Protecting your laptop in the field

An office computer sits behind a locked door. An investigator’s laptop rides in a vehicle, gets opened in coffee shops and motel rooms, sits on a passenger seat during a four-hour stakeout, and occasionally gets left somewhere it shouldn’t be. It usually holds everything: case notes, subject details, client correspondence and footage.

The good news is that the protections that matter most are built into Windows and macOS and take an afternoon to set up. This checklist is ordered by how much each step reduces your risk.

1. Turn on full-disk encryption, and confirm it’s on

If your laptop is stolen, full-disk encryption is the difference between “I lost a laptop” and “I lost every case on it.” Without it, a thief can pull the drive and read it on another computer without ever knowing your password. NIST’s guide to storage encryption (SP 800-111) describes full-disk encryption as a way to protect data on end-user devices exactly for this situation.

• Windows: BitLocker on Pro editions, or “device encryption” on many Home devices. Microsoft’s documentation notes that device encryption is often switched on automatically, but only becomes fully protective once the recovery key has been backed up, and that a device using only a local account can remain unprotected even though its data is encrypted. Check Settings → Privacy & security → Device encryption (or BitLocker in Control Panel) and make sure it says it’s on, not suspended.
• Mac: FileVault, in System Settings → Privacy & Security. Most recent Macs prompt for it during setup.

Both give you a recovery key. Treat it as seriously as your password: store it somewhere safe and not with the laptop. Apple’s own documentation warns that if you forget your login password and lose the recovery key, “your files and settings will be lost forever.” That’s the price of encryption that actually works. It’s the same trade-off that runs through our zero-knowledge encryption explainer.

Encrypt external drives too. A USB drive of surveillance footage in the glovebox is the same risk as the laptop, and easier to lose.

2. Lock the screen, every time

Encryption protects a laptop that’s turned off or locked. It does nothing for one that’s open and signed in.

• Set the screen to lock after five minutes or less of inactivity.
• Learn the shortcut to lock it instantly (Windows key + L; Control + Command + Q on a Mac) and use it every time you step away, even for a minute.
• Use a real sign-in password or PIN, plus a fingerprint or face sign-in if your laptop supports it, so locking is painless enough that you actually do it.
• Set the laptop to require a password when it wakes from sleep.

3. Keep it updated

Most successful attacks on laptops use flaws that were fixed months earlier. Turn on automatic updates for the operating system and your browser, and restart when asked rather than postponing for weeks. Remove software you no longer use: every program is something else to keep patched.

4. Use a standard account for daily work

Sign in day to day with an account that isn’t an administrator, and use the admin account only to install software. It’s a small change that stops a lot of malware from installing itself quietly. NIST’s telework guidance (SP 800-46) makes the same recommendation for devices used outside the office.

5. Be sensible about Wi-Fi

Public Wi-Fi is less dangerous than it used to be. The FTC’s current consumer guidance points out that most websites now encrypt traffic, which makes public networks “usually safe” for ordinary browsing. The remaining risks are fake networks and fake websites designed to capture passwords.

For field work:

• Prefer your phone’s hotspot to motel or coffee-shop Wi-Fi. It’s your network, and it’s usually fast enough for notes and uploads.
• Check the padlock and the address before signing in to anything, and use a password manager, which won’t autofill on a look-alike site.
• Turn off automatic joining of open networks.
• A reputable VPN adds a layer on untrusted networks, but it isn’t a substitute for the steps above.

6. Guard against the glance

Surveillance work puts you close to people who shouldn’t see your screen, including, occasionally, the subject.

• A privacy screen filter narrows the viewing angle so someone beside you can’t read it.
• Close case files and email before you open the laptop somewhere public.
• Turn off notification previews on the laptop and phone, so a client message or a subject’s name doesn’t pop up on the lock screen.
• Keep work and personal browser profiles separate, so a family member borrowing the laptop isn’t one click from a case.

7. Keep less on the laptop

The data that can’t be stolen from a laptop is the data that isn’t on it. Offload footage and archive closed cases to encrypted storage at the office. Don’t keep years of case files locally “just in case.” Our guide to surveillance video and photo file management covers a routine for getting footage off devices promptly.

8. Physical habits

• Never leave the laptop visible in a parked vehicle. If it has to stay in the vehicle, put it out of sight before you arrive, not in the parking lot where someone can watch you do it.
• Don’t leave it unattended in public, even for a restroom break.
• Record the laptop’s make, model and serial number somewhere other than the laptop.
• Turn on Find My (Mac) or Find my device (Windows). It won’t always get the laptop back, but remote lock and wipe can limit the damage.

9. Back up

Encryption and theft protection protect confidentiality. Backups protect availability. Keep an encrypted backup of anything on the laptop that isn’t stored elsewhere, and check now and then that you can restore from it.

10. Know what you’ll do if it’s lost

Write this down now, while you’re calm:

1. Try to locate, lock or wipe it remotely.
2. Change passwords for email, case management, cloud storage and anything else that was signed in, starting with email. Sign out other sessions where the service allows it.
3. Note what was on it and whether it was encrypted and locked. That answer shapes everything that follows.
4. Report the theft to police and keep the report number.
5. Decide whether clients need to be told. If client or subject data may have been exposed, notification duties can apply. Follow your breach plan (see data breach response) and check with your state board or an attorney.

An encrypted, locked laptop usually turns step 5 from a crisis into a short note in your file. That alone is worth the afternoon.

Your phone deserves the same treatment

Most of this applies to your phone as well: a strong passcode rather than a four-digit PIN, automatic updates, notification previews off on the lock screen, and remote lock and wipe turned on. Phones are encrypted by default once a passcode is set, which is one more reason to set a good one. For accounts, pair all of this with a password manager and two-factor authentication (see password managers and 2FA).

Spotted an error? Tell us by email and we'll correct it.