What to do with your old mobile phone? Smash it up says Tom Brady

NFL star Tom Brady says it’s regular practice when he gets a new phone to destroy the old one. What do the experts think?

Is smashing one’s phone to bits the best way to protect one’s personal information?

NFL commissioner Roger Goodell said Tuesday that his decision to uphold New England Patriots quarterback Tom Brady’s four-game suspension came down to a previously unreported detail in the “Deflategate” scandal: Brady allegedly ordered his assistant to destroy his cellphone immediately before he was interviewed by an NFL-appointed investigator.

Brady said in his testimony that it is his regular practice when he gets a new phone to destroy the old one so that “no one can ever, you know, reset it or do something where the information is available to anyone,” according to Goodell’s ruling.

Unfortunately, Brady’s phone contained nearly 10,000 text messages over four months, a span that included the AFC Championship game, when Brady was found to have used underinflated balls in New England’s blowout win over the Indianapolis Colts. This led Goodell to conclude that Brady’s decision to disappear his phone was a “deliberate effort” to stymie investigators.

Whatever his motive, and whatever you think of Goodell’s ruling, Brady’s decision raises a practical question: Is smashing one’s phone to bits the best way to protect one’s personal information?

In general, experts say, performing a factory reset of the phone and removing the SIM card should be enough to block identity thieves who prey on trashed or donated phones. But if you’re truly paranoid, or an international spy, or the husband of a Brazilian supermodel, it might be appropriate to try stronger measures.

Paul Stephens, director of policy and advocacy for the non-profit Privacy Rights Clearinghouse, pointed to a study published this year by researchers at the University of Cambridge that found information remained on the 21 types of Android smartphones they tested, even after a factory reset. “For a typical person, a factory reset is fine, but it may not always prevent someone skilled in forensics from discovering information on that phone,” Stephens said. “You have to look at your level of risk to make that determination.”

But even if Brady destroyed the phone, that doesn’t guarantee he’s destroyed the data. The reason: His information may have been backed up automatically into cloud servers.

“Destroying the phone does nothing,” said Don Andrew Bailey, the founder of security consulting firm Lab Mouse Security, if “all the info is stored on servers in the cloud.”

The nude photos of the actress Jennifer Lawrence released by hackers last year, for example, were accessed when hackers broke into her account on Apple’s iCloud platform. That hack prompted cybersecurity experts to warn users not to share sensitive information to the cloud.

And there’s more bad news. Even if you do disable cloud storage, reset your phone and smash it with a claw hammer: Your data is still not entirely safe. If you’re the subject of a criminal investigation, law enforcement agencies may still be able to see at least some of your personal data, so long as they get a court order for your service provider, Bailey said.

If Brady were using an iPhone to text with other people with iPhones, those messages would likely be stored on Apple’s servers and accessible with a warrant. Thankfully for Brady, though, deflating footballs isn’t a crime — and the NFL doesn’t have subpoena power.

Of course, there is an old-fashioned way to eavesdrop on someone’s phone: find all the people they contacted and look at their phones. Brady’s agents offered to give investigators a spreadsheet with the phone numbers of people he’d contacted in those four months and suggested the NFL ask them to produce the text messages. The NFL said that request was “simply not practical.”

—Danny Yadron contributed to this article.

The Wall Street Journal