Students gain credit for stealing 30 laptops from university staff

Stealing someone’s laptop could land you in jail. Stealing 30 of them would certainly earn you a longer sentence. But if you attend the University of Twente in the Netherlands, it may instead count as credit towards your degree.

Students did manage to steal 30 laptops from the Twente university campus, but no arrests were made because the whole thing was an experiment. It was setup by Trajce Dimkov, a PhD student and researcher in the Distributed and Embedded Security Group at the university. He wanted to find out how much human behavior factored into the security of an organization, specifically when viewed in isolation from the security practices in place there.

The laptops were given to members of staff at the university who were asked to always ensure they were secure. The staff were also told that students would try to steal them. Not only did that reinforce the fact the laptops needed to be kept safe, but also stopped anyone calling the police when their laptop disappeared.

Even with those ground rules in place, it only took the students 60 attempts to steal all 30 laptops. Some staff forgot to lock their doors when leaving a room, but even those that did found students using other methods to get the door unlocked. For example, caretakers were asked by students to unlock doors because they had left their laptop in there. In most cases the person with the key obliged.

As well as identifying how much of a negative impact human behavior has on a security system, Dimkov produced a system for mapping activity within an organization and highlighting the security issues. His model brings together maps of an area, the people with security clearance, different levels of clearance, their behavior and movements, how access is restricted, and all the security codes used. By modeling the data it is possible to see where a gap exists, for example, a caretaker having access to a room when valuable hardware or information is kept inside.

Such thinking and monitoring could help to improve security beyond the best practices companies rely on today. Coupled with the growing amount of mapping data being compiled by companies like Google, it may also be applicable to security in large public areas too, or even in the planning stages for area regeneration.

Read more at the University of Twente