Laptops Gone Wild

Sadly this is not the title of new spring break video. Rather it reflects the continuing growth industry that is lost and stolen laptops. As the number of laptops going missing grows at an ever alarming rate, many businesses have adopted policies regarding laptop security, tried to better educate their users regarding the security risks associated with this problem, and implemented stronger user authentication and even encryption on laptops containing sensitive information. Proactive businesses are now taking a further step in deploying “phone home” software in their laptops or installing applications that can be triggered remotely to irretrievably erase or encrypt data on a missing laptop. Clearly, these are all steps in the right direction. There are, however, some risks associated with implementing remote erasure software that should be addressed in your contract with the vendor.

While not all vendor agreements for the provision of remote erasure software present the same problems, certain trends are present:

• Be aware of agreements that give the vendor the ability to remotely access data on the missing laptop, other than information indicating the IP address or other similar information identifying its location. Some agreements are written broadly enough to permit the vendor access to almost everything stored on the laptop, creating a security risk of its own. Agreements should be written narrowly to define the type of data the vendor can access.
• Many agreements permit the vendor to coordinate with local law enforcement in recovering the laptop and prosecuting the thief. Some agreements neglect the importance of strictly controlling the sensitive information on the laptop during this process. Agreements should be written to ensure (i) the company to whom the laptop belongs is kept apprised of all developments in the case and, more importantly, all access to and use of information stored on the laptop; and (ii) the vendor is not relieved of its confidentiality and security obligations during the investigation.

• Agreements should be carefully revised to ensure strict procedures are followed and consents obtained before information on the laptop is erased. Unless an erase command comes from a specifically authorized person at the client, using a previously defined process, the vendor should be responsible for any unauthorized commands to erase information (regardless of whether the erasure arises from a bug in the vendor’s software, a hacker attacking the vendor’s systems, employee misconduct at the vendor, or simple negligence on the part of the vendor).

By ensuring these types of agreements are written properly to avoid some of the very problems they are trying to prevent, use of remote erasure/destruction software can be an important part in the overall solution to the problem of lost or stolen laptops.