Pitt professor says students safe from LoJack, webcam spying

Pitt freshman Sarah Pierotti has grown skeptical of her MacBook.

She’s been… Pitt freshman Sarah Pierotti has grown skeptical of her MacBook.

She’s been skeptical ever since last month, when a student accused Philadelphia area’s Lower Merion School District of remote accessing the laptop it gave him and using the webcam to take photos of him in his house. Lower Merion officials said they use the remote access feature on computers they think have been lost or stolen, but have since disabled the feature.

The accusations have created fears that other softwares — including some given out by Pitt — intended for security could potentially be used inappropriately.

So Pierotti has started to wonder whether she made the right decision when she bought a computer with a webcam and then installed Computrace LoJack for Laptops, a program that will trace her computer if it gets stolen.

“I thought it made my laptop more secure, but now I’m not so sure,” she said. “It’s really scary that they might activate that without good reason.”

Adam Lee, a Pitt computer science professor, said students with webcams probably don’t have to worry about having someone spy on them using their webcam.

Officials representing Absolute Software Corp., the firm that manufactures Computrace LoJack for Laptops, said their technology is different from that used in Lower Merion. The Lower Merion School District hasn’t said which program it used to access the computers it gave students.

When a laptop is reported lost or stolen, the next time that laptop connects to the Internet, the tracking program will send certain information out to either the company or in this case, the school district, Lee said. Lee specializes in computer security and privacy.

“It’s basically [motor vehicle] LoJack for laptops,” Lee said, referring to a product from the same company that collects cars’ GPS locations then reports them to police if they’re stolen.

That information could vary from a GPS location to a photograph taken from the webcam, Lee said.

The Computrace LoJack software, which Pitt’s Computing Services and Systems Development office offers to students, collects the computer’s GPS location.

“All information on a stolen computer with LoJack for Laptops goes to the Absolute Theft Recovery Team, who works with law enforcement to get the computer back,” Regina Nisita, an Absolute Software spokeswoman, said in an e-mail.

No data goes directly to the University or to police. The Absolute Theft Recovery Team exchanges e-mails and phone calls with local police, updating them on the stolen laptop’s location, she said.

Nisita said the technology recovers 75 percent of stolen laptops.

Christopher McGinley, Lower Merion’s superintendent of schools, said in an e-mail to parents that the school district had successfully used its software to return 18 of the 42 laptops lost, stolen or missing in the 2009-10 school year.

That same e-mail said the security feature “was only used for the narrow purpose of locating a lost, stolen or missing laptop. The district never activated the security feature for any other purpose or in any other manner whatsoever.”

Lee said that if students receive a laptop from other people, as the Lower Merion students did from their school district, and don’t know it has laptop recovery software, there is a chance someone could access their computer without their knowing it.

But if students installed the program on their own, it would be hard for someone to activate the program without their knowing, Lee said.

“Unless you know that program is on there, you’re sort of out of luck,” he said.

Protecting yourself from abuse by remote access software is the same as protecting your computer in general, Lee said. Running a firewall, making sure your network and Internet connection are protected, scanning for viruses and “don’t install stuff you don’t know where it came from,” Lee said, will all help make computers more secure.

Pitt’s Computing Services and Systems Development office offers the Computrace LoJack program to students to help track a lost or stolen laptop. Only students and the company providing the software would be able to access the computer.