Reminder: The Embarrassing Naked Photos On Your Stolen Laptop May Not Belong To The Thief

Many a lost laptop has been recovered thanks to tracking software like BackBlaze, LoJack and Hidden that tech-savvy computer owners install on their computers in case it falls into the wrong hands. The tales of these recoveries tend to be dramatic ones, with the rightful owner of the computer perhaps using location-tracking to see where the computer is when it is turned on or intercepting their browser activities and webcam photos to figure out who the dastardly thief is.

Some victims take pleasure in publicly shaming the thief who nabbed their laptop. Young entrepreneur Mark Bao used BackBlaze to tap into his stolen laptop where he found a home-made video of his thief break-dancing (which he posted to YouTube). A year after someone stole a Macbook from hacker Andrew ‘zoz’ Brooks, he regaled a Defcon audience with the tale of how he tapped into the computer to figure out who the thief was and where he lived; he also shared with the audience naked photos the thief had taken of himself in the shower, as well as messages he had exchanged with women on dating sites. When I watched that amusing and highly embarrassing pillory, I wondered to myself, “What if the person who is in possession of the computer isn’t actually the thief, but is being shamed as if he is?”

Well, that’s exactly what happened to Susan Clements-Jeffrey, reports Evan Brown at Internet Law Cases. She unknowingly used a stolen laptop to exchange explicit photos with her boyfriend and those photos wound up in the hands of a theft-recovery company and a couple of detectives, who called them “disgusting” when they arrested her. Now she’s suing the police department and Absolute Software, and she’s got a strong case…

While working as a substitute teacher at an “alternative high school” in Ohio in 2008, Clements-Jeffrey purchased a laptop from one of the students for $60. The low, low price probably should have tipped her off that the laptop was stolen. The student told her that the laptop was messed up and that his parents had given him a new one. In fact, the laptop belonged to another school district and had been reported stolen by a student who had checked it out and was using it at a public library.

Clements-Jeffrey, 52, got the laptop fixed up and then started using it to correspond with her long-distance boyfriend. Given the distance, their correspondence was at times quite sexually explicit, including steamy emails and instant messages (gSex?) and the exchange of naked photos.

Little did Clements-Jeffrey and her bf, Carlton Smith, know that the laptop had theft-recovery security software installed on it. The software was called “LoJack for Laptops” and was provided by Absolute Software. After it was reported stolen, the school district asked Absolute to retrieve information from the laptop to recover it. (If you followed the Pennsylvania school spycam story, this probably sounds familiar.) Once activated, it reported the laptop’s IP address, and granted Absolute remote access over the computer, with the ability to intercept emails, capture screenshots, and log key strokes.

Absolute captured screenshots of both lovebirds doing their best porn star poses. The Absolute recovery officer sent the explicit photos along with location information for the stolen laptop to the Springfield Police Department. The police made their way to Clements-Jeffrey’s house with a warrant where they seized the laptop. Clements-Jeffrey told them she hadn’t realized it was stolen. According to a judicial opinion in the case (via Internet Cases), the officers “told her that she was stupid and that she was under arrest” for receiving stolen property. They also showed her the sexy shots and “told her she should have known better than to do that kind of stuff on the webcam.” One of the prudish detectives wasn’t a fan of the photos, calling them “disgusting.”

The charges against Clements-Jeffrey were eventually dismissed, but then she sued the police department and Absolute Software for invasion of privacy, constitutional violations (on the part of the police department) and violating computer crime laws.

Absolute and the prudish po-po tried to get the case dismissed. They argued that Clements-Jeffrey should have known that the laptop was stolen and thus forfeited her right to privacy. They had one expert witness, a criminal law professor, go a step beyond that, attesting that “there is no reasonable expectation of privacy in communications via the Internet.” Period. The idea that any electronic communication lacks privacy protection whether on a stolen laptop or not is a scary thought and a ridiculous conclusion. The judge threw out that “expert opinion,” explains cyberlaw prof Susan Brenner who called it an “expert opinion FAIL.”

Judge Walter Herbert Rice ruled last week that Clements-Jeffrey and Smith have a legitimate case and are entitled to take it to trial. It’s an interesting case, and will be a meaty one for a jury to decide. Thieves do lose rights to privacy for their stolen goods. But what if they don’t know it’s stolen? And even if they do know it’s stolen, is it really necessary for the laptop police (and the real police) to be grabbing and exchanging their naked photos? I imagine it would be easier to identify a perp from photos where their clothes are on.

I reached out to Absolute for a comment on the case and to ask whether they’ve put any procedures into place to avoid “exposing” a person who has a stolen laptop who’s not a thief. They declined to comment on pending litigation.

Evan Brown sums up the issues at stake here well. It’s not that Absolute tried to track down the laptop, but that they decided to intercept (and share) the nude photos:

In so many words, the court was saying that Absolute went too far in collecting the contents of the communications being made on the stolen computer. Had the information collection stopped at IP addresses and other non-content information, the remote tracking efforts may not have run afoul of the ECPA.
via Using remote tracking software to find stolen laptop may have violated federal wiretap statute.

John Marshall, the attorney for the plaintiffs says the case is set to go to trial in two weeks on September 12. “We’re eager to bring this case to the jury,” says Marshall. “It’s a fascinating case and I’m eager to see what a jury will think.”

In the meantime, if you decide to trace your stolen laptop, think twice about what you decide to intercept and share. Break-dancing videos and nude shower photos could end up getting you into trouble.