[ISN] Idaho utility hard drives -- and data -- turn up on eBay

[InfoSec News]

http://www.computerworld.com/securitytopics/security/story/0,10801,111148,00.html

By Sharon Fisher 
MAY 04, 2006 
COMPUTERWORLD

Anybody with five bucks and a little patience may be able to score
sensitive corporate or customer data on eBay.

If your organization has engaged in the common practice of disk drive
recycling -- selling unneeded disk drives directly or through a
service -- company data might wind up for sale on eBay Inc.'s auction
site, even if the drives have been wiped first.

Idaho Power Co. discovered that possibility last week as it scrambled
to track down company disk drives that had been sold on eBay without
having been scrubbed first. The Boise, Idaho-based utility serves
approximately 460,000 customers in the southern part of Idaho and in
eastern Oregon.

Data on the drives, which had been used in servers, contained
proprietary company information such as memos, correspondence with
some customers and confidential employee information, the company
said.

Idaho Power had recycled approximately 230 SCSI drives -- a year's
worth of updates -- through a single salvage vendor, Grant Korth,
which then sold 84 of the drives to 12 parties through eBay. The
company recovered 146 of the drives from the vendor. It also got
assurances from 10 of the 12 parties that bought them on eBay that the
drives would be returned or the data on them would not be saved or
distributed. The other two drives are still being tracked down; an
Idaho Power spokesman did not know what information was on them.

Nampa, Idaho-based Grant Korth refused to comment. In the meantime,
Idaho Power has launched an independent investigation through Blank
Law & Technology PS in Seattle into why its policy on scrubbing drives
was not followed. Typically, Idaho Power was to have either physically
destroyed the drives or scrubbed them to U.S. Department of Defense
standards -- which involves degaussing them or overwriting the data
with a minimum of three specified patterns -- and the salvage vendor
was to have done the same, the Idaho Power spokesman said. The
company's probe could take several months, depending on what data was
on the drives, he said. Similarly, Idaho Power will not know what
regulatory penalties might apply until its investigation is completed.

Idaho Power is not alone, said Frances O'Brien, a research vice
president for asset management at Gartner Inc. "It happens all the
time," she said. Typically, a user either doesn't know to clean the
drives or doesn't do it correctly, she said.

According to a Gartner survey, organizations use outside companies to
dispose of PCs 29% of the time and to get rid of servers 31% of the
time. Other methods included donating hardware, putting it in storage,
selling it to employees, returning it to the vendor and selling it to
third parties.

Aside from the financial concerns with losing data, organizations that
improperly recycle disk drives can run afoul of a number of
regulations, depending on their industry: the Health Insurance
Portability and Accountability Act, the Sarbanes-Oxley Act, the
Gramm-Leach-Bliley for the banking industry, the Family Educational
Rights and Privacy Act for educational institutions and the Fair and
Accurate Credit Transactions Act. In addition, several states,
including California and New York, have broad-based privacy
regulations, said Robert Houghton, president of Redemtech Inc., a
Columbus, Ohio-based outsourcer.

The problem is widespread. Gartner estimates that through 2009,
consumers and businesses will replace more than 800 million PCs
worldwide and dispose of an estimated 512 million.

What's more, a company can get a bad reputation for not taking proper
care of personal data, O'Brien said. When companies hire an outsourcer
-- which is a practice that Gartner recommends -- it needs to be
careful of what the salvage company will do and how they will prove
it. "If everyone else is charging $20, and someone says they'll do it
for $2, you've got to wonder why," she said.

Simson Garfinkel, a postdoctorate fellow at Harvard University's
Center for Research on Computation and Society, researched the issue
by buying more than 1,000 hard drives on eBay to see what sort of data
could be gleaned from them. He found disk drives that held information
from an automated teller machine, a drive from a medical center that
held 31,000 credit card numbers, a supermarket credit card processor
and a travel agency that had discarded data on travel plans, credit
card numbers and ticket numbers. "One of the drives had consumer
credit applications on it -- names, work histories, Social Security
numbers -- all the information you need to apply for credit."

Even though drives may have been wiped of data, someone with the
know-how and patience could still retrieve information, Garfinkel
said. Standard tools such as Format and Delete simply remove the
reference to the files -- the data is still there. Garfinkel himself
has written a number of tools to retrieve information such as e-mail
addresses and credit card numbers on wiped disks.

Despite his findings, Garfinkel said companies seem to be doing a
better job protecting data, and he pointed to the Fair and Accurate
Credit Transactions Act as a possible reason. "The percentage of
drives out there that have usable data is going down, so companies are
more aware of the issue," he said.

Similarly, when Houghton's company has done an audit on clients'
supposedly wiped disk drives, 25% to 30% of them still had readable
data, he said.

Idaho Power said that in the future, it will destroy drives rather
than sell them for salvage -- a policy Garfinkel backs. "The resale
value of a hard drive is really minuscule, and it's easy to verify
it's been destroyed," he said. "These things are worth $5 to $20 each.  
I don't think anyone's buying them on the secondary market for
extortion, but you never know."