This an incident you need to handle and I am guessing that a standard response has not been detailed in your documentation.
Realize that your system is malfunctioning. It is not operating the the way it was intended to.
- Isolate your system [meaning your network(s) and physical facility if possible] to prevent the data from leaving your system. Take care to cause as little change to individual assets as possible. You want the state of the assets to stay constant until you can assess them.
- Identify the source or sources of the data leak.
- Isolate the leak source or sources to prevent further contamination in your system. Again, try to preserve there current state as much as possible. This will help you identify assets contaminated by the source.
- Identify all assets that may have been contaminated by the source or sources.
- Isolate the potentially contaminated assets. I know it is getting repetitive, but preserve the state of each asset as much as possible. These assets will help you assess the extent of the contamination.
- Treat all potentially contaminated assets at the level of the contamination. In this case TS.
- Verify that the remaining assets are not contaminated.
- Breathe, have something to eat or drink, take a short break, because the rest of your day/week/month is going to be painful.
- Discuss and plan remediation of contaminated assets. Planning well here will allow you to understand the scope of the problem, who is impacted, and how long you expect it to take.
- Execute the remediation plan and periodically report on progress.
Has anyone ever had to deal with an unauthorized laptop accidentally getting Top Secret level data on it?
I have not. I have been involved in containment and remediation of sensitive data.
How did you quarantine the system?
I have not been involved with the primary contaminated system, only secondary systems.
For systems suspected of contamination:
- Posted restricted area notice sign on the door.
- Locked the door.
- Removed network communications.
- Shutdown the system to preserve as much of the current state as possible.
- Analyzed the system to check for presence of data in question.
- If detected, moved the system to a secure area for sanitization.
Were you required to turn in the entire laptop or were you able to destroy/format the HDD?
The agency involved will determine the action to be taken, and the policies and practices may vary from agency to agency.
I do not have personal experience, but given that TS is described as 'Such material would cause "exceptionally grave damage" to national security if made publicly available.' I would expect that every physical component of the item formerly known as a laptop will be crushed, smashed, melted, dissolved, extruded, shredded, and used as target in a artillery range.
The consequence of the release of the information compared to the value of the laptop, the other software and data on the laptop, and any other adjacent items of value, makes it clear that preventing the release of the data is worth the cost of total destruction of the laptop.