Devices

Travel laptop: the machine that can be lost

Configuring a laptop that can be seized, lost, or stolen without operational consequences. Setup, preparation, behavior at the border.

Published May 15, 2025 18 min read Exposed

Last reviewed: January 20, 2026

A consultant comes back from four days in Shenzhen. He hands me his laptop and asks me to “check there’s nothing on it.” The machine is his work MacBook: eight years of mail, the password vault, three clients’ contracts, a permanent VPN tunnel into his firm’s network. He set it down twice at the hotel reception during meetings, plugged it once into a conference-room dock. I found nothing. That proves nothing. The real problem is that nothing could be proven either way — and the question “is there something on it?” should never have come up, because the machine should never have left with all of that on board.

Angle de lecture

Particulier RSSI / DSI

The usual trap

“I have BitLocker, if someone steals the laptop the data is protected.” That’s the first sentence I hear almost every time, and it describes exactly one scenario out of five. Disk encryption protects in one precise case: the machine is off, someone grabs it and runs. There, yes, the disk is unreadable without the key. In every other case that matters while traveling, it protects nothing.

A machine left asleep in a hotel room has its decryption keys sitting in memory, extractable through ten minutes of physical access. A machine you are compelled to unlock at a border post is, by definition, unlocked — encryption is beside the point. A machine plugged into an unknown USB dock in a meeting room exposes its interfaces to hardware you don’t control. Encryption at rest answers a single question: “what happens if someone steals the machine while it’s off?” On the road, that is almost never the question that comes up.

The second trap, more expensive, is believing that an MDM — Mobile Device Management — counts as travel preparation. The MDM enforces a PIN, can wipe remotely, sees the installed apps. What it doesn’t do: prevent fifteen years of client correspondence from syncing locally, empty the Downloads folder, or reduce what the machine can reach once it’s unlocked. The MDM manages a fleet. It does not design a device to be loseable. Those are two different problems, and the first does not solve the second. The right question isn’t “how do I prevent the loss” — it’s “what happens when this machine is lost, seized, or compromised?” And the only acceptable answer is: nothing catastrophic, because it was designed for exactly that.

There’s a third reflex, more insidious because it sounds reasonable: “I’m careful, I never let the machine out of my sight.” That’s false in practice. On a typical business trip, the laptop leaves your visual control dozens of times: at the airport security checkpoint where it travels alone down the belt while you walk through the scanner, in the overhead bin while you sleep, at the hotel reception while you fill out a form, on the meeting-room table during the coffee break, in the room during the business dinner. Individual vigilance is a protection mechanism that collapses at the first fatigue, the first jet lag, the first meeting that drags on. A security posture that depends on you “never letting go of the machine” is a posture that has already failed. Design, by contrast, does not get tired.

The root of the problem is cultural: people treat the travel laptop as a valuable object to protect, when it should be treated as a consumable to render harmless. As long as the thinking is about “how do I stop someone from accessing the machine,” you lose, because a determined adversary and a cooperative border post always end up getting in. The day the thinking becomes “what happens once someone has accessed it,” you win, because the answer was prepared cold: nothing interesting inside, nothing irreversibly lost, a replacement machine ready in two hours. That’s the whole reversal, and it’s the only one that holds up against the real vectors.

The real threat model: what actually happens to a laptop on the road

Let’s list the concrete vectors, in order of field frequency, not in order of how spectacular they are. The most mundane first, because that’s the one that hits.

Opportunistic theft and loss. The laptop left in a taxi, the bag snatched on a café terrace in Barcelona, the machine gone from a luggage locker. No state-level adversary in any of that, just opportunity. On a machine that’s off and encrypted, it’s a hardware loss. On a machine asleep and unlockable, or stuffed with irreplaceable data and no backup, it’s a crisis. This vector accounts for the overwhelming majority of real incidents, and it does not read the geopolitical bulletins: a “friendly” country changes nothing about it.

The order of magnitude is worth stating, because it corrects the usual mental hierarchy. People prepare against the spy and get caught by the pickpocket. Corporate travel insurers’ claim records consistently place equipment theft and loss far ahead of any form of targeted attack — a laptop is infinitely more likely to end up in a dumpster after a pickpocketing than in a state extraction lab. And the real cost of one of these incidents is almost never the price of the machine: it’s the data-breach notification to the ICO within 72 hours if the device held unencrypted personal data under UK GDPR, the notice to the individuals concerned, the internal investigation to figure out what was actually on the disk. An encrypted, minimized machine turns that scenario into a declarative non-event. A full, asleep machine turns it into a compliance crisis. The difference plays out entirely in the preparation, not in the quality of the thief.

Discreet physical access — the so-called evil maid scenario. Someone has a few minutes alone with your machine: housekeeping staff, a visitor, anyone with a passkey. On a machine that’s asleep, copying the contents or planting a persistence tool takes ten minutes via a boot key. On a machine that’s off with a TPM and a boot PIN, the attacker can’t boot it without the code. The difference between the two states is not cosmetic: it’s the line between “inaccessible” and “fully copied.”

The border search. In several jurisdictions, the officer can demand unlocking, copy the contents, or hold the device for days. In the United States, the border search requires no warrant — CBP Directive 3340-049A distinguishes the “basic” search, allowed without any suspicion, from the “advanced” search involving connection of extraction equipment, which requires reasonable suspicion but remains at the officer’s discretion. The traveler has, in practice, no way of knowing which of the two they’re undergoing, nor any way to obstruct it. In the UK, Schedule 7 of the Terrorism Act allows compelled disclosure of the passcode under criminal penalty — refusing is an offense in itself. In China, device inspection on entry is documented and data extraction is anything but theoretical; control apps have been installed on travelers’ phones at certain land crossings.

The key point is that encryption is not just useless here, it can turn against you: in several jurisdictions, refusing to provide the passcode of an encrypted machine exposes you to device retention, denial of entry for a non-citizen, even prosecution. Technical protection at rest does not answer legal compulsion. The only robust lever is upstream, in what the machine contains: you can’t be compelled to reveal what doesn’t exist on the disk, and a device with cloud-only access — revocable remotely, disconnected before the crossing — gives up nothing exploitable even when unlocked under duress. That’s exactly the logic of tier 3: separate the hardware so the border has nothing to seize.

Local network interception. Hotel or conference Wi-Fi, in a jurisdiction with mature interception capabilities, is not neutral. An attacker in a MITM position observes metadata even when the content is encrypted; a hostile network can push certificates, redirect traffic, exploit an unpatched browser flaw. A VPN closes this vector — provided it works on site, which you verify before leaving, not once you’re blocked on a Sunday morning in Beijing.

The right approach: design a loseable machine, not an unbreakable one

The pragmatic shift is to stop looking for the device that can’t be compromised — it doesn’t exist — and to build a device whose compromise costs nothing. It’s a complete inversion of the objective. You don’t harden the fortress; you make sure there’s nothing important inside. Three principles, and everything follows from them.

No irreplaceable data stored locally. Mission files live in the cloud or on a server reachable over VPN, synced on demand, never mirrored in full. Locally: strictly what you need for the current session. No full password vault, no long-lived SSH keys, no permanent access tokens. The mail client downloads only the last seven days, not ten years of archives. The rule is testable in one question: if the machine disappears right now, what do I lose that exists nowhere else? The answer must be “nothing.”

A machine you can re-image quickly. If the device is seized or suspected of compromise, you must be able to bring a replacement online without recovering anything from the questionable machine. That requires a clean reference image, provisioned before departure and stored off the machine — encrypted NAS, external drive in a safe place, encrypted cloud. That image serves twice: as a point of comparison on return, and as a from-scratch restore base. Provisioning it takes one hour, once; it turns a multi-day incident into an afternoon’s recovery.

Access with limited lifetime and limited scope. Short-expiry OAuth tokens, temporary credentials distinct from the everyday ones, VPN access restricted to the strict perimeter of the mission. A GitHub token valid for seven days is enough for a one-week mission; a token valid for a year stored on a travel machine is a year of access handed to whoever compromises it. Every access created for the trip is documented so it can be revoked on return — you can’t revoke what you haven’t listed. The credential rotation is planned before leaving, not after the incident.

Concretely, the machine is prepared cold, at home, with the time to handle the reboots. Full-disk encryption is enabled and verified — most people believe they have it, many don’t. Secure boot is in place, the boot PIN required, the machine configured to shut down completely rather than sleep. You create a standard, non-administrator account to limit the damage of a compromise. You uninstall apps that have no business on a mission and disable unnecessary cloud syncs. At the customs crossing as well as on every exit from the room: full shutdown, never sleep, because sleep leaves the keys in RAM and cancels the entire benefit of encryption.

Provisioning a clean image, concretely

The reference image is not an IT-department concept; it’s a procedure that fits in one afternoon and gets reused on every departure. The goal: capture the “clean machine, tools in place, no data” state so you can return to it identically. On Windows, you prepare a standard account encrypted with BitLocker and a boot PIN, then capture the state with a disk-imaging tool (the Windows ecosystem offers several, free or built in). On macOS, FileVault is enabled from the start and you keep the recovery reinstall procedure rather than a bootable image — a Mac re-provisions fast from a clean account. On Linux, full-disk LUKS encryption and a snapshot of a clean state, via a volume image or a sync of a reference system, do the job.

Three rules make the image useful rather than decorative. First, it’s stored off the machine — an encrypted NAS or an external drive kept in a safe place — never on the disk it’s supposed to restore. Second, it’s dated and versioned: you know when it’s from and what it contains, so you can compare on return what changed. Third, it contains no durable secrets: no permanent SSH key, no password vault, no long-lived token. Access is grafted on top at departure time, temporary and documented, and dropped on return. An image that respects those three rules turns the loss or compromise of a device into a recovery formality, not an incident.

Behavior on site: half the system

Hardware preparation is only worth something if behavior follows, and that’s where most decent setups fail in practice. A handful of reflexes weigh more than everything else. The VPN goes up before joining any network, not after “just checking your mail” on the hotel Wi-Fi — the first cleartext connection is enough to expose what you wanted to protect. Cloud and VPN sessions are cut the moment you leave the machine for more than a few minutes in a high-risk context: a session left open on an unattended device is an open door, regardless of disk encryption. You avoid public USB charging stations and unknown meeting-room docks in favor of your own AC charger and a charge-only cable with no data wires. And the machine shuts down — really, not sleep — before every border post and every prolonged exit from the room. None of these gestures is technical. All of them are taken or missed depending on the discipline of the moment, which is exactly why tier 3 doesn’t rely on them and prefers to remove the data rather than count on behavior.

What this means concretely

For you, as an individual

Three things, doable this week, for under €200. The goal isn’t to own the most secure device in the world — it’s to own a device whose loss doesn’t ruin you.

1. A separate travel machine, even refurbished. You don’t need a new laptop. A refurbished one at €400 — or an old machine wiped clean — is plenty. Install the OS, enable full-disk encryption with a boot PIN, and put on it only what you need for the trip. Not your photos, not your mail archives, not your life. A machine that contains nothing irreplaceable is a machine you can lose without drama.

2. The cloud as storage, never local. Put your mission documents in a cloud space, disconnect the sensitive accounts you won’t use (family photos, secondary mail), and configure your mail client to keep only the last seven days. If the machine disappears or is inspected, it gives access only to the strict minimum — and the rest is safe elsewhere.

3. Full shutdown, and VPN up from the first connection. Get into the habit of shutting down the machine, not closing the lid, before a border post or whenever you leave the room for more than a few minutes. Run your VPN once from home to confirm it works, and on site activate it before joining any Wi-Fi network. These two reflexes cost nothing and close the two most common vectors.

For you, CISO / IT director / executive

The right policy isn’t a single rule, it’s a travel policy by country risk level, inherited and auditable.

1. Three country tiers, three hardware postures. Tier 1 (EU, United States, Canada): hardened standard laptop — verified encryption, non-admin account, minimal sync. Tier 2 (non-OECD, moderate risk): dedicated minimal-data laptop, provisioned from a clean image. Tier 3 (China, Russia, countries with documented customs extraction): empty laptop with cloud-only access, systematically re-imaged on return. Direct consequence: you replace “the employee does their best” with an imposed, per-destination posture that’s verifiable, written into the security policy on the same footing as access management.

2. The trigger is automatic, not voluntary. Nobody spontaneously consults the procedure before booking. The reminder must fire from an event — visa request, agency booking, expense report — and route to IT the moment a tier 2 or 3 is detected. Direct consequence: you wire a trigger into the booking tool, with an alert to the SOC or IT, and the travel laptop is provisioned before the employee even thinks about it.

3. The return is part of the mission. A tier 3 device that plugs straight back into the corporate network is a potential incident vector injected into the heart of the IT estate. The return is planned at pre-departure: network isolation, forensic scan, re-image, rotation of the credentials used — in that order. Direct consequence: every tier 3 trip opens a return ticket before departure, and the machine touches the network only after closure.

Mistakes we see all the time

“Travel laptop” = main laptop with a few files deleted. If it holds three years of mail, your contacts, your notes, and your password vault, it isn’t a travel laptop, it’s your everyday machine with a reassuring name.
Sleep instead of shutdown before the border. Closing the lid in the airport waiting area. The decryption keys stay in memory and the encryption protects nothing anymore. Only a full shutdown actually reactivates it.
VPN or cloud session left open on an unattended machine. A permanent access window while you’re in a meeting and the machine is in the room. Cut the sessions the moment you leave the device in a high-risk context.
Long-lived tokens. A token valid for a year on a travel machine gives a year of access to whoever compromises it. Short, dated, documented, revoked on return.
No return procedure. The machine comes back, “it looks normal,” it gets plugged in. That’s the standard mode of most organizations, and it’s precisely the moment a discreet compromise crosses onto the internal network.
The unknown charger or dock. Airport USB station, conference-room dock, borrowed cable. Favor your own AC charger and a charge-only cable with no data transfer; juice jacking remains a vector on hardware you don’t control.

Actionable checklist

N1 Travel machine separate from the main machine (refurbished is fine)
N1 Full-disk encryption enabled AND verified, with a boot PIN
N1 Mission data in the cloud, nothing irreplaceable stored locally
N1 Sensitive cloud accounts not in use disconnected from the device
N1 Mail client limited to the last 7 days, no full archive
N1 VPN tested from home, activated before any network connection on site
N1 Full shutdown (never sleep) before the border and when leaving the room
N2 Clean reference image provisioned and stored off the machine before departure
N2 Standard rather than administrator account for the trip
N2 Temporary tokens and credentials, documented for revocation on return
N2 VPN access restricted to the strict perimeter of the mission
N2 VPN/cloud sessions cut the moment the machine is left unattended
N2 Country risk level determined (tier 1 / 2 / 3) before departure
N3 Empty, cloud-only-access laptop for tier 3 destinations
N3 Systematic re-image on return from tier 3, before any network reconnection
N3 Forensic scan and network isolation before restoration
N3 Rotation of all credentials used within 24h of return
N3 Return ticket opened before departure for every tier 3 mission

Sources and further reading

EFF — Digital Privacy at the U.S. Border [report]
NCSC — Travelling securely [official]
US CBP — Border Search of Electronic Devices (Directive 3340-049A) [official]