A couple years ago my trusty Dell laptop started to take a turn for the worst. Like many Windows users I could see the telltale signs that things were up. Our old friend, the Blue Screen of Death, reared its ugly head a few times and the system felt unstable in general. This was well outside my reinstall cycle so I quickly ran a full backup to make sure I didn’t lose everything and within an hour there was a lovely clicking noise coming from the hard disc.
I quickly dispensed with a couple first level help desk personnel and eventually found a person with authority to authorize a replacement for me. The drive would arrive in a couple days and as long as I was comfortable with it, I could do the replacement myself. Expecting a long wait without a laptop, I was pretty pleased until I learned the catch. I had to mail the old drive back to Dell for remanufacturing. I wasn’t about to send my drive anywhere, let alone to have my data given to some future participant in a similar process.
I explained that I wasn’t going to have it because there was sensitive information on the drive. Explaining to the support guy that I was obligated to keep the information secret, he put me on hold to find a solution. The only way that Dell would allow me to keep the drive was to sign an affidavit…which was fine with me until I read the affidavit which read that I was a US Government Contractor with classified material on the drive. I had neither.
After some critical thinking by both of us, we came to the conclusion that since Dell was expecting a drive with a mechanical problem that it could be in any form imaginable. This was a great deal because
- I got my first hands on experience with the inner workings of a laptop hard drive.
- I found out how hard it is to actually smash platters.
- Dell got a drive with some mechanical problems to salvage.
Fast forward to a couple months ago when the logic board on my Mac went out. It wouldn’t turn on so the girl at the Genius Bar went right into the paperwork. She explained that if the hard disc had to be replaced I wouldn’t be getting any of my old data back. I asked about receiving the old one for a while so I could try and retrieve the data in that case and she told me that couldn’t happen. I didn’t really sweat that since I had a week old backup at home. Then she brought the house down with this one..
What is your administrator password?
I looked at the other guy working the Genius Bar who knows my background a bit more and we both started to laugh. I needed a new logic board…there’s no reason for them to know any of my passwords…let alone the root. She said it was so they could test it to make sure it would boot. She was sympathetic and we both settled on something random to put on the form.
Is keeping hard drives a security issue as Dave Winer thinks? Not really.
Your machine belongs to the person at the keyboard whether it be you, the Geek Squad kid making $7 an hour and stealing all the porn he can find, or the guy who took your laptop out of the back seat of your Range Rover sporting that trendy Apple sticker.
This is one of the many reasons to use encryption. If I send my Mac to be serviced and the hard disc has to be replaced tomorrow I’m confident that the recipient has access to none of my information. While it’s true that Apple needs to take security more seriously and certainly shouldn’t be asking people for their passwords just keeping the drive is only a vulnerability if you make it so.
Something tells me that Bruce Schneier doesn’t lose sleep over this.
While the website doesn’t reflect it yet, I received word that I’ll be presenting at Shmoocon 2008. I’ll be talking about how the e-discovery process works, how organizations can reduce the cost of litigation, and how truly frightening the security surrounding e-discovery is.If you’re going to be there and would like to get together for a beverage…drop me a line. ###On a theoretically related note, the video and audio for my talks at DEFCON 15 should be available in their RSS feed soon.