Sometimes, ignorance is bliss… except when it comes to discarding old computer hard drives. Contrary to popular belief, leaving data on old computers destined for lease return, remarketing or recycling is the very last thing you want to consider doing. More often than not, those hard drives, even the ones erased and re-formatted, still can contain highly sensitive information and corporate secrets that can easily fall into the wrong hands!
To be specific, Simson Garfinkel*, researcher at the Harvard University Department of Science, collected 158 hard drives from various sources including online auction services and used computer equipment shops. To his surprise, thousands of credit card numbers, medical records and financial data were all readily available. Further inquiry determined that the organizations responsible for disposal sold the hard drives to other sources with all data intact. This was also due to the fact that data destruction employees were improperly trained in the correct data destruction techniques.
Speaking at the MIS confab about the value of forensics and self-auditing, Garfinkel said, “companies can use forensics to ‘understand what’s actually going on’ over their network… and track the flow of data across network boundaries. This could also include tracking old hard drives and their proper disposal.”
There are also several guidelines for preventing the theft of sensitive information when disposing of old computer hard drives:**
1. Trade in the old when buying the new, making proper disposal and on site data destruction of the old is a condition of the new purchase agreement.
2. Don’t skimp on the cost of on site hard drive disposal services. Purchasing the best quality service is a lot less expensive than potential lawsuits if customer information is compromised.
3. Gain additional savings by eliminating warehousing and other storage costs.
4. Include indemnification and liability transfer as part of any disposal contract to relieve you of any further accountability or possible litigation.
5. Choose highly qualified, reputable on site disposal or erasure experts who possess a thorough knowledge of all proper industry codes and standards for hardware disposal.
