Always-available embedded theft reaction subsystem

A hardware platform comprising:

• a hardware computing device including a core logic component to transition the platform from an unarmed mode to an armed mode upon receipt of a user arming command;
• a user interface to receive an override command from the user, to transition the system from the armed mode to the unarmed mode through a suspecting mode;
• the core logic component to transition the platform to the suspecting mode, in response to receiving the override command;
• a security action logic to perform one or more security actions including performing a full disk encryption of data on the platform in response to being in the suspecting mode;
• and
• the core logic to transition the platform from the suspecting mode to the unarmed mode, after the security action logic performs the security actions, in response to receiving the override command.

A platform comprising:

• storage including encryption logic to encrypt data;
• a core logic component of a computing device to transition a security system of the platform between a plurality of modes the modes including:
• an unarmed mode when the platform is usable;
• an armed mode, during which a risk behavior logic monitors for a risk behavior;
• a suspecting mode, reached when the risk behavior logic detects the risk behavior, in the suspecting mode a security action logic to react to the risk behavior and perform a security action including to perform a full disk encryption of data on the platform;
• and
• an interface to receive an override command from a user, and to transition from the armed mode to the unarmed mode through the suspecting mode, without use of a disarming command;
• and
• the core logic to transition through the suspecting mode, prior to moving the security system to the unarmed mode in response to the override command, so that the security action takes actions in response to receiving the override command.

A method comprising:

• transitioning a platform from an unarmed mode to an armed mode through a suspecting mode, the platform comprising a computing device coupled to a user interface, the computing device being selected from a group consisting of a laptop computer, a netbook, a tablet computer, and a mobile device;
• receiving an override command from the user interface to transition the platform from the armed mode to the unarmed mode through the suspecting mode, when in the armed mode;
• transitioning the platform to the suspecting mode in response to receiving the override command;
• performing at least two security actions in response to being in the suspecting mode, wherein one of the at least two security actions includes performing a full disk encryption;
• and
• transitioning from the suspecting mode to the unarmed mode after performing the security actions, in response to receiving the override command.