A mobile communication device that detects and responds to theft is disclosed. The mobile communication device comprises at least a cellular radio transceiver, a processor, a memory, wherein the memory comprises a user partition and a system partition, and an operating system kernel stored in the system partition of the memory. When executed by the processor, the operating system kernel prevents unprivileged users from accessing the system partition and determines a theft status of the mobile communication device or of at least one hardware component of the mobile communication device. When a theft status is determined, the operating system kernel performs at least one theft response selected from preventing boot-up of the mobile communication device, sending a message via the cellular radio transceiver, commanding presentation of a theft alert message on a display of the mobile communication device.