No Privacy in the Electronics Repair Industry
Extracted source text · arXiv 2211.05824
\documentclass[conference,compsoc]{IEEEtran}
\usepackage{array}
\usepackage{cite}
\usepackage{epsfig,endnotes}
\usepackage{xcolor,colortbl}
\usepackage{amsmath}
%\usepackage[pdftex]{graphicx}
\usepackage[caption=false,font=footnotesize,labelfont=sf,textfont=sf]{subfig}
\usepackage{url}
\def\UrlBreaks{\do\/\do-}
\usepackage{booktabs}
\usepackage{hhline}
\usepackage{tikz}
\usepackage{amssymb}
\usepackage[bookmarksnumbered,pdftex,pdfpagelabels=true,pagebackref=false]{hyperref} % with basic options
\hypersetup{
plainpages=false, % needed if Roman numbers in frontpages
% UH: needs to be in initialization statement
% pdfpagelabels=true, % adds page number as label in Acrobat's page count
% UH: needs to be in initialization statement
% bookmarks=false, % show bookmarks bar?
unicode=false, % non-Latin characters in Acrobat's bookmarks
pdftoolbar=true, % show Acrobat's toolbar?
pdfmenubar=false, % show Acrobat's menu?
pdffitwindow=false, % window fit to page when opened
pdfstartview={FitH}, % fits the width of the page to the window
% Mimicry Attacks on Keystroke Authentication on Smartphones
pdftitle={No Privacy in the Electronics Repair Industry}, % title: CHANGE THIS TEXT!
pdfauthor={Jason Ceci, Jonah Stegman, and Hassan Khan}, % author: CHANGE THIS TEXT! and uncomment this line
% pdfsubject={Subject}, % subject: CHANGE THIS TEXT! and uncomment this line
% pdfkeywords={keyword1} {key2} {key3}, % list of keywords, and uncomment this line if desired
pdfnewwindow=true, % links in new window
colorlinks=true, % false: boxed links; true: colored links
linkcolor=blue, % color of internal links
citecolor=blue, % color of links to bibliography
% filecolor=magenta, % color of file links
urlcolor=blue % color of external links
}
\def\changemargin#1#2{\vspace{1pt}\list{}{\rightmargin#2\leftmargin#1}\item[]}
\def\endchangemargin {\endlist \vspace{1pt}}
\newcommand{\subhead}[1]{\vspace {0.25pt}\noindent{\textbf{#1.}}}
\def\Q{\vspace{-1.5pt}\list{}{\rightmargin 0.25cm\leftmargin 0.25cm}\item[]}
\def\endQ {\endlist \vspace{-1pt}}
\makeatletter
\newcommand*{\radiobutton}{%
\@ifstar{\@radiobutton0}{\@radiobutton1}%
}
\newcommand*{\@radiobutton}[1]{%
\begin{tikzpicture}
\pgfmathsetlengthmacro\radius{height("X")/2}
\draw[radius=\radius] circle;
\ifcase#1 \fill[radius=.6*\radius] circle;\fi
\end{tikzpicture}%
}
\makeatother
% commenting
\newenvironment{SUBENVccomment}[2]{\color{#1}[#2:]~}{\color{black}}
\newcommand{\ccomment}[3]{\begin{SUBENVccomment}{#1}{#2}~#3\end{SUBENVccomment}}
\definecolor{author1}{rgb} {0.9,0.5,0.0}
\definecolor{author2}{rgb} {0.6,0.0,0.8}
\definecolor{author3}{rgb} {1.0,0.4,0.0}
% comments on
\newcommand{\jas}[1]{\ccomment{author1}{JA}{#1}}
\newcommand{\hk}[1]{\ccomment{author2}{H}{#1}}
\newcommand{\jon}[1]{\ccomment{author3}{JO}{#1}}
\newcommand{\new}[1]{\textcolor{black}{#1}}
\begin{document}
%Policy-less, Protocolless, Privacyless:
%\title{Privacy in the Electronic Repair and Services Industry}
%\title{In Need of Repairs: Privacy in the Electronics Repair Industry}
\title{No Privacy in the Electronics Repair Industry*}
%\nocopyright
%Will someone think about
% author names and affiliations
% use a multiple column layout for up to three different
% affiliations
\author{\IEEEauthorblockN{Jason Ceci, Jonah Stegman, Hassan Khan}
\IEEEauthorblockA{University of Guelph\\
\{jceci, jstegman, hassan.khan\}@uoguelph.ca
}}
\maketitle
%\pagenumbering{arabic}
\thispagestyle{plain}
\pagestyle{plain}
\begin{abstract}
%The annual global electronic repair and service industry is valued at over \$19B.
%Mom-and-pop and big-box stores
Electronics repair and service providers offer a range of services to computing device owners across North America---from software installation to hardware repair.
Device owners obtain these services and leave their device along with their access credentials at the mercy of technicians, which leads to privacy concerns for owners' personal data.
We conduct a comprehensive four-part study to measure the state of privacy in the electronics repair industry.
First, through a field study with 18 service providers, we uncover that most service providers do not have any privacy policy or controls to safeguard device owners' personal data from snooping by technicians. %\jas{might not be considered a naturalistic observation as we "intervene" with the script} \jon{I agree that this isn't a naturalistic observation study as we effect the variability by asking specific things with the script.}
Second, we drop \emph{rigged} devices for repair at 16 service providers and collect data on widespread privacy violations by technicians, including snooping on personal data, copying data off the device, and removing tracks of snooping activities.
Third, we conduct an online survey (n=112) to collect data on customers' experiences when getting devices repaired.
Fourth, we invite a subset of survey respondents (n=30) for semi-structured interviews to establish a deeper understanding of their experiences and identify potential solutions to curtail privacy violations by technicians.
We apply our findings to discuss possible controls and actions different stakeholders and regulatory agencies should take to improve the state of privacy in the repair industry.
%Finally, we provide suggestions for device manufacturers, operating system developers, and repair service providers on how to improve privacy, trust, and convenience in the electronics repair industry.
%The electronic repair industry provides economical and environmental benefits however, the privacy issues around
%Our findings show that most electronic repair stores do not have any privacy policy or controls to ensure that the device owner's personal data is protected from snooping. With a few exceptions, device owners were required to provide access credentials for a device repair job that did not require access to the device. Furthermore, technicians often snooped on device owners' personal data and in a few cases copied this data from the device.
%In the past two decades, we have seen enormous growth in consumer adoption of personal electronic devices. To this end, we conduct a comprehensive three-phase study to determine the current state of privacy policies in the device repair industry, the rate that privacy breaches occur in the industry and to explore consumer experiences with privacy during previous repairs. We find that many repair centres collected authentication credentials during repairs that should not require them and often stored the collected credentials insecurely, increasing the probability of a privacy breach. (Insert about phase 2 and 3) We provide suggestion for repair centres in the form of policy-based improvements, as well as provide suggestions for consumers to reduce their risk.
\end{abstract}
\maketitle
\input{01.introduction}
\input{02.Related_work}
\input{03.Methodology}
\input{04.Part-1}
\input{05.Part-2}
\input{06.Survey}
\input{07.Interview}
\input{08.Discussion}
\input{09.Limitation}
\input{10.Conclusion}
\section*{Acknowledgements}
This material is based upon work supported by NSERC under Grant No. RGPIN-2019-05120.
\bibliographystyle{IEEEtranS}
\bibliography{references}
%\clearpage
\input{11.Apendix}
\end{document}
\section{Related Work}
\label{sec:related_work}
Researchers have explored privacy concerns of device owners when sharing their devices temporarily with acquaintances~\cite{hang2012too,mazurek2010access,matthews2016she,karlson2009can} and when there is unauthorized physical access to personal devices by acquaintances~\cite{marques2019vulnerability}. Existing security controls are available that enable secure temporary device sharing (e.g., guest accounts~\cite{androidguestaccounts}).
However, these security controls are not designed to protect from technicians, who often need administrative access to the device.
Researchers and regulatory authorities have uncovered poor privacy practices at electronic retailers when refurbishing used devices~\cite{opc_report, ceci2021concerned}.
While these retailers may be providing repair services, the customer's intent is not to get the device repaired.
Some researchers have explored the knowledge and skills of technicians~\cite{jackson2012repair, jackson2014breakdown} and how the repair infrastructures are set up in \new{low income} countries~\cite{jang2018crowdsourcing, jang2019trust}.
However, these works do not explore the customers' privacy aspects.
%Therefore, we only discuss works that are related to the investigation of privacy in the electronics repair industry.
While news articles abound on privacy violations (see \S~\ref{sec:introduction}), the state of customers' privacy in the repair industry has not received a holistic academic treatment.
The only work on this subject is from Ahmed et al.~\cite{ahmed2016privacy}, where the authors' goal was to ``improve the practices surrounding the repair of digital artifacts in developing countries.'' The authors conducted this study in Bangladesh. Through an ethnographic study, a researcher interned at a smartphone repair shop for three months to note the technician and customer interactions.
This was coupled with an online survey and semi-structured interview to understand customers' privacy concerns. They found that technicians often snoop and sell the personal data of customers. Furthermore, while some customers reported their suspicions of possible privacy violations, a lack of understanding around privacy and repair was common among participants. Finally, they collected feedback on an Android application, which flagged privacy violations by logging which apps were used during repair. % along with timestamps.
Ahmed et al.'s investigation focuses on a \new{low or middle income} country and privacy in the context of smartphones repairs only. There are considerable differences between \new{high and low income} countries when it comes to the use of technology~\cite{sawaya2017self, vashistha2018examining, redmiles2019should} and privacy expectations and regulations~\cite{mare2017security, ahmed2016privacy}.
With the media coverage and subsequent promises from some service providers in the US~\cite{bbc_apple_snooping,bestbuy_privacy}, in addition to measuring customers' perceptions, it is important to understand the existence and communication of policies and controls to protect customers' privacy.
%Privacy in Repair: An Analysis of the Privacy Challenges Surrounding Broken Digital Artifacts in Bangladesh
%-Study on personal device repair in Bangladesh
%-Interviewed people that got devices repaired
%In 2016, Ahmed et al. conducted a series of online surveys and interviews to better understand peoples experiences during an electronics repairs in Bangladesh.
%-Anecdotes of selling pornography, 3 cases where individuals were aware of repair tech accessing their devices, commenting on apps they use, etc.
%-Repair in Bangladesh where privacy law is missing, privacy policies are scarce, little legal recourse after a privacy breach, small 1 person repair shops.
%-Lack of Ethical Privacy Principles - "When we asked the repairers how they felt about looking at such content, we found that none felt he was doing anything wrong"
%As privacy during personal device repairs is a previously unexplored domain, here we focus on the privacy preferences of consumers and the legal privacy rights of consumers.
%Privacy Preferences Consumers
%https://www.microsoft.com/en-us/research/wp-content/uploads/2009/04/PhoneSharingCHI2009.pdf
%-Features of "Guest Mode" consumers would want when sharing their phone. Relevent as they likely wouldn't want technicians touching any of the sensitive data.
%https://www.ftc.gov/es/system/files/documents/public\_comments/2013/12/00007-89101.pdf
%-Different data "willingness to lend phone" and Law enforcement. 90\% would definitely not allow a stranger to use their phone.
\section{Study Design}
\label{sec:design}
%A review of related works shows that the privacy aspects surrounding the electronics repair industry have not been explored in North America.
%The main objective of this research effort is to investigate the following questions:
\new{We aim to investigate the following questions:}
\begin{enumerate}\itemsep0em
\item[RQ1] Does the electronic repair industry have privacy policies or procedures to safeguard customers' data? If so, how are those policies or procedures communicated to customers?
\item[RQ2] Do repair service providers only request access to resources that are needed?
\item[RQ3] Do service technicians access customers' data? If so, how widespread is this issue, and what type of violations are common?
\item[RQ4] What are customers' understanding of risks around device repairs, and how does it influence their device repair decisions and repair preparations?
\item[RQ5] What solutions are viable to improve the state of privacy in the electronics repair industry?
\end{enumerate}
There are several challenges to our investigation.
Service providers are of various sizes and different service providers may have different maturity levels and corporate oversight.
A holistic investigation should investigate these research questions across different service providers.
%Second, customers may be different in terms of their technology proficiency and gender. The former difference may contribute to the use of a control to protect their data and latter may be subject to more snooping (as evident by the cases reported in \S~\ref{sec:introduction}). An investigation of our research questions needs to take these factors into account.
Moreover, customers may need different types of repairs or services. Some services may only need access to the device hardware, while some services may require access to the device OS. The type of access required may change for different device types for the same service. To collect meaningful data, it is important to carefully choose the appropriate device and service.
To find answers to these questions, we conducted a four-part study.
The first part of the study collected data on RQ1 and RQ2 by initiating repairs at various service providers.
%During the first part, we dropped personal devices for battery replacement. We choose such devices that did not require access to the device OS. During the device drop-off, the researchers collected data on the availability and communication of privacy policy, and request for the device access credentials.
Note that the first part required the investigator to ask the technicians about the existence of privacy policies. This may have influenced the technicians' interaction with the device.
Therefore, to investigate RQ3, we collected data using a separate study. For the second part, we had \emph{rigged} devices repaired that logged all the interactions of technicians during the repair process.
%To this end, we \emph{rigged} a Windows laptop to log all actions of the user. The audio driver on this device was disabled and the device was dropped for a repair service to get the audio issue fixed. After the completion of the service, the logs were analyzed to note if any privacy violations were perpetrated by the repair technicians and of what type.
Next, we conducted an online survey (n=112) for RQ4, which measured the respondents' understanding of risk perceptions, how it influenced their repair decision, safeguards they employed when getting the device repaired, and any privacy violations they noticed for the repair services that they requested. The findings were enriched, and RQ5 was investigated through a follow-up interview with a subset of survey participants (n=30).
%\new{We first cover aspects common to different parts.\jon{what does aspects common to different parts refer too? Does this refer to different sections of the paper? or different parts of the study?}
We document the recruitment process, study procedure, and results separately for the four parts in their respective sections. % \new{See \S~\ref{subsec:ethics} for a detailed description on how Parts 1 and 2 were conducted ethically.}
%}
\subhead{Controlling Confounding Factors}
We used various measures to control confounding factors.
For different parts of the study, an investigator never revisited the same service provider.
The investigators did not provide their real names at the device drop-off in case the technicians searched their names on the Internet to uncover that the investigators were security researchers.
We used different devices for different branches of service providers and different devices for different parts of the study to ensure that a record of the device did not exist in the service providers' central database.
Finally, the advertisement and recruitment for the survey and interview strictly began after the conclusion of the first two parts. This order ensured that we did not influence the behaviour of the technicians due to the knowledge of this study.\looseness=-1
\subhead{Choosing Repair Service Providers}
The first two parts of the study require interactions with the service provider.
We divided service providers into three categories.
A \emph{``National''} service provider is a big-box store that is a subsidiary of a publicly traded organization across North America.
A \emph{``Regional''} service provider is a store of a larger chain that has stores across more than two cities.
A \emph{``Local''} service provider is a service provider local to the city, is operating at a commercial location (i.e., not operating out of their home) and has a business license. When choosing local service providers, we only selected those service providers who had a website and a Google Maps rating of 3.5 stars or higher.
\subhead{Ethical Considerations}
\new{
We received approval from our institutional IRB for all four parts of the study. Part-3 and Part-4 required informed consent, PII anonymization, and allowing participants to withdraw their data up to two weeks after the study.
Part-1 and Part-2 required covert observations to study the policies and procedures of the service providers, which are \emph{commercial entities}. We did not collect any personally identifiable information about the technicians or representatives. To avoid influencing the behaviour of the technicians, we did not obtain informed consent, Part-1 required limited disclosure, and Part-2 required deception.
We strictly adhered to the guidelines in Canada's Tri-Council Policy Statement (TCPS-2)~\cite{tcps2} for covert observation studies where informed consent could not be obtained. To this end, several necessary measures were used to address privacy and confidentiality issues.
To protect the privacy of the repair technicians, we securely deleted all data where the technician may have used the device to view personal data (e.g., accessing a personal website or personal file on an external drive).
Second, all location tracking and additional information collection in the OS were disabled. After each experiment, only logs relating to privacy violations and covering tracks (e.g. removing logs or clearing ``recent files'') were retrieved before reimaging the device.
Third, we anonymized the collected data and only report the type of service provider (national, regional, or local) without disclosing which of the three cities the service provider belonged to. %The methodology (see \S~\ref{sec:2-methodology}) was described as it was performed to our IRB.
}
\new{
We chose to not debrief the service providers for several reasons (as permitted by TCPS-2).
Previous incidents of technicians' misconduct have resulted in the technician losing their job. %While we did not provide real names to the service providers, they would have the phone number (on the repair ticket) and credit card information (provided at the time of pickup) of the researcher.
Informing the service providers that they were a part of this study, regardless of anonymization assurances, may cause them to feel threatened and potentially retaliate.
Our experiment was designed to pose minimal risk to the technician and their privacy. The technicians were paid for their services and there is no expectation of privacy for the repair actions taken on the experimenter's device (we do not disclose any repair procedures). Given the minimal risks to technicians, a debrief provides little advantage.
On the contrary, disclosing the study to technicians who may have committed privacy violations may lead to psychological and social harms including feeling ashamed, a fear of social stigma, and guilt. There are precedents~\cite{finn2007designing, smith1975faith, chiou2012new} on not debriefing participants in technology and social science research for these reasons. For instance, Finn and Jakobsson did not debrief participants of their phishing experiment as ``[The subjects] may feel upset, anxious, or angry that they were fooled''~\cite{finn2007designing}. Interested readers are referred to the work by Roulet et al.~\cite{roulet2017reconsidering} for a discussion on consent and debriefing in covert participation experiments and several precedents in the social sciences domain.
While unconventional, our experiment design enables us to conduct legitimate privacy research in the public interest, which was otherwise not possible and which has the potential to improve the state of privacy, particularly for novice users who often engage with these service providers.}
\section{Part-1: Privacy Policies and Protocols}
\label{sec:part1}
The first part of the study was conducted from August 2021 to September 2021. The main objectives were to measure: (1) the existence and communication of privacy policies to safeguard customers' data; %(2) the communication of privacy policies or protocols to safeguard customers' data;
and (2) what information is collected for a repair procedure that does not require access to the device OS.
\subsection{Procedure}
To study the privacy policies and protocols, we visited eleven service providers---three national, three regional, and five local service providers. We also report our findings for two national smartphone repair service providers and for five device manufacturers. % in \S~\ref{subsub:smartphone_repair}.
We only visited one store for the national and regional service providers as we expected the existence and communication of policies to be the same across different stores of the same service provider.
%Note that we also investigated the policies and procedures by device manufacturers and for smartphone repair and discuss those in \S~\ref{subsec:part1_results}.
For the repair service, we chose battery replacement for Asus UX330U laptops as its battery replacement only required removal of the back of the device and the device BIOS provided all the details about the battery health. Therefore, it can be argued that the technicians did not need access to the device OS for diagnosis, replacement, or verification of the repair.
Understandably, several repair or service procedures do require access to the device OS, which leaves no option for the customer but to provide their credentials. For such repair procedures, our findings on the safeguards adopted by the service providers are of relevance. % to protect customers' data during our interaction. %Note that the device had a BIOS interface that provides details about the battery health.
%For smartphone, we chose Samsung S8. We chose device battery replacement as the
A script was prepared for the drop-off. % .
%The researcher approached the technician and told them that the ``device battery was having issues and it may need replacement''.
The researcher was required to look for any notice that outlined the privacy policy and take a picture of it right before leaving. %(The researcher was also required to take a picture of this notice right before leaving.)
The researcher was then required to explain the issue (``the battery is dying and needs replacement'') and make a mental note of the technician's requests and questions. If the technician asked for credentials, the researcher asked them why it was needed and how customers' data would be protected. After providing the credential, the researcher noted how it was stored. Finally, the researcher asked about any privacy policies and protocols to safeguard customers' data (``how do you make sure no one will access my personal data?''). Within ten minutes after the drop-off, the researcher completed a survey documenting their experience (see Appendix~\ref{app:reconnaissance_survey}).
%In stage one, we visited repair shops and attempted to get a battery replaced on either a phone or laptop. This type of repair was chosen as it should not require the technician gain access to the users personal data. Therefore, no pin or password should be required by the shops. Additionally, a device with a bad battery can still appear normal so any device that was brought in could have this problem. To ensure that the technicians didn't need access to the software of the computer we ensured the places that we only wanted the battery replaced. Not a diagnostic scan to see if the device needed a new battery. While going through the process of the repair questions surrounding security policies and procedures were asked. Specifically, around if there was a security policy and why a pin/password is required if it was requested by the technician. Additionally, we looked for any policies or procedures that the shops had posted. Within 10 minutes of leaving the store we would fill out a survey that asked about the shops procedure and would note down anything else of concern. We would then re-enter the store and try to cancel the repair. This was done in order to save money as we didn't need the actual device to be fixed.
%Add "Quotations are from repair centre representatives unless otherwise noted." Add about some manufacture repairs being initiated online (requirement)
%\begin{table}[t]
%\caption{Repair Centres}
%\label{tab:1-RepairCenters}
%\centering
%\small\addtolength{\tabcolsep}{-3.75pt} \renewcommand{\arraystretch}{1.05}
%\begin{tabular}{cccc}
%\multicolumn{4}{c}{{\bf n = 16}} \\ \hline
%\multicolumn{4}{c}{{\bf Centre Type}} \\
%\emph{Local} & \emph{Regional} & \emph{National} & \emph{Manufacturer} \\
%4 & 6 & 3 & 3 \\ \hline
%\multicolumn{4}{c}{{\bf Device Type}} \\
%&\emph{Laptop} & \emph{Smartphone}& \\
%&13 & 3& \\ \hline
%
%\end{tabular}
%
%\end{table}
\subsection{Results}
\label{subsec:part1_results}
For qualitative analysis of technicians' responses (e.g., response to ``how customers' data was protected''), we performed thematic analysis to identify themes (see details on thematic analysis in \S~\ref{subsec:interview_results}). The quotes from the technician were recalled by the researcher and are not verbatim. %For details on how this thematic analysis was conducted, see \two researchers independently performed thematic analysis to identify themes. The identified themes were discussed and compared by reviewers until consensus was reached. Several other researchers in the field have used this approach (e.g., Acar et al.~\cite{acar2017internet}). %For the qualitative data from interviews, we provide representative quotes from participants for different themes. When presenting quotes, we also identify the number of participants who expressed that theme.
\subhead{Privacy Policies}
None of the service providers posted any notice informing customers about their privacy policies. Similarly, until the devices were handed over, no researcher was informed about a privacy policy, their rights as a customer, or how to protect their data.
%None of the repair centres had posted repair privacy policies or had discussed the presence of a privacy policy with our researchers prior to initiating a repair.
After the devices were handed over, only three national and three regional service providers % (2 manufacturers and 2 national)
provided a terms and conditions document for the customer's signature. % that was required to be signed by the person dropping off the device.
However, these terms and conditions only communicated that the service provider was not liable for the loss of the customer's data and that the customer was responsible for backing up their data. No document listed any safeguards on how customers' data was protected, or the steps customers should take to safeguard their data from snooping.
All three national service providers provided a link to their online privacy policy, which was a generic policy on data collection and retention (i.e., not specific to electronics repair services). %In terms of data privacy, only one regional service provider mentioned that the customers' data will not be shared with third parties were largely related to privacy or data loss and ranged from
%requiring the user remove confidential information to allowing subcontractors to work on the device \hk{@JC where did you find this?}
%\begin{changemargin}{0.5cm}{0.5cm}
% \textit{"[] may utilize subcontractors in the performance of service... } (N2 - Drop off Form)
%\end{changemargin}
\subhead{Access to Credentials}
All but one repair service provider asked for the credentials to the device OS---a regional service provider was the only exception.
When technicians asked for the credentials, the researcher asked why it was needed.
All three national service providers \emph{needed} the credentials for repairs regardless of the service as it was a part of the ``paperwork'' (\textit{``We need the password for all repairs.''} (National-1)).
Technicians from one local and two regional service providers said that they needed the credentials to run diagnostics.
Technicians from four local service providers said that they needed it for the verification of the performed service.
We asked the technicians if the device battery could be replaced without providing the credentials.
The three national service providers could not take the device without the credentials.
Two regional and two local service providers agreed to do it but informed the researcher that they would not be able to verify their work and would not be responsible for the quality of their work.
Finally, one local service provider asked the researcher to remove the password if they did not want to share it, and one local service provider told the researcher that if the password was not provided, they would reset the device if required.
\subhead{Storage of Access Credentials}
Users widely reuse their credentials~\cite{das2014tangled}. It is possible that the password shared with the technicians is reused elsewhere~\cite{khan2020widely}.
For the repair service, the customer has to provide the password along with their name, contact number, and email address.
After providing this information to the technicians, the researcher noted how this information was stored.
All three national service providers stored this electronically in a database. No information was shared with the customer on who will have access to this information or how long it will be stored.
The three regional service providers stored this information in an electronic database too. Furthermore, two of these service providers printed a label with the customer's name, contact number, and password. This label was pasted on the device and its charger, which was accessible to all staff members.
Finally, for the local service providers, 3/5 put a sticky note with the password on the device itself and 2/5 stored this information in an electronic database.
%\begin{changemargin}{0.5cm}{0.5cm}
% \textit{``We can [do it without the password] but if it does not work properly, they will charge extra to do the same job''} (L2)
%\end{changemargin}
%Six repair centres refused to repair the device if the credentials were not provided. Five of these centres would not repair the device without credentials due to policy requirements while one indicated they could not repair the device without running diagnostics first. Two of the repair centres that refused to repair the device without credentials being provided stated that the credentials could be removed, either by the user or the centre representative as an alternative to providing the credentials.
%\begin{changemargin}{0.5cm}{0.5cm}
% \textit{``No, the form must be signed for the repair and you have to give us the password and fully access to the laptop.''} (R3)
%\end{changemargin}
%In addition to requiring the authentication credentials, the paper work provided at one repair centre (M2) required that confidential and sensitive information be removed from the device prior to the repair. Two repair centres asked for the removal or unlinking of cloud accounts saying it was required perform diagnostics and repair.
\subhead{Protection of Personal Data}
The researcher asked the technician if anyone would access the personal data on the device during the repair. All ten service providers who obtained credentials responded that the personal data would not be accessed, and only the technician working on the problem would access the device. % for diagnosis or repair or verification.
%13/16 repair centres answered no when asked with five indicating they will only perform the repair and not access data, two simply stating they will not access data, two indicating that only a technician will access the device, while four did not request the credentials so they did not have access to the data. Three repair centres answered that personal data may have to be accessed to perform diagnostics.
We asked the technicians how they ensure no one would access data on the device.
Their responses conveyed no indication of a protocol or control to protect access to customers' data.
Their responses were codified \new{and the inter-rater agreement between the two researchers was moderate (Fleiss's $\kappa$ = 0.48)}.
6/10 service providers (including two national service providers) ``reassured'' the researcher. Their responses were similar to: \textit{``The technicians only do the repair and nothing else.''} (National-1).
The response from 4/10 repair service providers was unsatisfactory or a deflection. Two representative responses are provided below:
\begin{Q}
\textit{``It will be sent to a technician elsewhere.''} (Regional-1)
\end{Q}
\begin{Q}
\textit{``It is an honour system. We wouldn't be in business if we were doing that.''} (Local-4)
\end{Q}
%The codified responses for ten repairs where the password was providedshow responses were co With the exception of the four repair centres that did not request authentication credentials, the responses of the repair centre either deflected the question (3/12), reassured the customer (6/12) or did not provide an answer (3/12). The following is an example of response defecting the question:
\subhead{Smartphone Repairs and Device Manufacturers}
%\label{subsub:smartphone_repair}
Most service providers that we investigated for this part of the study repaired both smartphones and computers. We also approached two regional smartphone repair service providers (who only repaired smartphones) to replace the battery of a Samsung S8 smartphone.
Similar to our findings for laptops, the researchers found no notice or communication on the privacy policy and how their data will be protected. One service provider requested the credentials, and the other did not. When the service provider was asked why the credentials were needed, they informed the researcher that it was needed to run the ``Samsung Diagnostic utility.'' When asked how this data would be protected, the service provider reassured the researcher that no one would look at customers' personal data.
An interesting aspect to note is that the terms of service of this regional service provider contradicted their reassurance:
\begin{Q}
\textit{``[Redacted name] will not treat data on your device as confidential and disclaims any agreement with you or other obligation to do so.''} (Regional-4)
\end{Q}
%\hk{@Jonah: regional vs local?}
%\jon{Though service providers make these claims, some of their policies directly contradict this. One service providers policy stated \textit{``[Repair place] will not treat data on Your Device as confidential and disclaims any agreement with you or other obligation to do so.''}(regional)
We also contacted six laptop manufacturers and requested a repair for their brand of devices.
One manufacturer had outsourced repairs to two national service providers, so we exclude it from the following results.
The mail-in instructions that the manufacturers provided were studied to see their policies on safeguarding customers' data and collection of credentials.
All device manufacturers stated that they had the right to delete all data on the device.
4/5 manufacturers suggested that the user should back up their device prior to mailing.
All generic mail-in instructions required credentials and contained warnings to the effect of:
\vspace{-1em}
\begin{Q}
\textit{``Failure to provide your username and password may delay or prevent us from completing your repair. You may also remove the system password prior to shipping the unit instead of providing it above.''} (Manufacturer-2)
\end{Q}
Such statements from the manufacturers leave little room for those customers whose device repair could be completed without access to the device OS.
Finally, none of the mail-in instructions listed any mechanisms that customers could use to safeguard their sensitive data before sending the device.
%Quote:
%Apple, Samsung
%Dell, Lenovo, Asus
\section{Part-2: Privacy Violations During Repair}
\label{study2}
The second part of the study was conducted from October 2021 to December 2021. The purpose of the second part was to collect data on privacy violations during repairs. There are several factors that influence this data collection that are not controllable. First, a technician with the intent to snoop may not get the opportunity to do so due to the presence of other individuals around them or deadlines. Second, only select technicians may be involved in snooping, and they may not get the device dropped off by the researcher for the repair service. Consequently, to concretely establish that privacy is ``regularly'' violated at a service provider, we need to collect a large number of samples. Since this requirement has obvious logistical issues, we only present our results for a limited number of device repairs.
\subsection{Methodology}
\label{sec:2-methodology}
We bought new laptops with Microsoft Windows 10 and disabled the audio driver on these laptops. We chose the audio issue as: (1) it was a simple and cheap repair; (2) it did not require access to users' files (unlike software installation or Virus removal); and (3) the problem was easy to create (i.e., disabling the driver).
A total of six devices were used in this experiment. Three devices were configured with a male persona, and three were configured with a female persona.
We set up email and gaming accounts, and populated browser history across several weeks. We added documents, pictures from the experimenters, and a cryptocurrency wallet with credentials.
\new{We also added female-coded revealing pictures. Female-coded pictures were used as most of the recently reported privacy violations were committed against females~\cite{apple_snooping, mobile_snooping,geeksquad_snooping}. Furthermore, researchers have shown that female and non-binary individuals are more likely to face issues from non-consensual image sharing, like a technician accessing devices~\cite{lenhart2016nonconsensual,geeng2020usable}.
%The revealing pictures were obtained from two Reddit users.
We reached out to verified Reddit posters on the ``r/GoneMild/'' subreddit, where posters post revealing pictures without any nudity.
Other researchers \cite{vandernagel2013faceless, shelton2015online, matzen2017streetstyle} have previously used and published pictures from the ``r/GoneWild/'' subreddit and discussed the best practices to ensure posters' anonymity~\cite{vandernagel2013faceless}. We followed these practices and shortlisted those posters who were verified, and whose posts did not contain their face, identifying features (tattoos, backgrounds), or any watermarks.
Two out of seven posters responded to our message and gave us permission to use their photos ``for research with the possibility that their photos could be viewed or copied by a computer technician operating in Ontario, Canada''.
The names and metadata of the images were scrubbed before use.
}\looseness=-1
We appropriately tweaked the content to reflect the male or female personas. %These tweaks include the email addresses, device usernames, and the choice of the folder name for revealing pictures (``selfies'' for the female and ``Cindy'' for the male persona),.
After preparing the devices, they were imaged, and these images were deployed before each drop-off. We developed a logging utility which is a wrapper on the Windows Problem Steps Recorder~\cite{psr}. Windows Problem Steps Recorder can execute in the background (through CLI) and captures the screen on every mouse click. It also records the keys pressed by the user. Our logging utility executed in the background as a Windows process and logged all interactions (referred to as ``interaction logs'') of the technicians. In addition, we enabled Windows Audit Policy to log access to any file on the device.
We targeted two national, two regional, and eight local service providers.
We considered two branches for each national and regional service provider. %---one for the male and the other for the female experimenter.
%The eight local service providers were balanced between the male and female experimenters.
The repair requests were gender-balanced. % to study if one gender was more susceptible to these attacks. %The assignment decision between the male and female experimenter was made based on the distance between the service provider and the experimenter's residence.
% In stage two, we brought laptops to repair shops in all three categories and stated that the audio didn't work; which was due to a audio driver that was disabled. This type of issue was chosen as it would require technicians to access the data on the laptops. The purpose of getting the technician to access the data on the device was to see if any unauthorized accessed was done. We define unauthorized access as accessing any information on the device that isn't required for the repair. This could be things such as opening documents, pictures or copying any data. To ensure that there was no gender bias drop offs were split 50/50 males to females for each category of shops. The same laptop was never dropped off twice at the same shop. Additionally, this split allowed us to see if gender played any role in technicians accessing unauthorized data. To see if any unauthorized access occurred laptops dropped off were configured with windows logging and windows step recorder enabled. These tools allowed us to see exactly what was accessed and done on the device during the repair. After the device was picked up from the repair shop the windows and step recorders logs were copied off of the computer.The laptops were also set up with honey pot data that covered 4 different categories (financial, personal documents, photos, and passwords). The laptops data was also split 50/50 male to female. This included accounts, names, and photos. Through these drop offs we were able to see the repair shops policies and procedures in action to see if they were being properly followed. Also, this allowed us to reveal problems with the privacy procedures that are in place by all of these shops.
\begin{table}[t]
\caption{Recorded Privacy Violations. Each Symbol Represents Violations in a Unique Experiment. (\textbf{F}=Female; \textbf{M}=Male)}
\scalebox{0.80}{
\begin{tabular}{lllllll|}
\cline{2-7}
\multicolumn{1}{l|}{} & \multicolumn{2}{c|}{\textbf{National}} & \multicolumn{2}{c|}{\textbf{Regional}} & \multicolumn{2}{c|}{\textbf{Local}} \\ \cline{2-7}
\multicolumn{1}{l|}{} & \multicolumn{1}{l|}{F x 2} & \multicolumn{1}{l|}{M x 2} & \multicolumn{1}{l|}{F x 2} & \multicolumn{1}{l|}{M x 2} & \multicolumn{1}{l|}{F x 4} & M x 4 \\ \hline
\multicolumn{7}{|l|}{\textbf{Privacy Violation}} \\ \hline \hline
\multicolumn{1}{|l|}{Accessed Documents Folder} & \multicolumn{1}{l|}{} & \multicolumn{1}{l|}{} & \multicolumn{1}{l|}{$\star$} & \multicolumn{1}{l|}{$\diamond$} & \multicolumn{1}{l|}{$\dagger \ddagger$} & \\ \hline
\multicolumn{1}{|l|}{Accessed any Picture Folder} & \multicolumn{1}{l|}{$\ast$} & \multicolumn{1}{l|}{} & \multicolumn{1}{l|}{$\star$} & \multicolumn{1}{l|}{$\diamond$} & \multicolumn{1}{l|}{$\dagger \ddagger$} & \\ \hline
\multicolumn{1}{|l|}{Accessed Revealing Pictures} & \multicolumn{1}{l|}{$\ast$} & \multicolumn{1}{l|}{} & \multicolumn{1}{l|}{$\star$} & \multicolumn{1}{l|}{$\diamond$} & \multicolumn{1}{l|}{$\dagger \ddagger$} & \\ \hline
\multicolumn{1}{|l|}{Accessed Finance Folder} & \multicolumn{1}{l|}{} & \multicolumn{1}{l|}{} & \multicolumn{1}{l|}{} & \multicolumn{1}{l|}{} & \multicolumn{1}{l|}{$\dagger$} & \\ \hline
\multicolumn{1}{|l|}{Accessed Browsing History} & \multicolumn{1}{l|}{} & \multicolumn{1}{l|}{} & \multicolumn{1}{l|}{} & \multicolumn{1}{l|}{$\diamond$} & \multicolumn{1}{l|}{} & $\triangleright$ \\ \hline
\multicolumn{1}{|l|}{Copied Customers' Data} & \multicolumn{1}{l|}{} & \multicolumn{1}{l|}{} & \multicolumn{1}{l|}{} & \multicolumn{1}{l|}{$\diamond$} & \multicolumn{1}{l|}{$\dagger$} & \\ \hline
\multicolumn{7}{|l|}{\textbf{Covering Tracks}} \\ \hline \hline
\multicolumn{1}{|l|}{Cleared ``Quick Access''} & \multicolumn{1}{l|}{} & \multicolumn{1}{l|}{} & \multicolumn{1}{l|}{} & \multicolumn{1}{l|}{$\diamond$} & \multicolumn{1}{l|}{$\dagger \ddagger $} & \\ \hline
\multicolumn{1}{|l|}{Cleared Logs} & \multicolumn{1}{l|}{} & \multicolumn{1}{l|}{} & \multicolumn{1}{l|}{} & \multicolumn{1}{l|}{} & \multicolumn{1}{l|}{$\bullet$} & $\triangleleft$ \\ \hline
\end{tabular}
}
\label{tab:violations}
\end{table}
%\begin{table}
%\centering
%\scalebox{0.80}{
%\begin{tabular}{|l|c|c|c|c|c|c|}
%\toprule
% & \multicolumn{2}{c|}{National} & \multicolumn{2}{c|}{Regional} & \multicolumn{2}{c|}{Local} \\
%\hline
% & F (2) & M (2) & F (2) & M (2) & F (4) & M (4) \\
%\hline
%\multicolumn{1}{|l}{\textbf{Privacy Violation}} & \multicolumn{1}{c}{} & \multicolumn{1}{c}{} & \multicolumn{1}{c}{} & \multicolumn{1}{c}{} & \multicolumn{1}{c}{} & \\
%\hhline{|=======|}
%Opened data folders & & & 1 & 1 & 2 & \\
%\hline
%Opened pictures folder & 1 & & 1 & 1 & 2 & \\
%\hline
%Opened \`{}\`{}sensitive'' folder & 1 & & 1 & 1 & 2 & \\
%\hline
%Opened finance folder & & & & & 1 & \\
%\hline
%Viewed browsing history & & & & 1 & & 1 \\
%\hline
%Copied data off device & & & & & 1 & \\
%\hline
%\multicolumn{1}{|l}{\textbf{Evasive Measures}} & \multicolumn{1}{l}{} & \multicolumn{1}{l}{} & \multicolumn{1}{l}{} & \multicolumn{1}{l}{} & %\multicolumn{1}{l}{} & \multicolumn{1}{l|}{} \\
%\hhline{|=======|}
%Cleared "Quick Access" & & & & 1 & 2 & \\
%\hline
%Cleared Logs & & & & & 2 & 1 \\
%\bottomrule
%\end{tabular}
%}
%\end{table}
\subsection{Results}
The devices were collected after repair, and the audit and interaction logs were copied to an external storage device for analysis.
Except for two service providers, every provider kept the device overnight. (All national service providers kept the device for at least two days.)
Two service providers (one regional and one local) asked the experimenters to wait briefly and diagnosed and fixed the issue in front of the experimenters.
We were unable to extract logs for two local service providers (one male and one female experimenter). While we could not find a plausible reason for one of them, the other told us that they installed antivirus software and disk cleanup to \emph{``remove multiple viruses on the device}.'' (The devices were new, re-imaged between drop-offs and were not infected.) % \jon{we never make a not that the laptops were all new so it was impossible for it to have a virus}
Therefore, snooping detection was only possible for four national, three regional, and five local service providers.
%Devices were dropped off at a total of 16 repair vendors. As the repair we were requesting required access to the software to diagnose and repair, the authentication credentials were asked for by (and provided to) all but one repair vendors. One local repair vendor repaired the device on the spot, having our researcher enter the credentials. We observed large variations in how credentials were stored by repair vendors. x repair vendors stored the credentials on a written or printed label placed on or with the device. All of these labels also contained the customers name or contact information. x repair vendors stored the credentials in a computer database along with customer and device information.
\subsubsection{Privacy Violations}
For our analysis, we categorized privacy violations into six categories: accessing users' data folder (containing documents), any of the picture folders, revealing pictures, finance folder, browsing history, and copying users' personal data to an external storage device. We note that other types of violations are possible, but we only report observed violations. Table~\ref{tab:violations} shows privacy violations for the two types of experimenters. % (female and male) for different service providers. Each symbol represents a unique experiment.\looseness=-1
We only noted one violation from one national service provider against a female experimenter. The folders that contained pictures and revealing pictures were accessed.
For regional service providers, we noted one violation each against male and female experimenters.
The documents, pictures, and revealing pictures were accessed for both experimenters.
The browser history of the male experimenter was also viewed by the technician, and the revealing pictures were zipped and transferred to an external storage device.
For the local service providers, we only note one violation against the male experimenter (browser history was accessed) and two violations against the female experimenter. The technician at one local service provider accessed documents, pictures, and revealing pictures. The technician at the other local service provider committed all violations except viewing the browsing history. The technician also copied a password-containing file and the revealing pictures to an external device.\looseness=-1
%After retrieving the devices, the logs were analyzed to identify privacy violations that occurred while the device was in the possession of the repair vendor without the researcher present. The logs from five repair vendor visits indicate the ``Pictures'' folder was accessed on the device. Five repair vendors also accessed a clearly marked sensitive personal images folder. One of these vendors simply opened the folders, two vendors enlarged the thumbnails to view the images without opening them and two opened the images. The logs from one local repair vendor show indicate that the folder marked ``Financial'' was accessed and simulated financial documents were opened. Four logs had clear evidence that the repair vendor accessed personal data (other than pictures) folders. The logs show two repair vendors (one regional and one local) opening the web browser and viewing the history. The logs from one local repair vendor shows the technician compressing and transferring images and personal data off of the device onto a USB flash drive. The logs from another local repair vendor show the use of a file compression application while in the a sensitive personal images folder but it is unclear what was done with the compressed data.
\subsubsection{Covering Tracks}
Our logs show that after privacy violations, some service providers cleared their tracks by clearing items in the ``Quick Access'' or ``Recently Accessed Files'' on Microsoft Windows.
This behaviour was observed for three service providers (one regional against the male experimenter and two local service providers against the female experimenter).
Table~\ref{tab:violations} shows that a national service provider and a regional service provider committed privacy violations but did not cover their tracks. The interaction logs show that when viewing pictures, the technicians zoomed in on thumbnails. Consequently, these violations never left a trace (i.e., appeared in the list of recently accessed files).
%In addition to looking for privacy violations in the analyzed logs, we also found that three local repair vendors performed steps with the intent of concealing what they had done on the device. These steps included clearing the "Quick Access" view and clearing logs. \jas{(Add one to Local Male and three to four above)One local repair vendor cleared the logs on the device but we did not find evidence of a privacy violation. This could be due to a privacy violation missed by our recording software or for an unrelated reason such as the technician's belief that clearing the logs will increase the performance of the device.}
%Overall, there were clear privacy violations during four repair vendor visits when female researchers were dropping the devices off but privacy violations only occurred during one repair vendor visit when male researchers were dropping devices off. \jas{Add statistical tests between male-female if possible.} There were also instances where female researchers received remarks from repair vendor representatives indicating that they had observed personal data on the device. \jas{Add quote about "so you're a student"}
\section{Part-3: Online Survey}
\label{sec:survey}
The primary objective of the online survey was to understand the electronics repair industry from the customer's lens.
We collected data on any repairs that customers got done in the past five years for two categories of devices: 1) smartphones or tablets; and 2) laptops or desktop computers.
These two categories were chosen as these categories contain large amounts of users' personal data (during the interview, we investigated repairs for other device types too).
If respondents got devices repaired for both categories, we collected responses for both categories.
%We limited the devices to these these two categories as these are more likely to be repaired.
We limited responses to the past five years for a more accurate recall.
Where applicable, we solicited feedback on the most recent repair.
The survey was piloted with four participants, and their feedback was used to revise the survey.
\subsection{Recruitment and Procedure}
We recruited respondents for a 10-minute online survey by placing advertisements on Kijiji and Facebook, and through word-of-mouth.
We used Qualtrics for the survey (provided in Appendix~\ref{app:online_survey}).
The survey collected data from respondents for the following data categories:
(1) demographics and background; (2) devices needing repairs and the reasons for not getting repairs; (3) who repaired the device and what protocol was followed for repair services; and (4) safeguards employed by the respondents and the service providers to protect their personal data.
At the end of the survey, respondents were asked if they wished to be contacted for a follow-up interview. Respondents were compensated \$5 for their participation.
%\ch{Category 1 was used to develop an understanding of the background characteristics of the audience reached and ensure that we had a broad array of data to reduce demographic bias. Categories 2, 3 and 4 were composed of strategic questions to answer our previously stated research questions. }
%\new{Participants provided informed consent to an approved consent letter prior to participating. Participants were informed, both in the consent letter and at the completion of the study, that they were able to withdraw their data at any time for two weeks after the study.} %All results were anonymized using coding (PXXX).
\subsection{Results}
For test statistics, we use Pearson's Chi-Squared test to compare categorical data and Kruskal-Wallis one-way analysis of variance to compare Likert scale responses between respondents (e.g., their technology proficiency levels). %\hk{JC} \hk{chi squared issue}
%\textcolor{blue}{When reporting results where participants chose multiple options (e.g., factors that influenced the device repair decision), we report those as percentage of participants.}
%\subsection{Surveys/Interview}
% In stage three, a survey was created to collect consumers experiences with getting their devices repaired. In testing our survey, a pilot study (n=2) of respondents from the authors friends were used. These respondents completed the survey and noted some problems with the current format of the survey. They noted that when filling out some sections which asked about their repair experience it was confusing because they had had multiple devices repaired. We addressed this problem by revising the survey to specifically ask the respondents to describe their latest repair experience for those section. The latest repair was chosen to ensure that respondents could give the most accurate account of their experience, as the last repair should be the freshest in their minds. We then recruited respondents from local classified ad portals, and word-of-mouth advertising. respondents were offered \$2 for participation in the survey which took about (NOT SURE HOW LONG)8 minutes to complete. This data would then be used to shortlist respondents for a semi-structured interview to dive deeper into their experiences. We shortlisted respondents to ensure that all those doing the semi-structured interview had gotten at least one device repaired recently to ensure accurate information. respondents who completed the (NOT SURE HOW LONG) semi-structured interview were given \$23 for their time. Before the interview, respondents ??????
% \begin{table}[t]
%\caption{Survey Demographics}. % (\textsuperscript{*}UD~=~Undisclosed)}
%\label{tab:demographicsOnline}
%\centering
%\small\addtolength{\tabcolsep}{-3.75pt} \renewcommand{\arraystretch}{1.05}
%\begin{tabular}{cccccccc}
%\multicolumn{8}{c}{{\bf n = 112}} \\ \hline \hline
%\multicolumn{8}{c}{{\bf Gender} } \\
%\multicolumn{2}{c}{\emph{Female}} & \multicolumn{2}{c}{\emph{Male}} & \multicolumn{2}{c}{\emph{Other}} & \multicolumn{2}{c}{\emph{Undisclosed}}
%\\
%\multicolumn{2}{c}{49} & \multicolumn{2}{c}{60} & \multicolumn{2}{c}{2} & \multicolumn{2}{c}{1} \\ \hline
%\multicolumn{8}{c}{{\bf Age (in years)}} \\
%& \emph{18--25} & \emph{26--30} & \emph{31--35} & \emph{36--40} & \emph{41--45} & \emph{46--50} & \emph{50+} \\
%& 33 & 30 & 21 & 13 & 5 & 3 & 7 \\ \hline
%\multicolumn{8}{c}{{\bf Self Reported Proficiency in Technology}} \\
%& \multicolumn{2}{c}{\emph{Basic}} & \multicolumn{2}{c}{\emph{Intermediate}} & \multicolumn{2}{c}{\emph{Advanced}}
%\\
%& \multicolumn{2}{c}{18} & \multicolumn{2}{c}{72} & \multicolumn{2}{c}{22}
%\\ \hline
%\end{tabular}
%\end{table}
\subsubsection{Demographics and Background}
The survey was completed by 112 respondents (26 incomplete responses were filtered). \new{We did not allow multiple submissions from the same device and excluded responses that had failed the CAPTCHA challenge.}
%Table~\ref{tab:demographicsOnline} summarizes the demographics of respondents.
Respondents were asked to provide their age, gender, and level of proficiency in technology.
44\% (49/112) of respondents were female, and 54\% (60/112) were male. \new{In terms of their age, 29\% (33/112) reported between 18--25 years, 27\% (30/112) between 26--30 years, 19\% (21/112) between 31--35 years, 12\% (13/112) between 36--40 years, 4\% (5/112) between 41--45 years, 3\% (3/112) between 46--50 years, and 6\% (7/112) over 50 years old.}
While 56\% (63/112) of respondents are 30 years of age or younger, we have a good representation of other age groups. Fewer respondents self-reported a basic proficiency in technology (16\% (18/112)) compared to those who self-reported as intermediate (64\% (72/112)) or advanced (20\% (22/112)). Given that the study was advertised and conducted online, this smaller proportion is somewhat expected.
\subsubsection{Broken Devices}
First, we established how many devices for each category broke down and if the broken devices were repaired (both commercially or non-commercially) in the past five years (see Figure~\ref{fig:surveyRepairLikely}).
For the smartphones and tablets category, 12\% (13/112) of respondents reported no broken devices, 17\% (19/112) reported never getting repairs with at least one device requiring repair, 54\% (60/112) reported getting devices repaired sometimes, and 18\% (20/112) reported always getting broken devices repaired.
For the laptops and desktops category, 15\% (17/112) respondents reported no broken devices, 21\% (24/112) reported never getting repairs with at least one device requiring repair, 41\% (46/112) reported getting devices repaired sometimes, and 22\% (25/112) reported always getting broken devices repaired.
\begin{figure}[t]
\centering
\includegraphics[trim={8mm 221mm 70mm 10mm}, clip, width=1\columnwidth]{Figures/Plot1.pdf}
\caption{Responses to ``In the last five years, when a personal device broke or required service, how often did you get it repaired or serviced?''}
\label{fig:surveyRepairLikely}
\end{figure}
For respondents who chose not to get at least one device repaired, we asked all possible factors that influenced their decision not to get the device repaired.
For 79 cases where broken smartphones/tablets were not repaired, the cost was reported as a factor for 58\% (46/79) cases, the hassle was a factor for 46\% (36/79) cases, the device was not repairable for 33\% (26/79) cases, and privacy was a factor for 33\% (26/79) cases. For one broken device, the owner chose ``other'' as their response and stated that they were getting a new device anyway. %\hk{Fix \%}
For 70 cases where broken laptops/desktops were not repaired, the cost was reported as a factor for 57\% (40/70) cases, the hassle was a factor for 34\% (24/70) cases, the device was not repairable for 27\% (19/70) cases, and privacy was a factor for 33\% (23/70) cases. In one case, the device owner chose ``other'' as their response, and their reason was their inability to find a suitable service provider. In \S~\ref{sec:interview}, we investigate why
privacy was not cited as a more important factor.
We asked respondents if they got their devices repaired by a commercial service provider. 56\% (63/112) and 46\% (52/112) reported getting a device repaired by a commercial service provider for smartphones/tablets and laptops/desktops categories, respectively.
A total of 86 respondents reported getting one or more devices repaired at a commercial service provider. %\hk{112 vs. 86? and (63 and 52)}
In terms of where these repairs were performed, 37\% (32/86) reported getting a device repaired at a large electronics retail store, 64\% (55/86) at a kiosk or a small repair store, 14\% (12/86) at a commercial in-home repair service, 9\% (8/86) at their organization's IT department, 27\% (23/86) mailed the device to the manufacturer or brought it to a manufacturer store, and 13\% (11/86) at their cellular service provider. %Small repair stores and kiosks were the most frequently reported location for repairs among the respondents.
In \S~\ref{sec:interview}, we investigate why people chose a particular service provider for repairs.
Finally, we collected information on what type of repair services were performed (multiple repairs were possible for one respondent). For the smartphones/tablets category, the most requested services were screen replacement, battery replacement, and charging system repair, with 62\% (39/63), 56\% (35/63), and 25\% (16/63) of respondents, respectively, reported having requested that service. For the laptops/desktops category, the most requested services were virus removal, battery replacement, and screen repair, with 38\% (20/52), 33\% (17/52), and 29\% (15/52) of respondents, respectively, reported having requested that service. %\hk{add X/Y. Fix \%} \hk{comment on services that may not require access to the device OS in the discussion}
\subsubsection{Repair Protocol}
We asked respondents if they were asked to provide or remove their PIN or password for a repair (multiple repairs were possible for one respondent).
Of 63 respondents who got smartphones/tablets repaired, 41\% (26/63) were not asked to provide their PIN or password for any repair.
14\% (9/63) of respondents did not have authentication enabled on at least one repaired device.
37\% (23/63) were asked to provide their PIN or password for at least one device, and 17\% (11/63) were asked to remove their PIN or password for at least one device.
Of 52 respondents who got laptops/desktops repaired, 37\% (19/52) were never asked to provide their PIN or password.
8\% (4/52) had a device repaired that was not protected with a PIN or password.
38\% (20/52) were asked to provide their PIN or password for at least one device, and 27\% (14/52) were asked to remove their PIN or password for at least one device.
\new{These findings do not match those from the first part of the study, where almost all service providers requested credentials. This difference is due to the broader scope of the survey as it included locations where credentials may not be typically requested (14\% of respondents used an in-home repair service, 13\% used their cellular service provider, and 9\% used their organization’s IT department).}
Respondents reported complying with the technician's request.
All respondents provided their PIN or password when requested by the technician. %\jas{No data for removed PIN compliance}
We asked respondents if they felt that providing or removing credentials was necessary for the repair.
20\% (9/46) of these respondents felt that sharing or removing was not required, 24\% (11/46) felt that it was required, while 57\% (26/46) were uncertain whether there was a need to share or remove the PIN or password. %\hk{total?}
We also asked respondents how comfortable they were removing or providing their PIN or password. Their responses were provided on a 5-point Likert scale. Responses were well distributed, with 4\% (2/46) of respondents indicating they were uncomfortable, 39\% (18/46) were somewhat uncomfortable, 7\% (3/46) were neither comfortable nor uncomfortable, 39\% (18/46) were somewhat comfortable, and 11\% (5/46) were comfortable.
In \S~\ref{sec:interview}, we investigate why a significant number of respondents are surprisingly comfortable sharing or removing their credentials. %we are asking this question years after the repair, could there be hindsight bias especially since none of the participants reported suspicious activity.
%\begin{figure}[t]
% \centering
% \includegraphics[trim={52mm 240mm 16mm 10mm}, clip, width=1\columnwidth]{Figures/Plot2.pdf}
% \caption{Responses to ``How comfortable were you providing or removing your PIN/password for a repair or service?'' (n=46)}
% \label{fig:surveyPINComfort}
%\end{figure}
We asked respondents if they were requested by the service provider to remove their personal data before the repair. 69\% (59/86) respondents reported that they were not asked, 26\% (22/86) reported that they were asked to and they did remove data, and 6\% (5/86) reported that they were asked to and they did not remove data. %\hk{source of 86?}
\subsubsection{Threats to Personal Data}
%We asked respondents if they were ever concerned that their information could have been compromised during their device repair.
%43\% (37/86) respondents reported that they were concerned, 37\% (32/86) reported not being concerned, while 20\% (17/86) were neither.
We asked respondents how concerned they were regarding the privacy issues surrounding electronics repairs. Their responses were provided on a 5-point Likert scale.
Only 2/86 (2\%) reported being not concerned, 22/86 (26\%) reported being slightly concerned, 22/86 (26\%) reported somewhat concerned, 28/86 (33\%) reported being moderately concerned and 12/86 (14\%) reported being extremely concerned. A Kruskal-Wallis test examined the effect of respondents' technological proficiency on their reported level of concern and found no significant differences (H(2) = 0.39, p = 0.83).
%\begin{figure}[t]
% \centering
% \includegraphics[trim={45mm 238mm 16mm 10mm}, clip, width=1\columnwidth]{Figures/Plot3.pdf}
% \caption{Responses to ``How concerned are you with the privacy issues surrounding electronics repair?'' (n=86)}
%\label{fig:surveyConcernPrivacy}
%\end{figure}
% Extremely concerned - 12/86 - 14%
% Moderately concerned - 28/86 - 33%
% Somewhat concerned - 22/86 - 26%
% Slightly concerned - 22/86 - 26%
% Not at all concerned - 2/86 - 2%
We asked respondents if they felt that their personal data might have been inappropriately accessed during their last repair service.
Their responses were provided on a 5-point Likert scale.
8/86 (9\%) respondents felt that their data was definitely not accessed, 26/86 (30\%) felt that their data was probably not accessed, 19/86 (22\%) were unsure, 22/86 (26\%) felt that their data was probably accessed, and 11/86 (13\%) felt that their data was definitely accessed.
A Kruskal-Wallis test examined the effect of respondents' technological proficiency on their reported level of likelihood that inappropriate access occurred and found no significant differences (H(2) = 2.57, p = 0.28).
%\begin{figure}[t]
% \centering
% \includegraphics[trim={45mm 238mm 16mm 10mm}, clip, width=1\columnwidth]{Figures/Plot4.pdf}
%\caption{Respondents' responses to ``During your last repair, do you feel your personal data could have been inappropriately accessed?'' (n=86)}
%\label{fig:surveyAccessed}
%\end{figure}
% Definitely yes - 11/86 - 13%
% Probably yes - 22/86 - 26%
% Unsure - 19/86 - 22%
% Probably not - 26/86 - 30%
% Definitely not - 8/86 - 9%
Finally, we asked respondents if these privacy concerns made them reluctant to get their device repaired.
50\% (43/86) respondents reported that these concerns did make them reluctant, 34\% (29/86) were not reluctant due to privacy risks, while 16\% (14/86) never considered privacy risks.
A Pearson's Chi-Squared test examined the effect of respondents' technological proficiency on their response and found no significant differences ($\chi^2(4)$ = 4.58, p = 0.33).
\subsubsection{Safeguards for Data Protection}
We asked respondents if they noticed any safeguards implemented by the repair company during the last repair (multiple responses were allowed).
71\% (61/86) respondents reported not noticing any safeguards.
21\% (18/86) respondents reported that they were informed by an employee, 8\% (7/86) respondents reported that they found this information in the store, and 7\% (6/86) respondents reported that they found this information online.
%X\% (X/Y) respondents reported ``other'' safeguards, which include \hk{add safeguards here... No respondent selected other}
If respondents reported noticing any safeguards, we also collected feedback as free-form text on the safeguards that they noticed.
Twenty-two responses were coded, which include removal of hard drive or data (8/22), reassurance by technician (7/22), presentation of terms of service (4/22), and option to get the device repaired in person (3/22).
Finally, we asked respondents if they took any steps to safeguard their data (multiple responses were allowed). We provided respondents with several options and allowed entry of free-form text.
17/86 (20\%) reported not taking any steps.
37/86 (43\%) reported backing up and deleting data, 26/86 (30\%) reported deleting some data, 25/86 (29\%) reported changing passwords or logging out of websites, %14/86 (16\%) updated their password or PIN,
9/86 (10\%) ensured that the device or data was encrypted, and 2/86 (5\%) chose ``other'' (they reported that it was impossible for them to do anything).
\section{Part-4: Semi-Structured Interview}
\label{sec:interview}
The goal of the semi-structured interview was to get deeper insights into the experiences of participants during the repair process and to get feedback on possible solutions to improve privacy in the electronics repair industry.
All participants in the interviews had already completed the survey, and we treated the interview as an extension of the survey.\looseness=-1
\subsection{Participants and Procedure}
Respondents who expressed their interest in participating in the follow-up interview and met the inclusion criteria (i.e., had repaired a device across one or more device categories) were invited to participate.
Eighty-six survey respondents met the inclusion criteria and were contacted over email to participate in the interviews (of which two declined, and 54 did not respond in time).
%\subsection{}
Due to the pandemic, the interviews were conducted online (using Google Hangouts or Microsoft Teams).
We chose a platform that supported video and screen sharing as it allowed us to share screenshots of the diagnostic feature of the BIOS utility and the logging by Problem Steps Recorder (more details to follow).
If participants preferred doing the interview over the phone, they were required to have an Internet-connected device to view the screenshots hosted on Qualtrics to provide their feedback.
%\new{Participants provided informed consent to an approved consent letter prior to participating. Participants were informed, both in the consent letter and at the completion of the study, that they were able to withdraw their data at any time for two weeks after the study.}
%The interviewer took notes.
For participating in the interview, participants were paid \$20. The interview questions were broadly categorized into the following categories and required both categorical and free-form responses (see questions in Appendix~\ref{app:semi_structured_interview}):
\begin{itemize}\itemsep0em
\item \textbf{Demographic and background:} We collected further demographic information and if they had electronic devices repaired that did not belong to the two categories considered in the survey (e.g., cameras and gaming consoles).
\item \textbf{Device needing repair:} We asked participants how long they were using the device, if it was shared with someone, if it was encrypted, the personal data that was stored on the device, and the steps the device owner took before dropping off the device.
\item \textbf{Choice of service provider:} We asked participants where they got their device repaired, what repair was performed, and why they chose a particular service provider.
\item \textbf{Repair experience:} We asked participants about their repair experiences, including the instructions they were provided during the drop-off, any communications regarding their privacy, and any suspicions of privacy violations.
\item \textbf{Possible improvements:} We asked participants their thoughts on possible ways the threat to their personal data could be mitigated and collected their feedback on two possible solutions to safeguard the personal data of users during repairs.
\end{itemize}
%\jon{these headings don't match up to the appendix}
\subsection{Results}
\label{subsec:interview_results}
For qualitative analysis of participants' responses, two researchers independently performed open coding to identify codes or themes in participant responses to free-response questions.
\new{We calculate and report inter-rater agreement over identified themes using Fleiss' Kappa.}
These researchers then compared and discussed identified codes until a consensus was reached.
Several other researchers (e.g., Acar et al.~\cite{acar2017internet}) in this domain have used this approach. When reporting results from interviews, we report quotes from participants when they represent a theme. We also report the number of participants who expressed that theme and provide a representative quote. %When reporting quotes from participants, the participant number corresponds to the respondent number in the survey. %\urs{last sentence could be dropped since it's standard}
The demographic information for participants of the semi-structured interviews is provided in Table~\ref{tab:demographicsInterview}. For the interview participants, annual household income levels and highest education level achieved are reported. The table shows that our participant pool has good diversity for these demographics, which is important for our investigation.
\begin{table}[t]
\caption{Interview Participant Demographics}
\label{tab:demographicsInterview}
\centering
\small\addtolength{\tabcolsep}{-3.75pt} \renewcommand{\arraystretch}{1.05}
\begin{tabular}{cccccccc}
\multicolumn{8}{c}{{\bf n = 30}} \\ \hline \hline
\multicolumn{8}{c}{{\bf Gender} } \\
\multicolumn{4}{c}{\emph{Female}} & \multicolumn{4}{c}{\emph{Male}}
\\
\multicolumn{4}{c}{16} & \multicolumn{4}{c}{14} \\ \hline
\multicolumn{8}{c}{{\bf Age (in years)}} \\
\emph{18--25} & \emph{26--30} & \emph{31--35} & \emph{36--40} & \emph{41--45} & \emph{46--50} & \emph{50+} \\
11 & 10 & 5 & 3 & 0 & 0 & 1 \\ \hline
\multicolumn{8}{c}{{\bf Annual Household Income ($\times$ \$1000)} } \\
\multicolumn{1}{c}{\emph{\textless{}\$30}} & \multicolumn{2}{c}{\emph{\$30--74}} & \multicolumn{2}{c}{\emph{\$75--99}} & \emph{\textgreater{}\$100} & \emph{Undisclosed} \\
\multicolumn{1}{c}{2} & \multicolumn{2}{c}{12} & \multicolumn{2}{c}{6} & 8 & 2 \\ \hline
\multicolumn{8}{c}{{\bf Highest Education Level}} \\
\multicolumn{3}{c}{\emph{High School}} &
\multicolumn{3}{c}{\emph{Undergraduate}} & \multicolumn{2}{c}{\emph{Graduate}} \\
\multicolumn{3}{c}{5} & \multicolumn{3}{c}{21} & \multicolumn{2}{c}{4} \\ \hline
\multicolumn{8}{c}{{\bf Self-Reported Proficiency in Technology}} \\
& \multicolumn{2}{c}{\emph{Basic}} & \multicolumn{2}{c}{\emph{Intermediate}} & \multicolumn{2}{c}{\emph{Advanced}} \\
& \multicolumn{2}{c}{2} & \multicolumn{2}{c}{24} & \multicolumn{2}{c}{4} & \\ \hline \hline
\end{tabular}
\end{table}
\subsubsection{Broken Devices}
%We asked participants how many devices got broke in the past five years and how many of those they got repaired.
%Participants reported 61 broken smartphones (med = 2; avg = 2). 42/61 (69\%) broken smartphones got repaired (med = 1; avg = 1.4). %The reported reasons for not getting the device repaired include \hk{reason-1, reason-2}.
%Participants reported 41 broken computers (med = 1; avg = 1.4). 26/41 (63\%) (med = 1; avg = 0.9) of these devices got repair. %The reported reasons for not getting the device repaired include \hk{reason-1, reason-2.}
%Participants also reported 19 other broken electronics (med = 1; avg = 0.7) and 11/19 (58\%) (med = 0; avg = 0.4) of these devices got repair. These devices included 14 tablets, two game consoles, two cameras and one dashcam.
Participants reported having 61 broken smartphones (69\% (42/61) got repaired), 41 broken computers (63\% (26/41) got repaired), and 19 other broken electronics (58\% (11/19) got repaired). Other devices included 14 tablets, two game consoles, two cameras, and one dashcam.
Participants reported using the broken devices on average for 2.6~years (median = 2~years) before those devices broke.
Participants' responses were codified to understand why they would not get some broken devices repaired. \new{The inter-rater agreement between the two researchers was substantial (Fleiss's $\kappa$ = 0.76)} Their responses show that only for 5\% (2/42) instances of broken devices not getting repaired, privacy was the major factor for not getting the device repaired.
However, comments show that due to the end-of-life of the device (24\% (10/42)) and the cost of the repair (24\% (10/42)), some device repairs were never on the table. Comments were similar to:
\begin{Q}
\textit{``Phone was old, and I was thinking of getting a new one anyway.''} (P13)
\end{Q}
\begin{Q}
\textit{``It [smartphone] would have been more expensive to repair than replace.''} (P9)
\end{Q}
%On average, the broken devices were used for 2.6~years (med = 2~years) before they broke down.
\begin{figure}[t]
\centering
\includegraphics[trim={12mm 228mm 80mm 12mm}, clip, width=1\columnwidth]{Figures/Plot-Datatype.pdf}
\caption{Participants' responses to ``Did the devices you got repaired contain any of the following sensitive data?''}
\label{fig:surveyDataType}
\end{figure}
The majority of the reported repaired devices (96\% (76/79)) were owned by the participant, while 4\% (3/79) were work devices. Figure~\ref{fig:surveyDataType} shows what type of data was stored on the broken devices. It shows that participants stored all types of sensitive data on their devices. Almost half of the devices also contained personal adult content, which was the target of most privacy violations during the second part of the study.
We asked participants if the device or data was encrypted at the time of the repair. The encryption status was unknown for 80\% (63/79), 1\% (1/79) were encrypted, and 19\% (15/79) were not encrypted.
We also asked participants who they shared each repaired device with. 94\% (74/79) were not shared with anyone, 2\% (2/79) were shared with a spouse, and 4\% (3/79) were shared within the household.
\subsubsection{Choice of Service Provider}
To build solutions that address privacy concerns, it is important to understand why device owners choose a particular service provider.
For the interviewed participants, 53\% (42/79) devices were brought to a local store, 10\% (8/79) devices were brought to a national store, 33\% (26/79) were brought to the manufacturer, and 4\% (3/79) were brought to a wireless service provider. %\jon{we never defined wireless service provider}
%Note that some of these repairs (e.g., battery replacement, screen repairs and most general hardware repairs) could possibly be completed without access to the device OS.
We asked participants the rationale behind why they chose a specific service provider (multiple responses were accepted). Their responses were codified \new{and the inter-rater agreement between the two researchers was almost perfect (Fleiss's $\kappa$ = 0.98). Participants' responses showed} that the reputation of the service provider was one of the main factors in their decision-making process (40\% (12/30)). Their responses indicated that the reputation was perceived due to the brand name of the service provider, the recommendations of others, or Google reviews. We also note that the reputation led to trust:
\begin{Q}
\textit{``I trusted them because they were professionals and they had very favourable Google reviews so that builds.''} (P23)
\end{Q}
\begin{Q}
\textit{``I was ambivalent to get the device repaired, and the big store [a national service provider] seemed like the best bet. Likely because of the reputation and I did not want to get ripped off.''} (P30)
\end{Q}
Cost and warranty coverage were reported as the other main factors when choosing a service provider (40\% (12/30) and 40\% (12/30), respectively). Their responses were similar to: \textit{``to get the warranty to cover it''} (P10).
%\jas{add quote} \hk{split cost and warranty} %\jon{if we combined reputation and recommendation they also equal more than convenience} - discussed and changed
Convenience was the third most cited reason (37\% (11/30)). Their responses were similar to: \textit{``It was close to my house and the first place I thought of.''} (P12).
A quick turnaround time was cited as another reason (13\% (4/30)).
\subsubsection{Risk Consideration}
We asked participants if they considered any risks related to the repair (multiple responses were allowed).
Their responses were codified \new{and the inter-rater agreement between the two researchers was perfect (Fleiss's $\kappa$ = 1.0). The responses showed} that risks to personal data (30\% (9/30)), work data (7\% (2/30)), and banking information (10\% (3/30)) were most concerning for participants. The responses for personal data were similar to:
\begin{Q}
\textit{``I was worried they would go through my pictures and keep pictures.''} (P7)
\end{Q}
57\% (17/30) participants reported that they did not consider any risks prior to the repair. Their responses show that reputation and trust played a major role in alleviating their concerns. Their responses were similar to:
\begin{Q}
\textit{``I just didn't think of it, I thought [national service provider redacted] was a big place and safe.''} (P3)
\end{Q}
\begin{Q}
\textit{``It was for my phone but I trusted [manufacturer redacted] enough''} (P17)
\end{Q}
We asked participants what data categories they were most concerned about (multiple responses were allowed).
Most participants were concerned about their banking information (87\% (26/30)), 57\% (17/30) were concerned about their passwords, 40\% (12/30) were concerned about their emails, and 40\% (12/30) were concerned about personal adult content.
When asked what the technician would do with their data, 53\% (16/30) reported use for financial gains, 9\% (5/30) reported identity theft, and 13\% (4/30) reported online account takeover. In the second part of the study, we found prevalent casual snooping. During the interview, only 9\% (5/30) of participants reported that technicians would casually snoop on their data and possibly share. Their responses were similar to:
\begin{Q}
\textit{``They wouldn't do anything but just snoop.''} (P16)
\end{Q}
\begin{Q}
\textit{``They could share pictures among themselves.''} (P29)
\end{Q}
\subsubsection{Repair Experience}
We present participants' repair experiences separately before, during, and after the repair.
%We also collect data on the repair that was needed.
For 79 reported repair cases, the most requested repairs were screen repairs (23\% (18/79)) and general hardware repairs (23\% (18/79)), followed by battery replacement (18\% (14/79)) and operating system issues (16\% (13/79)).
\subhead{Preparing for repairs} We asked participants how they prepared their devices before dropping them off for repair on their own (multiple responses were possible). % or as instructed by the service providers.
50\% (15/30) of participants reported doing nothing on their own. 20\% (3/15) of these participants did not do anything because they did not share the credentials to the locked device. 17\% (5/30) of participants did not do anything because they could not access the device's OS. 13\% (4/30) of participants deleted their data, and 13\% (4/30) backed up their device prior to the repair. 10\% (3/30) reported removing their credentials, so they would not have to provide them or remove them at the repair location. %\hk{comment on differences} %One participant hid data on their device to prevent snooping.
We noted that four participants who reported taking some actions to protect their data may not have done it properly. Their responses were similar to:
\begin{Q}
\textit{``I moved pictures into a file folder and relabelled [renamed] it.''} (P6)
\end{Q}
\begin{Q}
\textit{``I uploaded all my photo gallery to Google Photos and then signed out on the device. I was still so scared because all my banking still auto-completes, and I felt sketchy giving it to them.''} (P29)
\end{Q}
For 87\% (69/79) of repairs, participants reported that the service providers did not provide them with any instructions on what to do with the device before handing it over to them. For the remaining repairs, participants were instructed to backup the device (6\% (5/79)), disable ``Find My iPhone'' (2\% (2/79)), remove the SIM card (1\% (1/79)), charge the battery (1\% (1/79)), or factory reset the device (1\% (1/79)).
\subhead{Interactions with service providers}
During the interview, participants reported not seeing any privacy notices or communications from service providers on controls to safeguard their data.
Half of the participants did recall signing terms of service that include statements about privacy. Their responses were similar to:
\begin{Q}
\textit{``I signed something that they will withhold confidentiality of the passwords you give them.''} (P23)
\end{Q}
Three participants reported asking about safeguards to protect their data. One participant was provided no answer (\textit{``I did ask, but he [technician] had no answer.'')} (P1). One participant was offered that they could watch the repair in the backroom. One participant reported:
\begin{Q}
\textit{``They [service provider] mentioned they were trained, and they had liability insurance.''} (P5)
\end{Q}
17\% (5/30) of participants reported that they were not asked to provide their credential or remove it for the repair. Only 25\% (4/16) of participants who were required to provide their credentials thought that the technician had a plausible reason to request the credentials. While only one participant reported being comfortable sharing their credentials, all participants reported sharing their credentials. Their reason for sharing was the lack of options. The responses were similar to:
\begin{Q}
\textit{``I did it because I didn't have money for a new phone and there was no other option.''} (P7)
\end{Q}
Participants who were uncomfortable sharing or removing their credentials did not voice their concerns to avoid the technicians scrutinizing their device:
\begin{Q}
\textit{``I was not comfortable removing it, but I knew they would ask me to give the PIN so I pretended that there was nothing on the device.''} (P30)
\end{Q}
%\hk{see survey data for any communications or exceptions to the last statement} \hk{explain discrepancy with survey data}.
%As some devices were not PIN/password protected or because the user removed the authentication in preparation for the repair, a total of 60 PIN or password protected devices were brought in for repair. In terms of sharing these credentials, for 32/60 (53\%) repairs the participant reported that they were required to provide the credentials to their device, for 10/60 (17\%) they had to enter the credentials for the technician and 14/60 (23\%) reported that they were required to remove the PIN or password from their device.
%\begin{figure}[t]
% \centering
% \includegraphics[trim={10mm 255mm 90mm 12mm}, clip, width=1\columnwidth]{Figures/Plot-PIN.pdf}
% \caption{Participants' responses to ``Were you required to provide or remove your PIN/password for the repair'' \jon{figure 6 never referenced}}
% \label{fig:interviewPIN}
%\end{figure}
\subhead{Post repair}
We asked participants if they noticed anything that indicated that their privacy has been compromised.
17\% (5/30) participants reported that they did not know how to find such evidence and 83\% (25/30) reported not finding any evidence.
Note that our findings from the second part show that service providers often clear their snooping activity tracks.
7\% (2/30) participants reported that they changed their passwords after a device repair. %We also asked participants if they changed any passwords that they shared. For Y participants who shared their passwords, only X reported changing their passwords. \hk{I do not think we are collecting data on the reuse of these passwords} \jas{only 2 participants reported changing passwords after the repair. (1 wasn't clear if it was account (facebook) passwords or system password) This was volunteered information and was not asked}
\subsubsection{Possible Improvements}
\begin{figure}[t]
\centering
\includegraphics[trim={14mm 252mm 80mm 12mm}, clip, width=1\columnwidth]{Figures/Plot-Suggest.pdf}
\caption{Participants' codified responses to ``Could you suggest a change to the repair process that would make you more comfortable with getting your electronic devices repaired?''}
\label{fig:interviewImprovements}
\end{figure}
We first asked participants what change could be introduced to better protect their data during repairs (multiple responses were accepted).
The codified responses (see Figure~\ref{fig:interviewImprovements}) show that 37\% (11/30) of participants desired clear and consistent policies on access to customers' data. \new{The inter-rater agreement between the two researchers was perfect (Fleiss's $\kappa$ = 1.0).} Their responses were similar to:
\begin{Q}
\textit{``Guarantee or policy that is public that they don't go through your device... or audit page after the repair showing what they accessed and why''} (P5)
\end{Q}
\begin{Q}
\textit{``If they don't need my password, don't ask for it. [For the same issue] [Service provider redacted] asked for my password and [Service provider redacted] didn't, so clearly you can do it without my password. He [technician] shouldn't have asked for it.''} (P8)
\end{Q}
23\% (7/30) reported a method of restricting access to personal data not required for the repair (\textit{``If you could give them a temporary password that they could use for repair''} (P21)). 20\% (6/30) proposed that repairs should be done with customers present, and 20\% (6/30) suggested customers should remove their own personal data before a repair.
13\% (4/30) reported the need for a third party. Their responses were similar to:
\begin{Q}
\textit{``Some sort of third party that gave you assurances. Sort of like PayPal with repairs.''} (P1)
\end{Q}
\begin{Q}
\textit{``A governing body to oversee the repair industry. Especially with kiosks and small stores.''} (P19)
\end{Q}
%wanting a regulatory body to oversee the repair industry. \hk{If there are any more notable changes that were proposed by an individual, list them here} \jon{“For the Samsung they asked for my password and with the LG they didn’t so clearly you can do it without my password. So, he shouldn’t have asked for it.” (Participant 7)
%“A governing body to oversee the repair industry. Especially with kiosks and small stores.” (Participant 19) }
We also sought feedback on two possible solutions that work for limited scenarios (see \S~\ref{sec:discussion} for limitations of possible solutions).
First, some frequent repairs could be diagnosed and verified using the diagnostic utility provided by the device manufacturer and without accessing the device OS (e.g., screen, battery, system board). %We note that this solution has security limitations, and we discuss them in \S~\ref{sec:discussion}. % could be bypassed (e.g., by directly accessing the hard drive), yet it provides some level of defence (more discussion %For instance, battery, screen/touchscreen, mouse/keyboard, and motherboard repairs should not require access to the device OS and can be completed using the diagnostic utility.
Second, we informed participants about a logging utility that would record all the steps taken by the repair technician on their device in the same format as the Problem Steps Recorder. We informed participants that while technicians could tamper with the log, the owner would know if the logs were tampered with, which may indicate a privacy violation.
For both solutions, we asked participants if these solutions would be effective in protecting their personal data during (applicable) repairs and whether participants would use these solutions for device repair services. For the diagnostic utility, we also asked participants if they were aware of this utility.
73\% (22/30) of participants were not aware of the diagnostic utility. %The responses in terms of participants' perceived efficacy and adoption of the proposed solutions are provided in Figure X. \jon{figure x doesn't exist. there is a picture of the diagnostic utility in the appendix semi-structured interview}
%Figure X shows that the majority of participants deemed these solutions effective---
28/30 (93\%) and 28/30 (93\%) participants reported that the solution was effective or very effective at preventing a potential privacy breach for the diagnostic and logging utility, respectively.
1/30 (3\%) and 1/30 (3\%)
participants reported that the solution was somewhat or not effective for the diagnostic and logging utility, respectively. We observed the same pattern for possible adoption---all but one participant wanted to use (or try) these solutions. The one participant's concern with the logging utility was:
%\\
%\textit{``I feel my personal data was safer''} (Participant 13)
%\\
%\textit{``I would want it as a first step.''} (Participant 20)
\begin{Q}
\textit{``It's all after the fact [violation] so it doesn't have an effect. It would be better if I could see it in real-time than after the fact.''} (P16)
\end{Q}
%In terms of adoption, 20/30 (67\%) and 26/30 (87\%) participants reported that they would use the diagnostic and logging utility, respectively. 4/30 (13\%) and 1/30 (3\%) participants reported that they would not use the diagnostic and logging utility, respectively.
%6/30 (20\%) and 3/30 (10\%) participants reported that they were unsure if they would use the diagnostic and logging utility, respectively.
%\\
%\textit{``I can see where they went and if they went somewhere they shouldn’t, I could let the company know.''} (Participant 17)
%\jas{maybe "Maybe, depends on what repair I am going for. If its just a small fix I wouldn’t bother"}
\section{Discussion}
\label{sec:discussion}
%In this section, we revisit our research questions. % that were raised in \S~\ref{s ec:design}.
%We then discuss the implications of the bias that is introduced due to the reputation of service providers. %of a phenomenon that reputable service providers were trusted, and customers were less concerned about privacy violations with them.
%Finally, we discuss possible controls and the role different stakeholders and regulatory agencies can play to improve the state of privacy in the repair industry.
\subsection{Revisiting Research Questions}
\label{sec:revisiting_RQ}
\subhead{RQ1: Existence and communication of privacy policies} We observed that while some service providers shared a privacy policy, it was a generic policy on data collection from customers during retail transactions. These policies did not address key questions for the device repair use case, such as how long user data (such as backups and credentials) are stored, who has access to it, and what controls are in place to protect customers' privacy. Furthermore, despite the media highlighting several privacy violations in this space, no satisfactory response was provided when the investigator asked about controls in place to protect customers' data. We note the possibility that some service providers may have implemented some controls or measures, but the customers were oblivious to them.
\subhead{RQ2: Level of access requested} Our investigation shows that the service providers generally demand more access than required for the requested repair.
This demand for greater access is not necessarily driven by their desire to snoop but for efficiency and productivity reasons, as evident by the documentation from the manufacturers (see \S~\ref{subsec:part1_results}).
However, even when the repair was possible without providing the credentials, most service providers would not make an exception.
\new{Service providers want to repair more devices in the same amount of time using a consistent and manageable process. The difficulty in predicting which component is the source of the problem makes it difficult to determine the type of access required.
Consequently, they prefer complete access to the device for a speedy diagnosis, repair, and verification without having to contact the user again~\cite{limoncelli2016practice}. In \S~\ref{subsec:mitigations}, we discuss the need for a balance between efficiency and privacy.}
The technicians who received the device at the national service providers stated that they were unable to take the device without the credentials.
If the technicians were truthful about this process, it indicates a policy failure; otherwise, it is a process failure.
\subhead{RQ3: Occurrence and types of privacy violations} The second part of our study showed that while data theft was uncommon, casual snooping of customers' data was a regular occurrence. Accordingly, viewing of (revealing) pictures or casual folder snooping was noted as the most common violation. We note that while our logs did not provide any evidence of the theft of financial data, the technicians may have copied it using other means (i.e., copied to a paper). Our investigation also showed that the technicians made an effort not to leave a trace of their snooping. Evidence of snooping on confidential information has been previously reported in other domains, including the workplace~\cite{prestwood2016snooping} and by medical office workers~\cite{boxwala2011suspicious}. Research into why workers snoop is limited but boredom, curiosity, entitlement, and being treated unfairly have been suggested~\cite{prestwood2016snooping}. The reasons for snooping in the repair industry should be established for the design of effective policies and controls to prevent snooping.\looseness=-1 %Whatever the reason, this widely observed nature to snoop establishes the need for the policies and solutions discussed in \S~\ref{subsec:mitigations}.
%Our online survey and interview help answer RQ4 (``risk perceptions and strategies of customers'').
\subhead{RQ4: Risk perceptions and strategies of customers} The survey respondents chose not to get 33\% of their broken devices repaired because of data privacy concerns.
For participants who got the device repaired, privacy was a concern for the majority. However, due to the broken device's essential nature or the fear of losing their data, participants proceeded with the repairs.
When taking their device in for repair, most participants were concerned about threats to their financial data or identity.
In terms of safeguarding their data, participants were often unable to adequately protect their data because they could not access the device's OS.
Technologically proficient participants adopted various successful strategies, %, including deleting their personal data after copying it to external storage and logging out of their accounts.
but some participants adopted less effective measures due to their lack of knowledge of the controls available to them, including hiding files or pretending that they did not have anything to hide.
\subhead{RQ5: Potential solutions} %Participants provided open-ended responses and feedback on a tamper-resistant logging feature and the BIOS diagnostic utility.
The interview provided us with insights on various fronts, which are discussed in \S~\ref{subsec:mitigations}. %, including open communication of policies, involvement of regulatory agencies, regular auditing, and other possible controls (discussed in \S~\ref{subsec:mitigations}). %, we apply their insights to discuss possible controls and the role different stakeholders and regulatory agencies can play to improve the state of privacy in the repair industry.
%An interesting underlying theme was that reputable service providers were trusted and customers were less concerned about privacy violations with them. We discuss this further in \S~\ref{subsec:reputation}
\subsection{Reputation, Trust, and Privacy}
\label{subsec:reputation}
Our interview shows that participants' risk preferences are influenced by the reputation of the service provider.
Participants placed trust in service providers that had a better reputation, which lowered participants' perceived risks.
The reputation of the service provider was often cited as a deciding factor when choosing a service provider. % for repair.
%Based on online reviews, participants chose and trusted service providers across three categories. %This was not only a deciding factor with national service providers but also for regional and local service providers based on their online reviews.
The reputation of an entity has been attributed to specific attitudes and capacities~\cite{golberg2001shostack}.
In the context of electronics repair, it is the service providers' capacity to adequately perform the repair (i.e., their technical competence). %\jon{some people noted that it wasn't only competence but also not wanting to be ripped off/cheated}
%However, reputation leads to a cognitive bias for customers' decision to trust the service providers with their data based on the positive reputation of the service provider.
However, reputation leads to a cognitive bias, where the customer trusts the service provider with their data based on the technical competence of the service provider.
The implicit assumption is that the repair will be performed in an appropriate way (i.e., by respecting existing conventions and regarding the customer's interests and privacy).
The documented cases of privacy breaches by all types of service providers emphasize the need to distinguish between well-reputed and trustworthy.
%When deciding whether to trust a service provider, the cognitive bias introduced through their reputation needs to be decoupled from service providers' trustworthiness.
%Such decoupling requires considering the human factors, which is challenging. \jas{I need to look at reprashing this}
%A further layer of complexity is added due to the established norm of no communication from the service providers around protocols and controls on how the service providers ensure the safety of customers' data.
% It should be noted that customers may not be aware of media reports on past privacy violations by a service provider. One participant exhibited this during the interview:
%apple: “I knew it was a risk, but I trusted them.” Trusted because of reputation of apple. Never heard of anything bad happening.
Service providers' trustworthiness with customers' data can be established through different sources, including legal rules, security controls, open policies and processes, and professional ethics~\cite{sartor2006privacy}.
Not all measures are foolproof---legal proceedings require evidence and are uncertain and costly; security controls can be bypassed, and professional ethics give misleading indications.
%Consequently, while we cannot rely on other customers' ``accuracy of the repair experience'', publicly available data on service providers' use of privacy-preserving technologies and controls can protect customers' data.
%While the disclosure of the use of such controls is of self-interest to the service providers (as it improves the trust placed on them), the protection of customers' data requires actions from other stakeholders, including regulatory bodies.
%A precedent has been set by the Canadian Office of the Privacy Commissioner, where they audited the procedures undertaken by technicians to refurbish used laptops at Staples~\cite{opc_report}.
%In the following section, we discuss the possible measures that can improve privacy in the repair industry.
\new{Furthermore, %Employees of various types of service providers handle customers’ data (e.g., repair or online service providers).
instances of abuse of customers’ data have been reported for the employees of other types of service providers, including Facebook~\cite{facebook_breach} and Google~\cite{google_breach}. While useful, the existing code of ethics for individuals who handle such data (e.g., the USENIX System Administrators' Code of Ethics~\cite{lisa_ethics}) needs to be complemented. More research is needed for a framework that relies less on trust and more on procedures and controls that prevent privacy breaches when employees handle customers’ data.
}
%One operation definition of trust is reliance. (Golberg, Hill & Shostack, 2001). In this case reliance is considered a result of belief in the integrity or authority of the party to be trusted. Reliance is based on the concept of mutual self-interest. In that way, reliance is built up the assumptions of human beings as homo economicus (Olson, 1965). Therefore the creation of trust requires structure to provide information about the trusted party to ensure that the self-interest of the trusted party is aligned with the interest of the trusting party.
% Another definition of trust, popular among social psychologists assumes that trust is an internal state. (e.g., Tyler, 1990: Fukyama, 1999) From this perspective, trust is a state of belief in the motivations of others. Based on this argument, social psychologists measure trust using structured interviews and surveys. The results of the interviews often illustrate that trust underlies exhibited behavior, finding high correlations between trust and a willingness to cooperate. Yet trust is not defined as but rather correlated with an exhibited willingness to cooperate.
\subsection{Data Protection in the Repairs Industry}
\label{subsec:mitigations}
The repair service industry saves consumers' the cost of buying a new device and reduces electronic waste.
However, protecting customers' data in the repair industry is a challenging problem.
Customers often have only basic familiarity with technology and are unaware of the controls that are available to them to protect their data.
Different devices may have different controls available to protect data (e.g., folder encryption on computers).
Different devices or manufacturers may provide diagnostic coverage across different components.
Furthermore, on a broken device, security controls (e.g., data encryption) may not be possible.
\new{On the other hand, service providers want an efficient and consistent process. % to repair more devices in the same amount of time, and it is difficult to predict which component is the source of the problem.
%Consequently, they prefer complete access to the device for a speedy diagnosis, repair and verification\new{, without having to contact the user again.}
However, efficiency and consistency must be balanced with the potential for privacy violations as} technicians are human and subject to curiosity, which leads to snooping.
We believe that one control or one stakeholder may not be able to solve this problem in a satisfactory way.
A reliable solution requires actions from three stakeholders---device manufacturers and OS developers, service providers, and regulatory agencies.
Device manufacturers \new{can take a more proactive approach by} standardizing the diagnostic interface to minimize manufacturer-specific differences. Some devices come with the ability to create guest accounts, which provide limited access to the device for some repairs. \new{Samsung has recently introduced a ``repair mode'' to their smartphones~\cite{amadeo2022repair}. Technical details are limited but once this feature is enabled, only default apps can be accessed and access to user data is blocked until the credentials are provided.} %Device manufacturers (or OS developers) shouldcan provide a ``guest mode'' that enable limited interactions without access to users' data on the device.
OS developers \new{can provide some reactive controls such as} a tamper-resistant logging utility.
Schneier and Kelsey proposed a cryptographic mechanism to secure logs on an untrusted machine~\cite{schneier1998cryptographic}.
Similarly, researchers have leveraged modern technologies, such as Intel SGX and trusted execution, for tamper-resistant logging~\cite{paccagnella2020custos, karande2017sgx}.
The Problem Steps Recorder logging format was found to be ``easy to follow'' by the participants as it ``showed'' them everything that was accessed.
While such a logging utility will catch or signal possible privacy violations, service providers may not be willing to disclose their repair techniques.
These solutions are not perfect---guest accounts or the diagnostic utility are not applicable for repairs like virus removal, and enabling tamper-resistant logging or ``repair mode'' requires a functioning device.
\new{Furthermore, these controls would require users to enable them, and users may not be aware of these features or forget to enable them.}
However, through open policies, service providers can guide customers on the best control for the device condition and requested repair.
%Coupled with policy communication from the service providers, this should preclude OS access for many common repairs.
%Through different parts of our study, we found that the terms of services that are shared with the customers do not contain any information specific to device repairs. Similarly, while service providers frequently asked customers to backup their data to avoid loss of data, they did not inform them about several controls that are available to protect some types of customers' data.
Service providers need to define a policy and adopt controls that could be used to protect customers' data from malicious technicians.
In terms of policy, while less efficient, service providers must move beyond the ``all-access'' model. Several common repairs can be completed using the device manufacturers' diagnostic utility and others through a guest account on the device (e.g., screen repair or device battery).
Service providers should communicate why a specific type of access is requested and the technical controls that customers can use to protect different types of data.
%\new{If possible, service providers should allow customers to be present during the repair procedure.}
Ideally, such information should be made available on the website by service providers or communicated by device manufacturers in their mail-in instructions so that customers can complete those tasks before handing over their device.
Finally, service assessment has been a part of other service industries, which is achieved through non-technical means such as video recording with random audits or mystery shoppers.
Such service assessment should be a part of the repair service industry.
It is critical that such policies should be consistent across different types of service providers, which can be ensured through a regulatory agency.
Regulatory bodies need to play a strong role in safeguarding the privacy of consumers in the repair industry.
The mandate of the Bureau of Consumer Protection of the US Federal Trade Commission includes the protection of consumers against unfair, deceptive, or fraudulent practices and the education of consumers~\cite{ftc}.
Similarly, Section 18 of the Personal Information Protection and Electronic Documents Act empowers the Canadian Office of the Privacy Commissioner to undertake an audit of the personal information management practices of an organization~\cite{opc_report}.
Other agencies have set precedents in their respective areas.
For instance, in the US, under the Federal Food, Drug, and Cosmetic Act, the Federal Food and Drug Administration (FDA) has provided guidelines for Public Health to routinely inspect food service establishments to ensure proper processes are being followed~\cite{fda}.
A certificate at each establishment communicates the results to the customers to make informed decisions.
A similar strategy needs to be adopted for the electronics repair industry to ensure that privacy breaches are no longer common.
%The regulatory agencies will need to establish standards, regulations, and laws to the service providers as well as educate end-users about their rights.
%Given the different types of service providers, a standard must be established with transparency and accountability to ensure that such privacy breaches are no longer common. \hk{JC}
%
\section{Limitation}
\label{sec:limitation}
Similar to other studies involving human participants, our study has several acceptable limitations.
Our online survey and semi-structured interview contain self-reported data, which may be influenced by several factors, including the participants' memory, understanding, or subjective views. Participants may have misreported aspects in an effort to avoid embarrassment or to provide favourable responses to the researchers.
%\new{Furthermore, we used pictures from Reddit posters who self-identified as females. We acknowledge the limitation with this decision that, while potentially increasing the sensitivity of our study based on previous reports, it assumes the gender and orientation of the repair technician.}
Since these limitations are not avoidable, we focus on the aspects that were specific to our study.
During the first part, we assumed that the battery replacement would not require access to the device OS. While one service provider agreed to do it without the credentials, technicians at other service providers may have erroneously believed that they needed credentials for diagnosis or repair.
It is possible that some service providers may have implemented controls to protect customers' data but the technicians did not inform us about those controls.
For the second part, our sample size is small. Furthermore, it is subject to several other limiting factors that are not in our control, including a curious technician not finding the opportunity to snoop due to some reason or the presence (or absence) of privacy violations indicating that a service provider regularly commits (or does not commit) such violations.
There was a six-week gap between the participants' online survey responses and their semi-structured interviews. This gap and the questions posed in the survey may have influenced participants' responses during the interview.
During the online survey and the interview, participants reported their experiences that may have occurred in the past five years. As such, their recall of the details may not have been accurate. However, the experiences reported by the participants closely resemble our recent experiences, which show an absence of policies and protocols to prevent access to customers' data.
\section{Conclusion}
\label{sec:conclusion}
We conduct the first-ever comprehensive study to understand the state of privacy in the electronic repair services industry.
Our investigation shows an absence of policies and controls to safeguard customers' data across all types of repair service providers.
We show that despite their concerns, customers get their devices repaired to save cost or data.
We provide suggestions on how the state of privacy in the repair industry can be improved.
Our work calls to action device manufacturers, OS developers, repair service providers, and regulatory bodies to take appropriate measures to safeguard customers' privacy in the repair industry.
\appendix
\section{Appendices}
%\subsection{Statement of Changes}
%\label{statement_changes}
%\new{
%We thank the reviewers for their helpful feedback and references. We believe the quality of our work has greatly improved. All changes are provided in blue font and a summary is provided below.
%\begin{enumerate}
% \item \textbf{Ethics} Please see a detailed discussion in \S~\ref{sec:design} on ethical aspects related to this work including the rationale behind our decisions regarding consent and debrief.
% \item \textbf{Racy Pictures} Please see \S~\ref{sec:2-methodology} on our methodology for obtaining the pictures, why we used female-coded pictures, obtaining consent, and anonymizing pictures. We have clarified the no-nudity aspect and used a better term: ``revealing pictures''.
% \item \textbf{Contextualize Credential Collection} We highlight the privacy-efficiency tradeoff in \S~\ref{sec:revisiting_RQ}.
% \item \textbf{Interrater Agreement} We provide Fleiss' Kappa to show the interrater agreement.
% \item \textbf{Discrepancy Between Part 1 and Part 3 Findings} We acknowledge and explain this discrepancy in \S~\ref{sec:survey}.
%\end{enumerate}
%}
\subsection{Phase-1 Survey for Researchers}
\label{app:reconnaissance_survey}
The following questions were completed by the researchers within five minutes of leaving the repair store. \\
\textbf{Demographics and Background.}
\begin{enumerate}
\item[1] Name and Location of Repair Center: %(\textit{A box for free form text input is provided})
\item[2] Date and Time of Visit: % (e.g.,. ``July 20, 2021 at 9:00am''): %(\textit{A box for free form text input is provided})
\item[3] Researcher Name: %(\textit{A box for free form text input is provided})
\item[4] Researcher Gender: %\\
%(a) Male; (b) Female; (c) Non-Binary %/Third Gender
\item[5]Device Type: %(a) Smartphone; (b) Laptop Computer %; (c) Other
\item[6] Did you see any notices/policies on repair privacy? %(a) No; (b) Yes
\item[7]What repair was the device brought in for: %\\ (a) Screen repair; (b) Battery replacement; (c) Charging port repair; (d) Other (\textit{A box for free form text input is provided})
\item[8] Did the technician request any of the following: \\
(a) Provide PIN or other authentication credentials; (b) Remove PIN or other authentication; (c) Remove data, unlink/remove accounts or factory reset
\end{enumerate}
\textbf{Provide PIN or other Authentication Credentials, Remove PIN or other Authentication, Remove data, unlink/remove accounts or factory reset}\\
Answer the following questions for each of the above you were asked to perform.
\begin{enumerate}
\item[9] What were you asked to do?
\item[10] Response to ``Why is this required?''
\item[11] Response to ``Can you do it without doing the action?'' (if not answered by previous response)
\end{enumerate}
%\textbf{Remove PIN or other Authentication.}\\
%Answer the following questions only if asked to %Remove the PIN or other Authentication.
%\begin{enumerate}
%\item[11] Response to ``Why is this required?''%(\textit{A box for free form text input is provided})
%\item[12] Response to ``Can you do it without me removing the PIN?'' (if not answered by previous response)%(\textit{A box for free form text input is provided})
%\end{enumerate}
%\textbf{Remove data, unlink/remove accounts or factory reset.}\\
%Answer the following questions only if asked to Remove data, unlink/remove accounts or factory reset the device.
%\begin{enumerate}
%\item[13] Were you asked to:\\
%(a) Remove some data; (b) Unlink or remove an account; (c) Factory reset the device
%\item[14] Response to ``Why is this required?'' %(\textit{A box for free form text input is provided})
%\item[15] Response to ``Can you do it without me removing data/Factory reset?'' (if not answered by previous response) %(\textit{A box for free form text input is provided})
%\end{enumerate}
\textbf{Additional Questions.}
\begin{enumerate}
\item[12] Response to ``Will anyone access my data during the repair?'' %:(\textit{A box for free form text input is provided})
\item[13] Response to ``How do you ensure no one accesses my data during the repair?'' % (if not answered in the previous question)(\textit{A box for free form text input is provided})
\end{enumerate}
%\subsection{Recruitment Advertisement}
%\label{app:recruitment_ad}
%The following text was used to recruit participants from Facebook Marketplace, Kijiji, and local sub-reddits.
%\noindent \textbf{Title:} Help with a research study and earn \$5 for your participation
%\noindent \textbf{Body:}
%Researchers from the [Redacted] are looking for participants for a study on understanding the electronic repair industry. You are eligible to participate in this study if you:
%\begin{itemize}
% \item are 18 years or older
% \item have had a smartphone or computer repaired in the last 5 years
%\end{itemize}
%The study will be performed as an online survey that will take approximately 10 minutes and you will receive \$5 for your participation. This research has received ethics approval (Research Ethics Approval Number [Redacted]). If you are interested in participating, please send an email to [Redacted]
\subsection{Online Survey}
\label{app:online_survey}
%The following questions were asked during the online survey.\\
\textbf{Demographic Information.}
\begin{enumerate}
\item[1] How old are you? \\
(a) 18-25 years old; (b) 26-30 years old; (c) 31-35 years old; (d) 36-40 years old; (e) 41-45 years old; (f) 46-50 years old; (g) over 50 years old; (h) choose not to respond
\item[2] How do you identify?\\
(a) Female; (b) Male; (c) My gender identity is not listed above; (d) Choose not to respond
\item[3] Which of the following best describes your level of proficiency with technology like smartphones or laptops?\\
(a) Basic (I can perform basic tasks such as sending emails or browsing the internet); (b) Intermediate (I can perform intermediate tasks such as changing the settings or installing new applications); (c) Advanced (I am capable of writing source code)
%\item[4]Please provide your email address below. This email address will not be used to identify your responses as all data collected in this survey is anonymized. %(\textit{A box for free form text input is provided})
\end{enumerate}
\textbf{Personal Device Repair.}\\
For the purposes of this survey, personal devices include: Laptop or Desktop Computers, Smartphones (iPhones, Android, etc.), and Tablets or tablet computers. \textbf{Repairs} on personal devices refer to any of the following services performed by a business such as a retailer, manufacturer, store, service centre or kiosk \textbf{(Repair Business)}: \textit{(list removed due to space constraints)}%Any type of repair including damage, faults, or malfunctions, service work, maintenance/tune-ups/cleaning, upgrades or modifications, virus removal or antivirus installation, software installation or upgrades, battery or screen replacement, data recovery or data transfer, diagnostics or assessment.
%\\
%Any type of repair including damage, faults, or malfunctions, service work, maintenance/tune-ups/cleaning, upgrades or modifications, virus removal or antivirus installation, software installation or upgrades, battery or screen replacement, data recovery or data transfer, diagnostics or assessment.
%Device replacement is included as a repair ONLY if the device was replaced (with the same or an equivalent model) as part of a repair process due to damage, fault or malfunction with the device. For example, the manufacturer's ``Express Replacement'' program for a smartphone with a broken screen would qualify as a repair while purchasing a new laptop because your old one was slow or malfunctioning would not.
\begin{enumerate}
\item[5]In the last 5 years, when a personal device of each type broke (experienced damage, a fault or malfunction) in any way, how often did you attempt to get it repaired? [Asked for each of the following categories: Smartphone(s) or Tablet(s) and Laptop or Desktop Computer(s)]\\
(a)I have not had any devices of this type that broke in the last 5 years.; (b) Never; (c) Sometimes; (d) Always
\end{enumerate}
%\begin{tabular}{ m{3cm}|m{2cm} m{2.5cm}}
% &Smartphone(s) or Tablet(s) &Laptop or Desktop Computer(s)\\
% \hline
% I have not had any devices of this type that broke in the last 5 years. &\radiobutton &\radiobutton\\
% \hline
% Never &\radiobutton &\radiobutton\\
% \hline
% Sometimes &\radiobutton &\radiobutton\\
% \hline
% Always &\radiobutton &\radiobutton
%\end{tabular}
\begin{enumerate}
\item[6]\textbf{[IF Always or Sometimes for Laptop or Desktop Computer(s)]} In the last 5 years, for each of these device types, which of the following factors influenced your decision not to get a broken device repaired? (check all that apply.)[Asked for each of the following categories: Smartphone(s) or Tablet(s) and Laptop or Desktop Computer(s)]\\
(a) I repaired all devices of this type when they were broken.; (b) Not worth the cost; (c) Privacy concerns; (d) Not worth the hassle; (e) Device was not repairable; (f) Other (\textit{A box for free form text input is provided})
%\end{enumerate}
%\begin{tabular}{ m{3cm}|m{2cm} m{2.5cm}}
% &Smartphone(s) or Tablet(s) &Laptop or Desktop Computer(s)\\
% \hline
% I repaired all devices of this type when they were broken. &$\square$ &$\square$\\
% \hline
% Not worth the cost &$\square$ &$\square$\\
% \hline
% Privacy concerns &$\square$ &$\square$\\
% \hline
% Not worth the hassle &$\square$ &$\square$\\
% \hline
% Device was not repairable &$\square$ &$\square$\\
% \hline
% Other(\textit{A box for free form text input is provided}) &$\square$ &$\square$\\
%\end{tabular}
%\begin{enumerate}
\item[7] In the last 5 years, have you had any of the following electronic devices repaired by a store, repair centre, kiosk or other commercial device repair service? (Check all that apply)\\
(a) Smartphone(s) or Tablet(s); (b) Laptop or Desktop Computer(s)
\item[8] Where were the device(s) selected above brought for repair? (Check all that apply, list any other locations)\\
(a) Large electronics retailer/store; (b) Repair kiosk / small repair store; (c) Manufacturer (in-store or mailed in); (d) IT department of my workplace, organization or school; (e) Cellular service provider; (f) In-home repair; (g) Other (\textit{A box for free form text input is provided})
\item[9] What type(s) of repairs were performed on your device(s) selected above? (Check all that apply. Choose N/A if you didn't select a device of that type above.)[Asked for each of the following categories: Smartphone(s) or Tablet(s) and Laptop or Desktop Computer(s)]\\
(a) N/A; (b) Screen replacement; (c) Camera repair or replacement; (d) Battery replacement; (e) Charging system repair; (f) Motherboard/logic board repair/replacement; (g) Cellular, Wi-Fi, or Bluetooth repair; (h) Audio/microphone repair; (i) Forgotten passcode/PIN; (j) Water damage repair; (k) Virus/Malware removal; (l) Software installation; (m) Other hardware repair; (n) Other software repair; (o) Unknown repair (\textit{A box for free form text input is provided})
\end{enumerate}
%\begin{tabular}{ m{3cm}|m{2cm} m{2.5cm}}
% &Smartphone(s) or Tablet(s) &Laptop or Desktop Computer(s)\\
% \hline
% N/A &$\square$ &$\square$\\
% \hline
% Screen replacement &$\square$ &$\square$\\
% \hline
% Camera repair or replacement &$\square$ &$\square$\\
% \hline
% Battery replacement &$\square$ &$\square$\\
% \hline
% Charging system repair &$\square$ &$\square$\\
% \hline
% Motherboard/logic board repair/replacement &$\square$ &$\square$\\
% \hline
% Cellular, Wi-Fi, or Bluetooth repair &$\square$ &$\square$\\
% \hline
% Audio/microphone repair &$\square$ &$\square$\\
% \hline
% Forgotten passcode/PIN &$\square$ &$\square$\\
% \hline
% Water damage repair &$\square$ &$\square$\\
% \hline
% Virus/Malware removal &$\square$ &$\square$\\
% \hline
% Software installation &$\square$ &$\square$\\
% \hline
% Other hardware repair(\textit{A box for free form text input is provided}) &$\square$ &$\square$\\
% \hline
% Other software repair(\textit{A box for free form text input is provided}) &$\square$ &$\square$\\
% \hline
% Unknown repair(\textit{A box for free form text input is provided}) &$\square$ &$\square$\\
%\end{tabular}
\begin{enumerate}
\item[10] Were you \textbf{ASKED} to provide or remove your password/login/PIN for any repair for the following device(s) selected above? (Check all the apply)[Asked for each of the following categories: Smartphone(s) or Tablet(s) and Laptop or Desktop Computer(s)]\\
(a) N/A; (b) No, I was not asked for my password/login/PIN for any of the repairs; (c) One or more devices were not protected by a password/login/PIN; (d) Yes, I was asked for my password, login or PIN for at least one repair; (e) Yes, I was asked to remove my password, login or PIN prior to at least one repair
\end{enumerate}
%\begin{tabular}{ m{3cm}|m{2cm} m{2.5cm}}
% &Smartphone(s) or Tablet(s) &Laptop or Desktop Computer(s)\\
% \hline
% N/A &$\square$ &$\square$\\
% \hline
% No, I was not asked for my password/login/PIN for any of the repairs &$\square$ &$\square$\\
% \hline
% One or more devices were not protected by a password/login/PIN &$\square$ &$\square$\\
% \hline
% Yes, I was asked for my password, login or PIN for at least one repair &$\square$ &$\square$\\
% \hline
% Yes, I was asked to remove my password, login or PIN prior to at least one repair &$\square$ &$\square$\\
%\end{tabular}
\begin{enumerate}
\item[11]\textbf{[IF asked for PIN/password during a repair]} You answered ``Yes'' for at least one device in the previous question. Did you EVER \textbf{PROVIDE} your password/login/PIN when asked?[Asked for each of the following categories: Smartphone(s) or Tablet(s) and Laptop or Desktop Computer(s)]\\
(a) N/A; (b) yes; (c) no
\end{enumerate}
%\begin{tabular}{ m{3cm}|m{2cm} m{2.5cm}}
% &Smartphone(s) or Tablet(s) &Laptop or Desktop Computer(s)\\
% \hline
% N/A &\radiobutton &\radiobutton\\
% \hline
% No &\radiobutton &\radiobutton\\
% \hline
% Yes &\radiobutton &\radiobutton\\
%\end{tabular}
\begin{enumerate}
\item[12]\textbf{[IF asked for or to remove PIN/password during a repair]} You previously answered that you were asked to provide or remove your password/login/PIN for a repair. For any of these repairs, do you feel that providing or removing your password/login/PIN was not required for the repair?\\
(a) Yes; (b) Maybe; (c) No
\item[13]\textbf{[IF asked for or to remove PIN/password during a repair]} You previously answered that you were asked to provide or remove your password/login/PIN for a repair. How comfortable are you doing this for a repair?\\
(a) Comfortable; (b) Somewhat comfortable; (c) Neither comfortable nor uncomfortable; (d) Somewhat uncomfortable; (e) Uncomfortable
\item[14] Have you \textbf{EVER} been asked by a repair company to remove your personal data from a device before bringing it in for repair (including factory reset, erase all content, etc.)? (If you have been asked for multiple repairs, answer for the most recent)\\
(a) No, I was never asked to remove my personal data; (b) Yes, and I removed my data prior to the repair; (c) Yes, and I did not remove my personal data prior to the repair (if you unlinked an account from your device but did not remove your personal data select this option)
\item[15] Prior to getting a device repaired, have you ever taken any of the following steps to safeguard your personal data? (Check all that apply. Do not select actions you were instructed to do by your repair company.)\\
(a) I made a copy on a backup device and deleted all the data off the device I was getting repaired.; (b) I deleted some of my data.; (c) I set a password/PIN or set a new password/PIN.; (d) I changed passwords or logged out of websites or apps.; (e) I encrypted the device or ensured it was already encrypted.; (f) Other \textit{(A box for free form text input is provided)}
\item[16] During the last 5 years, were you ever concerned that your personal information could have been compromised during a repair?\\
(a) Yes; (b) No; (c) I don't know
\item[17] How concerned are you with the privacy issues surrounding electronics repair?\\
(a) Extremely concerned; (b) Moderately concerned; (C) Somewhat concerned; (d) Slightly concerned; (e) Not at all concerned
\item[18] Has the risk of your personal data being accessed by an unauthorized party ever made you reluctant to get a device repaired?\\
(a) Yes; (b) No; (c) I never considered this risk
\end{enumerate}
\textbf{Protecting Private Data.}
\begin{enumerate}
\item[19] At any time during your LAST repair transaction, were you aware of any safeguards implemented by the repair company to protect your personal data? (check all that apply)\\
(a) Yes, I was informed about one or more measures the repair company was taking to protect my privacy by an employee; (b) Yes, I saw information about one or more measures the repair company was taking to protect my privacy displayed in the store; (c) Yes, I saw information about one or more measures the repair company was taking to protect my privacy online; (d) No; (e) Other (\textit{A box for free form text input is provided}); (f) Not applicable
\item[20]\textbf{[IF saw or was informed about measures to protect privacy]}You previously answered that you were aware of steps taken by the repair company to protect your privacy. What steps did the repair company take to protect your personal data? (\textit{A box for free form text input is provided})
\item[21] During your LAST repair, do you feel your personal data could have been inappropriately accessed?\\
(a) Definitely yes; (b) Probably yes; (c) Unsure; (d) Probably not; (e) Definitely not
\end{enumerate}
\subsection{Semi-Structured Interview}
\label{app:semi_structured_interview}
%The semi-structured interview contained both multiple choice questions and free form responses to questions that further explored the responses of the participants.\\
\textbf{Demographics Information.}
\begin{enumerate}
\item[1] How old are you? (same options as survey Q1)
%(a) 18-25 years old; (b) 26-30 years old; (c) 31-35 years old; (d) 36-40 years old; (e) 41-45 years old; (f) 46-50 years old; (g) over 50 years old; (h) choose not to respond
\item[2] How do you identify? (same options as survey Q2)
%(a) Female; (b) Male; (c) My gender identity is not listed above; (d) Choose not to respond
\item[3] What is the highest level of education you have achieved?\\
(a) Some high school; (b) High school; (c) Some college/university; (d) Trade/technical/vocational training; (e) Associate's degree; (f) Bachelor's degree; (g) Master's degree; (h) Professional degree; (i) Doctorate; (j) Prefer not to say
\item[4] What’s your annual household income?\\
(a) Under \$15,000; (b) \$15,000-\$29,999; (c) \$30,000-\$49,999; (d) \$50,000-\$74,999; (e) \$75,000-\$99,999; (f) \$100,000-\$150,000; (g) Over \$150,000; (h) Prefer not to answer
\item[5] Which of the following best describes your educational background or job field?\\
(a) I have an education in, or work in, the field of computer science, computer engineering or IT; (b) I do not have an education in, nor do I work in, the field of computer science, computer engineering or IT; (c) Prefer not to say
\item[6] Which of the following best describes your level of proficiency with technology like smartphones or laptops? (same options as survey Q3)
%(a) Basic (I can perform basic tasks such as sending emails or browsing the internet); (b) Intermediate (I can perform intermediate tasks such as changing the settings or installing new applications); (c) Advanced (I am capable of writing source code)
\end{enumerate}
\textbf{Experience Getting Devices Repaired.}
\begin{enumerate}
\item[7] Please count the number of the following types of devices that required repair/service, and how many you got repaired in each category:[Asked for the following categories: Smartphones, Laptop or Desktop Computers, Tablets, Cameras, Game Consoles]
\item[8] \textbf{IF device wasn't repaired} For each device that had broken but was not repaired, why was it not repaired?
\end{enumerate}
\textbf{Repaired Device.}
These questions were asked for each device that was indicated as having been repaired.
\begin{enumerate}
\item[9] What device were you getting repaired? [Researchers noted down the make/manufacture and model. Additionally, Researchers noted down how long its been since the device was repaired.]
\item[10] Approximately how long have you used the device (or how long have you owned the device)?
\item[11] Was the device owned by you, Owned by your company, workplace, institution, or school – Only or primarily for work use, or Owned by your company, workplace, institution, or school – Used for both personal and work use?
\item[12] Did this device contain any of the following sensitive data?[Asked for the following categories: Contacts, Personal Emails, Passwords/Logins Including Apps, Work Emails, Texts, Chats, Pictures, Videos, Personal Adult Content, Commercial Adult Content, Banking Information, Digital Wallet]
\item[13] Was this your primary device, and was it shared with someone else (spouse, children, etc.)?
\item[14] Is the device encrypted, or has it ever been encrypted? [Researchers noted responses that had to do with the repair in question 18.]
\item[15] Where was the device brought for repair (Store, Kiosk, mailed in, manufacturer, IT department, etc.)? Or was it an in-home repair (record if in-home repair service for manufacturer, store, etc.)? What was the rationale behind using this repair vendor? % (cues: convenience or expertise or policies or cost or warranty)?
\item[16] What repair or service was performed on the device? Were you aware of the cause of the problem with the device prior to the repair?
\item[17] Prior to the repair, were you asked to take any steps? If yes, do you know what would happen if the device was too damaged to comply with these instructions?
\item[18] What steps did you take on your own to prepare the device for the repair (not because you were instructed to by the repair company)?
\item[19] Did you consider risks to your personal data when getting the device repaired? If so, what were those risks? Did you have any concerns about your data (name types)? [If no risks were reported, the researcher tried to understand why it wasn't considered.]
\item[20] At any time during the repair transaction, were you made aware of any safeguards implemented by the repair company to protect your data?
\item[21] Were you required to provide the repair technician with your PIN, password, or other authentication information? if yes:
\begin{enumerate}
\item[21.1] Was a reason given for why it was required?
\item[21.2] Did the reason seem plausible to you?
\item[21.3] Were you comfortable giving your PIN/password?
\end{enumerate}
\item[22] Did you feel your personal data was safe when getting your device repaired? (\textit{5-point Likert scale ``1'' - ``5, 5 being very safe''})
\item[23] Do you recall an incident where your personal data may have been compromised during a repair? %Or did they notice some changes such as someone cleared recently viewed files or some on saw files in quick access, which should not have been there.
If yes:
\begin{enumerate}
\item[23.1] When did this occur?
\item[23.2] What makes you believe your data may have been compromised?
\item[23.3] Did you take any recourse?
\end{enumerate}
\end{enumerate}
\textbf{General Questions.}
\begin{enumerate}
\item[24]Which of the following types of personal data are you most concerned about a repair technician accessing: [Researchers recorded free response answers for all categories in Q12.]
%(a) contacts; (b) personal emails/documents; (c) passwords; (d) work emails/documents; (e) texts; (f) chats; (g) non-sensitive images; (h) sensitive images; (i) banking information; (j) digital wallet; (k) browsing history
\item[25] If your personal data was compromised during an electronic device repair, what do you believe would be done with the data?
\item[26] Could you suggest a change to the repair process that would make you more comfortable with getting your electronic devices repaired?
\item[27]If there was a way to better protect your personal data during the repair of electronic devices, do you:
\begin{enumerate}
\item[27.1] Feel you would be more likely to use electronics repair services?
\item[27.2] Be more comfortable during a repair?
\end{enumerate}
\item[28] Researchers are proposing a logging program that cannot be disabled by the repair technician. It would be clear if the logs were deleted by the technicians. The following are pictures are examples of the screenshots that would be taken by the program during the repair so you are able to verify your privacy was maintained during the repair. [Researcher showed example output of the Windows Problem Step Recorder.]
%\begin{figure}[ht]\hfill\begin{minipage}{.5\textwidth}
%\centering
%\includegraphics[trim={0mm 0mm 55mm 10mm}, clip, width=0.7\columnwidth]{Figures/Example-Logging.jpg}
%\end{minipage}
%\caption{A screenshot showing PSR capture}
%\label{fig:psr}
%\end{figure}
\begin{enumerate}
\item[28.1] How effective do you feel this proposed logging program would be at preventing privacy breaches?(\textit{5-point Likert scale ``1'' - ``5, 5 being very safe''}) [Researchers also recorded free text response]
\item[28.2] Would you feel your personal data is safe when getting your device repaired if the logging program was used? (\textit{5-point Likert scale ``1'' - ``5, 5 being very safe''}) [Researchers also recorded free text response]
\item[28.3] Would you use this solution for repair services if it was available? [Researchers asked why for no and maybe responses] \\
(a) yes; (b) no; (c) maybe
\end{enumerate}
\item[29] [Researchers showed an example of UEFI diagnostics from a HP Laptop (see Figure \ref{fig:hp_bios}).] In this mode, most hardware on the device can be tested but no personal data can be seen or retrieved on the device. The “Diagnostic mode” can be accessed without a PIN/password. This mode exists for most laptops but most tablets and smartphones do not have this feature.
\begin{figure}[ht]
\centering
\includegraphics[ trim={0mm 0mm 0mm 0mm}, clip,width=0.8\columnwidth]{Figures/Hp+component+test.jpg}
\caption{Tests available through HP BIOS Diagnostic Utility}
\label{fig:hp_bios}
\end{figure}
\begin{enumerate}
\item[29.1] Did you know such a mode existed on laptops for diagnostics? Were you ever made aware of this by a repair facility?
\item[29.2] Would you be less concerned about your data privacy if a ``Diagnostic Mode” option existed for the service you are requesting?
\item[29.3] Would you be more likely to get your electronic devices repaired if it had this feature?
\end{enumerate}
\end{enumerate}
% Generated by IEEEtranS.bst, version: 1.14 (2015/08/26)
\begin{thebibliography}{10}
\providecommand{\url}[1]{#1}
\csname url@samestyle\endcsname
\providecommand{\newblock}{\relax}
\providecommand{\bibinfo}[2]{#2}
\providecommand{\BIBentrySTDinterwordspacing}{\spaceskip=0pt\relax}
\providecommand{\BIBentryALTinterwordstretchfactor}{4}
\providecommand{\BIBentryALTinterwordspacing}{\spaceskip=\fontdimen2\font plus
\BIBentryALTinterwordstretchfactor\fontdimen3\font minus
\fontdimen4\font\relax}
\providecommand{\BIBforeignlanguage}[2]{{%
\expandafter\ifx\csname l@#1\endcsname\relax
\typeout{** WARNING: IEEEtranS.bst: No hyphenation pattern has been}%
\typeout{** loaded for the language `#1'. Using the pattern for}%
\typeout{** the default language instead.}%
\else
\language=\csname l@#1\endcsname
\fi
#2}}
\providecommand{\BIBdecl}{\relax}
\BIBdecl
\bibitem{acar2017internet}
Y.~Acar, M.~Backes, S.~Fahl, D.~Kim, M.~L. Mazurek, and C.~Stransky, ``How
internet resources might be helping you develop faster but less securely,''
\emph{IEEE Security and Privacy}, vol.~15, no.~2, pp. 50--60, 2017.
\bibitem{ahmed2016privacy}
S.~I. Ahmed, S.~Guha, M.~R. Rifat, F.~H. Shezan, and N.~Dell, ``Privacy in
repair: An analysis of the privacy challenges surrounding broken digital
artifacts in {B}angladesh,'' in \emph{Proceedings of the Eighth International
Conference on Information and Communication Technologies and Development},
2016, pp. 1--10.
\bibitem{amadeo2022repair}
\BIBentryALTinterwordspacing
R.~Amadeo, ``Samsung's "repair mode" lets technicians look at your phone, not
your data,'' Jul 2022. [Online]. Available:
\url{https://arstechnica.com/gadgets/2022/07/samsungs-repair-mode-lets-technicians-look-at-your-phone-not-your-data/?amp=1}
\BIBentrySTDinterwordspacing
\bibitem{bbc_apple_snooping}
{BBC Technology News}, ``Apple pays millions in i{P}hone-repair explicit photo
case,'' \url{https://www.bbc.com/news/technology-57399627}, Jun. 2021, last
accessed: 02/2022.
\bibitem{bestbuy_privacy}
{Best Buy}, ``How {B}est {B}uy interacts with your devices.''
\url{https://www.bestbuy.com/site/privacy-policy/devices/pcmcat1488391980823.c},
last accessed: 02/2022.
\bibitem{boxwala2011suspicious}
A.~Boxwala, J.~Kim, J.~Grillo, and L.~Ohno-Machado, ``Using statistical and
machine learning to help institutions detect suspicious access to electronic
health records,'' \emph{Journal of the American Medical Informatics
Association : JAMIA}, vol.~18, pp. 498--505, 07 2011.
\bibitem{tcps2}
{Canadian Institutes of Health Research, Natural Sciences and Engineering
Research Council of Canada, and Social Sciences and Humanities Research
Council}, ``Tri-council policy statement: {E}thical conduct for research
involving humans,''
\url{https://ethics.gc.ca/eng/policy-politique_tcps2-eptc2_2018.html},
December 2018, last accessed: 06/2022.
\bibitem{ceci2021concerned}
J.~Ceci, H.~Khan, U.~Hengartner, and D.~Vogel, ``Concerned but ineffective:
User perceptions, methods, and challenges when sanitizing old devices for
disposal,'' in \emph{Seventeenth Symposium on Usable Privacy and Security
(SOUPS 2021)}, 2021, pp. 455--474.
\bibitem{chiou2012new}
W.-B. Chiou, P.-H. Wan, and C.-S. Wan, ``A new look at software piracy: Soft
lifting primes an inauthentic sense of self, prompting further unethical
behavior,'' \emph{International Journal of Human-Computer Studies}, vol.~70,
no.~2, pp. 107--115, 2012.
\bibitem{facebook_breach}
J.~Cox, ``Sources: Facebook has fired multiple employees for snooping on
users,''
\url{https://www.vice.com/en/article/bjp9zv/facebook-employees-look-at-user-data},
2018, last accessed: 08/2022.
\bibitem{google_breach}
------, ``Leaked document says google fired dozens of employees for data
misuse,''
\url{https://www.vice.com/en/article/g5gk73/google-fired-dozens-for-data-misuse},
2021, last accessed: 08/2022.
\bibitem{das2014tangled}
A.~Das, J.~Bonneau, M.~Caesar, N.~Borisov, and X.~Wang, ``The tangled web of
password reuse.'' in \emph{Network and Distributed System Security (NDSS)
Symposium}, 2014.
\bibitem{ftc}
{Federal Trade Commission}, ``{B}ureau of {C}onsumer {P}rotection,''
\url{https://www.ftc.gov/about-ftc/bureaus-offices/bureau-consumer-protection},
last accessed: 02/2022.
\bibitem{finn2007designing}
P.~Finn and M.~Jakobsson, ``Designing ethical phishing experiments,''
\emph{IEEE Technology and Society Magazine}, vol.~26, no.~1, pp. 46--58,
2007.
\bibitem{geeng2020usable}
C.~Geeng, J.~Hutson, and F.~Roesner, ``Usable sexurity: Studying
$\{$People’s$\}$ concerns and strategies when sexting,'' in \emph{Sixteenth
Symposium on Usable Privacy and Security (SOUPS 2020)}, 2020, pp. 127--144.
\bibitem{golberg2001shostack}
H.~Golberg, ``Shostack. privacy ethics and trust,'' \emph{Boston University Law
Review}, vol.~81, no.~2, pp. 407--422, 2001.
\bibitem{androidguestaccounts}
{Google Inc.}, ``Manage guests and users,''
\url{https://support.google.com/nexus/topic/6126546?hl=en&ref_topic=3416294}.
\bibitem{lisa_ethics}
U.~E.~W. Group, ``System administrators' code of ethics,''
\url{https://www.usenix.org/system-administrators-code-ethics}, 2014, last
accessed: 08/2022.
\bibitem{hang2012too}
A.~Hang, E.~Von~Zezschwitz, A.~De~Luca, and H.~Hussmann, ``Too much
information! {U}ser attitudes towards smartphone sharing,'' in
\emph{Proceedings of the 7th Nordic Conference on Human-Computer Interaction:
Making Sense Through Design}, 2012, pp. 284--287.
\bibitem{ibis_report}
{IBIS World}, ``Electronic \& computer repair services industry forecast,''
\url{https://www.ibisworld.com/united-states/market-research-reports/electronic-computer-repair-services-industry/},
Aug. 2021, last accessed: 02/2022.
\bibitem{jackson2014breakdown}
S.~J. Jackson and L.~Kang, ``Breakdown, obsolescence and reuse: {HCI} and the
art of repair,'' in \emph{Proceedings of the SIGCHI conference on human
factors in computing systems}, 2014, pp. 449--458.
\bibitem{jackson2012repair}
S.~J. Jackson, A.~Pompe, and G.~Krieshok, ``Repair worlds: {M}aintenance,
repair, and {ICT} for development in rural {N}amibia,'' in \emph{Proceedings
of the ACM 2012 conference on Computer Supported Cooperative Work}, 2012, pp.
107--116.
\bibitem{jang2018crowdsourcing}
E.~Jang, M.~C. Barela, M.~Johnson, P.~Martinez, C.~Festin, M.~Lynn,
J.~Dionisio, and K.~Heimerl, ``Crowdsourcing rural network maintenance and
repair via network messaging,'' in \emph{Proceedings of the 2018 CHI
Conference on Human Factors in Computing Systems}, 2018.
\bibitem{jang2019trust}
E.~H.~B. Jang, P.~Garrison, R.~V. Vistal, M.~T.~D. Cunanan, M.~T. Perez,
P.~Martinez, M.~W. Johnson, J.~A. Evangelista, S.~I. Ahmed, J.~Dionisio
\emph{et~al.}, ``Trust and technology repair infrastructures in the remote
rural {P}hilippines: Navigating urban-rural seams,'' \emph{Proceedings of the
ACM on Human-Computer Interaction}, no. CSCW, 2019.
\bibitem{karande2017sgx}
V.~Karande, E.~Bauman, Z.~Lin, and L.~Khan, ``{SGX-L}og: Securing system logs
with {SGX},'' in \emph{Proceedings of the 2017 ACM on Asia Conference on
Computer and Communications Security}, 2017.
\bibitem{karlson2009can}
A.~K. Karlson, A.~B. Brush, and S.~Schechter, ``Can {I} borrow your phone?
{U}nderstanding concerns when sharing mobile phones,'' in \emph{Proceedings
of the SIGCHI Conference on Human Factors in Computing Systems}, 2009, pp.
1647--1650.
\bibitem{khan2020widely}
H.~Khan, J.~Ceci, J.~Stegman, A.~J. Aviv, R.~Dara, and R.~Kuber, ``Widely
reused and shared, infrequently updated, and sometimes inherited: A holistic
view of pin authentication in digital lives and beyond,'' in \emph{Annual
Computer Security Applications Conference}, 2020.
\bibitem{lenhart2016nonconsensual}
A.~Lenhart, M.~Ybarra, and M.~Price-Feeney, ``Nonconsensual image sharing: one
in 25 americans has been a victim of" revenge porn",'' 2016.
\bibitem{limoncelli2016practice}
T.~A. Limoncelli, C.~J. Hogan, and S.~R. Chalup, \emph{The Practice of System
and Network Administration: Volume 1: DevOps and other Best Practices for
Enterprise IT}.\hskip 1em plus 0.5em minus 0.4em\relax Addison-Wesley
Professional, 2016, vol.~1.
\bibitem{eff_geeksquad}
A.~Mackey, ``Geek squad's relationship with {FBI} is cozier than we thought,''
\url{https://www.eff.org/deeplinks/2018/03/geek-squads-relationship-fbi-cozier-we-thought},
Mar. 2018, last accessed: 02/2022.
\bibitem{mare2017security}
S.~Mare, A.~Vashistha, and R.~J. Anderson, ``Security and privacy design
considerations for low-literate users in developing regions.'' in
\emph{Thirteenth Symposium on Usable Privacy and Security (SOUPS 2017)},
2017.
\bibitem{marques2019vulnerability}
D.~Marques, T.~Guerreiro, L.~Carri{\c{c}}o, I.~Beschastnikh, and K.~Beznosov,
``Vulnerability \& blame: Making sense of unauthorized access to
smartphones,'' in \emph{Proceedings of the 2019 CHI Conference on Human
Factors in Computing Systems}, 2019, pp. 1--13.
\bibitem{matthews2016she}
T.~Matthews, K.~Liao, A.~Turner, M.~Berkovich, R.~Reeder, and S.~Consolvo,
````{S}he'll just grab any device that's close'': A study of everyday device
\& account sharing in households,'' in \emph{Proceedings of the 2016 CHI
Conference on Human Factors in Computing Systems}, 2016, pp. 5921--5932.
\bibitem{matzen2017streetstyle}
K.~Matzen, K.~Bala, and N.~Snavely, ``Streetstyle: Exploring world-wide
clothing styles from millions of photos,'' \emph{arXiv preprint
arXiv:1706.01869}, 2017.
\bibitem{mazurek2010access}
M.~L. Mazurek, J.~Arsenault, J.~Bresee, N.~Gupta, I.~Ion, C.~Johns, D.~Lee,
Y.~Liang, J.~Olsen, B.~Salmon \emph{et~al.}, ``Access control for home data
sharing: Attitudes, needs and practices,'' in \emph{SIGCHI Conference on
Human Factors in Computing Systems}, 2010.
\bibitem{psr}
{Microsoft Support}, ``Record steps to reproduce a problem,''
\url{https://support.microsoft.com/en-us/windows/record-steps-to-reproduce-a-problem-46582a9b-620f-2e36-00c9-04e25d784e47},
last accessed: 02/2022.
\bibitem{geeksquad_snooping}
S.~Murdock, ``Geek {S}quad employee allegedly stole nude pictures off
customer's computer,''
\url{https://www.huffpost.com/entry/geek-squad-nude_n_3749201}, Aug. 2013,
last accessed: 02/2022.
\bibitem{opc_report}
{Office of the Privacy Commissioner of Canada}, ``Privacy audit report for
{S}taples {B}usiness {D}epot,''
\url{https://www.priv.gc.ca/en/opc-actions-and-decisions/audits/ar-vr_staples_2011/},
Jun. 2011, last accessed: 02/2022.
\bibitem{paccagnella2020custos}
R.~Paccagnella, P.~Datta, W.~U. Hassan, A.~Bates, C.~Fletcher, A.~Miller, and
D.~Tian, ``Custos: Practical tamper-evident auditing of operating systems
using trusted execution,'' in \emph{Network and Distributed System Security
Symposium}, 2020.
\bibitem{prestwood2016snooping}
L.~Prestwood, D.~Rafailova, M.~Machacek, B.~Kverek, A.~Fuillerat, and M.~Pezzo,
``The effect of entitlement on snooping in the workplace,'' in
\emph{Southeastern Psychological Association Conference 2016}, 03 2016.
\bibitem{redmiles2019should}
E.~M. Redmiles, ````should i worry?'' {A} cross-cultural examination of account
security incident response,'' in \emph{IEEE Symposium on Security and Privacy
(S\&P)}.\hskip 1em plus 0.5em minus 0.4em\relax IEEE, 2019, pp. 920--934.
\bibitem{roulet2017reconsidering}
T.~J. Roulet, M.~J. Gill, S.~Stenger, and D.~J. Gill, ``Reconsidering the value
of covert research: The role of ambiguous consent in participant
observation,'' \emph{Organizational Research Methods}, vol.~20, no.~3, pp.
487--517, 2017.
\bibitem{sartor2006privacy}
G.~Sartor, ``Privacy, reputation, and trust: Some implications for data
protection,'' in \emph{International Conference on Trust Management}.\hskip
1em plus 0.5em minus 0.4em\relax Springer, 2006, pp. 354--366.
\bibitem{sawaya2017self}
Y.~Sawaya, M.~Sharif, N.~Christin, A.~Kubota, A.~Nakarai, and A.~Yamada,
``Self-confidence trumps knowledge: A cross-cultural study of security
behavior,'' in \emph{Proceedings of the 2017 CHI Conference on Human Factors
in Computing Systems}, 2017, pp. 2202--2214.
\bibitem{schneier1998cryptographic}
B.~Schneier and J.~Kelsey, ``Cryptographic support for secure logs on untrusted
machines.'' in \emph{USENIX Security Symposium}, 1998.
\bibitem{shelton2015online}
M.~Shelton, K.~Lo, and B.~Nardi, ``Online media forums as separate social
lives: A qualitative study of disclosure within and beyond reddit,''
\emph{IConference 2015 Proceedings}, 2015.
\bibitem{smith1975faith}
R.~E. Smith, G.~Wheeler, and E.~Diener, ``Faith without works: {J}esus people,
resistance to temptation, and altruism,'' \emph{Journal of Applied Social
Psychology}, vol.~5, no.~4, pp. 320--330, 1975.
\bibitem{apple_snooping}
A.~Tikader, ``Woman catches {A}pple technician stealing her nude photos during
phone repair,''
\url{https://www.ibtimes.co.uk/woman-catches-apple-technician-stealing-her-nude-photos-during-phone-repair-1671893},
Nov. 2019, last accessed: 02/2022.
\bibitem{geeksquad}
D.~Trainer, ``Best {B}uy is thinking inside and outside the (retail) box,''
\url{https://www.forbes.com/sites/greatspeculations/2021/11/02/best-buy-is-thinking-inside-and-outside-the-retail-box/?sh=520fda1a6220},
Nov. 2021, last accessed: 02/2022.
\bibitem{fda}
{US Food and Drug Administration}, ``Laws enforced by {FDA},''
\url{https://www.fda.gov/regulatory-information/laws-enforced-fda}, Apr.
2021, last accessed: 02/2022.
\bibitem{mobile_snooping}
L.~Vaas, ``Phone repair shop employees accused of stealing nude photos,''
\url{https://nakedsecurity.sophos.com/2018/12/20/phone-repair-shop-employees-accused-of-stealing-nude-photos/},
Dec. 2018, last accessed: 02/2022.
\bibitem{vandernagel2013faceless}
E.~van~der Nagel, ``Faceless bodies: Negotiating technological and cultural
codes on reddit gonewild,'' \emph{Scan: Journal of Media Arts Culture},
vol.~10, 01 2013.
\bibitem{vashistha2018examining}
A.~Vashistha, R.~Anderson, and S.~Mare, ``Examining security and privacy
research in developing regions,'' in \emph{Proceedings of the ACM SIGCAS
Conference on Computing and Sustainable Societies}, 2018.
\end{thebibliography}