DON'T PUT, YOUR ELECTRONIC INFORMATION OUT WITH THE TRASH

Idaho Power, a utility serving parts of Idaho and Oregon, made headline news recently for a simple mistake that could happen to any of us. They recycled 230 PC hard drives through a salvage equipment vendor. The salvage company sold some of the drives on eBay. There's nothing wrong with any of that.

Problems arose when it was discovered that some of the drives contained proprietary information such as customer correspondence and confidential employee data.

Why neither the power company nor the salvage vendor bothered to scrub the drives is under investigation. Meanwhile, scenarios like this are much more common than you might think and are even more onerous when you add discarded PDAs, mobile phones and flash drives to the used equipment list.

The Fair and Accurate Credit Transactions Act passed in 2003 requires businesses and individuals to properly dispose of sensitive consumer information. Federal penalties can be costly and customer backlash can be severe.

Protecting your company and your customers is not as simple as deleting all the files on that old equipment. Proper steps must be taken to ensure complete data destruction.

You know that deleting a file on your PC actually moves it to the trash (or recycle) bin. You occasionally empty the trash bin and the file disappears from view. Unfortunately, this is where the problems begin.

Emptying the trash doesn't permanently erase files. It merely informs the operating system that the space occupied by the files is now available for other uses. The information contained in those files remains on the hard drive and can be retrieved by experts in computer forensics.

It gets worse. Even reformatting a hard drive to delete all folders and files does not permanently erase the information in those files. Again, formatting merely indicates that all the space on the drive is available for storage.

This problem is so tenacious that the Department of Defense has issued standards for the complete and permanent destruction of computer files. The standards dictate as many as seven write passes over the surface of a hard drive to completely and permanently erase the contents.

Why so many write passes? Hard drives use magnetism to store data. Magnetic fields are not simply on or off to represent ones or zeros. The fields have characteristic patterns or signatures. For example, a location containing a zero overwritten by a one has a different magnetic signature than a location containing a one overwritten by a one.

Computer experts with the right equipment can determine what information the drive last contained and what information was overwritten.

This problem also affects portable devices such as PDAs and mobile phones though not in exactly the same manner. These devices rarely use hard drives, relying on flash memory instead. Flash is electronic, not magnetic, so it is not plagued by the signature problem. Regardless, it is important to completely erase any portable device prior to disposal or resale.

Here's what you and your company need to do to protect yourselves and your customers prior to the disposal or resale of old electronic equipment.

Computer hard drives must be completely erased not just cleaned or reformatted. Doing this requires special software to electronically "shred" the files following DoD specifications. To completely erase a hard drive, boot the system from another device such as a floppy, CD or flash drive and run the shredding software. Alternatively, remove the drive and attach it to another system for erasure.

An easier approach may be to hire a salvage firm to do the shredding. Just be sure they have a track record for properly handling used hard drives.

It is possible to physically destroy a drive by smashing it but this may actually be more work as well as introducing risks of personal injury. Leave this approach to the salvage experts.

Flash drives should be completely erased using software that writes random data to the entire device. If the flash drive has stopped working, it is best to crush the device. Merely tossing it won't prevent someone from repairing it and extracting its contents.

PDAs and mobile phones present additional problems. Generally, a reset or initialize command will delete all the data in the device and return it to a factory configuration. The steps for doing this vary widely among manufacturers and product lines. Refer to your owner's manual for instructions.

Be aware that portable music players contain hard drives or flash memory and can be used to store data files. In addition, there are licensing issues around selling a used device full of copyrighted works. It's usually enough to simply delete all the music and data files on the device. However, a determined thief could retrieve many, if not all, of the files.

Erasing them with appropriate software is the best approach. If the device is to be scrapped and once contained any sensitive data files, crush it.

What about all those floppy disks, CDs, tapes and other storage media you have lying around? A salvage company can shred and recycle those components. Insist on proof that the work was done properly.

Some of these ideas may seem over the top but if your company's proprietary and confidential information ends up on eBay, the legal liability, lost business, and reputation damage could be catastrophic. Why take that chance?

Vin D'Amico is Founder and President of DAMICON, your ADJUNCT CIO™. He is an expert in IT Business Continuity Planning, Network Security Policies, and Freelance Writing focused on white papers, case studies, and handbooks. DAMICON services firms worldwide.

This article appeared in Vin's monthly Virtual Business column for the IndUS Business Journal in June 2006.

To learn more about how DAMICON can help your business, please take a look at our service programs.