Researchers at the University of Maryland have found personal data remained on many used cell phones purchased through a police auction website. Police departments typically acquire phones through civil asset forfeiture, but are sometimes the destination for items from the airport lost and found. Over a period of months, U-M-D researchers purchased 228 used phones from 'PropertyRoom.com,' a reseller that partners with thousands of police departments. Many contained personal information. One phone that was used in an identity theft scheme was resold with the identity theft victims' complete credit histories. The researchers didn't use any software to break into the phones, and study author Dave Levin says they found many people aren't taking basic precautions.

"First off, choose a good pin. We found about 20% or so of the phones that we ended up purchasing didn't have any pin we turned it on and it was just unlocked. For the other phones that we got into we guessed the pins because the pins were things like 1-2-3-4, 6-6-6-6, these types of things."

Researchers notified PropertyRoom, which advised them it will no longer sell phones with personal information. PropertyRoom did not respond to our request for comment.

To address issues with other resellers handling lost-and-found items, such as web outlets or pawn shops, researchers say legislation would be needed. While the issue of law enforcement reselling electronics containing personal data could also be addressed by legislation that at a minimum required the devices to be wiped clean, Levin says the best approach would be for police departments to not resell phones.

 "We didn't use any of the clever tools and tricks. Prior work has shown that even when you think you wipe something, it might not wipe something altogether. Not necessarily. We've seen that on phones, but it just the safest thing would have been to just destroy the phones altogether."

With the power of modern cell phones to handle so many tasks, the amount of personal data stored on the devices can be vast. Richard Roberts also worked on the study and says many of the phones contained a lot of personal information.

"For over a quarter of the phones – about 26, 27% that we purchased – we were able to super easily see all of the personal information from the previous person who owned it, whether that was texts, phone calls, emails, photos, anything that was on the phone."

U-M-D researchers destroyed the phones after the study was concluded.