Anybody with five bucks and a little patience may be able to score sensitive corporate or customer data on eBay.
If your organization has engaged in the common practice of disk drive recycling -- selling unneeded disk drives directly or through a service -- company data might wind up for sale on eBay Inc.'s auction site, even if the drives have been wiped first.
Idaho Power Co. discovered that possibility last week as it scrambled to track down company disk drives that had been sold on eBay without having been scrubbed first. The Boise, Idaho-based utility serves approximately 460,000 customers in the southern part of Idaho and in eastern Oregon.
Data on the drives, which had been used in servers, contained proprietary company information such as memos, correspondence with some customers and confidential employee information, the company said.
Idaho Power had recycled approximately 230 SCSI drives -- a year.s worth of updates -- through a single salvage vendor, Grant Korth, which then sold 84 of the drives to 12 parties through eBay. The company recovered 146 of the drives from the vendor. It also got assurances from 10 of the 12 parties that bought them on eBay that the drives would be returned or the data on them would not be saved or distributed. The other two drives are still being tracked down; an Idaho Power spokesman did not know what information was on them.
Nampa, Idaho-based Grant Korth refused to comment. In the meantime, Idaho Power has launched an independent investigation through Blank Law & Technology PS in Seattle into why its policy on scrubbing drives was not followed. Typically, Idaho Power was to have either physically destroyed the drives or scrubbed them to U.S. Department of Defense standards -- which involves degaussing them or overwriting the data with a minimum of three specified patterns -- and the salvage vendor was to have done the same, the Idaho Power spokesman said. The company's probe could take several months, depending on what data was on the drives, he said. Similarly, Idaho Power will not know what regulatory penalties might apply until its investigation is completed.
Idaho Power is not alone, said Frances O.Brien, a research vice president for asset management at Gartner Inc. "It happens all the time," she said. Typically, a user either doesn't know to clean the drives or doesn't do it correctly, she said.
According to a Gartner survey, organizations use outside companies to dispose of PCs 29% of the time and to get rid of servers 31% of the time. Other methods included donating hardware, putting it in storage, selling it to employees, returning it to the vendor and selling it to third parties.
Aside from the financial concerns with losing data, organizations that improperly recycle disk drives can run afoul of a number of regulations, depending on their industry: the Health Insurance Portability and Accountability Act, the Sarbanes-Oxley Act, the Gramm-Leach-Bliley for the banking industry, the Family Educational Rights and Privacy Act for educational institutions and the Fair and Accurate Credit Transactions Act. In addition, several states, including California and New York, have broad-based privacy regulations, said Robert Houghton, president of Redemtech Inc., a Columbus, Ohio-based outsourcer.
The problem is widespread. Gartner estimates that through 2009, consumers and businesses will replace more than 800 million PCs worldwide and dispose of an estimated 512 million.
What's more, a company can get a bad reputation for not taking proper care of personal data, O.Brien said. When companies hire an outsourcer -- which is a practice that Gartner recommends -- it needs to be careful of what the salvage company will do and how they will prove it. "If everyone else is charging $20, and someone says they.ll do it for $2, you.ve got to wonder why," she said.
Simson Garfinkel, a postdoctorate fellow at Harvard University.s Center for Research on Computation and Society, researched the issue by buying more than 1,000 hard drives on eBay to see what sort of data could be gleaned from them. He found disk drives that held information from an automated teller machine, a drive from a medical center that held 31,000 credit card numbers, a supermarket credit card processor and a travel agency that had discarded data on travel plans, credit card numbers and ticket numbers. "One of the drives had consumer credit applications on it -- names, work histories, Social Security numbers -- all the information you need to apply for credit."
Even though drives may have been wiped of data, someone with the know-how and patience could still retrieve information, Garfinkel said. Standard tools such as Format and Delete simply remove the reference to the files -- the data is still there. Garfinkel himself has written a number of tools to retrieve information such as e-mail addresses and credit card numbers on wiped disks.
Despite his findings, Garfinkel said companies seem to be doing a better job protecting data, and he pointed to the Fair and Accurate Credit Transactions Act as a possible reason. "The percentage of drives out there that have usable data is going down, so companies are more aware of the issue," he said.
Similarly, when Houghton's company has done an audit on clients' supposedly wiped disk drives, 25% to 30% of them still had readable data, he said.
Idaho Power said that in the future, it will destroy drives rather than sell them for salvage -- a policy Garfinkel backs. "The resale value of a hard drive is really minuscule, and it's easy to verify it's been destroyed," he said. "These things are worth $5 to $20 each. I don't think anyone's buying them on the secondary market for extortion, but you never know." [an error occurred while processing this directive]