Someone stole my laptop two weeks ago. With the help of the BackBlaze data backup service and some friends, I located it last week, after the thief had sold it to someone else. I told the police all this. I have it again. The thief remains at large, as far as I know.
The theft occurred the Wednesday before last at the Panera Bread on Huntington Avenue, near Northeastern University, while I was lunching before the class I teach there. I did all the stuff one is supposed to do in this situation, bought a replacement laptop (and bag), then carried on. I skip many details here so that I can get to the more interesting story of its recovery. (The fact of the theft is differently interesting, since I believe it to be the first blatant crime of this sort committed against me, and it deserves documenting. I hope to dedicate a separate post to it, later.)
To that end, I note here that I subscribe to the BackBlaze online backup service. While I took a financial hit from the laptop's loss, I did not suffer the devastation that would have come with losing years of work and data, because I pay BackBlaze a few dozen dollars per year to back all that stuff up elsewhere. A day after the theft, I had all my old working environment all set up on my brand new laptop. Weirdly, I found it hard to shake the feeling that I simply upgraded my computer on an impulse, and here I sat enjoying the results.
I hadn't considered the anti-theft implications of BackBlaze until the theft happened. To its credit, BackBlaze doesn't hide them; when you log in to recover your data, it presents you with obvious links to web pages on the topic of theft, and the ways that a victim might best use the tools now in front of them. For one thing, I could see the IP address that the thief was at when they popped the laptop open most recently -- the BackBlaze software connects to its remote servers several times a day in order to perform its backups, and that means it phones home the moment a laptop connects to the internet for the first time in a while, as was the case here.
That led to a spate of excitement. It was easy to see that the the IP belonged to a Comcast router somewhere in Boston. I asked Twitter for advice, and when some friends suggested I call Comcast and ask for the physical address associated with the router, a Comcast CSR (and Twitter trawler) politely let us know that they would only divulge this information to search-warranted police, so perhaps I should go talk to law first. I passed it along to the BPD detective on the case, who said that a single IP wasn't enough to write up a warrant, but invited me to keep watching and let him know about any future pings.
Then, nothing for nearly a week. I resigned myself to accepting that the laptop was lost, and hoped that the lack of any further pings meant that the thief had wiped the hard drive prior to flipping the machine on Craig's List or whatnot. I had changed all my passwords days before, of course, and had my clients change theirs as appropriate, but I knew that it was most likely that the thief hadn't bothered to dig through my data anyway; selling hardware is a much easier task for a typical street-crook than identity theft and other informational black-hattery. So, I felt safe enough, and was ready to move on.
The turnaround came when I sat down last week to write the original draft of this post. I wanted to brain-dump about the theft, which I suspected was bothering me more than I was allowing myself to let on. After writing a couple of sentences, I decided to check with BackBlaze one last time just to confirm that the machine hadn't emitted a peep since that one yelp, the day after the theft. Had I found what I expected, I would have started the process of shutting down that BackBlaze account and setting up a new one for my new machine.
Surprise: the most recent ping had come just the evening before. I swore, then, because it meant that the thief had not simply wiped my hard drive, as I had hoped he had. Taking the advice of that BackBlaze webpage about theft, though, I took a look at the most recently backed-up files, and gasped. There was a new user directory named "leo", and it was full of documents. Judging by the filenames, they looked like college admission forms and homework.
I immediately started crowing about this on Twitter and a couple of chat rooms I hang out in. My friends all agreed that was something else, all right, now could I please hurry up and download the files so that we could start to dig through them?
Looking through documents and sifting through web-history files, I teased out the user's name, email address, and other stuff, and my friends helped confirm and corroborate this information by scouring the web while I worked. Quickly, a profile of the user emerged. A Boston resident, she is an 18-year-old mother of an infant son. Perhaps just married, since her Gmail address has a different surname, but her current name came up on new-mother web forums. She plans to raise her son while starting down the path towards a college degree, and the laptop clearly played an important role in this plan.
(We knew her age because one of us found a 2007 feature photo of her from a local news website. The caption used her old name and said she was 14. And I know her combined academic and parenting plans because she wrote about them as a homework assignment.)
You can see how, at this point, I started feeling bad in entirely new ways about the theft. This young woman clearly wasn't a thief (though perhaps she was a bit dopey to buy hot merchandise), and wanted to use the laptop to help improve her station in life, as well as her tiny son's. Part of me just wanted to let it go entirely at this point, but it seemed objectively incorrect to just sit on this information. I also thought of that laptop thief on the large, and how I'd like to see him caught.
When I updated the detective the next morning with the results of our research, and he said "don't worry, we'll charge her with acquiring stolen property unless she surrenders it," I felt kind of heartbroken. With my nice new computer, I didn't really care about the old computer anymore, and I hated the thought of the police showing up at this woman's door to take away her computer -- a totem of a more hopeful future -- under threat of arrest. I felt like I'd made an infernal compact, and started up something beyond my control that was now going to go out and hurt people in my name. But I didn't make any effort to reverse it, because the other options didn't seem much better.
The student had a helpfully unique name (which did not resemble "leo" in any way), and within hours the cops had repossessed the laptop. According to the police report, the student's mother told of how she herself had bought the laptop from some dude at a local pizzeria, thinking it a well-timed gift for her ambitious daughter. The detective also found it funny how quickly the mom handed over the laptop as soon as two officers visited -- in all likelihood, she was under no illusions as to its likely origin, but (just like the police and me) hadn't expected it to call home for help.
When I visited the police station on Saturday to pick the laptop up, I gave the detective, at his request, a demonstration as to what BackBlaze was and how it had helped us recover the machine. At this point, I discovered that the thief had erased my user account, but had not wiped the system. This had allowed BackBlaze, which installs itself at the system level, to continue running.
The detective assured me that the investigation to the thief's identity would continue -- they still had some security-camera footage from the Panera Bread to go over -- though he was careful to not suggest that it would result in an arrest. He also passed along a message from the mother to me, a request that I please erase her kid's data once I got it back. And that was that. I don't expect to hear any more about this case… though further surprises, I suppose, wouldn't surprise me.
At this point, I had two laptops, one nicer and newer than the other. I liked the idea, which several friends also suggested, of offering to legitimately sell the laptop back to the poor student caught in the middle of this mess, once the dust had settled. But after a friend pointed out that I could return the new laptop to the Apple Store for a full refund -- Apple has a two-week return policy on this stuff -- I came to find that option irresistible, after sleeping on it and talking it over with others. It would peel the unexpected charge of $1,199 plus tax off my credit card, already suffering from a tough year. While I liked the idea of being magnanimous, it was just too hard to refuse this opportunity for personal recovery. So I visited the Apple Store Monday, and they took the laptop back with no hassle.
"Oh!" said the clerk at the store, when I told her why I was returning the machine. "Wow, that's great -- I'm really happy you got it back!"
"Thanks," I said.