Short answer
A container lock detects vibration, cover opening and cutting, but most vibration on a real route is a road surface rather than an attack. Useful tamper alerting comes from combining the raw event with context, whether the vehicle was moving, where it was, and what state the lock was in, not from raising sensitivity.
Key takeaways
- Not every vibration is an attack: rough roads and loading generate the majority of raw events.
- The three distinct tamper classes are cutting the securing element, opening the housing, and using the emergency override.
- A mechanical-key event looks legitimate and is often the most informative signal on the list.
- Context beats sensitivity: the same vibration means different things stationary at a depot and moving on a highway.
- Measure the dismissal rate, a persistently high one is evidence the thresholds are wrong, not that users are careless.
01What a lock can physically detect
Tamper detection is not one capability but several, each watching a different attack. The Jointech JT701 reports rope cut, cover opening and vibration. The JT709ex field lock reports tamper, use of the mechanical emergency key, and shackle cut.
Those map onto three genuinely different intentions. Cutting the securing element, rope or shackle, is an attempt to remove the lock. Opening the cover is an attempt to reach the electronics, usually to stop it reporting rather than to open the door. Using the emergency key is operating the lock through a legitimate channel at a possibly illegitimate moment.
Vibration sits apart from the other three because it is not an attack signature at all. It is a raw physical measurement that may accompany an attack, may accompany loading, and will certainly accompany a poor road surface. Treating it as equivalent to a cut event is the origin of most false alarm problems.
02Why raising sensitivity makes things worse
The instinct after a missed incident is to make the device more sensitive. It reliably produces the opposite of the intended result, because the ratio of genuine attacks to ordinary physical disturbance on a working route is heavily weighted towards the latter.
Lowering the vibration threshold multiplies events from every source at once, road joints, potholes, forklift contact during loading, the container being lifted at a port. The number of real attacks detected barely moves, because a real attack was already generating a far larger signal than a pothole.
What actually changes is the recipient. An operator receiving fifty events a day where two matter learns within a week to clear the list without reading it, and at that point the system has become worse than no system, because it produces a false sense that the containers are watched.
03The context that changes an event’s meaning
The same raw event carries completely different weight depending on three facts that the lock alone does not know: whether the vehicle was moving, where it was, and what state the lock was in.
Vibration while the vehicle is in motion on a highway is expected. The identical reading while the vehicle has been stationary for twenty minutes on a road shoulder is not, and the difference is not in the vibration but in everything around it. A cover-open event at a scheduled depot during a delivery window is plausible; the same event at 3 a.m. between two cities is not.
This is why tamper alerting belongs in a system that also holds the vehicle rather than in the lock’s own app. The discrimination that makes alerts useful is performed by combining sources, and a device that only knows its own accelerometer cannot perform it however good its firmware is.
04The mechanical key event, which looks legitimate
The JT709ex reports use of its mechanical emergency key as a distinct alert type, and this is one of the more useful signals available precisely because it does not look like an attack.
Emergency overrides exist for real reasons, a flat battery, a driver locked out at a remote site, a Bluetooth failure. The lock records their use without judging it, which gives an operator the ability to ask why the override was needed at that particular time and place, and whether the circumstances that supposedly required it were present.
A pattern of mechanical-key events on the same route or the same driver is far more informative than a single forced-entry alert. Forced entry is an incident; a recurring override is either a genuine equipment problem that needs fixing or a procedure being routinely bypassed, and both are worth knowing.
05How to tune thresholds without guessing
A threshold chosen before deployment is a guess. The defensible approach is to run the locks in a recording mode first, on real routes, and observe the distribution of raw events before deciding what should raise an alert.
That baseline period tells you what ordinary operation looks like on your specific lanes, how much vibration a particular road generates, how loading appears in the data, what a normal depot stop produces. The threshold is then set relative to that observed distribution rather than to a manufacturer default that knows nothing about your routes.
Re-tune when the routes change. A threshold calibrated on paved intercity corridors will misbehave the first time a container goes to a construction site, and the correct response is a route-specific profile rather than a single global number that is wrong in both places.
06Severity: what deserves waking someone up
Not every alert needs the same urgency, and flattening them into one channel guarantees the important ones are diluted. Three tiers cover most operations.
A cut event, rope or shackle, while the vehicle is stationary outside a planned stop is the highest tier: it warrants an immediate call, because the window for intervention is measured in minutes. A cover-open event is second: it suggests someone is attacking the device rather than the cargo, which is often a precursor. Vibration anomalies are third, useful in aggregate and rarely worth an individual notification.
The mechanical-key event sits awkwardly and deserves its own handling: it is not urgent, because the opening has already happened through a legitimate channel, but it must not be silently absorbed either. A daily digest that a supervisor actually reads serves it better than a push notification nobody investigates.
07What happens to events during a coverage gap
Tamper events are disproportionately likely to occur where coverage is poor, because both correlate with isolation. A design that assumes continuous connectivity will therefore lose exactly the events it exists to capture.
The requirement is local retention and ordered resynchronisation: the device holds events while the link is down and resends them in sequence once it returns. Order matters more than it appears, a cover-open followed by a cut tells a different story from a cut followed by a cover-open, and a system that replays them out of sequence produces a misleading timeline.
The slave locks add a second dependency. A JT709ex reports through its JT701 master over Bluetooth or LoRa at up to 1 km in open area, so a slave event can be delayed by the master being out of range as well as by the master being out of cellular coverage. Both need to be visible as reasons for a gap.
08Measuring whether the alerting works
The number that matters is not how many alerts fired but what proportion led to an action. A stream where most entries are dismissed without investigation is failing, regardless of how many genuine events it also contained.
Track the dismissal rate per alert type and per route. A high rate on vibration and a low rate on cut events is the expected and healthy pattern; a high rate across all types means the thresholds are wrong. Critically, treat that as a design signal rather than a discipline problem, the recipients are behaving rationally given what they are being sent.
Record the outcome of each investigated alert as well: attack, loading, road surface, equipment fault or nothing found. That feedback is the only mechanism by which the thresholds improve, and without it the same false positive recurs indefinitely because nothing ever told the system it was wrong.
09The alert that matters most is silence
A lock that has stopped reporting produces no tamper alerts at all, and on an operations screen that is indistinguishable from a container where nothing is happening. This is the failure mode most likely to be discovered only after a loss.
The countermeasure is to alert on the absence. A device that has not reported within its expected interval should raise something on its own account, separately from the tamper stream, because the two require different responses, one sends a supervisor to the container, the other sends a technician to the device.
Battery state belongs in the same view. The JT701 carries a 15,000 mAh battery and the JT709ex is quoted at up to three years of standby, but both eventually run down, and a flat lock is a silent lock. Monitoring the fleet’s health is what stops coverage eroding one quiet device at a time.
10What a Saudi and GCC route adds to the problem
Surface quality varies sharply between an intercity highway and the last kilometre into an industrial site or a construction yard, and vibration profiles vary with it. A single global threshold will be simultaneously too sensitive on the unpaved section and too permissive on the highway.
Heat compounds it through the device rather than the signal. Both locks are rated to a narrower envelope than fixed equipment, the JT701 to −20 to +70 °C and the JT709ex to −20 to +60 °C, and a lock mounted on a sun-facing door is operating near the top of that range for part of the day.
Dust attacks the seals and the charging port rather than the sensing. Both units carry IP67, which under IEC 60529 means dust-tight with resistance to temporary immersion, but that protects a correctly closed enclosure; a charging cover left unseated after a top-up is outside the rating entirely.
11A workable alerting design
Put the three attack signatures, cut, cover-open, override, on the alerting path, and keep vibration as an input to those rather than an alert of its own. Vibration corroborates a cut event; on its own it is noise on most routes.
Gate every alert on vehicle state before it is sent, so a stationary-outside-a-planned-stop condition escalates and a moving-on-a-highway condition does not. That single gate removes the majority of false positives without reducing detection of the events that matter.
Then assign a named recipient per tier and a response expectation, and review the dismissal rate monthly against the recorded outcomes. The design is not finished when it is deployed; it is finished when the dismissal rate on the top tier is low enough that the recipients trust it.
12Who should receive which alert
An alert with no named recipient is an alert nobody owns, and in practice that means nobody acts. Routing is as much a part of the design as the threshold, and it is the part most often left until after deployment.
The top tier belongs to whoever can physically reach the vehicle or reach the driver within minutes, usually a duty supervisor or a control-room operator, and on overnight routes that has to be someone actually on shift rather than an inbox read the next morning. A real-time capability routed to a nine-o-clock inbox is a reporting capability wearing the wrong label.
The lower tiers belong to different people entirely. Mechanical-key events and vibration patterns are a fleet-management question, better served by a daily or weekly review than a notification, and the person best placed to read them is whoever owns route planning and driver performance rather than whoever answers the phone at night.
13How ENTEK.AI approaches tamper alerting
On ENTEK.AI, the Smart Lock solution records tamper events from the lock, alongside locked, unlocked, unauthorized attempts and geofence entry and exit, each with its time and position. Every remote command sent to a lock is logged with who sent it, and each trip keeps its own audit log.
Alert rules are set per lock rather than globally, so a container that regularly visits an unpaved site can carry a different rule from one on intercity runs without weakening either. The rules are checked every 30 seconds, and alerts are sent within about a minute by email, SMS or WhatsApp.
The intended result is a smaller number of alerts that a supervisor acts on, with the full event history available when one needs a closer look.
| Raw event | Moving on a highway | Stationary at a planned depot | Stationary off-route |
|---|---|---|---|
| Vibration | Ignore, road surface | Ignore, loading | Log, corroborate only |
| Cover open | Escalate | Low priority | Escalate immediately |
| Rope / shackle cut | Escalate immediately | Escalate | Escalate immediately |
| Mechanical key used | Daily digest | Daily digest | Investigate, ask why |
| No report for the expected interval | Device alert | Device alert | Device alert |
Figures and sources
- Jointech JT701 tamper conditions detected: rope cut, cover open, vibration (Source: ENTEK.AI product specification, Jointech JT701, as of 2026-08-30)
- Jointech JT701 alert types published: rope cut, back cover, geo-fence, battery low (Source: ENTEK.AI product specification, Jointech JT701, as of 2026-08-30)
- Jointech JT709ex alert types published: tamper, mechanical key used, shackle cut (Source: ENTEK.AI product specification, Jointech JT709ex, as of 2026-08-30)
- Jointech JT709ex unlock methods, including the emergency override: Bluetooth, RFID, mechanical key (emergency) (Source: ENTEK.AI product specification, Jointech JT709ex, as of 2026-08-30)
- Jointech JT709ex link to its master, and range: Bluetooth / LoRa, up to 1 km (open area) (Source: ENTEK.AI product specification, Jointech JT709ex, as of 2026-08-30)
- Jointech JT701 operating temperature range: −20 to +70 °C (Source: ENTEK.AI product specification, Jointech JT701, as of 2026-08-30)
- Jointech JT709ex operating temperature range: −20 to +60 °C (Source: ENTEK.AI product specification, Jointech JT709ex, as of 2026-08-30)
- Jointech JT701 battery capacity: 15,000 mAh Li-ion (Source: ENTEK.AI product specification, Jointech JT701, as of 2026-08-30)
- Jointech JT709ex quoted standby life: up to 3 years (Source: ENTEK.AI product specification, Jointech JT709ex, as of 2026-08-30)
- Jointech JT701 quoted GPS accuracy, used as event context: 2.5 m CEP (Source: ENTEK.AI product specification, Jointech JT701, as of 2026-08-30)
- IP67, first digit: protection against solid foreign objects: dust-tight (no ingress of dust) (Source: IEC 60529, Degrees of protection provided by enclosures (IP Code), as of 2026-08-30)
- IP67, second digit: protection against temporary immersion: immersion up to 1 m for 30 minutes (Source: IEC 60529, Degrees of protection provided by enclosures (IP Code), as of 2026-08-30)
Questions
Why does my lock report tamper events on normal journeys?
Almost always because vibration is being treated as an alert in its own right. Rough road surfaces, loading and container handling all generate it, and on most routes the majority of raw vibration events are ordinary operation. Use vibration to corroborate a cut or cover-open event rather than as a standalone trigger.
Should I raise sensitivity after missing an incident?
Usually not. Lowering the threshold multiplies events from every source while barely increasing genuine detections, because a real attack already produces a much larger signal than a pothole. The better change is gating alerts on vehicle state and location, which removes false positives without reducing sensitivity to real events.
Is a mechanical-key event worth alerting on?
Worth recording and reviewing rather than waking someone. The opening has already happened through a legitimate channel, so it is not urgent, but a pattern of overrides on one route or one driver is either a real equipment fault or a procedure being routinely bypassed, and both need to be seen.
How do I know the alerting is tuned correctly?
By the dismissal rate. A high rate on vibration and a low one on cut events is healthy; a high rate across all types means the thresholds are wrong. Record the outcome of each investigated alert, attack, loading, road, equipment fault, nothing, because that feedback is the only way the thresholds ever improve.