Ars Technica reports what happened when researchers at the University of Guelph in Ontario, Canada, dropped off laptops at 12 computer repair companies — and then found out what they did after they were repaired:
The log files showed that technicians from six different Companies είχαν πρόσβαση σε προσωπικά δεδομένα και μάλιστα δύο από αυτά τα καταστήματα αντέγραψαν τα δεδομένα σε άλλη device.
The interception rate may actually have been higher than recorded in the study, which was conducted from October to December 2021.
In total, the researchers took laptops to 16 stores in the greater Ontario area for repair. Device logs from two of these visits were not recoverable. Two of the repairs were done on-site, in the presence of the customer, so the technician did not have the opportunity to see hidden personal data. In three cases, the Windows Quick Access or Recently Accessed Files (Windows Quick Access – Recently Accessed Files) had been deleted, which the researchers suspect was an attempt by the technicians to cover their tracks.
The majority of repair companies do not have a privacy policy, and those that do have no means of enforcing it. In many cases, the technicians asked the customer to provide their password even though it was not necessary for the repair they needed.
These findings came from a separate part of the study, in which the researchers gave a laptop computer Asus UX330U in 11 stores to replace its battery.
This repair does not require the technician to be connected to the machine, as removing the back of the device and accessing the device's BIOS (to check battery health) is all that is required. However, all but one of the service providers asked for the credentials for the device's operating system anyway.
When the customer asked if they could do the repair without giving the password, three refused to take the device, four agreed to take it but warned that they could not verify their work or be responsible for it, one asked the customer to remove the passcode and one said he would reset the device if needed.
