I left a $400 smartphone on a San Francisco sidewalk hoping it would get stolen

A few months ago, as I climbed into an Uber in San Francisco’s Mission district, I dropped a Samsung Galaxy on the sidewalk—and left it there. My Uber driver, who had come around to close my door, and I both stared at it, shiny and black against the dirty, grey sidewalk. I made no move to pick it up.

“You dropped your phone,” the driver said, confused.

“I know,” I said. “I meant to.”

I do not usually leave tech litter around, but Avast, a digital security firm, had given me the phone with the express purpose of losing it. The firm left 20 Samsung Galaxys in parks, bathrooms, taxis and street corners in San Francisco and New York City in April to see what would happen to them.

Four good Samaritans (one in SF and three in NYC) returned the phones after finding them, but the other 16 entered what Wired has called the “secret world of stolen smartphones.” Except in this case the world was a little less secret because the phones had three different anti-theft apps on them that could track their location, take over their cameras to take photos and videos, and keep track of what IP addresses they were connecting to.

The person who found my “lost” Samsung Galaxy was not one of the good Samaritans, even though I’d planted a series of text messages that would have given him or her contacts of mine to reach out to about finding the phone. He or she switched the phone’s language to Spanish, put in a new SIM card that changed the phone’s number and switched the network to Metro PCS.

“The one you lost was an interesting one,” says Avast CEO Vince Steckler. “The person who picked it up seems to live in Los Angeles, but the phone went back and forth between LA and San Francisco a lot.”

Four months later, at the end of August, the tracking software lost track of the phone. “We called its last known phone number and it was not in service,” said Steckler. “So they managed to recycle it. They wiped it and put a new phone number on it, or it died.”

The point of the experiment, says Steckler, was twofold. They wanted to perform a social experiment to find out how honest people are. (It’s a small, unscientific experiment, but judging from the results, you’re more likely to have your phone returned to you in New York than in SF.)

“To get only four out of 20 back says something about the average Joe on the street,” said Steckler. “People are opportunistic. That’s disappointing.”

Avast also wanted to prove that its anti-theft software performed better than that made by its competitors. Steckler says Avast’s software kept tracking the phones after the other programs were cleared with a factory reset. “We’re trying to see how long the anti-theft software will last before a user finds it,” he said. “You need a middle man who knows what he’s doing to get rid of our program.”

But even with Avast on them, most of the phones were completely wiped within a week. Five months later, just four phones are still being tracked and sending information back to Avast. One, that was dropped near the Googleplex remains in San Francisco, another left in Central Park is walking around the Bronx, and two more phones lost in New York wound up in India and the Dominican Republic. And the company continues to monitor their users.

“We know where they eat, where their friends are. We know the phone calls they’re making, when they switch phone cards, what operators they’re attaching to. We have pictures of the people using the phones,” said Steckler. “We see the phone in Mumbai commuting to work every day. We know where he lives. We can take pictures of them and the surrounding environment.”

I told Steckler that strikes me as a bit creepy, especially because I’ve written about innocent people who’ve been accused of theft thanks to tracking software that doesn’t tell the whole story. One rental company was chastised by the Federal Trade Commission because its anti-theft software used people’s computer cameras to take photos of them having sex. Because of the concern that the users might have bought what they thought were legitimately acquired phones, the company isn’t publishing the photos it has taken.

“The property is still ours,” said Steckler. “Is there anything wrong with tracking your own legitimate property?”

Of course, that raises the question of whether it’s still your property if you purposely distributed phones around cities hoping they would get picked up. As well as the more difficult question of whether it’s cool to program those phones to be spying devices.

Steckler says Avast has tried to call the people who have the phones and find out whether they’re the thieves or not, but that, though able to monitor their phone activity, the company hasn’t been able to get in touch with them. He says Avast is considering ending its experiment by activating a feature in the anti-theft software that blasts an audio alarm from the phone along with the message, “I’ve been stolen.”

The experiment tells us you’re probably screwed if you accidentally leave your phone behind somewhere, but it’s also a reminder of how creepy spyware can be, even when being used legitimately. The possibility of a program like this lurking on a phone or computer is something to keep in the back of your mind if you ever decide to buy a used tech device, or worse, steal one.