  Electronics repair and service providers offer a range of services to
computing device owners across North America -- from software installation to
hardware repair. Device owners obtain these services and leave their device
along with their access credentials at the mercy of technicians, which leads to
privacy concerns for owners' personal data. We conduct a comprehensive
four-part study to measure the state of privacy in the electronics repair
industry. First, through a field study with 18 service providers, we uncover
that most service providers do not have any privacy policy or controls to
safeguard device owners' personal data from snooping by technicians. Second, we
drop rigged devices for repair at 16 service providers and collect data on
widespread privacy violations by technicians, including snooping on personal
data, copying data off the device, and removing tracks of snooping activities.
Third, we conduct an online survey (n=112) to collect data on customers'
experiences when getting devices repaired. Fourth, we invite a subset of survey
respondents (n=30) for semi-structured interviews to establish a deeper
understanding of their experiences and identify potential solutions to curtail
privacy violations by technicians. We apply our findings to discuss possible
controls and actions different stakeholders and regulatory agencies should take
to improve the state of privacy in the repair industry.
