Larry Ponemon, of Ponemon Institute fame, got his gob smacked just a bit this past week, as you may have noticed.

Things kicked off with the release of a research report that made some headlines because it claimed that business travelers lose more than 12,000 laptops per week in U.S. airports. No sooner had this received some online news coverage than readers posting comments suggested that the numbers sounded too high.

They really do sound too high. A quick reality check raises a red flag or anyone who travels by air with any regularity. The TSA says some 10 million travelers pass through its checkpoints each week. At the rate of 12000 losses per week, you’d expect one notebook lost per 833 passengers through the mill.

Most of us have spent more time than we’d like to think about standing in airport security lines with several hundred fellow passengers. Is it true that someone loses a laptop in the interval between my joining the line and my getting my shoes retied on the other side of the X-ray? That doesn’t square with my sense of what the TSA officers around me in those instances are focusing on. It’s an anecdotal reality check at best, but still it seems fishy.

Ponemon was taken to task in relatively short order in a Computer World article by Patrick Thibodeau, who noted that, whereas Ponemon’s report claimed that an average of 1000 computers went missing at Miami International Airport each week, data provided to Computerworld by the airport officials showed that “for all of 2007, 68 laptops were reported stolen and 480 were turned in to the airport’s lost and found.” At Dulles, where the study estimates 400 lost laptops per week, “43 laptops were turned over to the airport’s lost and found in 2007.”

On the one hand, the article arguably punched some serious holes in the study. And it didn’t help the general perception that the study was underwritten by Dell, with the release of the study timed to coincide with Dell’s introduction of notebooks offering special loss-recovery features. (Ponemon says the research project was initiated several months before Dell contacted his institute in May 2008.)

However it may have looked to the casual observer, I think it’s important to note that there’s really no reason to believe that the report is in any way disingenuous with regard to what survey respondents told the research team. TSA checkpoint workers were asked how often they thought notebooks were lost, even if only temporarily. They answered and, on the face of it, they don’t seem to know what they’re talking about.

On the flip side of the coin, the airport theft reports may under-report the losses. There’s no particular reason to think that the airport security offices report laptop losses more accurately than TSA checkpoint workers. It’s interesting, though, that the two possibilities are so impossibly far apart. If one answer is correct, then the other answer is two orders of magnitude wrong.

R.R.

Posted in: Attacks, Data Loss Prevention, Mobile Devices, Risk and Management.

You can follow any responses to this entry through the RSS 2.0 feed. You can leave a reply, or trackback from your own site.