Journalists
Click on the Press Pack link above the story for further information and resources.
Data can be accessed years after equipment destroyed
26/Apr/2010
“High profile cases of data loss in recent months highlight that as the volume of confidential information stored by large organisations about their staff and customers has accelerated in recent years, so too has the risk of that information falling into the wrong hands and the potentially disastrous consequences which can follow.
“The Information Commissioners Office (ICO) in the UK has recently introduced new powers to levy fines of up to £500,000 on organisations who lose or mislay confidential information. Failure to ensure that sensitive data is correctly and securely disposed of could potentially cost an organisation hundreds of thousands of pounds - not to mention the cost to its reputation and the threats posed by data falling into the hands of criminals. But how much awareness is there among companies, individuals and public sector organisations of data security and what legislation we have in place?
Call for integral deletion methods and ban on sale of unwiped devices
“The European Data Protection Supervisor (EDPS) Peter Hustinx, said recently that EU law should force digital equipment manufacturers to include easy and free methods for deleting personal data inside data bearing equipment and should ban the sale of second hand goods that have not been properly wiped.
WEEE Directive ignores data protection issues
“Commenting on European proposals for changes to EU waste laws, Mr Hustinx said that the European Commission should have considered the data protection and privacy risks of the re-use and dumping of electronic goods right from the outset, a position which I fully support. In Europe, the Waste Electrical and Electronic Equipment (WEEE) Directive is a starting point for dealing with the problem of e-waste, but it is true to say that in its present form, it only considers the environmental issues. It ignores data protection issues thereby allowing potential for the export of redundant data.
Over a third of second hand devices contain sensitive data
Discarded hard drives - the study revealed that 34% of discarded hard drives still contain confidential data
“But it is not only changes in the law that are required, there is a general lack of awareness among both businesses and individuals of the dangers of disposing of redundant data bearing devices without first destroying the data. A survey carried out by BT and the University of Glamorgan of over 300 computer hard drives found that over one third contained a wide range of sensitive information. These included bank account details, medical records, confidential business plans, financial company data, personal ID numbers, job descriptions and even launch procedures for a US military missile air defence system. The hard drives were bought from the UK, America, Germany, France and Australia through computer auctions, computer fairs and eBay.
Value of data far exceeds life of equipment
“It is clear from the results of that study that a wide range of organisations, businesses and individuals all over the world are fundamentally failing in their duty to properly manage sensitive data when their IT equipment passes outside of their control.
“IT Directors budget vast amounts of money on data security to protect live data on the equipment they use day-to-day, yet fail to realise that the data has a value which far exceeds the useful life of the equipment. It is vital to realise that residual data can still be accessed years after the equipment has been discarded and that in the wrong hands could have not only financial consequences, but potentially in the case of the BT study, implications for national security. It is essential that organisations destroy data via a professional and secure data destruction system or through physical destruction, before passing the equipment for secondary use.
“The volume of data being recklessly discarded is growing exponentially with the size and diversity of devices. They hold a snapshot of our lives and must be erased or recycled professionally. The problem is not just limited to hard disk drives. Mobile phones, MP3 players, SatNavs and even set top boxes all store a snapshot of our lives and this information is finding its way to China, Africa and Eastern Europe.
Illicit demand for discarded data
“It was reported in Nigeria recently that second hand devices for sale which contain data are more expensive than those which have been securely erased. The data dictates the price and not the specification of the device and that can only mean that there is an illicit demand for discarded data.
“So discarding a USB stick, mobile phone or computer without consideration of the value of the residual data to someone else, could result in catastrophe both for the individual and their organisation.
“To prevent this happening and ensure complete peace of mind, businesses and large public sector organisations should seek the services of professional companies like ourselves who provide guaranteed data destruction of data bearing assets.
“In conclusion, whilst the legislation continues to lag behind, the lifecycle of computer equipment is ever shortening and the lifecycle of the data is on-going. Organisations and individuals should consider with great care the residual data on devices both during and at the end of their life.”
...ends...
Jon Godfrey is available for interviews at Infosec 2010 on Wednesday 28 April at the Sims Recycling Solutions on-site data shredder outside the main entrance to Earls Court from 10.30 am.
Further information: Jacqui Simpson +44 (0)1789 722042/ +44 (0)7827 851109 or email Jacqui.simpson@simsmm.com
Sims Recycling Solutions is the world’s largest electronics recovery and recycling company, enabling businesses to unlock the value in their surplus computer hardware, media and communications assets. Its Lifecycle Services proposition sustains the value of IT and electronic equipment, in a legally compliant, data secure, fully traceable and environmentally sustainable manner.