Ever wondered what happens to your passwords, documents and banking information when you get rid of an old computer, smartphone or tablet?
It depends on the method, say security experts, including whether you trade in the device at an electronics retailer or drop it off at a collection point for recycling.
According to University of New South Wales professor of cybercrime Richard Buckland, common recycling methods are not completely secure and may not fully erase data.
“If your device contains very sensitive data that would be worth someone investing tens of thousands of dollars trying to get back, then I wouldn’t hand [the device] in,” he said.
So, how should you safely dispose of an old device while protecting your personal data?
‘Globally recognised’ erasure software
Brett Burgess is the CEO of Moorup, a Melbourne-based “technology recommerce” company that buys and sells used electronics through retailers including Officeworks, Costco and Retravision.
He said when Moorup received a device from a consumer or business, the device was wiped and resold, or recycled if it was deemed “beyond economic repair”.
“If it’s got some resale value, or we can donate it, we’ll securely erase the device using software [developed] by a company called Blancco, a globally recognised expert,” he said.
“We completely and permanently render all the data on the device unrecoverable, using cryptographic erasure standards.”
Brett Burgess says the used electronics market has quadrupled in Australia since 2018. (Supplied: Moorup)
Mr Burgess said the erasure process typically took 48 hours and was verified with a “digitally signed, tamper-proof” certificate to confirm all data had been securely erased.
“It’s all done in-house in Australia and we only have a certain number of staff that can actually access the devices [and they] can’t see any of the data either,” he said.
Recycling centre risks ‘miniscule’
James Coghill is a technical consultant at Total Green Recycling, the only licensed e-waste recycler in Western Australia, where e-waste was banned from landfill in July 2024.
Since founding the company with his brother in 2008, Mr Coghill said Total Green Recycling now handled the majority of e-waste at collection points across the state.
James Coghill says Total Green Recycling processes 25 tonnes of e-waste a day. (Supplied: Total Green Recycling)
Mr Coghill said e-waste was brought to the sorting floor at Total Green Recycling’s facility in Perth and sorted into five waste streams, including a stream for computers.
The e-waste then goes through pre-processing to remove hazardous materials, including lithium-ion batteries.
“Whatever is left will then go through our shredding and separation plant,” Mr Coghill said.
“We’ve got a series of shredders that liberate the [remaining] material within the e-waste.”
Mr Coghill said although recycled devices were shredded, there were still data security risks because there was no “secure chain of custody” for individual devices.
“We cannot guarantee data is destroyed if a device is dropped off at one of the collection [points], usually a landfill tip. You don’t have visibility on that,” he said.
Total Green Recycling picks up and secures e-waste from collection points every two weeks. (ABC Radio Perth: Joshua Wong)
Mr Coghill said Total Green Recycling used to offer data destruction services at collection points, including degaussers, machines that used magnetic fields to permanently erase the data on storage devices, including hard drives.
But he said those services had been divested due to “massive” running costs.
“The people that did want their drives wiped were very happy … but in our experience, [most] people don’t want to pay for it and just want to see [devices] gone,” Mr Coghill said.
He said the risk of data theft at recycling centres was also “minuscule”, relatively speaking.
“The economic reality is that for someone to recover data from a device that’s been through a shredder, while possible, [it] is often more costly than what that data is worth,” he said.
No guarantees in a factory resetÂ
Professor Buckland said neither resellers nor recyclers provided a completely secure way to dispose of used devices.
“The onus is on you to secure your data before you hand the device in,” he said.
Delete and reset, advises Richard Buckland, and even then there are no guarantees. (ABC News: Greg Bigelow)
Professor Buckland said users should delete their data and perform a factory reset of their device before disposing of it.
However, he also said these steps were not completely effective.
“Computers are very good at holding data, so deleting it in the operating system very rarely results in it being deleted in the real world,” he said.
“There’s no definition of a factory reset. It can simply mean resetting all the default values like the brightness of the screen, but it can also leave user data completely untouched and sometimes that’s intentional.
“The data is still there and someone who knows how to look for it can find it.”
Consider device disposal risks
According to Professor Buckland, users should use a “risk-adjusted strategy” and weigh up the hazards of different disposal methods.
“If all you’ve got is your banking details that probably nobody is going to spend thousands of dollars on the off chance it can be recovered … going through your own deletion process first before handing it in is probably good enough,” he said.
Mr Coghill also recommended a risk assessment when deciding how to dispose of a device.
“We don’t want to see people not recycling their electronics because they’re worried about the data risk,” he said.
“The risk profile is probably similar, if not higher, than if you’re keeping it in your garage where someone can take it.”