Opportunities and Challenges in Securely Reusing and Repurposing Mobile Devices
Pith reviewed 2026-06-28 00:37 UTC · model grok-4.3
The pith
Vendor-locked security in phones makes secure repurposing difficult for most discarded devices.
A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.
Core claim
Security mechanisms that rely on vendor-controlled provisioning and fixed device lifecycles do not remain effective when devices are repurposed outside their original ecosystem. Experiments on the PinePhone reveal the difficulty of reconstructing trust anchors for boot integrity, trusted execution environment isolation, and hardware-bound secrets. These findings generalize to requirements for secure repurposing and show that vendor-locked mechanisms prevent safe reuse of most discarded devices.
What carries the argument
Hardware-backed security mechanisms (boot chain integrity, trusted execution environment isolation, and protection of hardware-bound secrets) that depend on vendor-controlled provisioning.
If this is right
- Secure repurposing requires explicit mechanisms to reconstruct or transfer trust anchors after the device leaves its original ecosystem.
- Vendor-locked provisioning prevents the majority of discarded phones from being safely repurposed.
- New design requirements are needed so that future phones can support both original use and later reuse without loss of security.
Where Pith is reading between the lines
- If vendor locks remain the norm, large-scale phone reuse programs will need new hardware or software layers that operate above the existing security stack.
- The work points toward a possible tension between long device lifecycles for environmental reasons and the fixed-lifecycle assumption built into current hardware security.
- One testable extension is whether open-source firmware projects can supply the missing trust-anchor reconstruction steps for a wider range of devices.
Load-bearing premise
Results from the open-hardware PinePhone and the simulated scenarios apply to the security behavior of typical vendor-locked phones.
What would settle it
A demonstration that trust anchors can be rebuilt on a common vendor-locked phone without weakening its original security guarantees, or a survey showing that most discarded phones can be repurposed while preserving those guarantees.
Figures
read the original abstract
An estimated 5.3 billion mobile phones became electronic waste in 2022. Many of these devices can be repurposed and used in different contexts to extend their lifetime and to reduce ecological impacts. An often overlooked aspect of smartphone reuse is cybersecurity: these devices embed hardware-backed security mechanisms that rely on vendor-controlled provisioning and are designed for a fixed device lifecycle. In this paper, we investigate whether security mechanisms and guarantees remain effective when devices are repurposed outside their original ecosystem. We explore security features in a PinePhone, an open-hardware smartphone, and focus on three core security aspects: boot chain integrity, isolation provided by the Trusted Execution Environment, and the protection of hardware-bound secrets. Our experiments simulate realistic repurposing scenarios and highlight the complexity of reconstructing trust anchors. We generalize our observations to infer requirements for secure repurposing and illustrate how vendor locked mechanisms hinder the repurposing of a majority of discarded devices.
Editorial analysis
A structured set of objections, weighed in public.
Referee Report
Summary. The paper investigates cybersecurity challenges in repurposing discarded mobile devices, focusing on hardware-backed security mechanisms designed for fixed lifecycles. Using experiments on the open-hardware PinePhone, it examines three aspects—boot chain integrity, Trusted Execution Environment (TEE) isolation, and protection of hardware-bound secrets—under simulated repurposing scenarios. The work highlights difficulties in reconstructing trust anchors, derives requirements for secure repurposing, and concludes that vendor-locked mechanisms hinder repurposing for the majority of devices.
Significance. If the generalization from open-hardware experiments holds, the paper would usefully identify concrete barriers to secure device reuse, supporting efforts to reduce e-waste through extended lifecycles while maintaining security guarantees. The focus on trust-anchor reconstruction in realistic scenarios provides a starting point for requirements engineering in this area.
major comments (1)
- [Abstract] Abstract and concluding sections: the claim that 'vendor locked mechanisms hinder the repurposing of a majority of discarded devices' rests on generalization from PinePhone (open-hardware) experiments. Because the tested device lacks vendor provisioning, attestation, and revocation mechanisms, the observed behaviors in boot-chain integrity, TEE isolation, and hardware-bound secrets do not directly measure the hindrance mechanisms asserted for locked devices; additional evidence or explicit qualification is required for this load-bearing inference.
Simulated Author's Rebuttal
We thank the referee for the constructive feedback. We address the single major comment below.
read point-by-point responses
-
Referee: [Abstract] Abstract and concluding sections: the claim that 'vendor locked mechanisms hinder the repurposing of a majority of discarded devices' rests on generalization from PinePhone (open-hardware) experiments. Because the tested device lacks vendor provisioning, attestation, and revocation mechanisms, the observed behaviors in boot-chain integrity, TEE isolation, and hardware-bound secrets do not directly measure the hindrance mechanisms asserted for locked devices; additional evidence or explicit qualification is required for this load-bearing inference.
Authors: We agree that the PinePhone experiments do not directly replicate vendor provisioning, attestation, or revocation, as these are absent by design on open hardware. The manuscript selects the PinePhone precisely to isolate and observe the core mechanisms (boot chain, TEE isolation, hardware-bound secrets) without vendor controls, then contrasts these observations with documented vendor practices for locked devices that bind trust anchors to a fixed lifecycle. To address the concern, we will revise the abstract and conclusion to add explicit qualification: the generalization is derived from the experimental demonstration of trust-anchor reconstruction complexity together with analysis of how vendor mechanisms typically prevent such reconstruction. This supplies the requested qualification while acknowledging the limits of direct experimentation on closed devices. revision: yes
Circularity Check
No significant circularity; purely experimental and observational
full rationale
The paper reports direct experiments on boot-chain integrity, TEE isolation, and hardware secrets using the PinePhone, then draws qualitative inferences about repurposing requirements and vendor-locked devices. No equations, fitted parameters, self-definitional constructs, or load-bearing self-citations appear in the derivation chain. The generalization step is an explicit inference from observed data rather than a reduction to inputs by construction. This matches the default case of a self-contained experimental study.
Axiom & Free-Parameter Ledger
Reference graph
Works this paper leans on
-
[1]
Android. 2026. Verified Boot. https://source.android.com/docs/security/features/ verifiedboot
2026
-
[2]
Arm. 2021. Arm CCA Security Model 1.0. https://developer.arm.com/ documentation/DEN0096/latest/
2021
-
[3]
Arm. 2025. ARM Trusted Firmware Design. https://chromium.googlesource. com/external/github.com/ARM-software/arm-trusted-firmware/+/v0.4- rc1/docs/firmware-design.md
2025
-
[4]
Arm. 2025. TrustZone for Cortex-A Product Support. https://developer.arm. com/Processors/TrustZone%20for%20Cortex-A
2025
-
[5]
Cornelis P Baldé, Ruediger Kuehr, Tales Yamamoto, Rosie McDonald, Elena D’Angelo, Shahana Althaf, Garam Bel, Otmar Deubzer, Elena Fernandez-Cubillo, Vanessa Forti, Vanessa Gray, Sunil Herat, Shunichi Honda, Giulia Iattoni, Vitto- ria Luda di Cortemiglia, Yuliya Lobuntsova, Innocent Nnorom, Noémie Pralat, and Michelle Wagner. 2024. THE GLOBAL E-WASTE MONIT...
2024
-
[6]
BBC. 2022. E-waste: Five billion phones to be thrown away in 2022. (Oct. 2022). https://www.bbc.com/news/science-environment-63245150
2022
-
[7]
Hilty, Basil Fuchs, and Yann Blum
Jan Bieser, Linda Burkhalter, Lorenz M. Hilty, Basil Fuchs, and Yann Blum. 2021. Lifetime extension of mobile internet-enabled devices: measures, challenges and environmental implications. https://doi.org/10.34961/1741
-
[8]
Barbara Bigliardi, Serena Filippelli, and Ivana Quinto. 2022. Environmentally- conscious behaviours in the circular economy. An analysis of consumers’ green purchase intentions for refurbished smartphones.Journal of Cleaner Production 378 (Dec. 2022), 134379. https://doi.org/10.1016/j.jclepro.2022.134379
-
[9]
Buildroot. 2026. Buildroot - Making Embedded Linux Easy. https://buildroot.org/
2026
-
[10]
European Environmental Bureau. 2019. Revealed: The climate cost of ’dispos- able smartphones’. https://eeb.org/revealed-the-climate-cost-of-disposable- smartphones/
2019
-
[11]
Marcelo Pilotto Cenci, Estela Moschetta Eidelwein, and Hugo Marcelo Veit
-
[12]
Composition and recycling of smartphones: A mini-review on gaps and opportunities.Waste Management & Research41, 10 (Oct. 2023), 1512–1528. https://doi.org/10.1177/0734242X231164324
-
[13]
Software Freedom Conservancy. 2026. Software Freedom Conservancy. https: //sfconservancy.org/
2026
-
[14]
Mauro Cordella, Felice Alfieri, Christian Clemm, and Anton Berwald. 2021. Durability of smartphones: A technical analysis of reliability and repairabil- ity aspects.Journal of Cleaner Production286 (March 2021), 125388. https: //doi.org/10.1016/j.jclepro.2020.125388
-
[15]
Mauro Cordella, Felice Alfieri, and Javier Sanfelix. 2021. Reducing the carbon footprint of ICT products through material efficiency strategies: A life cycle analysis of smartphones.Journal of Industrial Ecology25, 2 (2021), 448–464. https://doi.org/10.1111/jiec.13119
-
[16]
Debian. 2026. SecureBoot - Debian Wiki. https://wiki.debian.org/SecureBoot
2026
-
[17]
Vanessa Forti, Cornelis Peter Baldé, Ruediger Kuehr, and Garam Bel. [n. d.]. The Global E-waste Monitor 2020. https://hdl.handle.net/11159/652900
2020
-
[18]
WEEE Forum. 2022. International E-waste Day: Of ~16 Billion Mo- bile Phones Possessed Worldwide, ~5.3 Billion will Become Waste in
2022
-
[19]
https://weee-forum.org/ws_news/of-16-billion-mobile-phones-possessed- worldwide-5-3-billion-will-become-waste-in-2022/
2022
-
[20]
Valentin Girard, Maud Rio, and Romain Couillet. 2025. Computing, Complexity and Degrowth: Systemic Considerations for Digital De-escalation. InWorkshop on Computing within Limits (LIMITS) 2025. arXiv. https://doi.org/10.48550/ARXIV. 2507.19070
work page internal anchor Pith review doi:10.48550/arxiv 2025
-
[21]
Google. 2026. Hardware-backed Keystore. https://source.android.com/docs/ security/features/keystore
2026
-
[22]
Friederike Groschupp, Mark Kuhne, Moritz Schneider, Ivan Puddu, Shweta Shinde, and Srdjan Capkun. 2023. It’s TEEtime: A New Architecture Bringing Sovereignty to Smartphones. https://doi.org/10.48550/arXiv.2211.05206
-
[23]
Friederike Groschupp, Moritz Schneider, Ivan Puddu, Shweta Shinde, and Srdjan Capkun. 2021. Sovereign Smartphone: To Enjoy Freedom We Have to Control Our Phones. https://doi.org/10.48550/arXiv.2102.02743
-
[24]
Iness Ben Guirat and Jan Tobias Muehlberg. 2025. Resistance Technologies: Moving Beyond Alternative Designs. InWorkshop on Computing within Limits (LIMITS) 2025. arXiv. https://doi.org/10.48550/ARXIV.2508.05223
-
[25]
Sahil Gulliani, Maurizio Volpe, Antonio Messineo, and Roberto Volpe. 2023. Recovery of metals and valuable chemicals from waste electric and electronic materials: a critical review of existing technologies.RSC Sustainability1, 5 (2023), 1085–1108. https://doi.org/10.1039/D3SU00034F
-
[26]
Pengwei He, Haibo Feng, Guangji Hu, Kasun Hewage, Gopal Achari, Chang Wang, and Rehan Sadiq. 2020. Life cycle cost analysis for recycling high-tech minerals from waste mobile phones in China.Journal of Cleaner Production251 (April 2020), 119498. https://doi.org/10.1016/j.jclepro.2019.119498
-
[27]
Allen H. Hu, Chien-Hung Kuo, Lance H. Huang, and Chao-Chin Su. 2017. Carbon footprint assessment of recycling technologies for rare earth elements: A case study of recycling yttrium and europium from phosphor.Waste Management60 (Feb. 2017), 765–774. https://doi.org/10.1016/j.wasman.2016.10.032
-
[28]
Haoyang Huang, Fengwei Zhang, Shoumeng Yan, Tao Wei, and Zhengyu He
-
[29]
In2024 International Symposium on Secure and Private Execution Environment Design (SEED)
SoK: A Comparison Study of Arm TrustZone and CCA. In2024 International Symposium on Secure and Private Execution Environment Design (SEED). 107–118. https://doi.org/10.1109/SEED61283.2024.00021
-
[30]
Antonio Iera, Antonella Molinaro, Stefano Yuri Paratore, Giuseppe Ruggeri, and Antonella Zurzolo. 2011. Making a mesh router/gateway from a smartphone: Is that a practical solution?SOK9, 8 (Nov. 2011), 1414–1429. https://doi.org/10. 1016/j.adhoc.2011.03.004
2011
-
[31]
Hanson, Christoph Becker, Mike Berners-Lee, Andrew A
Bran Knowles, Vicki L. Hanson, Christoph Becker, Mike Berners-Lee, Andrew A. Chien, Benoit Combemale, Vlad Coroamă, Koen De Bosschere, Yi Ding, Adrian Friday, Boris Gamazaychikov, Lynda Hardman, Simon Hinterholzer, Mattias Höjer, Lynn Kaack, Lenneke Kuijer, Anne-Laure Ligozat, Jan Tobias Muehlberg, Yunmook Nah, Thomas Olsson, Anne-Cécile Orgerie, Daniel P...
-
[32]
Martin Lafréchoux. 2025. Practical Retrofitting for Obsolete Devices – Bridging the gap with old tech to create alternative interaction paradigms and workflows. InWorkshop on Computing within Limits (LIMITS) 2025. arXiv. https://doi.org/10. 48550/ARXIV.2508.00942
arXiv 2025
-
[33]
LibrePhone. 2026. LibrePhone. https://librephone.org/
2026
-
[34]
Graça Martinho, Diogo Magalhães, and Ana Pires. 2017. Consumer behavior with respect to the consumption and recycling of smartphones and tablets: An exploratory study in Portugal.Journal of Cleaner Production156 (July 2017), 147–158. https://doi.org/10.1016/j.jclepro.2017.04.039
-
[35]
Mobian. 2026. Mobian. https://mobian-project.org/
2026
-
[36]
Jan Tobias Mühlberg. 2022. Sustaining Security and Safety in ICT: A Quest for Terminology, Objectives, and Limits. InWorkshop on Computing within Limits (LIMITS) 2022. Virtual. https://doi.org/10.21428/bf6fb269.58c3a89d
-
[37]
Rainer Pamminger, Sebastian Glaser, and Wolfgang Wimmer. 2021. Modelling of different circular end-of-use scenarios for smartphones.The International Journal of Life Cycle Assessment26, 3 (March 2021), 470–482. https://doi.org/10.1007/ s11367-021-01869-2
2021
-
[38]
Asokan, Ahmad-Reza Sadeghi, Paulo Esteves-Veríssimo, Andreas Steininger, and Thorsten Holz
Andrew Paverd, Marcus Völp, Ferdinand Brasser, Matthias Schunter, N. Asokan, Ahmad-Reza Sadeghi, Paulo Esteves-Veríssimo, Andreas Steininger, and Thorsten Holz. 2019. Sustainable Security & Safety: Challenges and Opportunities.OASIcs, Volume 73, CERTS 201973 (2019), 4:1–4:13. https://doi.org/10.4230/OASICS. CERTS.2019.4
-
[39]
PINE64. 2025. PinePhone. https://pine64.org/devices/pinephone/ Section: devices
2025
-
[40]
PINE64. 2025. PinePhone - linux-sunxi.org. https://linux-sunxi.org/PinePhone
2025
-
[41]
PINE64. 2026. Privacy switches — PinePhone. https://pine64.org/documentation/ PinePhone/Privacy_switches/ Section: documentation
2026
-
[42]
Sandro Pinto and Nuno Santos. 2019. Demystifying Arm TrustZone: A Com- prehensive Survey.Comput. Surveys51, 6 (Nov. 2019), 1–36. https://doi.org/10. 1145/3291047 Opportunities and Challenges in Securely Reusing and Repurposing Mobile Devices LIMITS ’26, June 23–25, 20, Online
2019
-
[43]
postmarketOS. 2026. postmarketOS // real Linux distribution for phones. https: //postmarketos.org/
2026
-
[44]
Gudino, Neena Goveas, and Shubhangi Gawali
Challa Sai Reshwanth, Saivinay Goriparthi, Chandra Shekar R K, Lucy J. Gudino, Neena Goveas, and Shubhangi Gawali. 2023. IoT Systems Development Using Upcycled Mobile Phones: A Survey. In2023 IEEE International Conference on Recent Advances in Systems Science and Engineering (RASSE). 1–7. https://doi. org/10.1109/RASSE60029.2023.10363603
-
[45]
Clara Rigaud. 2025. Zombitron: towards a toolbox for repurposing obsolete smartphones into new interactive systems. InWorkshop on Computing within Limits (LIMITS) 2025. arXiv. https://doi.org/10.48550/ARXIV.2508.06354
-
[46]
Moritz Schneider, Ramya Jayaram Masti, Shweta Shinde, Srdjan Capkun, and Ronald Perez. 2022. SoK: Hardware-supported Trusted Execution Environments. https://arxiv.org/abs/2205.12742v1
arXiv 2022
-
[47]
Alon Shakevsky, Eyal Ronen, and Avishai Wool. 2022. Trust Dies in Darkness: Shedding Light on Samsung’s TrustZone Keymaster Design. In31st USENIX Security Symposium (USENIX Security 22). USENIX Association, Boston, MA, 251–268. https://www.usenix.org/conference/usenixsecurity22/presentation/ shakevsky
2022
-
[48]
Pritchard, Miranda Moss, and Daniel Gustafsson
Eric Snodgrass, Helen V. Pritchard, Miranda Moss, and Daniel Gustafsson
-
[49]
InWorkshop on Computing within Limits (LIMITS) 2024
Windternet: Designing grid-liberated servers for regenerative energy communities. InWorkshop on Computing within Limits (LIMITS) 2024. Virtual. https://urn.kb.se/resolve?urn=urn%3Anbn%3Ase%3Alnu%3Adiva-138472
2024
-
[50]
stm32. 2025. TF-A overview - stm32mpu. https://wiki.st.com/stm32mpu/wiki/TF- A_overview
2025
-
[51]
Martin Stojanov, Daniel Pargman, Mike Hazas, Rob Comber, and Jorge Luis Zapico. 2023. How do we arrive at constraints? Articulating limits for computing. InWorkshop on Computing within Limits (LIMITS) 2023. Virtual. https://doi.org/ 10.21428/bf6fb269.a317d18f
-
[52]
Sunxi. 2025. Pine64 - linux-sunxi.org. https://linux-sunxi.org/Pine64
2025
-
[53]
Jennifer Switzer, View Profile, Gabriel Marcano, View Profile, Ryan Kastner, View Profile, Pat Pannuto, and View Profile. 2023. Junkyard Computing: Repurposing Discarded Smartphones to Minimize Carbon. InProceedings of the 28th ACM International Conference on Architectural Support for Programming Languages and Operating Systems, Volume 2. 400–412. https:/...
-
[54]
Ubuntu Touch. 2026. Ubuntu Touch - Linux Phone. https://www.ubuntu-touch.io
2026
-
[55]
U-Boot. 2026. Booting from TPL/SPL — Das U-Boot unknown version documen- tation. https://docs.u-boot.org/en/stable/usage/spl_boot.html
2026
-
[56]
U-Boot. 2026. Building with GCC — Das U-Boot unknown version documentation. https://docs.u-boot.org/en/stable/build/gcc.html
2026
-
[57]
Boxall, Ka Yu Cheng, Aleksandar N
Jonovan Van Yken, Naomi J. Boxall, Ka Yu Cheng, Aleksandar N. Nikoloski, Navid R. Moheimani, and Anna H. Kaksonen. 2021. E-Waste Recycling and Resource Recovery: A Review on Technologies, Barriers and Enablers with a Focus on Oceania.Metals11, 8 (Aug. 2021), 1313. https://doi.org/10.3390/ met11081313 Number: 8
2021
-
[58]
Jinwen Wang, Ao Li, Haoran Li, Chenyang Lu, and Ning Zhang. 2022. RT-TEE: Real-time System Availability for Cyber-physical Systems using ARM TrustZone. In2022 IEEE Symposium on Security and Privacy (SP). IEEE, San Francisco, CA, USA, 352–369. https://doi.org/10.1109/SP46214.2022.9833604
-
[59]
Shamar Ward and Mechelle Gittens. 2018. Building useful smart campus applica- tions using a retired cell phone repurposing model. In2018 Third International Conference on Electrical and Biomedical Engineering, Clean Energy and Green Computing (EBECEGC). 43–48. https://doi.org/10.1109/EBECEGC.2018.8357131
discussion (0)
Sign in with ORCID, Apple, or X to comment. Anyone can read and Pith papers without signing in.