California CSLB Lock and Security Equipment Contractor C-28 Attorney Fee Petition Mechanics: Tyler Odyssey Civil Complaint Date as Primary Welch Anchor, CSLB License Check (C-28) as Secondary Anchor (THE ONLY C-28 Lock and Security Equipment Page in This Series — DISTINCT FROM D-16/C-61 Hardware, Locks and Safes — ONLY Page With ANSI/BHMA A156.25-2018 Electrified Door Hardware Advisory [THE ONLY PAGE in the Fee-Petition-Mechanics Series With an ANSI/BHMA A156.25 Advisory — PURE KETCHUM] and UL 294 Access Control System Units Advisory; AHJ Building Permit CBC § 1008.3 as Second Institutional Anchor; Fail-Secure Egress Entrapment Injury / UL 294 Level I Credential Cloning Unauthorized Entry Theft / Absent UPS Power-Failure All-Door-Unlock Three-Track Harm; Bus. & Prof. Code § 7031(b) Disgorgement), CLRA § 1780 Mandatory Attorney Fees

Statutory Framework: Bus. & Prof. Code § 7028, C-28 Lock and Security Equipment, ANSI/BHMA A156.25-2018 Advisory, UL 294 Advisory, AHJ Permit Advisory, § 7031(b) Disgorgement, and CLRA § 1780 Mandatory Attorney Fees

California Business and Professions Code § 7028 prohibits unlicensed contracting. The CSLB C-28 (Lock and Security Equipment Contractor) classification authorizes: installation and programming of electronic access control systems including credential readers, access control panels, electric strikes, magnetic locks (maglocks), and electrified panic hardware; low-voltage wiring for access control (Class 2 and Class 3 circuits per CEC Article 725); integration of access control with video management systems (VMS) and intrusion detection systems; installation of closed-circuit television (CCTV) systems including IP cameras, network video recorders (NVRs), and video analytics platforms; alarm system installation and central station monitoring connection (also requires alarm company operator license under Bus. & Prof. Code § 7590.1 for monitoring services); safe installation, anchoring, and combination service beyond residential scope. C-28 does not cover: line-voltage (120V/208V/277V) branch circuit wiring to power supplies (C-10 Electrical required); structural door frame or storefront modification (C-17 Glazing or B General Building); full building automation system (BAS) integration where HVAC control is primary (C-7 Low Voltage Systems or C-20 HVAC). C-28 is distinct from D-16/C-61 (Hardware, Locks and Safes), which covers limited specialty residential deadbolt installation, key-operated commercial lock replacement, and safe anchoring — not electrified hardware, credential systems, or network-connected access control requiring low-voltage system design.

ANSI/BHMA A156.25-2018 Electrified Door Hardware is a private standard of the Builders Hardware Manufacturers Association — NOT a California statute, NOT California administrative code, NOT a federal regulation. ANSI/BHMA A156.25 specifies: electric strike grade ratings — Grade 1 (commercial, 1,500 lbf static projected latch bolt, 1,000,000 operational cycles), Grade 2 (light commercial, 1,000 lbf, 500,000 cycles), Grade 3 (residential, 500 lbf, 250,000 cycles); fail-safe vs. fail-secure designation — fail-safe (FS) devices de-energize to the unlocked/open position and are required on all required means-of-egress doors per CBC Chapter 10 and NFPA 101 § 7.2.1; fail-secure (FC) devices remain locked during power failure and are prohibited on required egress doors without a listed manual override mechanism (thumbturn override or lever-operated mechanical bypass); electrified mortise lock voltage and current — 12 VDC or 24 VDC nominal, maximum 500 mA inrush, minimum 100 mA holding; voltage drop — maximum 10% voltage drop between listed power supply output terminals and device input terminals to ensure reliable operation across full ambient temperature range; electrified panic hardware (delayed egress) — maximum 15-second irreversible time delay after initial actuation per CBC § 1010.1.9.8, continuous audible alarm at door during delay period, automatic release upon fire alarm system activation; magnetic lock (maglock) specifications — minimum 1,500 lbf holding force for Grade 1; must include door position switch, motion sensor (passive infrared or active infrared) on the secure-side approach, and exterior request-to-exit (REX) pushbutton or passive infrared detector; power supply listing — UL 603-listed Security Power Supplies with minimum 4-hour standby battery backup calculated at maximum connected load. PURE KETCHUM: ANSI/BHMA A156.25-2018 is a private BHMA trade association standard — it creates no private civil right of action and no mandatory attorney fee-shifting mechanism for building owners against unlicensed California C-28 contractors.

UL 294 Access Control System Units is a private standard of Underwriters Laboratories — NOT a California statute, NOT California administrative code, NOT a federal regulation. UL 294 specifies four destructive resistance levels for access control equipment enclosures and credential readers: Level I — no destructive resistance requirement; Level II — 5 minutes resistance to attack with hand tools (screwdriver, hammer, chisel); Level III — 10 minutes resistance to attack with power tools (drill, angle grinder) up to 300 watts; Level IV — 20 minutes resistance to attack with power tools up to 300 watts plus 3 minutes with a portable core drill. UL 294 also specifies four line security levels for communication path monitoring: Level A (no line security — supervised by resistor or end-of-line device only); Level B (supervised open/short detection); Level C (encrypted polling with challenge-response); Level D (cryptographic authentication with certificate-based challenge-response). UL 294 credential reader technology designations: Level I readers use 125 kHz passive proximity technology (HID Prox, EM4100, EM4200, AWID) — these credential formats are susceptible to commercial RFID skimming and cloning devices (Proxmark3, Flipper Zero) available for under $200 that can copy a credential at conversational distance (up to 12 inches); Level II readers use 13.56 MHz high-frequency technology without mutual authentication (MIFARE Classic, FeliCa Lite) — susceptible to cryptographic attacks on the static sector key structure; Level III readers use 13.56 MHz technology with AES-128 or DES/3DES mutual authentication (MIFARE DESFire EV2, SEOS, iCLASS SE) — credential data encrypted in transit and at rest, resistant to commercial cloning tools; Level IV readers use PKI-based smart card authentication (PIV, CAC) with on-card key generation. AHJ building permit under CBC § 1008.3 constitutes the second institutional anchor — the permit record confirms whether the egress hardware configuration was reviewed by the Building Official for means-of-egress compliance, including the fail-safe/fail-secure designation of electric strikes and magnetic locks on required egress doors.

California Business and Professions Code § 7031(b) provides that a person who employs an unlicensed contractor may bring an action for recovery of all compensation paid to that unlicensed contractor for performance of any act or contract. The disgorgement remedy under § 7031(b) is independent of actual damages and applies even when the work was performed adequately — the unlicensed status alone supports disgorgement. Ketchum v. Moses (2001) 24 Cal.4th 1122 and PLCM Group Inc. v. Drexler (2000) 22 Cal.4th 1084 establish the lodestar methodology for computing attorney fee awards under California fee-shifting statutes. Hensley v. Eckerhart (1983) 461 U.S. 424 and Missouri v. Jenkins (1989) 491 U.S. 274 establish fees-on-fees — attorney time spent litigating the fee motion is itself compensable at the lodestar rate. CLRA § 1780 provides mandatory attorney fees to any prevailing plaintiff in a CLRA action, including actions arising from unlicensed contractor services.

Three-Track Harm Analysis: Fail-Secure Egress Entrapment Injury / UL 294 Level I Credential Cloning Unauthorized Entry Theft / Absent UPS Power-Failure All-Door-Unlock

Track 1 — Fail-Secure Electric Strike on Required Egress Door → Power Failure → Occupant Entrapment → Personal Injury: An unlicensed C-28 contractor installs a fail-secure electric strike on a stairwell exit door designated as a required means of egress under CBC Chapter 10. Per ANSI/BHMA A156.25, a fail-secure device remains locked when electrical power is removed — in contrast to a fail-safe device which de-energizes to the unlocked (open) position. The contractor selects fail-secure hardware without installing a NFPA 101 § 7.2.1.6-compliant mechanical override (thumbturn on the egress side or lever-operated bypass). During a utility power failure affecting the building (not captured by a UPS), the electric strike remains locked from the egress side. A building occupant attempting to exit via the stairwell during the power outage — whether routine (utility interruption) or emergency (fire, earthquake) — is unable to open the door from the egress side. The CBC § 1010.1 requirement for free egress without a key, special knowledge, or effort is violated. Resulting harm: physical injury from collision with locked door during panic evacuation; delayed egress during fire or seismic event leading to smoke inhalation or injury; emergency responders unable to access stairwell. CLRA § 1780 personal injury damages, tort damages for negligence, and § 7028 unlicensed contractor liability combine for a compound damages claim.

Track 2 — UL 294 Level I Proximity Readers Where Level III Required → Credential Cloning → Unauthorized Entry → Theft: An unlicensed C-28 contractor installs 125 kHz proximity readers (HID Prox format, UL 294 Level I technology) at the entrance to a facility storing negotiable instruments, controlled substances, or high-value equipment, where the project security specification required 13.56 MHz AES-128 encrypted readers (UL 294 Level III technology). The Level I HID Prox cards transmit a static, unencrypted 26-bit Wiegand code at any proximity to a compatible reader — including a covert commercial RFID skimmer. An adversary using a Proxmark3 or similar device copies the Wiegand credential number from an authorized employee's badge at conversational distance (cafeteria, elevator). The cloned credential number is written to a blank proximity card. The adversary presents the cloned card to the Level I reader, which transmits the matching Wiegand code to the access control panel, which grants entry. Resulting harm: unauthorized facility access; theft of controlled substances, negotiable instruments, or regulated assets; chain-of-custody breach requiring regulatory reporting; investigation costs; insurance deductible; reputational harm. Per UL 294, Level III technology (DESFire EV2, SEOS, iCLASS SE) with mutual authentication and AES-128 encryption prevents this credential-cloning attack. § 7031(b) disgorgement of all compensation paid to the unlicensed C-28 contractor plus CLRA § 1780 mandatory attorney fees.

Track 3 — Absent UPS Backup on Access Control Power Supply → Utility Power Failure → All Fail-Safe Locks De-Energize → Unsecured Facility: An unlicensed C-28 contractor installs a UL 603-listed security power supply feeding multiple fail-safe magnetic locks throughout a multi-tenant commercial building but omits the required standby battery backup or installs an undersized battery calculated at minimum rather than full connected load. Per ANSI/BHMA A156.25, fail-safe maglocks de-energize to the unlocked/open position — the fail-safe design is correct for egress compliance, but the power supply must maintain minimum 4-hour standby battery capacity at maximum connected load to keep the maglocks energized (locked) during a utility power failure. When a utility power failure occurs (utility grid outage, tripped main breaker, transformer failure), the undersized battery depletes within minutes. All fail-safe maglocks de-energize simultaneously. All controlled access doors in the facility — perimeter entries, server room doors, pharmacy or records room doors — fall to the unsecured (open) state for the duration of the outage. Any person on-site or entering during the outage has uncontrolled access to all secured areas. Resulting harm: theft of assets; unauthorized access to HIPAA-protected records or controlled substance storage; security incident triggering regulatory reporting obligations; breach of tenant security covenants; insurance coverage disputes. CLRA § 1780 mandatory fees plus § 7031(b) disgorgement.

Billing Gap Computation: 13.25 Hours = $3,975–$6,625/yr at $300–$500/hr Median Solo Rate

Three compensable pre-complaint research gaps arise from an unlicensed C-28 Lock and Security Equipment Contractor claim under Ketchum v. Moses lodestar methodology.

Welch Anchor & Lodestar Period

The primary Welch anchor is the Tyler Odyssey civil complaint filing date — the timestamp in the court's case management system when the complaint against the unlicensed C-28 contractor was filed. The secondary anchor is the CSLB License Check date, confirming the contractor's license status (none, expired, or suspended) at the time of the access control installation. The lodestar period runs from the date the attorney first reviewed the project records through the Tyler Odyssey filing date, capturing all pre-complaint investigation time including ANSI/BHMA A156.25 procurement, UL 294 Level analysis, permit record requests, and harm quantification.

Under Ketchum v. Moses (2001) 24 Cal.4th 1122, the lodestar (reasonable hours × reasonable hourly rate) may be enhanced by a multiplier based on the complexity of the litigation, the novelty and difficulty of the questions presented, and the preclusion of other employment. Bus. & Prof. Code § 7031(b) disgorgement is independent of damages — the full contract price paid to the unlicensed C-28 contractor is subject to disgorgement regardless of whether the work was defective. Missouri v. Jenkins (1989) 491 U.S. 274 establishes that time spent litigating the fee petition itself is compensable at the lodestar rate.

Frequently Asked Questions