Stolen Laptop Calls In! - Will Police Act?

broswell asks: "We rent computer equipment and occasionally our equipment gets stolen. I wrote a little VBS script that calls our webserver every hour (script below) and installed it on our laptops. Sure enough, some laptops went missing. One of the stolen laptops is now calling in from a Verizon Internet account which appears to be in a neighboring town. The Baltimore City Police grudgingly filled out a police report 'so we could collect insurance' but don't seem willing to subpoena Verizon, find the address of the end user, recover tha laptop and prosecute the thief. They seem clueless. The Maryland State police has a computer crimes unit. The have a clue, but they claim they don't have jurisdiction. It is not about the money (our customer signed for the computers and will pay for the stolen items), we just want justice." With all of the necessary information in hand of the proper authorities, how likely is it that the stolen laptop will be recovered?

For those interested, here is the script the laptop used to report itself back to its owners:

Set objShell = CreateObject("WScript.Shell")
Set objScriptExec = objShell.Exec("ipconfig /all")
strIpConfig = objScriptExec.StdOut.ReadAll
myvar = "send=" + strIpConfig

do until 0=1
on error resume next
a=HTTPPost("http://www.yourtrackinghost.com/cgi-bin/locator.pl",myvar)
WScript.Sleep 3600000

LOOP

Function HTTPPost(sUrl, sRequest)
set oHTTP = CreateObject("Microsoft.XMLHTTP")
oHTTP.open "POST", sUrl,false
oHTTP.setRequestHeader "Content-Type", "application/x-www-form-urlencoded"
oHTTP.setRequestHeader "Content-Length", Len(sRequest)
oHTTP.send sRequest

HTTPPost = oHTTP.responseText
End Function

Comments

good luck with that

[grapeape]

I had a laptop and 2 desktops stolen from my van in the parking lot next to the police station in downtown KC. One of my side windows as well as the windows of 3 other vehicles were broken out. The police department couldnt even be bothered to walk downstairs to file a report and told me I would need to phone it in, I called and the detective said I wasnt likely to get it back but he would get back to me. Later that night after I was home my work aim account logged itself online. I got the IP called the police department with the info, was called back the next day and reprimanded for "interfering in police work". Anyway I stopped interfering, 2 years later and I guess they are still busy doing "police work" because I have never heard back from them. I guess I learned my lesson, dont bother. Now when I have to be downtown I just leave the doors unlocked, its alot cheaper than replacing the windows. I've actually managed to make a game out of it, I no longer have to take old computers to the salvage place, I just load them in the van and take them downtown.

Police not doing their job?

[bulliver]

The Police seem to be somewhat arbitrary on what they will and won't investigate. A recent anecdote from my part of the world (took place in Kelowna BC, Canada) is interesting: A guy goes to a filling station, pumps $100 in gas, and drives away. The gas station has the guy's face, and his license plates clear as day on security video. They phone the police and get told by the RCMP that they will not follow up this seemingly open and shut case, the reason? The RCMP says it is "too much work" to investigate every pump-and-run, and it is the gas station's fault anyway because they don't require payment up front.

Re:Police not doing their job?

[pimpimpim]

A situation like this was once in the newspaper in Holland: pump owners had all the date, but police couldn't be bothered. The newspaper coverage increased the amount of pump-and-run cases a bit (hey, if it's that easy...), but it also made it clear to government and police officials that they had to take this seriously, and I guess they improved since then.

Makes you sometimes wish you were in a corruptable regime, there you could have Police officers at least help you if you gave them money. You'd have to give more money than the crooks of course, but anyway there you know then why they won't help you (if you offer too little), and that is better then not being able to get anything done with the police due to random reasons.

if only that were a macbook

[v1]

with its built-in camera... mug shot? no we don't need that, we have a printscreen. lets go get him.

Now when will they put a GPS in these things?

Good luck

[PrimeNumber]

The only way you will get you laptop back is if the people responsible are caught speeding while wardriving.
Police departments these days are mainly interested in are catching speeders to meet 'quotas'.
Sadly, most cops today are assigned the role of 'stealth tax collectors' that generate additional revenue streams for local and city governments.

OK..let's look!

[Anonymous Coward]

..from the cops POV: "hey we can use x-money from our budget to go get some stupid civvies laptop, OR, we can get these new shiny black boots from acme police supply and some of the new 150,000 watt tasers! And with every sale they are throwing in a nifty black badge cover!"

Yep, I know some cops, that's how they think and act. They *don't care* for the most part, especially on small amounts of stolen items. No promotion potential, no newspaper "tough on terrorism/narcotics" coverage, etc. There's little profit in it for them, just boring drudge work, and they are really lazy guys for the most part. I mean lazy. wired, but lazy when it comes to anything like real work..

  The police business is a growing profitable industry, the big money is in protecting the establishment (the mayor's or chief's laptop would be recovered immediately for example, or if it was personal like one of their own's relatives), and in large drug cases and other high profile cases of that nature. They don't like or want to deal with "little crime" for the most part.

This could be fun

[RealityMogul]

First off, nice job with the script. Now, take it a few steps further. Let that script connect as it is, but let the server return a status indicator as to whether or not the machine is stolen. If it is - let the script modify IE, Opera, and Firefox configuration settings to use a proxy installed on a server you own. Preferably a proxy that can be set to log EVERYTHING. Just wait for them to log into something with clear text username/password, like most e-mail accounts from major providers use. Shouldn't be much of a leap to get enough info on him/her to pinpoint their street address.

Cheap != stolen

[davidwr]

It's urban legend but I'm sure similar things happen in real life:
Disgruntled soon-to-be-ex-wife sells husband's car or other stuff for pennies on the dollar.

Unless you are a pawn shop owner or otherwise "knowledgable," the fact you bought it cheap is not evidence you "knowingly" received stolen goods. However, you are still in possession of them and that's usually a misdemeanor. At best, you will be out whatever you paid the real crooks.

BTW, I've received working electronic goods for a very small fraction of their street value, usually because the owner wanted to do me a favor or he just wanted to get rid of the stuff. Now only if I could get a $1,000 laptop for 80% off :).

Re:RIAA

[wizbit]

No, I've been through this with several friends.

If I tell you I can get you a laptop for $100, are you at all suspicious? Anyone with some common sense will suss out that my source might be slightly less-than-reputable. The problem, of course, is very very few people in these cases are "truly" ignorant.

Re:Media

[Anonymous Coward]

I work for a major PD as a Specialist Reserve Officer. My thing is breaking into computers to obtain evidence when the casual attempts fail. After a couple of conversations with a deputy city attorney , it appears that it is extremely difficult to obtain a filing, much less a conviction, unless the suspect is caught in an illegal act and seen doing so by the eyes of several officers. The greatest cases I've seen were never even filed. I've worked with the feds on some cases and we've been extremely careful not to pollute the original hard drives, but our cases don't even get filed because there's an element of doubt in someone's mind, somewhere along the line. We've handed felony cases to the DA that could be called Silver Platter, but they were not filed because they have higher priorities. Their focus is on violent crime, at least where I do this stuff. If you're just an average Joe like me, I think the police don't give a high enough priority on your loss to give you a second thought. I'm sorry for those in your shoes, but I tend to agree with their priorities.

Re:Got supoena?

[anagama]

You are quite correct, a subpoena is the ticket. But it's very easy to get this kind of info in the context of a court case, even a civil case. See Here.

Re: Stolen Goods

[Venner]

In the USA, in general...

You can't take shelter in the title to stolen goods, even if you bought the goods in good faith. (The title is void.) The real owner can come and take it back and leave you with nothing. Your course of action is then to sue the thief (if you can still find them) for the money you paid (if they are still solvent).

The law favors the real (true) owner in such cases.

(And before anyone says anything, yes, this is true only in cases of theft. Fraud is an entirely different crime; you give the good up willingly, even if you are misled. In that case, a good faith purchasor buying from the fraudster can acquire good title, even over the original owner.)

Baltimore police: laptop theft... try kiddnapping

[Tronster]

My current situation: http://www.tronster.com/missing/

My friend's 3 kids was "kidnapped" yesterday by their father here in Baltimore, their location is unknown.

After a 4 day custody trial, which ended Friday, he was orded to turn them over at a Police station at 8pm on 8/18/06. He neve showed.

I've spent the day riding with her to and from multiple Police stations as well as the Towson commissioner's office. Everywhere we go we hear the same thing, "Without a bench warrant our hands are tied."

Today I learned 2 things:

1. It's nearly impossible to get a hold of a judge on a Saturday
2. Commissioner's can be downright cruel and unhelpful

While working with the Baltimore police, most all have been very friendly (many have agreed with us about Commissioner's!) but none of them are able to do more than write down what we say. We're quickly losing hope; and even if an amber alert goes out... it may be too late if he has left the country. I have almost no faith in the Baltimore legal system and how it interacts with the police is non-existant. (Note: I blame this interaction between the two, not the Police themselves.)

Regardless, I wanted to tred on the border of being on topic as the Baltimore police and their inability to act on this may cause us to lose 3 children to an unstable man. If any Slashdoter's have 5 seconds, please click on the web-page below I made, and let me know if you see him or the kids.

With luck and more leg work, we'll get the amber alert up ASAP.

http://www.tronster.com/missing/

Re:Explained it wrong

[EnderWigginsXenocide]

YOU:
Hate to disappoint you, but no cop will bother with fingerprints for a simple auto burglary.

ME:
Untrue. Careful with broad all-encompassing statements.

YOU:
It's a simple matter of priorities. There are way too many things for the police to do than track down petty criminals.

ME:
Correct.

If officers are sitting on alot of crap calls (no crime commited, just bitchy neighbor complaints about barking dogs or music in the daytime hours, etc.) they will often take the five minutes to print a car about the top of the "doorjamb," around the doorhandle, and in locations likely to be touched in the comission of a crime (say a dashboard if a piece of installed equiptment is stolen, think radio, dvd, sat-nav.) If any prints look very good they will take a lift and file them along with their report of stolen property.

Sure, your stolen ipod won't get shoved to the front of the live-scan line, it will be bumped to the end of the que by just about any other crime with fingerprint evidence.

Crimes like theft are often commited by repeat offenders, and thus these criminals will have prints on file. A print left in a "low profile" crime can lead to a routine request for an arrest warrant. Of course this won't lead to a SWAT raid on the perps residence, but next time he/she cheks in with their PO, gets a traffic violation, or somehow draws the attention of the law enforcement community, the cuffs will go on and they'll be jailed right away for violating their terms of release and may see additional time from the new crime.

This process requires very little effort (no major investment of time or money... lifting a print is dirt cheap next to sequencing DNA for example) and makes for an easy bust down the road.

Now, when you call in your car that's been broken into you might wait [quite] a few hours to get an officer out to take a report because it is indeed a low priority call [no life in danger, not in progress, and not likely to lead to a quick apprehension even when a quick response is made.]

If a department has, or at some point in the past had, the funding to train the average patrol officer to lift prints then you may receive this kind of service (smaller towns like El Monte CA [higher crime rate] and Fullerton CA [lower crime rate] both do this, neither being particulary large in population [relative to their neighboring cities in the LA Metro area.])

It's cheaper to have officers collect "basic evidence" than to have an officer wait on scene for a specalist in evidence collection to clear their currrently pending calls and respond to a crime that's quite low priority. When a city dosen't have, or never has had, the funding to do this then you end up with simple theft being a purely paper crime (where the only response to the crime is a piece of paper[a report] and no other action is taken regarding the crime.)

Re:Depends on the Police Department

[Jah-Wren Ryel]

The lojack program seems to do the exact thing yours does, but then again, perhaps because it is "official", the police may take the information more seriously.

More likely, they have at least one person on staff who knows how to "speak cop," and thus knows how to get on their side of the thin blue line. So instead of seeing Absolute as a threat to their control, they are perceived as an ally whom the cops may call upon for a favor in the future.

ThatScript v2.0

[entendre entendre]

Phoning home is one thing, but even better would be to phone home and then download any little executable that it finds there. These could do a variety of things:

• Upload any non-trivial IP from the laptop to the server, since that's probably the last chance you have to keep it.
• Taunt your local police. ("Hi, I'm sending this email from a stolen computer and i just wanted you to know that you're never going to catch me because you're all a bunch of fat lazy slobs. Crime does pay, bitches!")
• Taunt the theives' local police. ("Wanna buy a laptop? I got three more just like this one, ready to go, super cheap.")
• Install a key logger, get his credentials. Post things all over the internet with the theif's ID (e.g. his next MySpace diary entry will be "so my friends and I stole some computer gear last week...")
• Append random obscenities into every email that exits the computer ("P.S. I fucked your mom too.")
• Random pseudo-malware "attacks" on police station web servers - nothing that would bring the server down, but enough to take the IT department's attention. It is possible that their heads are so far up there asses that nothing can reach their brains, but I think there's a fair chance that their IT depeartment can still get through to them.
• To be continued...

Surely there is more to add to that list. Remember - you have plausible deniability. Your computer was stolen by an egomaniac hacker who loves to taunt police and do unspeakable things to sheep.

However I do recommend against the P2P thing suggested earlier. That might just move your computer from the theif to an evidence locker while the RIAA does their paperwork. That sounds counterproductive.

Re:ThatScript v2.0

[pruss]

Wouldn't there be a security problem with executing whatever the server hands back, since then if the server is compromised, every machine connected to the server is compromised? Better would be to have each client check for a password before executing what the server hands back, though then one would need to keep track of a password for each of the clients. (I suppose whoever is in charge of each client could keep track of her own password, or one could keep a printed list at a secure location.)

So, taking into account the comments here, I think what one might do is the following. perl script, calls in during every hour, at random time (not to clobber servers; or else at a pre-assigned time). Sends `traceroute server.com`. Server responds. If first list of response matches the password hash on the laptop, call eval() with rest of response. If one needs to get additional executables onto the system, the perl script can fetch them.

I dunno, they do here (Tucson)

[Sycraft-fu]

Some punks broke in to my car and tried to steal it. They failed, which says they sucked because it was an old Jeep that was easy to hotwire. They rifled through all the shit I had in it, but decided none of it was worth stealing (they were correct). The police came and took finger prints from likely places. I think they were mine, probably, but they tried anyhow.

John Doe Lawsuit can get you subpoena

[billstewart]

If Verizon requires a subpoena to justify violating the privacy of the person whose IP address you're interested in, and the police won't push the case enough to get you one, you've still got a tort action against the people who ripped you off. You don't know who they are, but you can generally file a civil lawsuit against "John Doe", similar to the way the RIAA files them against John Doe file sharers. That'll let you get the court to give you a subpoena, which should be good enough for Verizon's lawyers. You might or might not be able to do that in small claims court, depending on your local rules and the value of the computers; otherwise it'll probably cost you lawyer money, and therefore might or might not be worth it.

Do move fast - if the thief sold it to somebody, it might stay there a while, but if they're just checking whether it works or seeing what they can find, they may fence it or pawn it.

This (sorta) happened to me

[SUPAMODEL]

A couple of years ago, a laptop (among other items) was stolen from my car. Didn't have any password protection on my user account (nothing good on there) and I had my MSN and ICQ accounts set to autosignin.

About a week after it was stolen, I came home from University to find that my desktop computer had been signed out of MSN cause someone else had signed in. Turns out someone with my laptop was coming on as me and being annoying to some of my friends. Got a webserver set up that I had access to the logs from, and put on a certain page that no-one else knew about. One of my friends dropped it into the conversation, and bam, laptop user clicks on it.

I made a couple of sworn statements to the police and took a long time convincing them that I had something useful. Took about 10 weeks for them to act on the information, and unfortunately I was away from home when they did. They traced the IP back to an account registered to some bloke a couple of hours away, and they had him under some suspicion of receiving stolen goods but never caught him with any. So, the police raided and got my laptop (and others) back. They also found a considerable qauntity of drugs, which I guess helps seal a conviction for something.

The person was aout the 4th or 5th person to handle my laptop within the week, and I believe the police have never nailed the people who originally stole it (over 2 years ago).

The person actually on MSN that we used to take the bait was this guy's 13 year old nephew. When I got the laptop back it still had all my files on it (although the used a black marker to try to fill in some engraving I had under the battery with my details) and they'd also set up their own user account. This kid had his MSN signin info, all his emails, yada yada yada. Never signed into MSN as him or looked at his stuff, I shoulda. Just reformatted it and started again - never know what shit they had on there.

So, yes, it can be done. But it takes A LOT of work to convince some low-level police grunt that an eye-pea address has some credibility (I was helped cause I had set my browser to return a really random useragent string, so we pretty much knew it was my laptop).

Re:Depends on the Police Department

[anticypher]

LoJack and other professional security companies employ ex-law enforcement personnel for one big reason, to speak "cop", and to work their old contacts inside of police forces. I work with a number of serious security companies who specialise in computer/telecoms fraud cases. They all have a group of ex-cops on staff to make sure when they need to pursue a case once the perp has been identified, things will move along quickly. I've tried, and failed every time, to file cases 'through the front door' with various police organisations around Europe.

A detective level ex-cop with a good contact book and knowledge of their local system can jump from a mediocre salary as a public servant to private industry with a boost of 5 to 8 times their earnings.

The OP needs to find a private security company in his area with ex-cops on staff, or just put out some ads for ex-cops to do some free-lance security work for the company. So every time one of his scripts calls home with identifying info, the security consultant files the requisite paperwork with his drinking buddies, and the case ends up directly on their desk monday morning. Recover a few laptops like that (with extra added bonus of taking down some thieves), and the company may be able to renogiate their insurance premiums. Dangle the promise of significantly lower insurance premiums in front of management to get their approval to hire one of these guys for a few cases. In the US and the UK, you can even hire off-duty cops for this kind of work, depending on the jurisdiction.

the AC

Re:Media

[zippthorne]

You get tickets for 60 in a 55? What're you doing? Looking like a hippie while driving an expensive sportscar trailing a banner saying "Pigs are teh sux?"

Good gracious man, be polite, turn on your dome light, and don't make any threatening moves. (this is good advice for anyone who is being approached by someone who carries a gun and faces violent offenders regularly)

It's been my experience that they don't really want to give you the ticket, at least not until they meet you. Most of them just want you to drive safely. But if they can't avoid it (generally due to some stupidity on your part), or you piss them off enough they won't look for a way to avoid it, well you're going to bear the full penalty for your infraction.

Even then, though, it's not really YOU who'se been singled out for unfair punishment, but others who've been singled out for unfair leniency.

insurance company should instigate investigation

[chargen]

Since insurance companies are so good at preventing payouts, why not put all the evidence to them and state that you don't want to file a claim as the laptop is still recoverable, but that the police are unwilling to cooperate and that you'll need to file a claim within x weeks if the situation is unresolved. In a way it's too bad it's not a higher value item which might be cause for more action on each party's part. -Pete

Some cops couldn't give a shit less

[davie]

We recently discovered a burning pile of personal effects next to the dumpster at the office. The items included a purse, wallet with some ID, personal mail, make-up and work clothing and name badge (from a local restaurant). Naturally, we called the police. The officer arrived, poked around a little bit with his foot, then turned around to get back into his car and leave. Incredulous, we asked what he was doing and why he wasn't collecting what was obviously evidence of some kind of criminal activity and he told us that "the detectives wouldn't like it he brought the material back to the station because it would get the other evidence dirty."

Bluff

[DeanFox]

My home was broken into three times, three days in a row. It was neighborhood kids.

I wasn't getting anywhere with the police. First the cop would take a report then a detective would come out and look around. I could tell by their tone that they weren't going to do anything about it. Not, that is, until the third time. Do you know what changed their mind?

While the detectives were there trying to make it look like they were doing something I faked a call to work and pretended to leave a message that I wasn't coming in the next day. Then I faked a call to a friend asking if I could borrow his "weapon" and that I needed it that night. I turned to the cops and said, they've come in three times, three days in a row, and they're coming back. It's my right and I'm going to protect my property.

On their way out they were visibly upset. They were convinced there was going to be a blood bath the next day. I got a call 4 hours later that they caught and arrested the boys responsible. 4 hours. And that was after they were already booked and in custody. The arrests had to have been at least and hour or two earlier.

The detective kept telling me I could go to work after all, blah, blah. It really was the thought of me hiding in ambush that got these police to do their job. It took all but 2-3 hours for them to find and arrest these boys. It took me lying and convincing them I was going to shoot the next person who walked through my door to get them to do it.

This is one of those bluffs that probably only works once in a lifetime but it worked.

Re:Nothing new

[Anonymous Coward]

In 1989 I bought a one year old car. I was replacing my 6 year old car that I was driving at the time. I had attempted to sell my car in my local newspaper. I had also started a new job at the time and had made friends with one of the security guards upon entry into the building that I was working in. She was my age and I thought she was beautiful.

One day in the building cafeteria, I saw her sitting by herself eating lunch. I asked if she minded if I joined her. She didn't mind at all. In the conversation she mentioned that she needed a new car that hers needed some serious repair. I told her about my car and she said that she would be interested. It was also an excuse to give her my phone number and address.

She noticed me now everytime that I walked into the building and told me that she would call me. The following week she called me and told me she would like to come out to my house on the following Saturday and take the car to a mechanic.

Since she was leaving her car at my house and I knew where she worked, I didn't think twice. She drove over to my house in her 1973 Dodge station wagon with the slant 6 motor leaving a trail of smoke behind it. She hopped in my 1983 Toyota Supra and said that she would be back in a couple of hours. She didn't leave the keys to her car.

Several hours later, no return. The next day, no return. I went to work on Monday and asked if she would be in. I was told that she quit work the previous Friday.

I gave her a couple of days, then reported the car as stolen. I didn't keep insurance on a car that I was selling. No word from the police at all. Several months later, luck would have it I was driving into Atlanta for some reason and she comes speeding past me. Cell phones were a new thing then and I called the police. They kept asking my location of the car and I would tell them it was on the interstate. They kept telling me that by the time they sent someone there, the car would be gone. I told them that I wanted to update the stolen car report and when they looked it up, there was no report of it being stolen.

The next day I went back to the police department and filed another stolen car report and went to the DMV and listed the tag as stolen. Maybe that would help.

Less than a year later, I came across the car again in a secured parking lot of a building downtown. I called the police. I had the title to the car in hand, I had the registration to the car in hand. When the cops got there, I told them that the car was mine and it was stolen. I didn't have the spare key to the car at the time but I wanted it impounded. I had all the paperwork. They told me that I needed the key to the car. I told them that I lived 20 minutes away and I would go get the key.

When I got back to the car, paperwork in hand with the key to the car, they tried to arrest me for filing a bad police report. There again was no police report of the car being stolen. The security guard woman that stole my car joined the county police department of where the car was. She was an off duty officer now on night duty watching this building.

She told them that I gave her the car and I was jealous that she was no longer dating me. She took off with the car again 10 minutes before I made it back with the key. I have never seen the car again.

Long story short, police protect their own and they do what ever they want to do or not do.