Washington, DC - Strong end-user privacy and security controls, such as device encryption and firmware passwords, not only protect personal information from unwanted access - they can also make it easier to recover lost or stolen devices as well.
Last month, on a family trip to the west coast, I had the misfortune of having a personal laptop stolen from my rental car in broad daylight. I had just finished a long call from the car and stuffed my laptop bag under the back seat of the vehicle as I was meeting my family for brunch.
I walked out of the restaurant an hour later to find the restaurant owner already on the phone with the police. She informed me that my vehicle was broken into and that it was the second break-in at their location that day.
Fortunately for me, while I was a bit bummed about losing my two-year-old laptop, I backup regularly and always enable disk encryption which is an important step to protect the information stored on the hard-disk from unwanted access by criminals, employers, or other actors (with the exception of very sophisticated adversaries).
In addition to disk encryption, I had also set a firmware password, which is an end-user control that essentially prevents the machine from being booted up or reset without knowing the password. Essentially, whereas disk encryption protects information stored on the device, firmware passwords protect the actual hardware.
Firmware (or hardware) passwords aren’t just an Apple thing. Many laptops and mobile devices allow users to set passwords that prevent the device from being used (or reset) without it. For example, most PCs allow users to set BIOS passwords which prevent modification of PC settings (including settings that allow users to reset/reinstall the operating system). Some states have even begun requiring anti-theft features in smartphones to prevent their use after theft and Congress is also considering similar laws. Overall, these measures have been reported to cause a reduction in smartphone thefts.
Fast forward to a few weeks later, when I received an email to my personal account notifying me of an upcoming Apple Genius Bar visit. I was initially confused by the email but soon realized that it's probably the thief (or the undiscerning buyer) of my laptop trying to take it into Apple for repair - likely because they’re unable to use it without knowing the firmware password I set.
I immediately began calling local law enforcement and the nearby Apple stores notifying them of the theft and this development. After a few phone calls and the help of a fantastic Sergeant in the Local Crimes Unit of the Sacramento Police department, I was able to coordinate an agreement whereby Apple would notify law enforcement if the new user brought the machine in for repair. After an initial disappointment on account of the suspect skipping his Genius Bar reservation, a representative from Apple Customer Relations notified me that the device was brought into another store and they were coordinating with Sacramento Police Department to return it to me. I’m unclear as to whether they were able to track down the original thief.
In the end, strong end-user controls like device encryption and firmware passwords not only protect sensitive info stored on the device, they also prevent criminals from utilizing stolen property. The more devices feature strong end-user controls, the less likely thieves can profit from their theft on the open market.
