By Lieutenant Sabrina Tapp-Harper, Baltimore, Maryland, Police Department; Adjunct Professor, Baltimore City Community College; and IACP Fellow
he Baltimore City School Police Force comprises approximately 100 sworn members and serves the Baltimore City Public School System of over 80,000 students and 18,000 staff members. This agency is responsible for more than 200 facilities and the contents of each building. The force is an entity separate from the Baltimore City Police Department.
To prevent the theft of laptop computers and to aid in the recovery of stolen computers, the school system has installed a computer program from Absolute Software known as Computrace LoJack for Laptops (L4L). Stolen laptops equipped with this software dial into the monitoring system when they are connected to the Internet, capturing use information. In turn, the company notifies the police department about the stolen laptop being used. Following are two case examples illustrating how this works:
- On May 18, 2007, a teacher at Rognel Heights Elementary School 89 reported that six laptop computers were missing. All of the computers were equipped with L4L. Then, on September 7, 2007, one of the computers was detected connected to the Internet, and an address was identified. The software company forwarded this information to the school detectives. Detectives responded to the location to interview the person and observed the stolen computer in plain view. The suspect in this case alleged that he had bought the laptop computer for $300 at a car wash.
- On June 15, 2007, a staff member at the Success Academy in Baltimore reported a black ThinkPad IBM RS2 laptop computer missing from the school basement. Someone had forced entry into the basement-level classroom and had taken the laptop computer. When the computer was connected to the Internet, the L4L system was activated. The investigation found that this computer was sold for $167.50 on eBay over the Internet using PayPal to an individual living in Portage, Indiana. The transaction took place on October 12, 2007, according to thepayment summary. Based on the information provided, the Portage Police Department recovered the stolen computer and shipped it back to Baltimore.
How the System Works
Once the L4L software is installed, the product acts on behalf of the legitimate owner of the computer through an agent within the computer’s core programming (the Computrace Agent). Upon activation, the software enables the computer to contact the company’s monitoring center at predetermined intervals without interfering with the operation of the computer.
When the protected computer is used for phone calls, the monitoring center logs and archives the electronic serial number as well as the date, time, and originating phone number of the call. Given this information, the company can pinpoint the precise physical location of the computer, even if the phone line is equipped with caller identification blocking. If the computer has been reported lost or stolen, personnel at the monitoring center immediately forward the information to the appropriate law enforcement agency.
The Internet allows millions of computers to communicate with one another. Every computer on the Internet has a unique Internet Protocol (IP) address. When a computer communicates via the Internet, part of the information sent is the computer’s own IP address. The network to which the computer is connected assigns these IP addresses. When a user connects to an Internet Service Provider (ISP), that network will assign the computer a unique IP address for the time it is connected to the network. Unlike a phone number, the IP address will not necessarily provide the physical location of the computer. With an IP address, officers should be able to obtain such information as the name, address, phone number, and billing information of the user of the computer. This information assists in determining the physical location of the stolen computer.
Besides monitoring when users connect to the Internet, the software also provides additional forms of support.
One additional feature is a call log, which shows important post-theft information relating to the stolen laptop. This information is taken directly from the computer’s BIOS. During the investigative process, the log document should accompany the investigator’s affidavit and then must be attached to the subpoena when it is served on the ISP. The server time stamp (that is, the call time) is Pacific Standard Time.
Also provided is a warrant subpoena support form, which establishes jurisdiction and gives a narrative account of the relevance of the software to the case. This form should not be sent to the ISP.
A preservation letter ensures that the subscriber information is secure and retained pending service of the subpoena.
Finally, there is an introduction letter explaining how the software works. Officers should take this information to the state’s attorney when applying for the subpoena for the subscriber record.
Much as cars can be protected with tracking devices, today it is possible to protect and track laptop computers. As more laptops become available in schools, libraries, and government offices, the need to recover them and prosecute those responsible for their theft will take on greater importance. ■