A RELATED WORK ON PRESENCE OF REMNANT DATA AND IMPLICATIONS

<table><caption>Table 1: The list of works that investigated remnant data in second-hand devices. In the 'device' column, 📞, 📞, 📞, and 📞 indicate drives (HDD/SSD), USB sticks, memory cards, and portable devices (e.g., smartphone, tablet, laptop), respectively. To specify the types of remnant data, we used: 🏠 ('data related to an identified organization'), 🏠 ('data related to an identified individual'), 📞 ('regular photos'), 18 ('sensitive photos'), 🔒 ('credentials'), 🔒 ('redeemable financial data'), and 🔒 ('illegal content or evidence of illegal activities'). N refers to the number of devices/participants. n refers to the number of devices/participants with remnant data. The spreadsheet version of this table is available in Supplementary 4.</caption><thead><tr><th>authors</th><th>year ▲</th><th>device</th><th>N</th><th>n</th><th>country</th><th>館</th><th>人</th><th>圖</th><th>18</th><th>锁</th><th>锁</th><th>盜</th></tr></thead><tbody><tr><td>Jones et al. [27]</td><td>2005</td><td>☞</td><td>105</td><td>92</td><td>UK</td><td>✓</td><td>✓</td><td>-</td><td>-</td><td>✓</td><td>-</td><td>✓</td></tr><tr><td>Jones et al. [32]</td><td>2006</td><td>☞</td><td>317</td><td>130</td><td>UK, US, AU, DE</td><td>✓</td><td>✓</td><td>✓</td><td>-</td><td>✓</td><td>✓</td><td>✓</td></tr><tr><td>Jones et al. [29]</td><td>2007</td><td>☞</td><td>300</td><td>126</td><td>UK, US, AU, DE</td><td>✓</td><td>✓</td><td>-</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td></tr><tr><td>Jones et al. [31]</td><td>2008</td><td>☞</td><td>338</td><td>158</td><td>UK, US, AU, DE, FR</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td></tr><tr><td>Valli and Woodward [54]</td><td>2008</td><td>☞</td><td>48</td><td>N/A</td><td>AU</td><td>✓</td><td>✓</td><td>-</td><td>-</td><td>✓</td><td>-</td><td>✓</td></tr><tr><td>Jones et al. [28]</td><td>2009</td><td>☞</td><td>43</td><td>39</td><td>UK</td><td>✓</td><td>✓</td><td>✓</td><td>-</td><td>-</td><td>-</td><td>-</td></tr><tr><td>Jones et al. [30]</td><td>2009</td><td>☞</td><td>346</td><td>163</td><td>UK, US, AU, DE, FR</td><td>✓</td><td>✓</td><td>-</td><td>-</td><td>✓</td><td>✓</td><td>✓</td></tr><tr><td>Sutherland et al. [48]</td><td>2010</td><td>☞</td><td>32</td><td>5/7*</td><td>UK</td><td>✓</td><td>✓</td><td>-</td><td>-</td><td>✓</td><td>-</td><td>-</td></tr><tr><td>Glisson et al. [20]</td><td>2010</td><td>☞</td><td>49</td><td>49</td><td>UK</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>-</td><td>✓</td><td>✓</td></tr><tr><td>Szewczyk [49]</td><td>2011</td><td>☞</td><td>119</td><td>105</td><td>AU</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td></tr><tr><td>Sansurooah [45]</td><td>2011</td><td>☞</td><td>80</td><td>64</td><td>AU</td><td>✓</td><td>✓</td><td>✓</td><td>-</td><td>✓</td><td>-</td><td>-</td></tr><tr><td>Jones et al. [26]</td><td>2012</td><td>☞</td><td>45</td><td>30</td><td>UAE</td><td>✓</td><td>✓</td><td>✓</td><td>-</td><td>✓</td><td>-</td><td>-</td></tr><tr><td>Szewczyk and Sansurooah [51]</td><td>2012</td><td>☞</td><td>78</td><td>55</td><td>AU</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td></tr><tr><td>Szewczyk et al. [50]</td><td>2013</td><td>☞</td><td>140</td><td>102</td><td>AU</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>-</td><td>✓</td></tr><tr><td>Szewczyk et al. [52]</td><td>2014-2015</td><td>☞</td><td>268</td><td>255</td><td>AU</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td></tr><tr><td>Martin et al. [38]</td><td>2016</td><td>☞</td><td>40</td><td>26</td><td>UAE</td><td>✓</td><td>✓</td><td>-</td><td>-</td><td>✓</td><td>✓</td><td>✓</td></tr><tr><td>Angelopoulou et al. [2]</td><td>2016</td><td>☞</td><td>110</td><td>43</td><td>UK</td><td>✓</td><td>✓</td><td>✓</td><td>-</td><td>✓</td><td>-</td><td>-</td></tr><tr><td>Robins et al. [44]</td><td>2016</td><td>☞</td><td>272</td><td>248</td><td>AU</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td></tr><tr><td>Angelopoulou et al. [1]</td><td>2018</td><td>☞</td><td>100</td><td>70</td><td>UK</td><td>-</td><td>✓</td><td>✓</td><td>-</td><td>✓</td><td>✓</td><td>-</td></tr><tr><td>Jones et al. [25]</td><td>2019</td><td>☞</td><td>100</td><td>71</td><td>UK</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>-</td><td>-</td><td>✓</td></tr><tr><td>Boonkrong and Heeptaisong [6]</td><td>2019</td><td>☞</td><td>30</td><td>20</td><td>TH</td><td>-</td><td>✓</td><td>✓</td><td>✓</td><td>-</td><td>✓</td><td>✓</td></tr><tr><td>Conacher et al. [11]</td><td>2020</td><td>☞</td><td>122</td><td>68</td><td>GB</td><td>✓</td><td>✓</td><td>✓</td><td>-</td><td>✓</td><td>-</td><td>-</td></tr><tr><td>Schneider et al. [46]</td><td>2021</td><td>☞</td><td>614</td><td>75</td><td>CN</td><td>-</td><td>✓</td><td>✓</td><td>✓</td><td>-</td><td>-</td><td>-</td></tr><tr><td>Roberts et al. [43]</td><td>2023</td><td>☞</td><td>228</td><td>61</td><td>US</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td></tr><tr><td>Ceci et al. [9]</td><td>2023</td><td>☞</td><td>16</td><td>14</td><td>CA</td><td>-</td><td>✓</td><td>✓</td><td>✓</td><td>-</td><td>✓</td><td>-</td></tr></tbody></table>

<footnote>*Five out of seven repairable devices had remnant data.</footnote>
A RELATED WORK ON PRESENCE OF REMNANT DATA AND IMPLICATIONS

<table><caption>Table 1: The list of works that investigated remnant data in second-hand devices. In the ‘device’ column, 📞, 📞, 📞, and 📞 indicate drives (HDD/SSD), USB sticks, memory cards, and portable devices (e.g., smartphone, tablet, laptop), respectively. To specify the types of remnant data, we used: 📞 (‘data related to an identified organization’), 📞 (‘data related to an identified individual’), 📞 (‘regular photos’), 📞 (‘sensitive photos’), 📞 (‘credentials’), 📞 (‘redeemable financial data’), and 📞 (‘illegal content or evidence of illegal activities’). N refers to the number of devices/participants. n refers to the number of devices/participants with remnant data. The spreadsheet version of this table is available in Supplementary 4.</caption><thead><tr><th>authors</th><th>year ▲</th><th>device</th><th>N</th><th>n</th><th>country</th><th>館</th><th>人</th><th>圖</th><th>18</th><th>锁</th><th>口</th><th>茶</th></tr></thead><tbody><tr><td>Jones et al. [27]</td><td>2005</td><td>☞</td><td>105</td><td>92</td><td>UK</td><td>✓</td><td>✓</td><td>-</td><td>-</td><td>✓</td><td>-</td><td>✓</td></tr><tr><td>Jones et al. [32]</td><td>2006</td><td>☞</td><td>317</td><td>130</td><td>UK, US, AU, DE</td><td>✓</td><td>✓</td><td>✓</td><td>-</td><td>✓</td><td>✓</td><td>✓</td></tr><tr><td>Jones et al. [29]</td><td>2007</td><td>☞</td><td>300</td><td>126</td><td>UK, US, AU, DE</td><td>✓</td><td>✓</td><td>-</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td></tr><tr><td>Jones et al. [31]</td><td>2008</td><td>☞</td><td>338</td><td>158</td><td>UK, US, AU, DE, FR</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td></tr><tr><td>Valli and Woodward [54]</td><td>2008</td><td>☞</td><td>48</td><td>N/A</td><td>AU</td><td>✓</td><td>✓</td><td>-</td><td>-</td><td>✓</td><td>-</td><td>✓</td></tr><tr><td>Jones et al. [28]</td><td>2009</td><td>☞</td><td>43</td><td>39</td><td>UK</td><td>✓</td><td>✓</td><td>✓</td><td>-</td><td>-</td><td>-</td><td>-</td></tr><tr><td>Jones et al. [30]</td><td>2009</td><td>☞</td><td>346</td><td>163</td><td>UK, US, AU, DE, FR</td><td>✓</td><td>✓</td><td>-</td><td>-</td><td>✓</td><td>✓</td><td>✓</td></tr><tr><td>Sutherland et al. [48]</td><td>2010</td><td>☞</td><td>32</td><td>5/7*</td><td>UK</td><td>✓</td><td>✓</td><td>-</td><td>-</td><td>✓</td><td>-</td><td>-</td></tr><tr><td>Glisson et al. [20]</td><td>2010</td><td>☞</td><td>49</td><td>49</td><td>UK</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>-</td><td>✓</td><td>✓</td></tr><tr><td>Szewczyk [49]</td><td>2011</td><td>☞</td><td>119</td><td>105</td><td>AU</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td></tr><tr><td>Sansurooah [45]</td><td>2011</td><td>☞</td><td>80</td><td>64</td><td>AU</td><td>✓</td><td>✓</td><td>✓</td><td>-</td><td>✓</td><td>-</td><td>-</td></tr><tr><td>Jones et al. [26]</td><td>2012</td><td>☞</td><td>45</td><td>30</td><td>UAE</td><td>✓</td><td>✓</td><td>✓</td><td>-</td><td>✓</td><td>-</td><td>-</td></tr><tr><td>Szewczyk and Sansurooah [51]</td><td>2012</td><td>☞</td><td>78</td><td>55</td><td>AU</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td></tr><tr><td>Szewczyk et al. [50]</td><td>2013</td><td>☞</td><td>140</td><td>102</td><td>AU</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>-</td><td>✓</td></tr><tr><td>Szewczyk et al. [52]</td><td>2014-2015</td><td>☞</td><td>268</td><td>255</td><td>AU</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td></tr><tr><td>Martin et al. [38]</td><td>2016</td><td>☞</td><td>40</td><td>26</td><td>UAE</td><td>✓</td><td>✓</td><td>-</td><td>-</td><td>✓</td><td>✓</td><td>✓</td></tr><tr><td>Angelopoulou et al. [2]</td><td>2016</td><td>☞</td><td>110</td><td>43</td><td>UK</td><td>✓</td><td>✓</td><td>✓</td><td>-</td><td>✓</td><td>-</td><td>-</td></tr><tr><td>Robins et al. [44]</td><td>2016</td><td>☞</td><td>272</td><td>248</td><td>AU</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td></tr><tr><td>Angelopoulou et al. [1]</td><td>2018</td><td>☞</td><td>100</td><td>70</td><td>UK</td><td>-</td><td>✓</td><td>✓</td><td>-</td><td>✓</td><td>✓</td><td>-</td></tr><tr><td>Jones et al. [25]</td><td>2019</td><td>☞</td><td>100</td><td>71</td><td>UK</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>-</td><td>-</td><td>✓</td></tr><tr><td>Boonkrong and Heeptaisong [6]</td><td>2019</td><td>☞</td><td>30</td><td>20</td><td>TH</td><td>-</td><td>✓</td><td>✓</td><td>✓</td><td>-</td><td>✓</td><td>✓</td></tr><tr><td>Conacher et al. [11]</td><td>2020</td><td>☞</td><td>122</td><td>68</td><td>GB</td><td>✓</td><td>✓</td><td>✓</td><td>-</td><td>✓</td><td>-</td><td>-</td></tr><tr><td>Schneider et al. [46]</td><td>2021</td><td>☞</td><td>614</td><td>75</td><td>CN</td><td>-</td><td>✓</td><td>✓</td><td>✓</td><td>-</td><td>-</td><td>-</td></tr><tr><td>Roberts et al. [43]</td><td>2023</td><td>☞</td><td>228</td><td>61</td><td>US</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td></tr><tr><td>Ceci et al. [9]</td><td>2023</td><td>☞</td><td>16</td><td>14</td><td>CA</td><td>-</td><td>✓</td><td>✓</td><td>✓</td><td>-</td><td>✓</td><td>-</td></tr></tbody></table>

<footnote>*Five out of seven repairable devices had remnant data.</footnote>
## B BACKGROUND ON DATA RECOVERY

To explain how data could be recovered from second-hand storage devices, thus creating security and privacy issues, we provide some background about data deletion and recovery techniques. For consistency, we follow Gutmann and Warner's definition of the terms 'erase' and 'delete', which defines 'erase' as "purposeful overwriting of data with other data – thus rendering it immediately irretrievable" and 'delete' as "data being *forgotten* by the operating system and being marked as available for overwrite". In the case of 'delete', data can be retrieved, to a large extent, until it is overwritten. Data deletion includes different operations. The process behind these operations varies across systems. Yet, it generally consist in deleting only the *link* between a file's metadata and its content stored in the allocation units of a storage device (e.g., when files are sent to the trash bin then emptied on a Windows operating system). Although this could be sufficient for the system to manage visible and deleted files, data might still be recoverable otherwise [7].

Easy-to-use and open-source forensic tools such as Autopsy<fnref n="50" /> can restore the link between the content of a file and its metadata. Such tools also enable users (buyers) to perform advanced operations such as *carving*, that is the analysis of the unallocated space in search for known signatures to recover fragments of deleted files [7]. To reduce the chances of recovering files, *wiping* can be used. With this technique, every bit of the storage is zeroed-out, i.e., overwritten multiple times with zeroes. Wiping tools are largely available on modern operating systems, e.g., Windows, macOS.

## C BACKGROUND ON SWISS LAW

Switzerland is a federal state which follows the legal tradition known as “Civil Law” like the countries of the European Union, as opposed to the Anglo-Saxon conception of “Common Law.”<fnref n="51" /> The latter is a system characterized by case law, that is law developed by judges through decisions of courts and similar tribunals.<fnref n="52" /> In the “Civil Law” tradition, the jurisprudence is certainly important, but it is “only” an aid to interpretation.<fnref n="53" />

Civil law is defined by the fact that its core principles are codified into a referable system which serves as the primary source of law.<fnref n="54" /> This is especially true in criminal law, which is the primary source of this legal analysis, since there can be no punishment without law.<fnref n="55" /> Due to the special focus on the criminal implications, to determine the infractions, we use mainly the Swiss Criminal Code<fnref n="56" /> and, to determine the legal proceedings, we use the Swiss Criminal Procedure Code.<fnref n="57" /> We also refer to the legal literature and case

laws whenever relevant. Regarding data protection, the FADP<fnref n="58" /> is the major piece of legislation in Switzerland.

## D SURVEY QUESTIONNAIRE

Below, we provide the full transcript of the survey questionnaire. In order to avoid leading questions, we (i) used skip logic/coding rules, (ii) used unbiased language and statements, and (iii) did not make any assumptions in the questions.

Note: Coding rules are marked in gray (not visible to respondents)

### Sec. A: Security Knowledge

The following questions relate to buying second-hand electronic storage devices in general (hard drives, USB sticks, or memory cards).

Some of these questions concern your knowledge of specific technologies; please **remember that remuneration IS NOT dependent on your knowledge**. So, please answer based on your **current** knowledge (e.g., do not look for the correct answer online).

(1) [Grid question. Row order randomized.] To what extent do you **agree or disagree** with the following statements?

Row options:

- It is technically possible (by using simple software readily available on the Internet) to **recover data** from a storage device, after the data has been sent to the trash bin and the **trash bin has been emptied**

- It is technically possible (by using simple software readily available on the Internet) to **recover data** from a storage device, after the device has been **formatted/erased** with the standard procedure

- Only **executable** files (e.g., programs, scripts) can contain **viruses** and **malware**

- Pressing a powerful **magnet** on a USB stick can **erase** the data it contains

(a) Strongly disagree

(b) Disagree

(c) Somewhat disagree

(d) Neither agree nor disagree

(e) Somewhat agree

(f) Agree

(g) Strongly agree

(2) [Grid question. Row order randomized.] To what extent do you **agree or disagree** with the following statements?

Row options:

- Plugging a USB stick into my computer could enable **malware** (i.e., a malicious software designed to cause harm) to be automatically installed on my computer

- Plugging a USB stick into my computer could **physically damage** my computer

- Antivirus software can scan **internal** hard drives but **not external** storage devices (external hard drives, memory cards, and USB sticks)

- **Fully erasing** all data from an electronic storage device (i.e., without someone being able to recover them) is technically **impossible**

(a) Strongly disagree

(b) Disagree

(c) Somewhat disagree

(d) Neither agree nor disagree

(e) Somewhat agree

(f) Agree

(g) Strongly agree

### Sec. B: Experience

The following questions relate **specifically** to your experience when you bought online the storage device `$DeviceName` on Ricardo.ch, on `$TransactionDate`.

(3) When you plugged the device you bought, did you find any data on it?

<footnote n="50">⁵⁰https://www.autopsy.com/</footnote>

<footnote n="51">⁵¹Müller-Chen/Müller/Widmer Lüchinger, Comparative Private Law, Zurich/St.Gallen 2015, p. 149, 207.</footnote>

<footnote n="52">⁵²Müller-Chen/Müller/Widmer Lüchinger, Comparative Private Law, Zurich/St.Gallen 2015, p. 223 ss; Fallon-Kund, Zum Einfluss von Kultur- und Sozialnormen auf das Recht, Geneva - Zurich - Basel 2015, p. 78.</footnote>

<footnote n="53">⁵³Swiss Civil Code of 10 December 1907 (RS 210) states that "the court shall follow established doctrine and case law" (Art. 2).</footnote>

<footnote n="54">⁵⁴Müller-Chen/Müller/Widmer Lüchinger, Comparative Private Law, Zurich/St.Gallen 2015, p. 154 ss.</footnote>

<footnote n="55">⁵⁵Also known by the Latin adage " nulla poena sine legem" and which also appears in Art. 7 of the Convention for the Protection of Human Rights and Fundamental Freedoms of 4 November 1950 (ECHR).</footnote>

<footnote n="56">⁵⁶Swiss Criminal Code of 21 December 1937 (SCC; RS 311.0).</footnote>

<footnote n="57">⁵⁷Swiss Criminal Procedure Code of 5 October 2007 (CrimPC; RS 312.0).</footnote>

<footnote n="58">⁵⁸Federal Act on Data Protection of 25 September 2020 (FADP; RS 235.1).</footnote>
## B BACKGROUND ON DATA RECOVERY

To explain how data could be recovered from second-hand storage devices, thus creating security and privacy issues, we provide some background about data deletion and recovery techniques. For consistency, we follow Gutmann and Warner's definition of the terms 'erase' and 'delete', which defines 'erase' as "purposeful overwriting of data with other data – thus rendering it immediately irretrievable" and 'delete' as "data being *forgotten* by the operating system and being marked as available for overwrite". In the case of 'delete', data can be retrieved, to a large extent, until it is overwritten. Data deletion includes different operations. The process behind these operations varies across systems. Yet, it generally consist in deleting only the *link* between a file's metadata and its content stored in the allocation units of a storage device (e.g., when files are sent to the trash bin then emptied on a Windows operating system). Although this could be sufficient for the system to manage visible and deleted files, data might still be recoverable otherwise [7].

Easy-to-use and open-source forensic tools such as Autopsy<fnref n="50" /> can restore the link between the content of a file and its metadata. Such tools also enable users (buyers) to perform advanced operations such as *carving*, that is the analysis of the unallocated space in search for known signatures to recover fragments of deleted files [7]. To reduce the chances of recovering files, *wiping* can be used. With this technique, every bit of the storage is zeroed-out, i.e., overwritten multiple times with zeroes. Wiping tools are largely available on modern operating systems, e.g., Windows, macOS.

## C BACKGROUND ON SWISS LAW

Switzerland is a federal state which follows the legal tradition known as “Civil Law” like the countries of the European Union, as opposed to the Anglo-Saxon conception of “Common Law.”<fnref n="51" /> The latter is a system characterized by case law, that is law developed by judges through decisions of courts and similar tribunals.<fnref n="52" /> In the “Civil Law” tradition, the jurisprudence is certainly important, but it is “only” an aid to interpretation.<fnref n="53" />

Civil law is defined by the fact that its core principles are codified into a referable system which serves as the primary source of law.<fnref n="54" /> This is especially true in criminal law, which is the primary source of this legal analysis, since there can be no punishment without law.<fnref n="55" /> Due to the special focus on the criminal implications, to determine the infractions, we use mainly the Swiss Criminal Code<fnref n="56" /> and, to determine the legal proceedings, we use the Swiss Criminal Procedure Code.<fnref n="57" /> We also refer to the legal literature and case

laws whenever relevant. Regarding data protection, the FADP<fnref n="58" /> is the major piece of legislation in Switzerland.

## D SURVEY QUESTIONNAIRE

Below, we provide the full transcript of the survey questionnaire. In order to avoid leading questions, we (i) used skip logic/coding rules, (ii) used unbiased language and statements, and (iii) did not make any assumptions in the questions.

Note: Coding rules are marked in gray (not visible to respondents)

### Sec. A: Security Knowledge

The following questions relate to buying second-hand electronic storage devices in general (hard drives, USB sticks, or memory cards).

Some of these questions concern your knowledge of specific technologies; please **remember that remuneration IS NOT dependent on your knowledge**. So, please answer based on your **current** knowledge (e.g., do not look for the correct answer online).

(1) [Grid question. Row order randomized.] To what extent do you **agree or disagree** with the following statements?

Row options:

- It is technically possible (by using simple software readily available on the Internet) to **recover data** from a storage device, after the data has been sent to the trash bin and the **trash bin has been emptied**

- It is technically possible (by using simple software readily available on the Internet) to **recover data** from a storage device, after the device has been **formatted/erased** with the standard procedure

- Only **executable** files (e.g., programs, scripts) can contain **viruses** and **malware**

- Pressing a powerful **magnet** on a USB stick can **erase** the data it contains

(a) Strongly disagree

(b) Disagree

(c) Somewhat disagree

(d) Neither agree nor disagree

(e) Somewhat agree

(f) Agree

(g) Strongly agree

(2) [Grid question. Row order randomized.] To what extent do you **agree or disagree** with the following statements?

Row options:

- Plugging a USB stick into my computer could enable **malware** (i.e., a malicious software designed to cause harm) to be automatically installed on my computer

- Plugging a USB stick into my computer could **physically damage** my computer

- Antivirus software can scan **internal** hard drives but **not external** storage devices (external hard drives, memory cards, and USB sticks)

- **Fully erasing** all data from an electronic storage device (i.e., without someone being able to recover them) is technically **impossible**

(a) Strongly disagree

(b) Disagree

(c) Somewhat disagree

(d) Neither agree nor disagree

(e) Somewhat agree

(f) Agree

(g) Strongly agree

### Sec. B: Experience

The following questions relate **specifically** to your experience when you bought online the storage device `$DeviceName` on Ricardo.ch, on `$TransactionDate`.

(3) When you plugged the device you bought, did you find any data on it?

<footnote n="50">⁵⁰https://www.autopsy.com/</footnote>

<footnote n="51">⁵¹Müller-Chen/Müller/Widmer Lüchinger, Comparative Private Law, Zurich/St.Gallen 2015, p. 149, 207.</footnote>

<footnote n="52">⁵²Müller-Chen/Müller/Widmer Lüchinger, Comparative Private Law, Zurich/St.Gallen 2015, p. 223 ss; Fallon-Kund, Zum Einfluss von Kultur- und Sozialnormen auf das Recht, Geneva - Zurich - Basel 2015, p. 78.</footnote>

<footnote n="53">⁵³Swiss Civil Code of 10 December 1907 (RS 210) states that "the court shall follow established doctrine and case law" (Art. 2).</footnote>

<footnote n="54">⁵⁴Müller-Chen/Müller/Widmer Lüchinger, Comparative Private Law, Zurich/St.Gallen 2015, p. 154 ss.</footnote>

<footnote n="55">⁵⁵Also known by the Latin adage " nulla poena sine legem" and which also appears in Art. 7 of the Convention for the Protection of Human Rights and Fundamental Freedoms of 4 November 1950 (ECHR).</footnote>

<footnote n="56">⁵⁶Swiss Criminal Code of 21 December 1937 (SCC; RS 311.0).</footnote>

<footnote n="57">⁵⁷Swiss Criminal Procedure Code of 5 October 2007 (CrimPC; RS 312.0).</footnote>

<footnote n="58">⁵⁸Federal Act on Data Protection of 25 September 2020 (FADP; RS 235.1).</footnote>
(a) Yes

(b) No

(c) I do not remember

(d) I did not check

[Display Q4 and Q5 if Q3$Yes]

(4) [Multiple selection. Order randomized.] What types of data did you find?

(select all that apply)

(a) Regular photos (e.g., photos of nature landscape)

(b) Sensitive private photos that disclose information about the seller (e.g., photos picturing the seller or one of their contacts being naked)

(c) Confidential data that discloses information about the seller (e.g., bank statements, work contracts, pay slips, medical records)

(d) Credentials or passwords (e.g., password to an online account)

(e) Redeemable financial data (e.g., voucher, credit-card number, crypto wallet)

(f) Evidence of illegal activities (e.g., rape, drug dealing, arms trafficking, homicide)

(g) Illegal content (e.g., child pornography)

(h) Data related to an identified organization (e.g., client details, contracts)

(i) Data related, sensitive or not, to an identified individual other than the seller (e.g., photos, e-mail, personal information)

(j) Other types of data, please specify: [] (Text field)

(5) Regarding the data/files that you found on the device, were they readily visible and accessible on the device or did you use specific file-recovery techniques such as carving (e.g. with the help of software such as Autopsy, DiskDrill, or Scalpel)?

(a) I used file recovery techniques. I followed the following procedure: [] (Text field)

(b) I accessed the files without any specific technique (i.e., they were readily visible on the device)

(c) I do not remember

[Display Q6, Q7, Q8 and if Q4 is answered.]

[Repeat Q6, Q7, Q8 for every Q4$DataType.]

You answered that you found Q4$DataType on the device you bought.

(6) Did you delete them?

(a) Yes, I deleted them

(b) No, I kept them

(c) I do not remember

(7) Have you **used them** in any way (opened, copied, printed, shared, etc.)?

(a) Yes, please specify: [] (Text field)

(b) No

(c) I do not remember

(8) [Multiple selection.] Which of the following entities (if any) did you notify about the data you found? (select all that apply)

(a) The seller from Ricardo.ch

(b) The competent authorities, please specify: [] (Text field)

(c) An identified individual, other than the seller, who is concerned by the data found

(d) An identified organization, who is concerned by the data found

(e) A contact person from Ricardo.ch

(f) No

(g) I do not remember

The following questions relate **specifically** to your experience when you bought online the storage device `$DeviceName` on Ricardo.ch, on `$TransactionDate`.

(9) [Multiple selection. Order randomized.] Which of the following **precautions** did you take with the device you bought?

(a) I scanned it with an anti-virus software

(b) I plugged it to a computer that has little or no sensitive data and/or that would not be missed if the computer broke

(c) I plugged it to a personal electronic device other than a computer, such as a phone, camera, etc.

(d) I formatted/erased it

(e) Other, please specify: [] (Text field)

(f) I did not take any precaution

(10) Was your computer or another device infected with a malware by the device you bought when you plugged it?

(a) Yes

(b) No

(c) I am not sure

(d) I do not remember

[Display Q11 if Q10$Yes]

(11) What kind of malware was carried by the device you bought?

(a) Trojan horse, worm, virus

(b) Ransomware

(c) Spyware

(d) I am not sure

Sec. C: Attitudes

[Display Q12 for Q4$DataType = 'false']

The following questions relate to **hypothetical** scenarios about the purchasing of used electronic storage devices **in general** (hard drives, USB sticks, memory cards) on Ricardo.ch.

(12) [Grid question. Row order randomized.] **Imagine** that you found Q4$DataType = 'false' on a second-hand storage device you bought, how likely would you do the following?

Row options:

- I would delete the data

- I would use the data (if likely please specify how): [] (Text field)

- I would notify the person who sold me the device (seller)

- I would notify the competent authorities (if likely please specify who): [] (Text field)

- I would notify an identified individual, other than the seller, who is concerned by the data found

- I would notify an identified organization who is concerned by the data found

- I would notify Ricardo.ch

(a) Extremely unlikely

(b) Moderately unlikely

(c) Slightly unlikely

(d) Neither likely nor unlikely

(e) Slightly likely

(f) Moderately likely

(g) Extremely likely

Sec. D: Legal Beliefs

The following questions relate to purchasing second-hand electronic storage devices **in general** (hard drives, USB sticks, memory cards).

Below you will be presented with different statements related to legal rights and obligations in online transactions for second-hand electronic storage devices. You will be asked to what extent **you agree or disagree** with these statements, under ⚙️ **Swiss law**.

Please answer truthfully; your answers will be treated confidentially.

(13) [Grid question. Row order randomized.] To what extent do you **agree or disagree** with the following statements?

Row options:

(1.1) If I find **personal nude photos** (e.g., of the sellers or of their contacts) on a used device I bought, I **can** legally **keep them and make personal use of them** (e.g., **look at them**).

(1.8) If I find **original nature landscape photos** on a used device I bought, I **can** legally **share them on social media**
(a) Yes

(b) No

(c) I do not remember

(d) I did not check

[Display Q4 and Q5 if Q3$Yes]

(4) [Multiple selection. Order randomized.] What types of data did you find?

(select all that apply)

(a) Regular photos (e.g., photos of nature landscape)

(b) Sensitive private photos that disclose information about the seller (e.g., photos picturing the seller or one of their contacts being naked)

(c) Confidential data that discloses information about the seller (e.g., bank statements, work contracts, pay slips, medical records)

(d) Credentials or passwords (e.g., password to an online account)

(e) Redeemable financial data (e.g., voucher, credit-card number, crypto wallet)

(f) Evidence of illegal activities (e.g., rape, drug dealing, arms trafficking, homicide)

(g) Illegal content (e.g., child pornography)

(h) Data related to an identified organization (e.g., client details, contracts)

(i) Data related, sensitive or not, to an identified individual other than the seller (e.g., photos, e-mail, personal information)

(j) Other types of data, please specify: [] (Text field)

(5) Regarding the data/files that you found on the device, were they readily visible and accessible on the device or did you use specific file-recovery techniques such as carving (e.g. with the help of software such as Autopsy, DiskDrill, or Scalpel)?

(a) I used file recovery techniques. I followed the following procedure: [] (Text field)

(b) I accessed the files without any specific technique (i.e., they were readily visible on the device)

(c) I do not remember

[Display Q6, Q7, Q8 and if Q4 is answered.]

[Repeat Q6, Q7, Q8 for every Q4$DataType.]

You answered that you found Q4$DataType on the device you bought.

(6) Did you delete them?

(a) Yes, I deleted them

(b) No, I kept them

(c) I do not remember

(7) Have you **used them** in any way (opened, copied, printed, shared, etc.)?

(a) Yes, please specify: [] (Text field)

(b) No

(c) I do not remember

(8) [Multiple selection.] Which of the following entities (if any) did you notify about the data you found? (select all that apply)

(a) The seller from Ricardo.ch

(b) The competent authorities, please specify: [] (Text field)

(c) An identified individual, other than the seller, who is concerned by the data found

(d) An identified organization, who is concerned by the data found

(e) A contact person from Ricardo.ch

(f) No

(g) I do not remember

The following questions relate **specifically** to your experience when you bought online the storage device `$DeviceName` on Ricardo.ch, on `$TransactionDate`.

(9) [Multiple selection. Order randomized.] Which of the following **precautions** did you take with the device you bought?

(a) I scanned it with an anti-virus software

(b) I plugged it to a computer that has little or no sensitive data and/or that would not be missed if the computer broke

(c) I plugged it to a personal electronic device other than a computer, such as a phone, camera, etc.

(d) I formatted/erased it

(e) Other, please specify: [] (Text field)

(f) I did not take any precaution

(10) Was your computer or another device infected with a malware by the device you bought when you plugged it?

(a) Yes

(b) No

(c) I am not sure

(d) I do not remember

[Display Q11 if Q10$Yes]

(11) What kind of malware was carried by the device you bought?

(a) Trojan horse, worm, virus

(b) Ransomware

(c) Spyware

(d) I am not sure

Sec. C: Attitudes

[Display Q12 for Q4$DataType = 'false']

The following questions relate to **hypothetical** scenarios about the purchasing of used electronic storage devices **in general** (hard drives, USB sticks, memory cards) on Ricardo.ch.

(12) [Grid question. Row order randomized.] **Imagine** that you found Q4$DataType = 'false' on a second-hand storage device you bought, how likely would you do the following?

Row options:

- I would delete the data

- I would use the data (if likely please specify how): [] (Text field)

- I would notify the person who sold me the device (seller)

- I would notify the competent authorities (if likely please specify who): [] (Text field)

- I would notify an identified individual, other than the seller, who is concerned by the data found

- I would notify an identified organization who is concerned by the data found

- I would notify Ricardo.ch

(a) Extremely unlikely

(b) Moderately unlikely

(c) Slightly unlikely

(d) Neither likely nor unlikely

(e) Slightly likely

(f) Moderately likely

(g) Extremely likely

Sec. D: Legal Beliefs

The following questions relate to purchasing second-hand electronic storage devices **in general** (hard drives, USB sticks, memory cards).

Below you will be presented with different statements related to legal rights and obligations in online transactions for second-hand electronic storage devices. You will be asked to what extent **you agree or disagree** with these statements, under ⚙️ **Swiss law**.

Please answer truthfully; your answers will be treated confidentially.

(13) [Grid question. Row order randomized.] To what extent do you **agree or disagree** with the following statements?

Row options:

(1.1) If I find **personal nude photos** (e.g., of the sellers or of their contacts) on a used device I bought, I **can** legally **keep them and make personal use of them** (e.g., **look at them**).

(1.8) If I find **original nature landscape photos** on a used device I bought, I **can** legally **share them on social media**
(12) If I find illegal content, such as **child pornography**, on a used device I bought, I can be **held liable** if I do not delete it.

(19) If I find **confidential data** related to an **identified organization** on a used device I bought, I can legally sell them.

(110) If I find **credentials (passwords and identifiers)** on a used device I bought, I **can legally use them to access** the associated **service** (e.g., mail, Dropbox).

(13) If I find purchased songs, movies, software, etc. on a used device I bought, I can legally keep and make personal use of them.

(111) If I find an **unpublished book** (e.g., a novel written by the seller) on a used device I bought, I can legally publish it under my name.

(112) If I find **redeemable financial data** (e.g., vouchers, credit card numbers, or crypto wallets) on a used device I bought, I can legally cash them in.

(113) If I find encrypted or password-protected data on a used device I bought, I **can legally use specialized software** to gain access to it.

(114) After purchasing a used device, I **can** legally use **data recovery/forensics techniques**, (e.g., carving) to access data that was **previously deleted** from the device.

(115) Generally speaking, if I find **data from the seller** on a used device I bought, I **can** consider that the seller has left it there willingly for me to use as I choose.

(116) If I find **data related to an identified organization** (e.g., client details, contracts) on a used device I bought, it is **my legal obligation** to notify them.

(117) If I find **data related to the seller** on a used device I bought, it is **my legal obligation** to notify them.

(118) If I find **data related to an identified individual other than the seller** on a used device I bought, it is **my legal obligation** to notify them.

(119) If I find illegal content such as **child pornography** on a used device I bought, it is **my legal obligation** to **report** it to the competent authorities.

(120) If I find **evidence of illegal activities** (e.g., rape, drug dealing, arms trafficking, homicide) on a used device I bought, it is **my legal obligation** to **report** it to the competent authorities.

(14) If a used device I bought contains **malware** in the **clear** (i.e., without the need to recover it through specific software), the **seller** can be **held liable**.

(212) If a used device I bought contains **malware** in the **clear** (i.e., without the need to recover it through specific software), the **online second-hand shopping platform** can be **held liable**.

(15) If the **seller** did **not delete** possibly **sensitive data related to another individual** (e.g., nude photos of their partner), the **seller** can be **held liable**.

(16) If the **seller** did **delete** possibly **sensitive data related to another individual** (e.g., nude photos of their partner) but these data are **still recoverable** (e.g., through carving), the **seller** can be **held liable**.

(17) If the **seller contacts the buyer after the transaction asking them to delete some data** left on the device, the **buyer** has the legal **obligation** to do so.

(a) Strongly disagree

(b) Disagree

(c) Somewhat disagree

(d) Neither agree nor disagree

(e) Somewhat agree

(f) Agree

(g) Strongly agree

## Sec. E: Background

(14) With which gender identity do you most identify?

(a) Male

(b) Female

(c) Non-binary

(d) Prefer to self-describe: [] (Text field)

(e) Prefer not to say

(15) What is your age group?

(a) 18 to 20

(b) 21 to 29

(c) 30 to 39

(d) 40 to 49

(e) 50 to 59

(f) 60 or older

(16) [Grid question. Row order randomized.] Please indicate to what extent you **agree** or **disagree** with the following statements.

Row options:

- Compared to others, **I am more sensitive** about the way online companies **handle** my personal information.

- To me, it is the most important thing **to keep my privacy intact** from online companies.

- **I am concerned** about **threats to my personal** privacy today.

(a) Strongly disagree

(b) Disagree

(c) Somewhat disagree

(d) Neither agree nor disagree

(e) Somewhat agree

(f) Agree

(g) Strongly agree

## Sec. F: Security Practices

(17) [Grid question. Row order randomized.] Please indicate how often you use the following technology-related practices.

Row options:

- I use a **password/passcode to unlock** my electronic devices (computer, tablet, smartphone).

- If I discover a security problem, **I continue what I was doing** because I assume someone else will fix it.

- I try to make sure that the **programs** I use are **up-to-date**.

- I verify that my **anti-virus** software has been **regularly updating** itself.

- **I plug** USB sticks that **I find** into my electronic devices (computer, tablet, smartphone).

- **I plug** USB sticks that **my contacts** (family, friends, colleagues) **give me** into my electronic devices (computer, tablet, smartphone).

(a) Never

(b) Rarely

(c) Sometimes

(d) Often

(e) Always

(18) [Grid question. Row order randomized.] To what extent do the following statements reflect what you are capable of doing?

Row options:

- I know how to **manually delete some files** from a storage device (by sending them to the trash bin).

- I know how to **manually delete all data** from a storage device (by sending them to the trash bin).

- I know how to **empty the trash bin** of a storage device.

- I know how to **format** a storage device.

- I know how to **safely erase (wipe)** a storage device.

- I know how to **scan** a storage device **with my antivirus software**.

(a) Very untrue of me

(b) Untrue of me

(c) Somewhat untrue of me

(d) Neutral

(e) Somewhat true of me

(f) True of me

(g) Very true of me

## Sec. G: Expectations

(19) [Multiple selection. Order randomized.] When you bought the device `$DeviceName`, would you have liked to receive more information from Ricardo.ch on any of the following? (select all that apply)

(a) The technical aspects of transactions with storage devices (i.e., security and privacy risks)
(12) If I find illegal content, such as **child pornography**, on a used device I bought, I can be **held liable** if I do not delete it.

(19) If I find **confidential data** related to an **identified organization** on a used device I bought, I can legally sell them.

(110) If I find **credentials (passwords and identifiers)** on a used device I bought, I **can legally use them to access** the associated **service** (e.g., mail, Dropbox).

(13) If I find purchased songs, movies, software, etc. on a used device I bought, I can legally keep and make personal use of them.

(111) If I find an **unpublished book** (e.g., a novel written by the seller) on a used device I bought, I can legally publish it under my name.

(112) If I find **redeemable financial data** (e.g., vouchers, credit card numbers, or crypto wallets) on a used device I bought, I can legally cash them in.

(113) If I find encrypted or password-protected data on a used device I bought, I can legally use **specialized software** to gain access to it.

(114) After purchasing a used device, I **can** legally use **data recovery/forensics techniques**, (e.g., carving) to access data that was **previously deleted** from the device.

(115) Generally speaking, if I find **data from the seller** on a used device I bought, I **can** consider that the seller has left it there willingly for me to use as I choose.

(116) If I find **data related to an identified organization** (e.g., client details, contracts) on a used device I bought, it is **my legal obligation** to notify them.

(117) If I find **data related to the seller** on a used device I bought, it is **my legal obligation** to notify them.

(118) If I find **data related to an identified individual other than the seller** on a used device I bought, it is **my legal obligation** to notify them.

(119) If I find illegal content such as **child pornography** on a used device I bought, it is **my legal obligation** to **report** it to the competent authorities.

(120) If I find **evidence of illegal activities** (e.g., rape, drug dealing, arms trafficking, homicide) on a used device I bought, it is **my legal obligation** to **report** it to the competent authorities.

(14) If a used device I bought contains **malware** in the **clear** (i.e., without the need to recover it through specific software), the **seller** can be **held liable**.

(212) If a used device I bought contains **malware** in the **clear** (i.e., without the need to recover it through specific software), the **online second-hand shopping platform** can be **held liable**.

(15) If the **seller** did not delete possibly **sensitive data related to another individual** (e.g., nude photos of their partner), the **seller** can be **held liable**.

(16) If the **seller** did delete possibly **sensitive data related to another individual** (e.g., nude photos of their partner) but these data are **still recoverable** (e.g., through carving), the **seller** can be **held liable**.

(17) If the **seller contacts the buyer after the transaction asking them to delete some data** left on the device, the **buyer** has the legal **obligation** to do so.

(a) Strongly disagree

(b) Disagree

(c) Somewhat disagree

(d) Neither agree nor disagree

(e) Somewhat agree

(f) Agree

(g) Strongly agree

## Sec. E: Background

(14) With which gender identity do you most identify?

(a) Male

(b) Female

(c) Non-binary

(d) Prefer to self-describe: [] (Text field)

(e) Prefer not to say

(15) What is your age group?

(a) 18 to 20

(b) 21 to 29

(c) 30 to 39

(d) 40 to 49

(e) 50 to 59

(f) 60 or older

(16) [Grid question. Row order randomized.] Please indicate to what extent you **agree** or **disagree** with the following statements.

Row options:

- Compared to others, **I am more sensitive** about the way online companies **handle** my personal information.

- To me, it is the most important thing **to keep my privacy intact** from online companies.

- **I am concerned** about **threats to my personal** privacy today.

(a) Strongly disagree

(b) Disagree

(c) Somewhat disagree

(d) Neither agree nor disagree

(e) Somewhat agree

(f) Agree

(g) Strongly agree

## Sec. F: Security Practices

(17) [Grid question. Row order randomized.] Please indicate how often you use the following technology-related practices.

Row options:

- I use a **password/passcode to unlock** my electronic devices (computer, tablet, smartphone).

- If I discover a security problem, **I continue what I was doing** because I assume someone else will fix it.

- I try to make sure that the **programs** I use are **up-to-date**.

- I verify that my **anti-virus** software has been **regularly updating** itself.

- **I plug** USB sticks that **I find** into my electronic devices (computer, tablet, smartphone).

- **I plug** USB sticks that **my contacts** (family, friends, colleagues) **give me** into my electronic devices (computer, tablet, smartphone).

(a) Never

(b) Rarely

(c) Sometimes

(d) Often

(e) Always

(18) [Grid question. Row order randomized.] To what extent do the following statements reflect what you are capable of doing?

Row options:

- I know how to **manually delete some files** from a storage device (by sending them to the trash bin).

- I know how to **manually delete all data** from a storage device (by sending them to the trash bin).

- I know how to **empty the trash bin** of a storage device.

- I know how to **format** a storage device.

- I know how to **safely erase (wipe)** a storage device.

- I know how to **scan** a storage device **with my antivirus software**.

(a) Very untrue of me

(b) Untrue of me

(c) Somewhat untrue of me

(d) Neutral

(e) Somewhat true of me

(f) True of me

(g) Very true of me

## Sec. G: Expectations

(19) [Multiple selection. Order randomized.] When you bought the device `$DeviceName`, would you have liked to receive more information from Ricardo.ch on any of the following? (select all that apply)

(a) The technical aspects of transactions with storage devices (i.e., security and privacy risks)
(b) The legal aspects of transactions with storage devices (i.e., rights, obligations, liability)

(c) Other, please specify: [ ] (Text field)

(d) None

(20) [Order randomized.] After reading this questionnaire, is there anything you would change when buying second hand storage devices on online platforms?

(a) Yes, please specify: [ ] (Text field)

(b) No

## E PRECAUTIONARY ACTIONS

<figure><img src="image_6.png" /><figcaption>Figure 4: Precautions taken by buyers to mitigate risks.</figcaption></figure>

## F ASSOCIATIONS BETWEEN ATTITUDES

Table 2 shows Spearman's rank correlation coefficients between different courses of action for any type of data. The **likelihood to delete the remnant data is negatively correlated with the intention to notify the authorities** ($r = -0.47, p < .001$) and **the platform** ($r = -0.19, p < .001$). We found medium position correlations between using data and notifying other entities, including competent authorities ($r = 0.18, p < .001$), individuals ($r = 0.25, p < .001$), organizations ($r = 0.26, p < .001$), and platforms ($r = 0.19, p < .001$). This explains that, even before reporting remnant data, users need to first investigate the content. We found several strong positive correlations between notifying different entities. These findings were expected, as those who are open to notifying others built a similar understanding of the opportunity to notify these different entity types and do not differentiate between them.

Finally, to better understand the respondents' attitudes with regard to illegal content, we looked at the associations between the likelihood of data usage and other attitudes, such as deleting data or notifying other entities. Particularly, we sought for understanding why some respondents (13%) reported they would use illegal data vs. legal data. Figures 5 and 6 in Appendix G depict these associations. The results show that out of the 13% who reported they would extremely likely use data, 11% responded that they would extremely likely notify the competent authorities. This again highlights the fact that, in order to report incidents, users would need to open and understand the content. One of the respondents, in an open-ended answer, reported that "[deleting illegal content] could be very problematic, as it could easily lead to potential evidence and information relevant to the investigation simply being destroyed." These findings highlight the possible difficulties even well-intentioned users could face in real life.

<table><caption>Table 2: Spearman rank correlation matrix for general attitudes toward remnant data.</caption><thead><tr><th></th><th>D</th><th>U</th><th>NS</th><th>NCAs</th><th>NII</th><th>NIO</th></tr></thead><tbody><tr><td>Delete (D)</td><td></td><td></td><td></td><td></td><td></td><td></td></tr><tr><td>Use (U)</td><td>-0.11<sup>*</sup></td><td></td><td></td><td></td><td></td><td></td></tr><tr><td>Notify Seller (NS)</td><td>0.11<sup>*</sup></td><td>0.03<sup>*</sup></td><td></td><td></td><td></td><td></td></tr><tr><td>Notify Competent Authorities (NCAs)</td><td>-0.47<sup>**</sup></td><td>0.18<sup>**</sup></td><td>-0.05</td><td></td><td></td><td></td></tr><tr><td>Notify Identified Individual (NII)</td><td>0.0</td><td>0.25<sup>**</sup></td><td>0.36<sup>**</sup></td><td>0.44<sup>**</sup></td><td></td><td></td></tr><tr><td>Notify Identified Organization (NIO)</td><td>0.03</td><td>0.26<sup>**</sup></td><td>0.4<sup>**</sup></td><td>0.45<sup>**</sup></td><td>0.86<sup>**</sup></td><td></td></tr><tr><td>Notify the Platform</td><td>-0.19<sup>**</sup></td><td>0.19<sup>**</sup></td><td>0.25<sup>**</sup></td><td>0.57<sup>**</sup></td><td>0.6<sup>**</sup></td><td>0.65<sup>**</sup></td></tr></tbody></table>

<footnote>* and ** refers to correlation coefficients with *p* < .05 and *p* < .001, respectively.</footnote>
(b) The legal aspects of transactions with storage devices (i.e., rights, obligations, liability)

(c) Other, please specify: [ ] (Text field)

(d) None

(20) [Order randomized.] After reading this questionnaire, is there anything you would change when buying second hand storage devices on online platforms?

(a) Yes, please specify: [ ] (Text field)

(b) No

## E PRECAUTIONARY ACTIONS

<figure><img src="image_8.png" /><figcaption>Figure 4: Precautions taken by buyers to mitigate risks.</figcaption></figure>

## F ASSOCIATIONS BETWEEN ATTITUDES

Table 2 shows Spearman's rank correlation coefficients between different courses of action for any type of data. The **likelihood to delete the remnant data is negatively correlated with the intention to notify the authorities** ($r = -0.47, p < .001$) and **the platform** ($r = -0.19, p < .001$). We found medium position correlations between using data and notifying other entities, including competent authorities ($r = 0.18, p < .001$), individuals ($r = 0.25, p < .001$), organizations ($r = 0.26, p < .001$), and platforms ($r = 0.19, p < .001$). This explains that, even before reporting remnant data, users need to first investigate the content. We found several strong positive correlations between notifying different entities. These findings were expected, as those who are open to notifying others built a similar understanding of the opportunity to notify these different entity types and do not differentiate between them.

Finally, to better understand the respondents' attitudes with regard to illegal content, we looked at the associations between the likelihood of data usage and other attitudes, such as deleting data or notifying other entities. Particularly, we sought for understanding why some respondents (13%) reported they would use illegal data vs. legal data. Figures 5 and 6 in Appendix G depict these associations. The results show that out of the 13% who reported they would extremely likely use data, 11% responded that they would extremely likely notify the competent authorities. This again highlights the fact that, in order to report incidents, users would need to open and understand the content. One of the respondents, in an open-ended answer, reported that "[deleting illegal content] could be very problematic, as it could easily lead to potential evidence and information relevant to the investigation simply being destroyed." These findings highlight the possible difficulties even well-intentioned users could face in real life.

<table><caption>Table 2: Spearman rank correlation matrix for general attitudes toward remnant data.</caption><thead><tr><th></th><th>D</th><th>U</th><th>NS</th><th>NCAs</th><th>NII</th><th>NIO</th></tr></thead><tbody><tr><td>Delete (D)</td><td></td><td></td><td></td><td></td><td></td><td></td></tr><tr><td>Use (U)</td><td>-0.11<sup>*</sup></td><td></td><td></td><td></td><td></td><td></td></tr><tr><td>Notify Seller (NS)</td><td>0.11<sup>*</sup></td><td>0.03<sup>*</sup></td><td></td><td></td><td></td><td></td></tr><tr><td>Notify Competent Authorities (NCAs)</td><td>-0.47<sup>**</sup></td><td>0.18<sup>**</sup></td><td>-0.05</td><td></td><td></td><td></td></tr><tr><td>Notify Identified Individual (NII)</td><td>0.0</td><td>0.25<sup>**</sup></td><td>0.36<sup>**</sup></td><td>0.44<sup>**</sup></td><td></td><td></td></tr><tr><td>Notify Identified Organization (NIO)</td><td>0.03</td><td>0.26<sup>**</sup></td><td>0.4<sup>**</sup></td><td>0.45<sup>**</sup></td><td>0.86<sup>**</sup></td><td></td></tr><tr><td>Notify the Platform</td><td>-0.19<sup>**</sup></td><td>0.19<sup>**</sup></td><td>0.25<sup>**</sup></td><td>0.57<sup>**</sup></td><td>0.6<sup>**</sup></td><td>0.65<sup>**</sup></td></tr></tbody></table>

<footnote>* and ** refers to correlation coefficients with *p* < .05 and *p* < .001, respectively.</footnote>
G ADDITIONAL DATA

<figure><img src="image_7.png" /><figcaption>Figure 5: Associations of the likelihood of data 'usage' and other attitudes towards Illegal content (e.g., child sexual abuse material)</figcaption></figure>

<figure><img src="image_8.png" /><figcaption>Figure 6: Associations of the likelihood of data 'deletion' and other attitudes towards Illegal content (e.g., child sexual abuse material).</figcaption></figure>
G ADDITIONAL DATA

<figure><img src="image_9.png" /><figcaption>Figure 5: Associations of the likelihood of data 'usage' and other attitudes towards Illegal content (e.g., child sexual abuse material)</figcaption></figure>

<figure><img src="image_10.png" /><figcaption>Figure 6: Associations of the likelihood of data 'deletion' and other attitudes towards Illegal content (e.g., child sexual abuse material).</figcaption></figure>