Evidence note. This report distinguishes between local documentation, technical possibility, and international findings. Targeted Kurdish-, Arabic-, and English-language searches identified no reliable published study examining privacy practices in phone-repair or second-hand-phone shops in the Kurdistan Region, and no verified local case clearly establishing that a repair technician copied customer data. The limited availability of public information may also reflect the sensitive nature of such cases: where complaints are handled by the Asayish or its technical teams, confidentiality and limited disclosure may restrict access to case details. However, without supporting documentation, this remains a possible explanation for the evidence gap rather than confirmation that specific incidents occurred or were investigated. The absence of published evidence does not establish that misuse never occurs, but claims about its prevalence require further local research.

1. Introduction

A customer walks into an unofficial repair shop in Erbil, Sulaimaniyah, Duhok, Kalar or Halabja. The screen is broken, and the technician asks for the PIN. In another shop, a seller hands over an old phone after deleting the photo gallery. Both believe they have transferred a piece of hardware. They may also have transferred access to photographs, conversations, contacts, locations, documents, financial services and online accounts. The central question is therefore simple: how much of a person’s private life remains visible or recoverable when a phone leaves their hands?

2. Inside the Repair Shop: Who Can See What?

Phone repair is a regulated occupation in the Kurdistan Region. The KRG’s public licensing service covers labour directorates in Erbil, Sulaimaniyah, Duhok, Soran, Zakho and Garmian/Kalar, and lists age, workplace, skill, registration, inspection and clearance requirements. The published page does not state a customer-data, password or confidentiality procedure.[1] This is an observation about that public page, not a claim that no other rule or good practice exists.

A technician may reasonably need the phone to operate when diagnosing software, touch, camera, microphone, speakers, mobile service or connectivity. A battery, charging-port or some screen repairs can often be carried out while the phone remains locked; final testing can be done by the owner in the technician’s presence. The shop should explain the exact test before requesting access. Apple’s current service guidance says customers should never disclose an Apple Account password or device passcode; for some software support, the owner may enter it while remaining present.[2]

Some phones provide a safer route. Google Pixel Repair Mode starts a clean Android system in a separate secure area, tells owners not to share their lock code, and still recommends a backup because storage-related repairs may require erasure.[3] Samsung Maintenance Mode similarly creates a separate account that hides photos, videos, contacts, messages, call history and user accounts while leaving diagnostic functions available.[4]

Without such a mode, an unlocked phone may expose whatever the operating system and individual apps allow: galleries, messages, contacts, email, notes, files, browser activity and logged-in social-media or cloud accounts. Banking apps and saved-password stores may demand a second PIN or biometric check, so access is not automatic. A person with access could copy data by cable, upload or messaging without changing the original; the owner might see no obvious sign. If the phone is sent to another branch or subcontractor, more people may handle it. A responsible shop should identify that chain in advance, record any access permission, and return or erase any test copy.

3. Deleted Does Not Always Mean the Same Thing

Deleting one item is not the same as erasing a phone. A deleted photo may first sit in “Recently Deleted.” After permanent deletion, the phone usually marks its storage space as available for reuse; older Android file systems have allowed forensic recovery until the space was overwritten.[5] Recovery depends on the phone’s age, encryption, storage technology, operating system, condition and how much it has been used since deletion. Small traces-thumbnails, cached previews, downloaded attachments or database fragments-may also survive even when the original is gone. It is therefore inaccurate to promise that every deleted item is recoverable, or that none is.

Modern factory resets are different. Encryption scrambles stored information and a secret key unlocks it. On supported Apple devices, “Erase All Content and Settings” erases a key and makes the files cryptographically inaccessible.[6] Android 16-compatible devices must provide a factory reset that deletes the user-data file system in line with recognized sanitization standards.[7] In ordinary circumstances, a correctly completed reset on a modern encrypted iPhone or Android phone therefore makes the previous user’s local content inaccessible.

This is not absolute. Older or unencrypted phones, damaged devices, unofficial software, an interrupted or incorrectly chosen reset, or manual deletion alone create greater uncertainty. A 2023 study of Android 11 and 12 phones found some encrypted bytes and usage information outside the main user-data area after reset; it did not show that readable old photographs and messages could simply be restored.[8] Cloud storage is separate: resetting the handset does not erase copies held in iCloud, Google services, WhatsApp backups or another person’s device. Those copies may return when the owner signs in or restores a backup.

4. The Privacy Risks of Selling a Used Phone

Removing apps and photographs by hand is an incomplete sale process. The owner should first back up what is needed, sign out of messaging, social media, email, banking and cloud services, remove the Apple, Google, Samsung or other manufacturer account, and disable device tracking or activation lock through the manufacturer’s official steps. Then remove the physical SIM and removable memory card and perform the correct factory reset. Apple’s guidance confirms that an iPhone erase removes local content, turns off Find My and Activation Lock, but does not delete content from iCloud; it also tells Android trade-in users to sign out, erase, and remove SIM and memory cards.[9]

The seller should wait until the phone restarts at the first setup screen, without their name or account. If that does not happen, the transfer should pause. Shops, trade-ins and person-to-person sales create different accountability: a shop may issue a receipt but pass the phone among staff; a social-media or marketplace sale may leave less documentation and puts the phone immediately in a stranger’s hands. No reliable published research was found on whether sellers or buyers in Kurdistan receive erasure guidance, or whether local traders routinely verify a reset. This deserves direct research in Erbil, Sulaimaniyah, Duhok, Garmian/Kalar, Halabja and other markets.

5. Evidence from Kurdistan and Iraq

The strongest local evidence concerns the consequences of digital exposure, not its source. A 2023 report citing Kurdistan Region Police statistics recorded 2,576 cases of misuse of communications devices in 2022, compared with 343 in 2021; it also reported 690 such cases in Sulaimaniyah and more than 100 violations in Garmian during the first half of the preceding year.[10] These figures cover broad communications misuse and online blackmail. They must not be read as repair-shop or second-hand-phone cases.

Unauthorized access can expose intimate material, private conversations, financial information or work files. The consequences may include impersonation, fraud, threats and non-consensual sharing. The risk can be especially serious for women in socially conservative settings, survivors of abuse, journalists protecting sources, activists, candidates and public figures, because exposure may reveal identities, relationships or locations. Iraq’s Supreme Judicial Council has also noted that fear of stigma can deter reporting.[11]

Law and consumer protection

Iraq’s 2005 Constitution recognizes personal privacy in Article 17 and protects telephone and electronic communications from monitoring, eavesdropping or disclosure except for legal and security necessity under a judicial decision in Article 40.[12] In the Kurdistan Region, Law No. 6 of 2008 states that private telephone, postal and electronic communications are inviolable. It penalizes listed misuses of communications devices, including certain threats, leaking conversations, taking photographs without permission, and publishing private or family information in ways that cause harm.[13]

The law was written before today’s platform environment. A University of Garmian legal study concluded that Law No. 6 is used against cybercrime but needs further amendment, noting that social networks are not addressed in the Journalism Law.[14] The Kurdistan Parliament’s Law No. 9 of 2010 applied Federal Consumer Protection Law No. 1 of 2010 in the Region pending a specific regional law.[15] Those rules provide a general consumer framework, but the materials reviewed do not set out a detailed phone-repair code on PIN requests, copying, subcontracting or breach notification.

Iraq still has no standalone cybercrime law, according to an April 2026 Supreme Judicial Council statement. Courts use Penal Code Articles 430 and 431 for threats linked to demands, including threats to publish private images or information; the applicable sentence depends on the facts and seriousness.[11] A 2022 Council article recorded 2,452 electronic-blackmail complaints in Iraqi investigation courts between 2 January and 31 March 2022.[16] A victim may therefore have criminal or consumer routes, but the correct remedy depends on the conduct and jurisdiction. This report is general information, not legal advice.

6. What International Research Shows

International work shows why local safeguards are worth testing. A North American study of 18 electronics service providers found that most lacked privacy policies or controls; instrumented devices left at 16 providers recorded snooping, copying and attempts to remove traces.[17] The experiment was largely computer-based, so it illustrates repair-process weaknesses rather than proving conduct in Kurdistan phone shops. A 2025 Singapore investigation did include phones: three of 40 submitted devices were phones on which technicians snooped, alongside nine laptops.[18]

Disposal research finds human error rather than inevitable technical failure. In a 2021 survey of 131 users, 25% of participants who disposed of devices reported insecure erasure methods; confusing prompts and limited knowledge were important causes.[19] A UK study of 100 second-hand phones and tablets found 52% had been reset or erased, 28% could not be examined, and 20% contained data identifying a previous owner.[20] These results do not measure Kurdistan, but they support clear, local-language instructions and a verifiable reset process.

7. How Phone Owners Can Protect Themselves

8. Recommendations for Repair Shops and Authorities

Repair businesses should use a short written privacy notice and receipt stating who owns the phone, the requested repair, whether unlocking is necessary, which tests are authorized, whether data may be erased, and whether another branch or subcontractor will handle it. PIN requests should be exceptional, explained and recorded; account passwords should never be requested. Staff should have confidentiality duties, work in access-controlled areas, avoid personal storage media, delete authorized test copies, and offer customer-visible testing.

KRG authorities could add data-handling conditions to the existing mobile-repair licensing and inspection process; publish Kurdish and Arabic guidance for repair and resale; promote built-in repair modes; support secure-erasure services; and make complaint routes visible. Universities and consumer bodies should conduct anonymous mystery-shopper tests, interviews and second-hand-phone examinations across the Region, with ethical safeguards and results separated by location and type of business.

9. Conclusion

Handing over or selling a phone can also hand over access to parts of a person’s private life. The risk is manageable: limit unlocked access during repair, use a maintenance mode, and complete a verified factory reset before transfer. Repair businesses and authorities share responsibility for making those steps normal, clear and accountable.

References

All sources are independent of INSM/INSEM. Titles in Kurdish or Arabic are followed by an English translation.

[1] Kurdistan Regional Government Services. مۆڵەتی پیشەی چاککەرەوەی ئامێری پەیوەندی (مۆبایل) [Professional licence for communications–device (mobile–phone) repairer]. Ministry of Labour and Social Affairs; last updated 22 April 2024. (Kurdish).

[2] Apple. Prepare your iPhone or iPad for a service appointment. Apple Support, 30 June 2026. (English).

[3] Google. Use Repair Mode for repair services. Pixel Phone Help; accessed 3 September 2026. (English).

[4] Samsung. How to use Maintenance mode on your Galaxy phone or tablet. Samsung Support UK; updated 4 June 2026. (English).

[5] Joel Reardon, Claudio Marforio, Srdjan Capkun and David Basin. Secure Deletion on Log-structured File Systems. 2011; research tested the older YAFFS file system used on Nexus One phones. arXiv:1106.0917. (English).

[6] Apple. Data Protection in Apple devices. Apple Platform Security, 18 February 2021. (English).

[7] Android Open Source Project. Android 16 Compatibility Definition, section 9.12: Data Deletion. Google; last updated 2 December 2025. (English).

[8] Mattheüs B. Blankesteijn, Aya Fukami and Zeno J. M. H. Geradts. Assessing Data Remnants in Modern Smartphones After Factory Reset. Forensic Science International: Digital Investigation 46, article 301587, September 2023. DOI: 10.1016/j.fsidi.2023.301587. (English).

[9] Apple. What to do before you sell, give away, or trade in your iPhone or iPad. Apple Support, 29 May 2026. (English).

[10] Bassem Francis. حالات “الابتزاز الإلكتروني” تسجل قفزة كبيرة في إقليم كردستان [Electronic blackmail cases record a large rise in the Kurdistan Region]. Independent Arabia, 13 January 2023. (Arabic).

[11] Iraqi Supreme Judicial Council. استئناف واسط تنظم ورشة عمل متخصصة عن الابتزاز الإلكتروني [Wasit Court of Appeal organizes a specialized workshop on electronic blackmail]. 30 April 2026. (Arabic).

[12] Republic of Iraq. دستور جمهورية العراق [Constitution of the Republic of Iraq]. Approved by referendum, 15 October 2005; Arabic text hosted by the Kurdistan Region Presidency. (Arabic).

[13] Kurdistan Parliament–Iraq. قانون رقم (6) لسنة 2008: قانون منع إساءة استعمال أجهزة الاتصالات في إقليم كوردستان–العراق [Law No. 6 of 2008 on Preventing Misuse of Telecommunications Equipment in the Kurdistan Region of Iraq]. 2008; official text. (Arabic).

[14] Iman Safauldin Jalal. التنظيم القانوني للإعلام الإلكتروني في إقليم كوردستان/العراق [Legal regulation of electronic media in the Kurdistan Region/Iraq]. Journal of Garmian University 9(4), 801–820, Fall 2022. DOI: 10.24271/jgu.2022.163856611. (Arabic).

[15] Kurdistan Parliament–Iraq. قانون رقم (9) لسنة 2010: قانون إنفاذ قانون حماية المستهلك الاتحادي رقم (1) لسنة 2010 في إقليم كوردستان–العراق [Law No. 9 of 2010 applying Federal Consumer Protection Law No. 1 of 2010 in the Kurdistan Region]. 2010; official text. (Arabic).

[16] Judge Dr Habib Ibrahim Hamada. التكييف القانوني لجريمة الابتزاز الالكتروني في التشريع العراقي [Legal classification of electronic blackmail in Iraqi legislation]. Iraqi Supreme Judicial Council, 30 June 2022. (Arabic).

[17] Jason Ceci, Jonah Stegman and Hassan Khan. No Privacy in the Electronics Repair Industry. Accepted at the 44th IEEE Symposium on Security and Privacy, 2023; preprint posted 10 November 2022. (English).

[18] Faith Leong and Dynn Othman. Some tech repair shops are looking at data on your devices, even cloning them. CNA Insider, 18 January 2025. (English).

[19] Jason Ceci, Hassan Khan, Urs Hengartner and Daniel Vogel. Concerned but Ineffective: User Perceptions, Methods, and Challenges when Sanitizing Old Devices for Disposal. Seventeenth Symposium on Usable Privacy and Security (SOUPS 2021), USENIX Association, August 2021, pp. 455–474. (English).

[20] Olga Angelopoulou, Andy Jones, Graeme Horsman and Seyedali Pourmoafi. A Study of the Data Remaining on Second-Hand Mobile Devices in the UK. Journal of Digital Forensics, Security and Law 17, article 5, 2022. DOI: 10.58940/1558-7223.1785. (English).