OTTAWA — In March, after the federal government promised a ban on “consumer hacking devices” on the grounds that they help car thieves, I approached the Speaker of the House of Commons with a request: could I try one of those devices on keycard readers in the Parliament Buildings? 

The sergeant-at-arms not only refused, but said if I tried it on my own, he’d banish me from the place for life.

It was part of a project to see just how much of a menace a Flipper Zero is, since the Liberal government has sought to ban them as car-theft tools.

This was the last in a series of increasingly weird things I tried with this little handheld thing that feels like a Tamagotchi crossed with the settings for a Wi-Fi connection you’re trying to troubleshoot. I had not expected to learn that it’s (probably) easier to use a Flipper Zero to get into Parliament itself than to get past the gates of Ottawa’s Parliament transit station.

How it works: Infrared remote controls, tags on merchandise, credit cards, key fobs, even certain electronic toys—they all send or receive data on electromagnetic frequencies. Flipper Zeros can read and mimic those signals. The premise of a ban, which Innovation Minister François-Philippe Champagne has more recently watered down to a possible licensing system, is that Flippers can fake the signals from the fobs that unlock car doors and start motors.

Cybersecurity experts have scoffed, saying that’s true for cars that are now really old, but modern ones use ever-changing codes that can’t be duplicated by a device selling for around $300. The Flipper Zero manufacturer attacked the premise as well.

The scorn seems to not be completely justified. Security types have demonstrated apparent weaknesses in certain fob systems that a Flipper Zero can help exploit. These are a long way from making a Flipper into a magic wand, though.

After I got my hands on one and started waving it around at work, The Logic’s editors asked me to see how much Flipper trouble I could get into without actually getting into trouble.

I’m not scared of a command line or even a breadboard, but my hacker skillz are, at best, Script Kiddie 201-level. Still, if these things are serious public threats, someone like me ought to be able to get close to some mischief.

I failed to “steal” my own car with the Flipper, despite having all the time in the world, total access to the car’s control fob and a Flipper beefed up with “RogueMaster” firmware, a version of the device’s stock firmware that includes enthusiast-written add-ons.

You can buy other tools that will program new fobs. Auto mechanics and car dealers have these things to replace duds and lost ones. Typically, they need to be plugged into the electronics of the car involved—and if a thief has that kind of access, you have other problems.

Plenty of devices use signals that a Flipper Zero can emulate, and those signals aren’t as secure.

(Boring) remote controls: Flippers have infrared ports that can read and play back the beams from remote controls, for instance, and cloning the remotes for my TV and air conditioner was trivial. A Flipper’s limited buttons make it a clumsy remote control, but it works.

Tesla chargers have buttons that open the vehicles’ charging ports by sending the car a standard radio signal. The signal works at a distance and there’s no encryption, so one button press on a duly programmed Flipper can pop open multiple port covers at once. Small minds, such as mine, find that amusing. The covers close on their own after a bit.

In the cards: More interestingly, the Flipper’s Near Field Communication (NFC) functions could read data off cards from my wallet that I didn’t know was embedded in them.

NFC is the technology that lets you pay at a store by tapping a credit card on a reader. As with a reader at a checkout, the card has to be within a few centimetres of the Flipper, at the most. But if they are, and the Flipper is set to monitor the right frequency, it emits a happy bleep! and its little screen shows what the card broadcasts about itself.

That varied from card to card. For an especially verbose one, the screen showed the card number, the dates of issue and expiry, the country where the card was issued and its default currency. It also showed the number of times I can incorrectly enter the PIN before (presumably) the card is frozen.

I could save this information on my Flipper Zero. Much like with a TV remote, the device is capable of beaming it out again as if the Flipper were the actual credit card.

To a point. I turned on the emulation mode and tried tapping my Flipper on a reader at a grocery store; the reader recognized that it was getting the right type of signal, but said the tap had failed and I should try again.

Like modern car fobs, payment cards now typically transmit two sets of information: the data that allows the financial transaction, plus a separate, ever-changing code that tells the reader the card is legit. A smartphone set up with something like Apple Pay can replicate that key-generating system, but it takes co-operation from the assorted providers involved to set up.

The Flipper also does not read the four-digit PIN you punch in if you have to insert the card in a reader, or the “CVV” code you have to type in for an online purchase. So although it gets close, the data a Flipper can read from a card is not quite enough to rip it off.

I tried the Flipper on three transit smartcards: an Ontario Presto card, a paper “L’occasionnelle” card from Montreal and a London Oyster card. Bleep! Bleep! Bleep!

I learned that all three are from smartcard company MiFare; some technical details about the frequency they all use; and that each holds bits of account data—though none of that was readily intelligible.

For the sake of science, I trooped into Ottawa’s Parliament light-rail station, a couple of blocks from the Peace Tower, to test the mimicry of my Presto transit card. The Presto reader recognized it was getting a signal, but its screen turned red instead of green—“Tap not accepted”—and the fare gate stayed shut.

Access granted, access denied. A fob for after-hours access to my office proved marginally more difficult to scan, only because the Flipper Zero’s basic tools didn’t “see” it. But the fob has a brand name on it—HID, a giant in the sector—and that led me to the right app from the RogueMaster package, and then to the chirpy bleep! of a successful reading.

As with my assortment of cards, the Flipper had to be within about two centimetres for the reading to take.

The fob uses a 26-bit format (an industry standard), the successful scan told me. It presented me with columns of letters and numbers, which it offered to emulate, modify, and/or write to another device.

I asked it to emulate my fob. An indicator light on the Flipper started flashing purple and the word “Emulating” appeared on the device’s little orange screen. Oddly excited, I held it up to a reader on an office door. It beeped and the door unlocked.

Now, the Flipper was posing as my fob. It didn’t become a master key. I could use it to pretend to be … myself.

Using a Flipper to copy a fob or card does create a genuine security problem, though. It might take dexterity and nerve to snatch a card and return it, but you’d only need to have it for a few seconds to make a clone. An innocent-seeming jostle might do it, if you were deft.

This is the scenario that, were I in charge of security for Parliament, would worry me.

A Parliamentary pass is both a photo ID card—it has “Parliament of Canada” printed on it—and a tap-card that can open certain security doors in Parliament, especially for after-hours access when there aren’t as many guards on duty.

Walk around downtown Ottawa for an hour and you’ll see many of these hanging around people’s necks, or the lanyards swinging loose out of their pockets.

I tried the same process with the pass as I had with my office fob: Choose the right mode for the Flipper Zero. Hold it against the card. Wait a moment.

Bleep!

Huh.

The Flipper’s screen revealed some detail about the type of security card it is—one billed by the manufacturer as “entry level.” I can’t say for sure whether a Flipper mimic of the card would work on a Parliament Hill reader, but there’d be one way to find out.

In my request to the Speaker’s office—in mid-March—to test my Flipper’s mimic of the card’s signal, I laid all this out. “Maybe it won’t work and it’ll be a testament to parliamentary security,” I wrote.

They took a few days, but then Speaker Greg Fergus’s communications director, Mathieu Gravel, wrote, very politely, to say they’d cancelled my pass on the grounds that the proposal was itself a risk to parliamentary security. (I could get a replacement pass, though.)

Parliament’s security team tests its protections against all kinds of potential threats, he told me, and absolutely no way would it have any part in my proposed exploit.

“Should anyone attempt such a test, it would be considered a breach of security, and as such, the Sergeant-at-Arms would permanently revoke someone’s access card (if applicable) and their rights to be in the [Parliamentary] Precinct,” he wrote.

Keeping in mind the security team’s claim that it tests these devices itself, can I conclude that a Flipper Zero copy of a pass card would indeed work? And if so, is there a plan to do anything about that?

“For security reasons, detailed information is not shared publicly,” Gravel wrote in our last exchange.

Take from that what you will. My takeaway is that, unless Parliament has hastened upgrades in the last few weeks, a Flipper Zero will get you into Parliament more readily than the transit station that serves it.