When I contacted the original owners of the phones, their stories were similar: The phones had been stolen, the owners desperately tried to get them back, and--not having installed a remote-wiping app--the owners had to accept the fact that their data was out in the wild. The owner of the Motorola Droid, Emily Smith, even remotely accessed her voicemail and found that the thief was using the phone as her own. But that knowledge couldn't help her get the phone back, and when I met up with Smith in San Francisco, she said that she switched from Android to an iPhone, because Apple's MobileMe would allow her to remotely lock her handset should it be stolen in the future. I returned the Droid to Smith. The owner of the Samsung Rogue was not able to meet up with me, and asked that we destroy the information on it.
Smith's story is a familiar one: A lot of people's phones are stolen, but as smartphones get smarter, the loss of data is going to become more disconcerting. When you lose a phone, you don't just lose your own information, but also contact details, photos with other people in them, and the messages that other people have sent you. Installing an app that can remotely lock and erase the information on your phone is a great way to prevent a devastating mistake.
That said, if someone really has it out for you, or is specifically looking to harvest personal data, all they really have to do is grab the phone and put it in a Faraday bag (made of a special material that inhibits all communication from the network to the phone, preventing any remote-wiping tools). Or, easier still, if you have a GSM-based phone that requires a SIM card to communicate with the network (think AT&T and T-Mobile), all the thief needs to do is remove the SIM card to prevent your remote-wiping app from destroying your information.
Information That Won't Come Off a Phone
Some types of phone information can't be wiped off even if you follow the instructions correctly.
The last phone we found information on was an HTC SMT5800 Windows-based smartphone sold to us by Jason Mills's SoonerSoft. Mills had done a complete factory reset of the phone, leaving no email or contacts behind. But deep in the phone's menu we found a 'call duration' option that listed the number of incoming and outgoing calls that the previous user had made in total hours and minutes.
"On some phones, call duration is not wipeable," Mills says. "They'll let you wipe the contacts and everything, but keep a list of call time so if the phone is resold, [a reseller] couldn't say this phone is refurbished or brand-new; they'd have to say it's used."