SaTC: CORE: Small: Managing Privacy and Environment for Used and End-of-Life Electronic Devices

The COVID-19 pandemic accelerated the transition towards increased telework and mobile working. This implies that personal devices and home networks have moved from occasional to pervasive professional use, and can now be classified as critical infrastructure. Managing the security of these networks is thus a national priority. Progress towards the Internet-of-Things leads to consumers owning an expanding array of devices privy to personal video, audio and other information. End-of-life poses a large security risk if disposed-of devices still contain sensitive data and end up in the wrong hands. Data security is also important for sustainability: A consumer concerned about privacy may store a device or recycle it, instead of selling for reuse. Many devices turned in for recycling are not reused because the device and data cannot readily be cleared for a new user. Decreased reuse has economic, social and environmental impacts. Data security and end-of-use are thus fundamentally intertwined, but currently poorly understood and managed.

This project involves integrated research and outreach activities to better understand and manage the privacy of data on home devices. For a set of Internet-of-Things and other home consumer electronics, consumers are surveyed on privacy and end-of-use behaviors. Personally Identifiable Information stored on different devices is assessed and analyzed for privacy risk. The usability of data wiping protocols is evaluated to clarify how easy and effective it is to remove personal data from different devices. The results from these activities leads to construction of a model predicting security and end-of-use behaviors for different consumer groups. This model is used to suggest effective interventions to improve privacy and sustainability outcomes, e.g. improving the usability of wiping protocols or educating consumers. Outreach is done to support decision-making, for example research results are brough to stakeholders in industry and consumer groups engaged in standard development. A consumer guide to security and end-of-use is developed and distributed widely, e.g. through the iFixit website. K-12 summer camps are held for high school students from under-represented groups. Undergraduate and graduate students will be engaged in the privacy assessment and usability evaluations. An exhibit on security and end-of-use is developed for Imagine RIT, an annual event that brings tens of thousands of Rochester residents to campus.

This award reflects NSF's statutory mission and has been deemed worthy of support through evaluation using the Foundation's intellectual merit and broader impacts review criteria.