Prey caught a stolen-MacBook thief by turning the device into its own evidence source

During the August 2011 London riots, Greg Martin came home to a ransacked flat and a stolen MacBook Pro. Police took a report and dusted for prints, but the usual path ended there; what they did not expect was that the laptop ran Prey, the free open-source tracking software he had installed earlier. He flagged the machine as missing and waited, and the thief, clever enough to bypass the login by adding a new administrator account, kept using it.

Almost two days later a report arrived while Martin was on a business trip in Luxembourg. He raised the reporting frequency to one capture every five minutes, hoping to catch the thief on Gmail or Facebook, and after two hours of watching him browse religious videos and shop for a Mercedes A-class on AutoTrader, the thief logged into Facebook. The resulting file held his name, school, address in west London, IP address, BSkyB ISP, home wireless network name, Facebook profile and webcam pictures of his face.

That file let London's Metropolitan Police make the arrest rather than hope: the blogger reports justice was served, commenters congratulated him on getting the MacBook back, and Prey's founder confirmed the recovery in the Hacker News thread that followed. The story also showed the product's economics — free open-source tracking whose recoveries became the marketing — drawing 272 points and 152 comments when posted to Hacker News on 12 August 2011.

Install the tracker before theft, then let every use of the laptop report the thief

Prey had to be installed before the theft, and being free and open source removed the cost barrier that would have left an ordinary victim without the tool when the flat was ransacked.

The thief's own use is the evidence: each session silently beamed location, screenshots and webcam captures from his network, unavoidable without abandoning the laptop's value.

Raising the report frequency to one capture every five minutes caught the decisive Facebook login, tying face, name, school, home address, ISP and wireless network into one dossier.

Passwords and insurance protect data and replacement value but do not recover hardware; the evidence file gave police a named suspect to act on.

When a stolen asset has to be used to be valuable, make that use the alarm: free pre-installed telemetry turns the thief into the person who delivers the evidence

London's Metropolitan Police acted on the file and the blogger reports justice was served; commenters congratulated him on getting the MacBook back, and Prey's founder confirmed the recovery in the discussion. The post drew 272 points and 152 comments on Hacker News on 12 August 2011, where readers asked whether it was another viral-marketing campaign; the founder said the team had nothing to do with the story beyond building the software, noting a similar tale had surfaced on Reddit the day before. Another commenter described recovering an employee's MacBook with Prey and police help.