The data on the laptop is likely more valuable than the laptop itself. Many orgs will sell you old laptops once they reach end of life but they will require the laptop back from you to wipe it clean and purge data from it as well as licenced software etc. Asking to buy it and being honest is not only the most ethical thing to do, but the smartest thing to do. (Not least because why would you want to keep an old worn out laptop over a brand new one?)
Before we even get to security controls, you will face a number of problems trying to swap out the machine for a new one. Getting the exact same spec laptop will be hard, first of all these spec machines are usually sold exclusively to enterprises, secondly the same models tend to have differences from year to year, the IT guys will probably intimately familiar with these differences.
I do not recommend saying your laptop was stolen, mature orgs will launch an investigation, data officers and legal teams could become involved, this will would mean there is a good chance that the police would be involved, so you would end up breaking a lot of laws, not least wasting police time.
In the same vain I do not recommend saying the laptop was broken, as the IT department will require the broken laptop back, to ensure that it can be safely disposed of.
Many security controls will dictate the requirement of an asset inventory of authorised devices, including the CIS critical controls, ISO27001 etc. This will mean there is a chance that each asset will be tracked and auditable against its MAC address (which will allow switches to only allow authorised devices on the network), device owner, hostname, serial number, and asset numbers. Additionally the laptop may be part of the orgs domain.
So if the goal is to get this “done in the most ethical way”, I think you will fail straight away. Proably a better way of saying it is to get it done in the least unethical way, as you would likely need to do the following:
- Break the law
- Circumvent the companies security controls
- Breach your contract of employment
- Break the orgs security policy
- Break the orgs acceptable use policy
- Break the orgs data handling policies
If the orgs has basic security controls in place (minus drive encryption) then you would also need to:
- Source an identical laptop
- Remove tamper proof asset tags and place them on the new laptop
- Configure the new laptop to spoof the old laptops MAC address (Which would revert to the hardware address once reinstalled)
- Change the serial number of the new laptop to that of the old laptop (This would need to be done in the BIOS and would probably require you to flash the BIOS)
- Have the laptop reimaged with the orgs image and joined to the domain with the same hostname, which would require access to local admin right on the laptop, domain admin rights and/or the orgs imaging server
TLDR: If the org has some basic security controls in place then swapping one machine out for the other would not only break the law but would require considerable effort.