At the Elmcroft of Lebanon, Tennessee, the staff of the memory-care unit knew the code to the keypad that controlled the exit door. Residents weren’t supposed to be able to leave unattended. That’s how the system worked: the keypad stood between those in the facility’s care and the risks outside of it.

But on March 2, 2020, the system broke down—because one resident realized the keypad was giving the code away.

That afternoon, a husband and wife living in the memory-care unit left the facility, which now operates as American House Lebanon. While the man and woman were gone about 30 minutes before a stranger picked them up two blocks away and returned them to the facility, uninjured, the real question came afterward: how did they manage to get through the locked exit in the first place?

According to Tennessee recordscited in local reporting, the man told staff that he had previously worked with Morse code in the military and learned the door’s numeric exit code by listening as staff punched it on the keypad. From those sounds, he figured out the code well enough to use it himself.

It was an irresistible scene straight out of a spy novel: a man uses his cunning military expertise to plot his and his wife’s escape by ear alone. But more than a caper, this was a case of dementia wandering that could have turned tragic.

Six in 10 people living with dementia will wander at least once, says the Alzheimer’s Association. Some wander repeatedly. They may be trying to go home, find someone, follow an old routine, or respond to things like anxiety and confusion. Once they venture outside, the risks—including traffic, weather, falls, and dehydration—multiply.

And a 2024 study in BMC Geriatrics that analyzed 25,000 MedicAlert subscribers found dementia status was strongly associated with a history of critical wandering.

In this case, the husband had dementia and had previously shown exit-seeking behavior. Before he and his wife, who had Alzheimer’s and Parkinson’s, made their March 2 exit, the husband’s care plan had already been revised to include increased rounds and staff attention.

After the couple left the unit, the facility changed all memory-care exit codes and staff were re-trained to check doors. The state assessed$2,000 in civil monetary penalties.

But six years later, there are still plenty of questions about the technical side of things. Public records don’t identify the particular keypad model used, nor do they say whether each button made a distinct tone. It also isn’t clear if the man heard different pitches, counted button presses, or used other auditory clues.

And while the husband said he had experience in “Morse code,” that may describe his background and trained ear rather than the literal code-breaking method.

But however it worked, it was proof that sounds leak secrets. Scientists call this a “side channel”. While a password, PIN, or keypad door code is the secret, systems can leak information around it, such as clicks, timing patterns, and vibrations. So, the man didn’t need to know the keypad’s code if the staff repeatedly entering it gave away enough clues.

In close-range tests of commercial metal ATM PIN pads, with a microphone placed 0.3 meters away, researchers reported recovering 96 percent of 4-digit PINs, and up to 94 percent of 5-digit PINs, within three attempts—simply by analyzing the sounds of the keys as they were pressed. And a separate 2023 IEEE workshop paper reported 95 percent accuracy for classifying isolated laptop keystrokes from a nearby phone microphone, and 93 percent from Zoom audio, in tests on a 2021 MacBook Pro.

While these studies don’t prove anything about how the keypad at the Elmcroft actually worked, repeated sounds can become information, which can lead to access. And in a memory-care unit, that’s a security risk. If someone nearby is watching or listening every time a code is entered, then the door may be revealing its own code.

Since the incident at the Elmcroft in 2020, the regulatory landscape around memory-care units has changed. Tennessee combined the former Health Services and Development Agency with the Department of Health’s Office of Health Care Facilities to create the Health Facilities Commission. It now includes health-facility licensing and investigations for compliance with state and federal regulations.

On that day in March 2020, the husband and wife were lucky that they were quickly found and returned to the facility unharmed. But the failure had already happened. The system just gave the code away, one press of a button at a time.