Two Ph.D. students and their professors have developed an open-source system for tracking the location of a lost or stolen laptop that does not rely on a proprietary, central tracking service–providing some competition for commercial software developers. One leading commercial developer, however, says the open-source version lacks a number of essential features and, therefore, is less effective in deterring laptop thefts and recovering laptops that do go missing.
The open-source developers of Adeona are Ph.D. students Gabriel Maganis from the University of Washington (UW) and Thomas Ristenpart from the University of California, San Diego, and UW professors Tadayoshi Kohno and Arvind Krishnamurthy. They cite two major differences between Adeona and a commercial product.
First is cost. Adeona can be downloaded free of charge. Second is privacy. Adeona’s developers say it preserves privacy, because no one besides the owner (or an agent of the owner’s choosing) can use Adeona to track a laptop.
"Unfortunately, with current proprietary tracking systems, users sacrifice location privacy," say the software’s creators. "Indeed, even while the device is still in the rightful owner’s possession, the tracking system is keeping tabs on the locations it (and its owner) visits. Even worse, with some commercial products, even outsiders (parties not affiliated with the tracking provider) can ‘piggy-back’ on the tracking system’s internet traffic to uncover a user’s private information and locations visited."
According to its web site, Adeona, named after the Roman goddess of safe returns, is designed to use the open-source OpenDHT distributed storage service to store location updates sent by a small software client installed on an owner’s laptop. The client software continually monitors the current location of the laptop, gathering information (such as IP addresses and local network topology) that can be used to identify its current location. The client then uses strong cryptographic mechanisms not only to encrypt the location data, but also to ensure that the ciphertexts stored within OpenDHT are anonymous and unlinkable.
The Mac OS X version of the solution (other versions include Windows XP, Vista, and Linux) also can capture pictures of the laptop user or thief using the built-in iSight camera and the freeware tool isightcapture. Like location information, these images are privacy-protected so that only the laptop owner (or an agent of the owner’s choosing) can access them.
Adeona isn’t the first solution to provide laptop-tracking technology. Absolute Software, a leader in computer theft recovery, sells a similar product: Computrace LoJack for Laptops.
According to the company, more than 70 million computers have a form of its Computrace software built into their BIOS or firmware to prevent the software from being removed by unauthorized users.
Already Dell, Fujitsu, Gateway, HP, Lenovo, Motion Computing, Panasonic, and Toshiba have embedded Computrace into their computers, Absolute says–and buyers can choose whether to activate the software for a fee. LoJack for Laptops, a service specifically marketed for students, has a starting price of $39.99.
The Premium edition of Computrace LoJack for Laptops adds an extra service that can remotely delete sensitive files, protecting them from computer criminals. Premium users also are eligible for a Service Guarantee of up to $1,000 if a stolen computer can’t be recovered and a remote data delete operation cannot be completed.
The Absolute Theft Recovery Team uses information sent from the stolen computer to investigate, gather evidence, and assist local police with recovering a computer and reportedly is staffed by former police officers and security professionals. The team is a private investigation agency that works directly with local law enforcement officials and internet service providers, the company said.
According to David Hawks, business development manager for Absolute Software, the company sent a cease-and-desist letter to the makers of Adeona last month, claiming possible patent infringement. For a few days after the letter was sent, Adeona’s download site was labeled "temporarily unavailable."
However, Maganis told eSchool News that "we are not aware of any issue that prevents distribution of Adeona. As a matter of fact, Adeona is now available for download."
As of press time, Adeona’s download site was available again.
It seems, for the moment, that Absolute Software has backed off from its cease-and-desist message. Absolute’s senior manager, Craig Clark, on behalf of the company’s general counsel, says that the "non-commercial academic project of UW is not a viable substitute for our tracking and recovery services. They are not in a competitive business; in fact, they’re not in business at all."
Absolute says it is not seeking relief from Adeona for patent infringement, but the company’s general counsel says it reserves the right to do so in the future–and it notes that Absolute also has the right to seek relief from anyone downloading and using the software in ways that infringe on Absolute’s patent.
A statement from Absolute points out what the company calls Adeona’s "practical flaws," such as its easily removable software, rudimentary location-based tools, lack of a "data delete" function, and lack of a professional, licensed theft recovery team with established law-enforcement relationships.
Though Adeona’s developers admit that the program can be easily uninstalled, this is only because they want to provide flexibility for the user, they say. Pending feedback, future versions of Adeona could incorporate mechanisms that will make the software difficult to remove.
"A motivated and sufficiently equipped or knowledgeable thief can always prevent an internet device tracking: He or she can erase software on the device, deny internet access, or even destroy the device," explains Adeona’s web site.
"The Adeona system was designed to protect against the common thief–for example, a thief that opportunistically decides to swipe a laptop from a coffee shop or a dorm room, and then wants to use it or perhaps sell it on online. Such thieves will often not be technologically savvy and will not know to remove Adeona from a user’s system. While device tracking will not always work, systems like Adeona can work, and it is against the common-case thief that we feel tracking systems can add significant value."
For any licensing questions that users might have, Adeona’s developers recommend checking out http://www.gnu.org/licenses/old-licenses/gpl-2.0.html, which are the terms of the GNU General Public License Version 2.0 1991, as published by the Free Software Foundation Inc.
"This program is distributed in the hope that it will be useful, but without any warranty; without even the implied warranty of merchantability, non-infringement, or fitness for a particular purpose," explains the project’s web site.