All thinkpads have a Wifi card whitelist at the BIOS level that prevent installing certain WiFi cards. The restriction can be bypassed with a BIOS modification: either installing Libreboot, Coreboot or editing the official Lenovo/IBM BIOS.

This laptop comes with LoJack, a BIOS capability that the user has the option to "disable", even "permanently" if she wants. Since the BIOS is non-free, and we don't know what it actually does, it is conceivable that the phone-home capability could be re-enabled by a malicious BIOS upgrade/modification or possibly even a program.

From the BIOS: Computrace Module Activation:

Enables or Disables the BIOS interface to activate Computrace modules. Computrace is an optional monitoring service from Absolute Software.