Laptop Hard Drive Encryption Has Achilles Heel

Disclosure Laws

U.S. states have enacted a series of tough data disclosure laws over the past five years which force companies to notify residents whenever they lose sensitive information. Under these laws, a missing laptop can cost a company millions of dollars as well as public embarrassment as it is forced to track down and notify those whose data was lost.

However, many state laws, such as California's SB 1386 make an exception for encrypted PCs. So if a company or government agency loses an encrypted laptop containing sensitive data, they are not compelled to notify those affected.

The team's research may spur legislators to rethink that approach, Halderman said. "Maybe that law is placing too much faith in disk encryption technologies," he said. "It may be that we're not hearing bout thefts of encrypted machines where that data could still be at risk."

Laws like SB 1386 treat encryption as if it's a "magic spell" and ignore the fact that there's such a thing as bad encryption, said encryption expert Bruce Schneier, who is chief technology officer with BT Counterpane.

The underlying problem is that if someone gains access to your machine, it is very difficult to protect the data on your hard drive, Schneier said. "That's an extremely hard problem for a lot of reasons, and this is one example of that."

Hardware-based encryption would probably reduce the risk, Halderman said, but he agreed that "it's a difficult problem."

Hard-drive makers Seagate and Hitachi both offer hardware-based disk encryption options with their hard drives, although these options come with a premium price tag.