Feeds

How to find stolen laptops

The legal eye

Build a business case: developing custom apps

Mark Rasch discusses the legal issues behind the discovery and recovery of stolen laptops that use LoJack-style homing devices to announce their location, and the location of the thieves, anywhere in the world.

Bad things happen online. Trade secrets are lost or stolen. Personal information is compromised. Copyrights and trademarks are infringed. Bloggers post confidential, defamatory, or just annoying information. Websites host stolen credit cards, hacking tools and techniques, or other things that you might not want.

In the course of investigating these things, companies or law enforcement agencies frequently need to rely on information in the hands of third parties. An example of this is the various companies that offer data or computer locator services. A sort of "LoJack(tm) for stolen computers.

If a corporate computer is reported lost or stolen, these services use various means to identify the computer, or the data on it. When the target computer is then used - generally to get online - the computer essentially "phones home" with its location.

Here's the problem with this approach. The computer doesn't really give its location. At best, it can reveal the Internet Protocol (IP) address of the network it is on. While this information is helpful to the true owner of the computer, it is not sufficient to locate and/or recover the stolen hardware.

Imagine that your "On-Star(tm)" equipped car is stolen. OnStar is one of the various services that provides motorist assistance, including Global Positioning Satellite location data. If you report the car stolen, they can remotely turn the GPS on, track the car, and even turn the telephone inside the car on and listen into the thieves' conversations. All of this occurs on the network the real owners own and it reveals information about your vehicle. So, no problem, right?

Finding subscriber information

When it comes to network based investigations however, we cannot easily track where the computer went. Once we have the IP address, we would look up the network that was assigned that block of IP addresses. It might be an internet café in Riga, Latvia, or a giant Internet Service Provider in Dulles, Virginia.

What we really want is subscriber identification information. That is, what subscriber was assigned that particular IP address at that particular instant. Now of course, a lot of this information may be spoofed, and it is usually less than trivial to piggyback on a legitimate network (such as, a hacker using an open or insufficiently secured WiFi network). Nonetheless, tracking down physical location data or subscriber data from a raw IP addresses is the ultimate goal of the investigator.

This is where technology and the law intersect - and not in a good way for either of them. While you can do a traceroute or a WHOIS search in a couple of seconds, in order to get subscriber data from an ISP requires some form of legal process (usually). ISP privacy policies legitimately protect this data, but they generally contain a provision (and one would be implied by law even if it wasn't in the policy) that the information may be disclosed if there is a "valid legal order."

In the case of law enforcement agencies, there are many legal avenues for obtaining this information from ISP's. First, they can just ask for it - obtain consent. In extreme situations (imminent threat to health and safety) the promise of a later subpoena may be sufficient. In the United States, for example, they can also use various legal processes - a grand jury subpoena, a formal investigative demand, an administrative subpoena, a discovery order, a search warrant, a Title III wiretap order, an order issued by the Foreign Intelligence Surveillance Court. Or, as recently revealed in the New York Times, various agencies including the Department of Defense and the Central Intelligence Agency (and of course the FBI) can issue what is called a National Security Letter (NSL) on their own authority to get this information.

Endpoint data privacy in the cloud is easier than you think

Next page: Building a subpoena

More from The Register

next story
14 antivirus apps found to have security problems
Vendors just don't care, says researcher, after finding basic boo-boos in security software
'Things' on the Internet-of-things have 25 vulnerabilities apiece
Leaking sprinklers, overheated thermostats and picked locks all online
iWallet: No BONKING PLEASE, we're Apple
BLE-ding iPhones, not NFC bonkers, will drive trend - marketeers
Multipath TCP speeds up the internet so much that security breaks
Black Hat research says proposed protocol will bork network probes, flummox firewalls
Only '3% of web servers in top corps' fully fixed after Heartbleed snafu
Just slapping a patched OpenSSL on a machine ain't going to cut it, we're told
Microsoft's Euro cloud darkens: US FEDS can dig into foreign servers
They're not emails, they're business records, says court
How long is too long to wait for a security fix?
Synology finally patches OpenSSL bugs in Trevor's NAS
Israel's Iron Dome missile tech stolen by Chinese hackers
Corporate raiders Comment Crew fingered for attacks
prev story

Whitepapers

7 Elements of Radically Simple OS Migration
Avoid the typical headaches of OS migration during your next project by learning about 7 elements of radically simple OS migration.
Implementing global e-invoicing with guaranteed legal certainty
Explaining the role local tax compliance plays in successful supply chain management and e-business and how leading global brands are addressing this.
Consolidation: The Foundation for IT Business Transformation
In this whitepaper learn how effective consolidation of IT and business resources can enable multiple, meaningful business benefits.
Solving today's distributed Big Data backup challenges
Enable IT efficiency and allow a firm to access and reuse corporate information for competitive advantage, ultimately changing business outcomes.
A new approach to endpoint data protection
What is the best way to ensure comprehensive visibility, management, and control of information on both company-owned and employee-owned devices?