Fubar. On a wooden door you would hope to just use one or the other. 

Even a British Standard door deadlock is only guaranteed to take 1.5 tons against the door being kicked in and 0.75 tons pushing the bolt being pushed back in the lock. But few doors are as strong as the 2″ oak test doors that relies on. The door will cave in long before you threaten the lock.

Multipoint locks in a security door can see off multiple blows even during pressure from hydraulics, and all multipoints really need multiple levers and ideally multiple people if without hydraulics or kinetics like enforcers.

This City of London police video is most informative. It shows a typical wooden panel door with a mortice deadlock and nightlatch being destroyed – with two blows of an enforcer popping the latch after a ‘rabbit’ jack softens up the deadlock. When ‘upgraded’ to a BS2621 deadlock and London bars (frame reinforcing strips), it caves in with only one blow, although we do not know what the door is made of being a flush type. When changed to an insurance rated LPS1775 SR3 security door (with the old MI5 class 2 rating which is now CPNI High) they find themselves having to try a spreader, rabbit, halligan and Enforcer, but to no avail other than the spreader bends the door and frame; in fact the door and frame are so hard that they have to use the Enforcer to remove the spreader. Finally, refusing to take the hint, they take on an SR4 government class 3 / CPNI Enhanced) security door by attacking the hinge side, only to find the spreader goes nowhere and the Enforcer just bounces off – thanks to reinforced hinges and special anchored dog bolts.

Yet upvc multipoints are so flexible they often still work after forcing them with a screwdriver or shovel, depending if they are locked properly. Some locks with rollers are so useless that locksmiths have a tool to lift them, some have mushrooms that grip better but are still tiny and will not stop multiple prys and wedges, while the best use hooks to try to stay in the keep whether the door is forced forwards or sideways. The vulnerability for UPVC doors with good locks is if they are essential slabs of foam, as you see in the next but one video. The video after that shows what the solid core compsite doors are made of – plywood, which is strong, but not so much after you mortice locks into it.

Although the toughest door you will likely come across is made of 1.5mm steel, some thinner metal skinned doors from the pre-eco 1990s contain foam on a flimsy wooden frame, these are not much better than the Chinese ‘security doors’ that kids can cut the lock out of with a tin opener because they are made of glorified Bacofoil. Look at the absolute state of it!

In contrast, enforcers have been known to bounce off solid core fibreglass doors made in the 2010s, so unless you are looking at a cheap flimsy upvc job do not risk breaking your foot trying to kick it in, likewise with solid wooden doors with a deadlock.

Cheap doors come in cheap frames so can come flying in whilst still in the frame, with no tools needed, just a few kicks.

Hollow doors can be torn apart with your bare hands, effectively made of fresh air, egg boxes / cardboard and hardboard on a flimsy frame, they are mainly found on council houses awaiting upgrade.

Some metal doors are aluminium such as residential double glazing or shop doors, this is a more pliable material than steel (but not always to be underestimated as it is used in some ballistic door frames lined with fibreglass). Patio doors are vulnerable to being lifted out with a spade or pried sideways, unless they have anti lift wedges and security bolts, which can be surprisingly strong. Ultimately if noise and damage is not an issue the glazing normally lets you walk straight through the locked frame. 

Outside opening doors can have their exposed hinges attacked to sheer the screws by smashing up or down on them then forking off with the flayed end of a crowbar. Dog bolts in (security hinges) or between hinges will almost certainly still leave the hinge stile needing to be forced as if a locking stile. 

Metal skinned fire exits with panic bars can be dealt with by punching a hole with a pike and hooking a wire through to pull the bar or using the pike to push it. The same sort of wire can be used on push releases such as panic bars between double doors or even through the locking edge of single doors. 

A similar technique of hammering a pike through the door can be used against drop bars.

Magnetic locks on double doors with a motion detector inside can be opened by slipping something on a stick through the gap between the doors. 

Handles that should be key locks are vulnerable to manipulation.

Panels such as glass, foam, plastic or bevelled wood are weak spots. Sometimes the whole panel goes in while the door stays locked. Other times the door stays locked while it comes out still in its frame. So you do not always have to crawl through a hole in a panel. As for old style panels from aluminium double glazed doors, still found in cheap upvc, if strong they flex inwards and pop out, and if weak they stay put while your boot goes through them. Once through the glass in a metal skinned door you could unscrew the cassette holding the whole light. 

Some doors have fanlights you can break to open wide enough to crawl through or you may have to crawl through the broken glass.

Ideally you do not want to risk injury by throwing yourself against doors, but if you do not have tools and it comes to it then factor in that a shoulder barge is three times as strong as a kick and will take off a nightlatch. 

Some doors have fire brigade emergency releases which are basically iron bolt heads you axe off.

Cellar doors either need padlocks cutting off or, if locked from inside, you could smash the mortar around it then crowbar it up. Similarly, gratings can be released by hammer or levered up, pavement lights can be smashed. If your best option is a chute you need a man to lower you on a rope.

Cheap little padlocks can possibly be shimmed. Generally padlocks can be cut with power tools or boltcroppers, or torched or wedged open with a shape like a pickaxe hammered in, or used against the staple by twisting via a hammer on the padlock or pike through the hasp, or sledgehammered off along with any staple, or cutting staple bolt heads or hammering the padlock off of the hasp by hammering down on a crowbar that has been slotted through the hasp. 

Don’t forget the old classics of first checking for unlocked doors and windows and asking yourself who might have a key. 

Garage doors are usually thin and flexible but if you need to cut you can cut out a horizontal door and walk it open.

Consider a Burg Wachter mortice lock blocker for around £12, or the SBD rated Loxal Locking Bar if there is a letterbox, to stop keyholders barging in on you.

Tools

• A 8lb axe is for chopping, but also as a backstop for other tools and for hammering crowbars in.
• A 10lb sledgehammer is to soften up doors or remove the masonry holding them.
• A Ktool is hammered down onto a round cylinder then levered off.
• A lockpuller is a large nail puller to rip off cylinders.
• A shove knife is a 20 gauge (0.9mm) eight inch hook for latches.
• A locking pliers is to unscrew some cylinders or hold padlocks.
• Hydraulics work best on metal frames as wood gives little to purchase on.
• A bambam slap hammer pulls out padlock cylinders with a self tapping screw.
• A duckbill pickaxe is shoved in a padlock shackle and then hammered to separate it from the padlock.
• Boltcroppers are best for non hardened steel, and against padlocks are best used on the staple – both sides of the shackle need cutting.
• A power saw is best for roller shutters.
• A battery drill is best for shop doors to gain access to manipulate the lock.
• A battery reciprocating saw can go through bars and glass.

• A battering ram is for walls, as doors now have better tools. Make an L shape hole so you can just knock the top of a square and let gravity do the rest.

• For tips on how to use crowbars and sledgehammers see the NYFD fire rescue guide.
• See also the video below on UK security doors and Manual of Firemanship Part II.

Windows

Windows are thinner and so easier, although you eventually want a door open and you might not find the key inside. External beading may allow you to gouge out the whole unit. Washing up liquid can release security tape wedged between the frame and unit. It may be safer and quicker to force the opening light. On sashes that means slipping or punching the fasteners. On casements it means levering the wood.

If the frame beats you and you are forced to go through the glass then consider that axes have been known to bounce off normal annealed glass in sealed units, so start on glass with a spring punch then rake out the rest. You might find a battering ram like a ladder you can use pointing downwards to smash glass, or you could climb a ladder to get above the window then smash it, either way you avoid glass falling on you.

Acrylic panes will smash with light tools. Tough plastic like polycarbonate or the pvb in laminated glass needs a purchase hole by pickaxe then power saw or axe round the edges then sledgehammer to fold the pane out the way.

Toughened or tempered glass is four times stronger than annealed but won’t stop a spring punch. Although it breaks into safer crumbs, its British standard allows a small proportion to be deadly shards, so be careful. 

Rooflights can be dispatched with a hammer through glass, crowbar into a gap or operating rods turned with a wrench.

Glass blocks need something approaching the might of a sledgehammer. 

Boarded up premises may need bolt heads to be power sawn or chiselled off, or the wooden battens splitting at the location of the bolt with a pike. There may be a brace of 2 by 4 hidden behind a boarded up door which then highly suits a chainsaw. 

Beware some windows, especially rooflights, open over stairwells.

Shutters & grilles

Roller shutters need their padlocks cutting off, then there may be pins or bolts to remove to get rid of the slats or you can just crowbar the whole thing up or cut a triangle or vertical slit and walk through it with or without pulling out the remains of the slats. Security shutters may have interlocking slats that you cannot slide out. Some have extra locks to cut through which is another reason to just cut the shutter. 

Scissor gates are usually attacked by ripping out the hinges by twisting the grille with a screwdriver then climbing up and using your weight to yank out hooks from the top runner. On weaker aluminium models you could smash out diagonals with a shovel. Metal gates are usually attacked at the lock. 

Window bars can be cut, or gouged out of the wall with a crowbar or a sledgehammer, or hammered out of the wall by hitting the middle so they gradually curve out their mountings. Once you have done one side their own strength may let you twist the other side out.

Alarms

• The two ways past a sensor are to:
  • bypass it – by not being where it does not want you to be, or
  • spoofing it – by being where it does not want you to be without it realising.
• Your options are therefore mainly to:
  • move elsewhere by avoiding the detection zone or avoiding the facade fabric movement it expects, or
  • move slower than the set count, or
  • move invisibly by shielding signal or tampering.
• Staying away from the sensor is the best bet if safety and witnesses are not a concern. You can stay away by diverting the long way round, or pretend to stay away by refusing to play by the sensor’s rules, for example a reed switch wants you to open a door so you come through it while closed. Similarly a PIR wants you to rush about stealing stuff before guards arrive, so you walk so slowly that you never trigger the feet-per-second setting. Or maybe you need to not bang walls, break glass, give off heat or reflect microwaves.
• Ideally sensors will be overt and line of sight, but beware they might be covert, terrain-following or volumetric. Passive sensors may be harder to spot, whereas with active sensors you will usually see a microwave sensor or laser. Active sensors will not have demoralised the guard with false alarms but are easier to spot. Covert sensors are mainly only going to be encountered underground at infrastructure. Volumetric sensors will usually be microwave or infrared, so whilst harder to nip around can at least be seen.
• Tampering is something insiders do on cheap or badly managed sensors. It is not for food rescues, as sensors should have tamper switches inside and should cover each other. It is, however, how proximity alarms like capacitance, strain and pressure pads are defeated as the sensors are too difficult.
• Reed switches may be balanced with extra magnets or voltage detectors, or might be Hall effect sensors measuring magentism.
• Vibration sensors might be mercury switches, piezoelectric or inertia, and might be programmed to recognise tools. The equivalent for glass measures the low frequency of impact followed by high frequency breaking, but some can be fooled by the application of safety film to deaden it. There might be magnets detecting removal of glazing.
• Fabric may contain breakwire continuity detectors to detect smashing through.
• Capacitance sensors may be hiding in metal openings or protecting metal objects like filing cabinets, especially if they are inexplicably mounted on insulating blocks or have foil mats underneath. They can be detected with RF gear.
• Infrared beams sometimes have mirrors to lace a higher fence of coverage.
• Microwave sensors usually do not alarm on movement much slower than an inch per second or movement in an arc which does not affect Doppler.
• Pressure mats are self explanatory, so simply do not step on mats, although they are uncommon and mostly reserved for dementia care alarms.
• Pressure plungers are vulnerable to tampering without careful installation.
• Open stairs might have strain sensors.
• Light sensors might trigger when you enter a strongroom.
• Once you know what model or at least the type of sensor you can get a good idea of the worst case scenario for sensitivity and range.