These companies do this by activating pre-installed software once your computer is reported stolen – software that can track the location of your laptop through GPS, access the thief’s IP address, and even monitor the thief’s activity. The latter means tracking keystrokes, messages, emails, and even real-time communications happening via webcam.

An Ohio woman has been given the go-ahead to sue one of these laptop-tracking companies after they captured sexually explicit images from a live communication between her and her boyfriend.

Absolute Software, whose products LoJack for Laptops helps to recover stolen computers, is on the bad end of this decision.

Here’s the story of how a long-term substitute teacher’s sex pics were captured by Absolute and eventually used by law enforcement officers:

The Clark County Ohio school district purchased a bunch of laptops for school use years ago. One of those laptops was issued to a vocational student and in 2008, it was stolen from a public library. The vocational student reported the theft to the Police.

That stolen laptop was eventually purchased by a 9th grader at an alternative school within the Clark County School District. He purchased it for $40 at a bus station and subsequently sold it to long-term sub Susan Clements-Jeffrey for $60. He apparently made up a story about not needing the computer, which was a gift from his aunt and uncle.

The laptop in question was busted up and had been wiped of some software but another teacher at the school repaired it for Clements-Jeffrey.

Little did Clements-Jeffrey know, but when the school district purchased the laptops, thy entered a security contract with Absolute Software. Back in April 2008, when the vocational student reported the laptop in question stolen to police, Absolute was contacted and the “tracking alarm” was triggered. “The stolen laptop was directed to report its IP address to Absolute the next time the laptop was connected to the internet,” says the court documents.

Absolute also prompted the laptop to download a bunch of software that would allow them to intercept communications and monitor activity in real time.

And in June 2008, a Absolute “theft recovery officer” used this ability to monitor webcam communications between Clements-Jeffrey and her boyfriend. During that 30-second monitoring period, the tech took three screencaps of the live video.

In these pictures, Clements-Jeffrey is naked and in one she is spreading her legs.

After all this information was reported to the police, they brought her in for questioning. According to Clements-Jeffrey, the officers showed her the explicit images obtained by Absolute and laughed at her, mocked her and told her she should have known better than to do this stuff on the web.

The charges for having the stolen property were later dropped, as Clements-Jeffrey denied having seen the scratched-off serial number and claiming that $60 for the 2-year-old laptop didn’t raise any red flags. She remains steadfast that she didn’t know the laptop was stolen.

Now, she is suing Absolute software for the ordeal. She claims that her fourth amendment rights against illegal search and seizure were violated and that Absolute violated her privacy based on the Electronic Communications Privacy Act and the Stored Communication Act.

Absolute hit back that Clements-Jeffrey had no expectation of privacy, as the laptop was stolen. From Wired –

The defendants moved for summary judgment on grounds that courts have ruled in the past that there is no legitimate expectation of privacy in cases involving known stolen property. They asserted that Clements-Jeffrey should have known the laptop was stolen based in part on the $60 price the seller was asking for it and on the fact that the serial number had been scraped off the bottom of the machine.

Absolute also insisted it was acting on behalf of its customer, the school district, and therefore was covered under “color of law” and “safe harbor” statutes. The company cited its agreement with the school district, which gives Absolute’s staff “the ability to view and recover any files that are present” on the school’s computers.

The Judge has ruled, however, that “a reasonable jury could find that they crossed an impermissible boundary.” The suit can move forward.

In June, we told you about another computer-recovery company called Hidden that got their name in the news by finding a man’s MacBook. The victim set up a blog where he posted images that the Hidden app was taking of the thief in real-time.

This ruling is a big decision when it comes to how far these companies can go to retrieve stolen property. Should IP addresses and GPS be enough? Should they have the right to monitor sensitive communications from suspected thieves?

You can read the full court decision here.

There is no notification of the breach at the flyclear.com site, nor has anything been reported on the breech blog or on the attrition.org data loss site on this issue yet.

The "Fly Clear" program is designed for travelers to speed through the TSA checkpoint at airports because they have already been background checked, and provided the government and its contractor all the information necessary to ensure that you are not a danger to yourself or others. Joining clear requires that you give up the following information.

Step Two: Stop by a Clear enrollment station to have images of your iris and fingerprints captured, and to submit two forms of approved government-issued identification for verification. Please bring a US Passport if you have one. Please read the document requirements before you come to complete to the Clear enrollment station. Source: Clear FAQ

CBS 5 is reporting that all this kind of information has been lost with the theft of an unencrypted laptop from a locked cabinet at the San Francisco airport.

Verified Identity System’s Clear program allows passengers to scan their smart cards at a kiosk for a speedier security screening. T.S.A. spokesperson Ann Davis told CBS an unencrypted computer storing the personal information on the cards went missing from SFO on July 26th. Davis said VIP is a privately run company that the airport provides with background checks of enrolled customers. Now the company must suspend new enrollments, notify affected customers, and secures computers until they can install encryption. Source: CBS 5

With both standard information and biometric information on the loose, this makes for almost a double whammy when it comes to data loss and the influence this can have on a person and their identity. It is unknown what the longer repercussions are going to be with the loss of biometric information outside of the fingerprints (if anyone knows how to hack iris readers let me know that would be an interesting article to write about), printing or wax impressions of fingerprints are well known ways to defeat most fingerprinting biometric systems. This should make that thumb print at the bank when cashing a check more interesting in the longer run as it is going to be impossible to change your biometric information while it is possible to get everything else cleaned up.

Travel this summer has been hard, and it looks like it just got harder for 33 thousand people.

Comments

The UW website states:

“Adeona is the first Open Source system for tracking the location of your lost or stolen laptop that does not rely on a proprietary, central service. This means that you can install Adeona on your laptop and go — there’s no need to rely on a single third party. What’s more, Adeona addresses a critical privacy goal different from existing commercial offerings. It is privacy-preserving. This means that no one besides the owner (or an agent of the owner’s choosing) can use Adeona to track a laptop. Unlike other systems, users of Adeona can rest assured that no one can abuse the system in order to track where they use their laptop. “

A very cool feature is using the iSight camera to take pics of the “user” after your laptop has been lost/stolen.  This feature is for Mac OS X, but Adeona is useful for laptops of all kinds.  The team is looking at Adeona for mobile devices.

Linux, OS X and XP/Vista are supported.

Btw kudos to: Ph.D. students Gabriel Maganis and Thomas Ristenpart, working with UW faculty members Tadayoshi Kohno and Arvind Krishnamurthy.

Comments