Comment

Why end-user device controls are critical

Shutterstock image (by deepadesigns): Safety concept, closed padlock on a digital background.
The FTC's chief technologist recently had his laptop stolen. What happened next shows just how valuable end-user privacy and security controls can be.

Strong end-user privacy and security controls, such as device encryption and firmware passwords, not only protect personal information from unwanted access -- they can also make it easier to recover lost or stolen devices as well.

Last month, I had the misfortune of having a personal laptop stolen.

Fortunately for me, while I was a bit bummed about losing my two-year-old laptop, I backup regularly and always enable disk encryption which is an important step to protect the information stored on the hard-disk from unwanted access by criminals, employers, or other actors (with the exception of very sophisticated adversaries).

In addition to disk encryption, I had also set a firmware password, which is an end-user control that essentially prevents the machine from being booted up or reset without knowing the password. Essentially, whereas disk encryption protects information stored on the device, firmware passwords protect the actual hardware.

Firmware (or hardware) passwords aren’t just an Apple thing. Many laptops and mobile devices allow users to set passwords that prevent the device from being used (or reset) without it. For example, most PCs allow users to set BIOS passwords which prevent modification of PC settings (including settings that allow users to reset/reinstall the operating system). Some states have even begun requiring anti-theft features in smartphones to prevent their use after theft and Congress is also considering similar laws. Overall, these measures have been reported to cause a reduction in smartphone thefts.

Fast forward to a few weeks later, when I received an email to my personal account notifying me of an upcoming Apple Genius Bar visit. I was initially confused by the email but soon realized that it's probably the thief (or the undiscerning buyer) of my laptop trying to take it into Apple for repair – likely because they’re unable to use it without knowing the firmware password I set.

I immediately began calling local law enforcement and the nearby Apple stores notifying them of the theft and this development. After a few phone calls and the help of a fantastic Sergeant in the Local Crimes Unit of the Sacramento Police department, I was able to coordinate an agreement whereby Apple would notify law enforcement if the new user brought the machine in for repair. After an initial disappointment on account of the suspect skipping his Genius Bar reservation, a representative from Apple Customer Relations notified me that the device was brought into another store and they were coordinating with Sacramento Police Department to return it to me. I’m unclear as to whether they were able to track down the original thief.

In the end, strong end-user controls like device encryption and firmware passwords not only protect sensitive info stored on the device, they also prevent criminals from utilizing stolen property. The more devices feature strong end-user controls, the less likely thieves can profit from their theft on the open market.

This article first appeared on the Federal Trade Commission's Tech@FTC blog. The author’s views are his own, and do not necessarily represent the views of the Commission or any Commissioner.

About the Author

Ashkan Soltani is the Federal Trade Commission's chief technologist.

Featured

  • Contracting
    8 prototypes of the border walls as tweeted by CBP San Diego

    DHS contractors face protests – on the streets

    Tech companies are facing protests internally from workers and externally from activists about doing for government amid controversial policies like "zero tolerance" for illegal immigration.

  • Workforce
    By Mark Van Scyoc Royalty-free stock photo ID: 285175268

    At OPM, Weichert pushes direct hire, pay agent changes

    Margaret Weichert, now acting director of the Office of Personnel Management, is clearing agencies to make direct hires in IT, cyber and other tech fields and is changing pay for specialized occupations.

  • Cloud
    Shutterstock ID ID: 222190471 By wk1003mike

    IBM protests JEDI cloud deal

    As the deadline to submit bids on the Pentagon's $10 billion, 10-year warfighter cloud deal draws near, IBM announced a legal protest.

Stay Connected

FCW Update

Sign up for our newsletter.

I agree to this site's Privacy Policy.