How should you dispose of IoT smart devices?

Smart devices are everywhere. They inform us, simplify our access to information and, in general, make our lives a little bit easier. From baby monitors to fridges, kettles, and doorbells, IoT tech is in constant reach. But, is there a hidden cost attached to this convenience?

Could the Internet of Things threaten our sensitive data?

The Internet of Things (IoT) is a broad term that describes objects equipped with software, chips, and other technologies, enabling them to connect to the internet and exchange data with other devices and systems. For example, if you have a smart kettle, it would be considered an IoT device as it can connect to your smartphone for remote control. But can boiling the kettle without getting up from your comfy spot on the sofa come with hidden risks?

While IoT devices are highly convenient, what you may not know is that these devices can store a decent-sized chunk of information about their owners. Data stored on IoT devices can include:

• Your email address and password
• Usernames and passwords for account logins
• Information about your Wifi network, such as your SSID and password
• Your VPN username and password (if you’re using one)
• Your DDNS usernames and passwords
• Depending on the device, it could also store photo, audio, or video footage of you. 

Often, smart devices lack the functional capabilities to encrypt information like a PC or laptop would. However, while your smart devices are in use, it’s recommended to protect this data. You can do this by using unique passwords for all your accounts, changing your default router passwords, keeping all software up to date, and enabling multi-factor authentication for all your logins. But what about when you want to get rid of these devices? 

How should you dispose of smart technology?

The secure disposal of your smart tech is absolutely necessary to protect your personal information.

It may seem a little dystopian that the incorrect disposal of your kettle could land you in hot water, but in a world full of IoT smart devices, this is a reality that many individuals and businesses have to consider.

This is because there are two main issues when it comes to the data held on smart devices: the capabilities of the user and the effectiveness of data erasure. 

User capabilities and knowledge

It probably won’t come as a surprise that a lot of people do not know how to protect or erase data on a smart device. Some people will not even be aware that smart devices contain data about them.

A 2023 study by P. Liu et al. discovered that 80.2% of people surveyed were worried about the leakage of their personal data in used IoT devices, but, interestingly, 25.6% didn’t know that the devices could store their home WiFi information, and 38.8% didn’t know that third-party accounts could be stored in an IoT device.

The same study also found that 51.1% of the smart tech users surveyed did not erase their sensitive data when disposing of IoT devices. The reason that the majority gave for not erasing data is that they didn’t know how to. This could indicate that over half of the IoT smart devices that are entering waste streams contain personal data. 

Effectiveness of data erasure

In the same study by P. Liu et al., the other 48.9% who did know how to erase their data did so by overwriting, soft resetting, or hard resetting their used IoT device before disposal. On the surface, this seems promising. However, the research group also studied the ‘wiped’ IoT devices…

Shockingly, the researchers found that data overwriting, firmware upgrades, soft and hard resetting were largely ineffective in erasing user information by design. Instead of erasing data, these processes were found to be marking the state of the storage unit from valid to invalid. This indicates that IoT manufacturers may not always build effective data erasure capabilities into their systems. The implications of this are alarming. Even if users do their due diligence by resetting their devices, their information could still be present.

While the UK government has set out a code of practice for consumer IoT security, there’s still some way for IoT device manufacturers to go. In the meantime, there are a few options you have to ensure your IoT smart devices are secured when no longer needed.

Return schemes 

If you’re an individual consumer (not buying on behalf of a business), you can typically return your used smart devices to a retailer when buying a new one. While these schemes are good for reducing waste and useful for electronics that don’t contain personal information, IoT devices are a different story. 

We asked one of the UK’s leading electronics retailers to ask what they did, if anything, with smart devices returned through WEEE takeback schemes. A representative said:

“Smart devices returned through WEEE schemes are not automatically wiped – it’s your responsibility to erase personal data before handing them in”.

In response to being asked if they could offer any advice or help articles on how to wipe data from such devices, the retailer stated that they do not offer such guidance. Bad news if, like many, you aren’t sure how to effectively wipe a smart device. Even worse news if you return a smart device through a WEEE takeback scheme and it’s later sold onto the highest bidder!

While it is quite easy for a lot of us to search the internet for data wiping instructions for specific devices, it’s not clear how effective these practices are. Secondly, not everyone is tech-savvy. For example, smartphone usage in older generations has increased. However, because older generations did not grow up with rapidly advancing modern technology, many aren’t confident using it. A OnePoll survey commissioned by the BT Group found that 29% of respondents aged 65 and over find new tech complicated and overwhelming. 40% also said that not being shown how to use something would hold them back. So, what should we do for the large percentage of our population who aren’t confident enough to wipe their own smart devices?

Secure destruction

Secure destruction is one of the best solutions for unwanted IoT devices and smart tech. With secure destruction, you’re not relying solely on data erasure to ensure your information isn’t at risk. As long as you’re using a fully accredited service provider that follows strict security procedures and operates in line with EN 15713 standards, your information will be in safe hands.

In many ways, IoT device destruction is very similar to hard drive destruction. Some people prefer to degauss or wipe hard drives before having them professionally destroyed, but it’s not necessarily needed. This is because physically destroying hard drives makes information retrieval impossible. The same goes for any electronics that contain personal data.

When you use an environmentally conscious shredding provider, there’s also the added benefit of recyclability. Breaking IoT objects down with industrial shredders actually makes devices easier to recycle. It’s one of the fastest ways to separate different components, such as plastics and metals. While destruction means the devices can’t be reused in their current state, the materials still can. 

When you choose secure destruction, you remove the need to wipe devices and don’t need to worry about your information falling into the wrong hands. With Shred Station, you also have a sustainable, guilt-free, carbon-neutral, and zero-to-landfill disposal solution. Win-win.

If secure destruction sounds like it’s the right option for you, get in touch with our team of experts to book in. Our fully accredited services are available UK-wide, and no job is too big or small.

Sign up for our newsletter here to receive updates on blog articles, data protection advice, and Shred Station news.