We caught technicians at Best Buy, Mobile Klinik, Canada Computers and others snooping on our personal devices

When you need to drop off your tech devices for a repair, how confident are you that they won't be snooped on?

CBC's Marketplace took smartphones and laptops to repair stores across Ontario — including large chains Best Buy and Mobile Klinik — and found that in more than half of the documented cases, technicians accessed intimate photos and private information not relevant to the repair.

Marketplace dropped off devices at 20 stores, ranging from small independent shops to medium-sized chains to larger national chains, after installing monitoring software on the devices. In total, 16 stores were recorded. (At four stores, the tracking software didn't log anything, or the stores didn't appear to turn the devices on.)

Technicians at nine stores accessed private data, including one technician who not only viewed photos but copied them onto a USB key.

"These results are frightening," said Hassan Khan, associate professor in the school of computer science at the University of Guelph. "It's looking through information, searching for data on users' devices, copying data off the device.... it's as bad as it gets."

To examine the extent of privacy breaches by technicians at repair stores, Marketplace teamed up with Khan, who had previously done a privacy study on laptop repairs in a number of Ontario stores, which found that many technicians snooped on personal data.

For the Marketplace investigation, Khan, along with graduate students Angela Tran and Brandon Lit, loaded four smartphones and six laptops with the kind of private data many users would have on their devices: financial information, social media and email accounts, as well as browser history. For the sake of the experiment, the information was fake, so no one's personal information would be at risk.

Marketplace also took intimate selfie-style photos of two models whose faces were cropped out, and those pictures, along with other generic photos, were saved on the devices.

For the laptops, Khan and his team initially created a repair issue by disabling the WiFi. Technicians at the first few stores didn't need to keep the device in order to fix it, so Khan's team created a new software problem that would require stores to hold on to the device to repair it, by disabling the USB port. 

Khan and his students installed secret logging software that would screen-capture and record what technicians accessed during each repair. 

For the smartphone test, Prof. Mohammad Mannan from Concordia University and his Ph.D. student Sajjad Pourali created a repair issue — a flickering screen — and installed logging software that screen-recorded the technicians' actions. 

Khan and other computer science experts Marketplace spoke with said that looking at photos or files would not be necessary for these types of repairs.

"Going through those files to look for a fix does not make sense," said Khan.

Marketplace shared the findings with former Ontario privacy commissioner Ann Cavoukian, who said, "your personally identifiable data is extremely sensitive."