Robert Siciliano bought 30 used devices from Craigslist and found that over half still contained recoverable personal and financial data despite factory resets. Android phones and Windows machines left behind recoverable "breadcrumbs" while BlackBerry and Apple devices scrubbed data better. He recommends destroying storage media instead of reselling devices.
Chapters
—have been wiped clean.
Cell phones and tablets could still be loaded with data. An ID thief needs to target you. K2's Shelley Bailey Shaw has more on what to do and what not to do with your used gadgets.
And I was surprised that I found people's entire digital lives.
Robert Siciliano is an identity theft expert with McAfee, the digital security software company. And like many of us, he used to sell his old digital devices when he upgraded to new ones. But not anymore. I will never, ever sell a device—
that has storage in it ever again.
Here's why. Siciliano did a little experiment. He went on Craigslist and bought 30 digital devices.
I bought iPhones, iPads, laptops, desktops, netbooks, notebooks. I wanted to see what type of information I could find on them. I was able to retrieve data on over half of them.
And here's the really scary part. In most cases, the person selling the device thought they'd purged the data by following the manufacturer's instructions. But for someone who knows computers, it wasn't hard to retrieve that data.
I bought this from a student. It had all of his personal information, banking information. It had photos and videos, videos of him at a concert, and a lot of pornography. Way too much information for me. This was from a consumer desktop. This had the family's entire personal information, their banking information, their Social Security numbers, enough data to steal their identities or take over existing accounts. This hard drive came off of a laptop from a business. This had all kinds of business documents, employee records. This This device right here would be considered a data breach with the amount of information that was on there.
Siciliano says equipment manufacturers and software developers need to do a better job so people can effectively erase and delete the data stored on their devices.
The problem with a lot of the digital devices that we have today is when you reset the operating system, when you reinstall or reformat, it doesn't often do the job in which it says it does. So you're leaving a lot of breadcrumbs that can be all spliced back together which allows a bad guy to basically steal your identity.
Based on his experiment, Siciliano says BlackBerrys were the best at completely scrubbing deleted data. Apple products also did a good job. Android devices were the worst. Even when people did a factory reset, he could still find a tremendous amount of data. Siciliano also found that it's hard to completely scrub devices that run on Windows XP.
This study scared me so much because I'm just as guilty as anyone else for selling, you know, used devices on Craigslist. I will never ever sell a device that has storage in it ever again. I will take it and put it in a vice and I will drill holes through it. I will smash it with a sledgehammer or I'll put it in a bucket of salt water for a year. But you're not going to see me selling it on Craigslist.
Shelly Bailey Shaw, K2 News. When asked to respond to this experiment, Microsoft tells The Problem Solvers its new software has considerable security and privacy improvements. Google did not respond. Another thing, many of the used smartphones and computers Siciliano bought came came with viruses or other malicious software that could have compromised his personal information. So the money you save when buying someone else's digital device may not be worth the risk.
