While picking up lunch at a cafe, Thom leaves his devices unattended — what should he do?
Thom should never leave his laptop, phone, or Common Access Card (CAC) unattended in a public place. He should keep his devices with him or physically secured, and always take his CAC. Unattended devices invite theft and unauthorized access.
The answer
In this DoD Cyber Awareness Challenge scenario, the correct action is that Thom must not leave his government devices, CAC, or belongings unattended in a public space. He should take his laptop, phone, and CAC with him, or secure them so no one else can touch them. A cafe is an uncontrolled area full of strangers, so anything left on a table is one distraction away from being stolen or tampered with.
The underlying principle the challenge is testing: you are personally responsible for the physical security of your devices, credentials, and any Personally Identifiable Information (PII) at all times in public. Convenience never outranks that responsibility.
Why unattended devices are a serious risk
An unattended laptop or phone is a target for several kinds of attack, not just simple theft:
- Physical theft of the hardware and the sensitive data it holds.
- Unauthorized access if the screen is unlocked or the CAC is left in the reader, which can bypass authentication entirely.
- Tampering, such as plugging in a malicious USB device or installing a keylogger in seconds.
- Shoulder surfing, where a bystander reads sensitive information off the screen.
A CAC is especially critical. It is both the identity credential and, when inserted, the key that unlocks systems. Leaving it in a device, or on a table, is like leaving a key in a lock. That is why the rule is to remove your CAC and take it with you whenever you step away.
The bigger principle: protect PII and credentials in public
Cyber security is not only firewalls and passwords; it includes basic physical discipline. The same rules apply to your workstation: whenever you leave, lock your screen, remove your CAC, and secure the area. In a cafe you have no controlled perimeter, so the safest move is to keep everything on your person. If you truly cannot carry it, you should not bring work devices at all.
Applying the decision to Thom: he should either take his devices and CAC to the counter with him or not walk away from them. There is no acceptable version of this scenario where the correct answer is to trust that a public table is safe. Public spaces are, by definition, uncontrolled, and the burden is on the individual to keep government property and information out of reach of anyone unauthorized.
- 1
Are you stepping away from your device in public?
A cafe counter, restroom, or line all count as leaving it unattended.
- 2
Can you take the device and CAC with you?
- 3
Can't carry it right now?
- 4
Never do this
Frequently asked
What should you do with your CAC when you leave your workstation?
Remove your CAC and take it with you every time you step away, even briefly, and lock your screen. The CAC unlocks systems while inserted, so leaving it in the reader lets anyone use your access. Never store it in the device or leave it on your desk.
Why is leaving devices unattended in public a security risk?
An unattended device can be stolen, tampered with (malicious USB, keyloggers), or accessed if left unlocked, and bystanders can shoulder-surf sensitive data. Public places are uncontrolled areas, so you cannot assume anything left there stays safe.
What is the DoD Cyber Awareness Challenge?
It is the Department of Defense's mandatory annual security-awareness training. It uses realistic scenarios, like Thom at the cafe, to teach users how to protect classified information, PII, credentials, and devices against everyday threats such as phishing, theft, and social engineering.
How do you protect PII in a public place?
Keep devices and documents on your person, lock your screen when stepping away, remove and carry your CAC, shield your screen from onlookers, and avoid discussing or displaying sensitive information where others can see or hear it.