Mobile phones seized in US criminal investigations are being sold online with personal data like emails, bank details and nude photos intact. Security experts warn that the practice enables hackers to buy phones and commit the same crimes as the previous owner, with the same data and victims.
Various US states have laws allowing police forces to dispose of lost-and-found items if they aren’t collected within a certain time, as well as devices that were used in criminal investigations or seized from criminals.
and his colleagues at the University of Maryland bought 228 mobile phones that were being disposed of by different police departments from the auction site PropertyRoom, paying an average of just $18.
Advertisement
Although many of the phones were protected by a PIN, the researchers were able to access 61 of them: 49 weren’t locked at all and another 11 used common passcodes that were easily guessed. One phone even arrived with a police note listing the PIN, apparently having been broken into with used by law enforcement agencies to extract data from protected devices.
One phone, which the team believes had been used by an identity fraudster, had 24 credit reports stored inside, with the identity, bank account details, employment record and social security numbers linked. Other phones had stored credit card details, both stolen and not. Scans of five passports and 14 driver’s licences were also found. Several phones had images of government-issued IDs and some included communication between sex workers and clients.
As well as the financial and identity information, the team found personal data including nude photographs, messages to friends and family and web browsing histories.
“If these phones aren’t being handled properly, you risk creating this cycle of people who are already victims of identity theft or some other crime having their data recirculating,” says Roberts. “I think there’s a clear problem at the police department level, because PropertyRoom runs the largest online police auction house in the US, but it’s not the only place. So if this problem was trickling down to them, it’s likely trickling down through to other places too.”
Roberts says that these kind of phones should either be destroyed or comprehensively wiped. “No one should have their information be sold in this manner, including people who did commit criminal acts. It’s not just their data; it’s everyone that they interacted with,” he says. “We have every text message they send to every person they know; we have every email they send to every person; we have their phone call history.”
The researchers also scoured online auction listings from a two-year period and found images showing written-down PINs, owners’ names and phone numbers and even evidence stickers detailing how the phones were obtained and the names of the officers involved in the cases.
at the University of Manchester, UK, says he either keeps or destroys his old phones, and that leaking personal information puts the owner at risk of fraud and other crimes. “If it was OK to trade in this kind of equipment, there wouldn’t be a whole line of business designed to not only wipe devices, but to actually, in some cases, shred them into tiny little pieces,” he says. “If a company was caught doing this in the UK, they could face huge fines.”
A PropertyRoom spokesperson said in a statement: “PropertyRoom.com has always had policies and processes in place to wipe working smartphones before going to auction and auction other non-working phones sold for parts only. We do our best to continuously review our processes to ensure they are keeping up with the fast-changing digital landscape. We have updated our processes to ensure that no smartphones or electronics will be auctioned on PropertyRoom.com that aren’t wiped, locked, reset to factory settings, or hard drives/storage drives removed and destroyed.”
Reference: R. Roberts et al, preprint ()
