You Probably Are Not Fully Removing Your Private Photos and Data Before Selling Your Old Technology

Maxx-Studio/Shutterstock.com

Do you really want your old email addresses and credit card numbers for sale on the secondhand market?

Old email addresses, thousands of credit card numbers, love letters and even pornography: these are just some of the data researchers have found left behind on devices for sale on the secondhand market.

These results are concerning for the National Association for Information Destruction, the international trade association for the secure information destruction industry. NAID’s mission is to help companies meet regulatory standards for data erasure set by the Defense Department and the National Institute of Standards and Technology.

CEO Bob Johnson told Quartz private data can be successfully removed from old devices, but many resellers just don’t take the necessary precautions to delete it. E-waste not stripped of sensitive information can be an easy target for identity theft.

In a 2017 survey, one of the largest of its kind in recent years, the association looked at 258 mobile devices, tablets and computer drives and used only the most basic measures to try to extract data. They found that 40 percent of devices resold in “regular commerce channels” (think Amazon, eBay and second-hand stores) contained personally identifiable information like tax details, usernames, passwords, company and personal data.

These findings have been replicated over and over in the last 14 years by various researchers. It’s not just individuals who are lax about removing data; companies around the world are at fault as well. In a 2007 study researchers in Canada obtained 60 secondhand drives that had previously belonged to health care facilities. They were able to recover personal information from 65 percent of the drives. The data included, in the words of the researchers, “very sensitive mental health information on a large number of people.”

discardedthings
Think of all the data.

A 2006 study of 200 hard drives obtained in the U.K. by the British Telecommunication’s Security Research Center and Edith Cowan, 20 percent contained enough information for individuals to be identified, 15 percent contained information of a “personal nature” and 10 percent contained financial information on the organization or individual from which they had originated. One hard drive still contained data about the plans for a classified missile system designed and built by weapons manufacturer Lockheed Martin.

Even as far back as 2003, two MIT graduate students purchased 150 previously-owned hard drives from secondhand markets to see if there was still personally identifying information on them. Of the 150 hard drives, only 9 percent had been properly cleared of their previous owners’ data. From the remaining drives the researchers were able to use computer forensic techniques to find old email addresses, credit card numbers, fax templates, love letters and porn.

Johnson says there are some cases where it might make more sense to destroy rather than resell old drives and devices, because it would require extreme effort to even attempt to retrieve data from the hard drive.

Meanwhile, there are more than 1,200 U.S. companies with NAID membership who follow regulations for data erasure. So if you have sensitive information on an old hard drive or device, it may be worth your while to get it in the hands of a company that follows the federal standards for deleting data before reselling it.

According to Johnson, this simple act could have helped all of the consumers whose private data lives on in second-hand remnants: “Had they sent it to a qualified company to sanitize it, and that company knew what they were doing, you would not be able to get data off that drive. Even the NSA would not be able to get data off that drive.”

X
This website uses cookies to enhance user experience and to analyze performance and traffic on our website. We also share information about your use of our site with our social media, advertising and analytics partners. Learn More / Do Not Sell My Personal Information
Accept Cookies
X
Cookie Preferences Cookie List

Do Not Sell My Personal Information

When you visit our website, we store cookies on your browser to collect information. The information collected might relate to you, your preferences or your device, and is mostly used to make the site work as you expect it to and to provide a more personalized web experience. However, you can choose not to allow certain types of cookies, which may impact your experience of the site and the services we are able to offer. Click on the different category headings to find out more and change our default settings according to your preference. You cannot opt-out of our First Party Strictly Necessary Cookies as they are deployed in order to ensure the proper functioning of our website (such as prompting the cookie banner and remembering your settings, to log into your account, to redirect you when you log out, etc.). For more information about the First and Third Party Cookies used please follow this link.

Allow All Cookies

Manage Consent Preferences

Strictly Necessary Cookies - Always Active

We do not allow you to opt-out of our certain cookies, as they are necessary to ensure the proper functioning of our website (such as prompting our cookie banner and remembering your privacy choices) and/or to monitor site performance. These cookies are not used in a way that constitutes a “sale” of your data under the CCPA. You can set your browser to block or alert you about these cookies, but some parts of the site will not work as intended if you do so. You can usually find these settings in the Options or Preferences menu of your browser. Visit www.allaboutcookies.org to learn more.

Sale of Personal Data, Targeting & Social Media Cookies

Under the California Consumer Privacy Act, you have the right to opt-out of the sale of your personal information to third parties. These cookies collect information for analytics and to personalize your experience with targeted ads. You may exercise your right to opt out of the sale of personal information by using this toggle switch. If you opt out we will not be able to offer you personalised ads and will not hand over your personal information to any third parties. Additionally, you may contact our legal department for further clarification about your rights as a California consumer by using this Exercise My Rights link

If you have enabled privacy controls on your browser (such as a plugin), we have to take that as a valid request to opt-out. Therefore we would not be able to track your activity through the web. This may affect our ability to personalize ads according to your preferences.

Targeting cookies may be set through our site by our advertising partners. They may be used by those companies to build a profile of your interests and show you relevant adverts on other sites. They do not store directly personal information, but are based on uniquely identifying your browser and internet device. If you do not allow these cookies, you will experience less targeted advertising.

Social media cookies are set by a range of social media services that we have added to the site to enable you to share our content with your friends and networks. They are capable of tracking your browser across other sites and building up a profile of your interests. This may impact the content and messages you see on other websites you visit. If you do not allow these cookies you may not be able to use or see these sharing tools.

If you want to opt out of all of our lead reports and lists, please submit a privacy request at our Do Not Sell page.

Save Settings
Cookie Preferences Cookie List

Cookie List

A cookie is a small piece of data (text file) that a website – when visited by a user – asks your browser to store on your device in order to remember information about you, such as your language preference or login information. Those cookies are set by us and called first-party cookies. We also use third-party cookies – which are cookies from a domain different than the domain of the website you are visiting – for our advertising and marketing efforts. More specifically, we use cookies and other tracking technologies for the following purposes:

Strictly Necessary Cookies

We do not allow you to opt-out of our certain cookies, as they are necessary to ensure the proper functioning of our website (such as prompting our cookie banner and remembering your privacy choices) and/or to monitor site performance. These cookies are not used in a way that constitutes a “sale” of your data under the CCPA. You can set your browser to block or alert you about these cookies, but some parts of the site will not work as intended if you do so. You can usually find these settings in the Options or Preferences menu of your browser. Visit www.allaboutcookies.org to learn more.

Functional Cookies

We do not allow you to opt-out of our certain cookies, as they are necessary to ensure the proper functioning of our website (such as prompting our cookie banner and remembering your privacy choices) and/or to monitor site performance. These cookies are not used in a way that constitutes a “sale” of your data under the CCPA. You can set your browser to block or alert you about these cookies, but some parts of the site will not work as intended if you do so. You can usually find these settings in the Options or Preferences menu of your browser. Visit www.allaboutcookies.org to learn more.

Performance Cookies

We do not allow you to opt-out of our certain cookies, as they are necessary to ensure the proper functioning of our website (such as prompting our cookie banner and remembering your privacy choices) and/or to monitor site performance. These cookies are not used in a way that constitutes a “sale” of your data under the CCPA. You can set your browser to block or alert you about these cookies, but some parts of the site will not work as intended if you do so. You can usually find these settings in the Options or Preferences menu of your browser. Visit www.allaboutcookies.org to learn more.

Sale of Personal Data

We also use cookies to personalize your experience on our websites, including by determining the most relevant content and advertisements to show you, and to monitor site traffic and performance, so that we may improve our websites and your experience. You may opt out of our use of such cookies (and the associated “sale” of your Personal Information) by using this toggle switch. You will still see some advertising, regardless of your selection. Because we do not track you across different devices, browsers and GEMG properties, your selection will take effect only on this browser, this device and this website.

Social Media Cookies

We also use cookies to personalize your experience on our websites, including by determining the most relevant content and advertisements to show you, and to monitor site traffic and performance, so that we may improve our websites and your experience. You may opt out of our use of such cookies (and the associated “sale” of your Personal Information) by using this toggle switch. You will still see some advertising, regardless of your selection. Because we do not track you across different devices, browsers and GEMG properties, your selection will take effect only on this browser, this device and this website.

Targeting Cookies

We also use cookies to personalize your experience on our websites, including by determining the most relevant content and advertisements to show you, and to monitor site traffic and performance, so that we may improve our websites and your experience. You may opt out of our use of such cookies (and the associated “sale” of your Personal Information) by using this toggle switch. You will still see some advertising, regardless of your selection. Because we do not track you across different devices, browsers and GEMG properties, your selection will take effect only on this browser, this device and this website.