Wiped Out

The handling of electronic scrap, especially computers, is creating a clash of philosophies. On one side, the push to develop an effective recycling/reuse infrastructure is becoming a growing challenge as the next generation of computers brings more e-scrap onto the market. While the infrastructure is taking hold, another trend is contributing to the interesting dynamics of electronics recycling: More companies are concerned about protecting the information stored on their hard drives.

While hard drives make up a small part of the equipment by volume, they are one of the most critical components of the computer, with a commensurate value greater than many other parts of the computer.

Additionally, while many electronics recyclers concentrate on rebuilding and reselling equipment and components, a growing trend toward destroying the hard drives and away from data erasure could make that resale side more challenging.

Many methods are available to protect information stored on hard drives from being accessed by outside sources. Each of them carries advantages, as well as disadvantages.

To some, destroying the drives in-house may sound like the easiest means for accomplishing the task. However, in addition to hard drives, companies have to destroy other devices that contain sensitive data, including tape drives, storage arrays and other magnetic media. The time it takes for an internal staff member to totally destroy these devices can be significant.

While destroying hard drives in-house is technically feasible, it is likely too time consuming to be practical. This means that having an outside source to handle the destruction becomes necessary. When shopping for these services, however, companies are presented with a wide panoply of methods, from destroying and grinding the hard drives to overwriting to degaussing the devices.

While some firms may opt to keep the destruction of electronic media in-house and to use some form of degaussing to render the information on the obsolete equipment useless, the method has some drawbacks. One is the cost of the equipment, which can run to more than $20,000. Additionally, the degaussing process can be time consuming.

According to the National Computer Security Center, data is stored on magnetic media in small areas called magnetic domains that are aligned in the direction of an applied magnetic field. Degaussing, which subjects the media to an alternating magnetic field of sufficient intensity, leaves these domains in random patterns, making the previous data unrecoverable.

To successfully erase recorded data from magnetic media, it is necessary for the strength of the degaussing field to be greater in value than the coercivity of the magnetic media devices.

Robin Ingenthron with Good Point Recycling, a Middlebury, Vt., based company that provides electronics recycling services throughout the Northeast, says that while degaussing can be sufficient for older computer systems, it is less effective with newer computer systems.

While degaussing is often an effective method for destroying data on hard drives, there are some lingering concerns that with larger hard drives, it is possible that some data could be retrievable following the procedure.

In one article in a technology magazine, a supplier of degaussing equipment equated degaussing with an Etch A Sketch toy. Even after degaussing, drives may contain residual patterns that may be vulnerable to certain types of retrieval technologies.

Ingenthron stresses that the most important issue in destroying data on electronic media is trying to balance cost, liability and risk. Such a balance differs from client to client, he adds.

As for the equipment itself, Ingenthron says there are several different kinds of risk to consider. "This isn’t going to be a popular statement, but the risk of a truck driver taking bank papers home to read is different from the risk of a truck driver taking a Pentium 4 laptop home. The value of the computer is what drives the risk in our business, not the value of the data."

When it comes to computers dating back to 1995 that feature 486 processors, it is almost impossible to give one away, data, software and all, Ingenthron says. "I wouldn’t worry about leaving one on a pile for two months between shreds," he adds. "However, a single Pentium 4 laptop has a street value of $250, and you need to account for that hard drive from the minute it leaves the client’s possession," Ingenthron says.

"The secondary market for used computers is our greatest asset and our greatest enemy," he adds.

Dan Bayha, vice president of Back Thru the Future Computer Recycling, a computer recycling company based in Ogdensburg, N.J., says he feels that shredding hard drives provides the safest and most assured method of information destruction. "The only method of assuring destruction is to shred and then melt the drives," he says.

When it comes to wiping and degaussing hard drives, Bayha says there are technological issues that could limit the effectiveness of either of these methods. For instance, hard drives with bad sectors cannot be overwritten.

While the market is very sensitive to the costs associated with protecting sensitive information, Bayha says that with the concerns about identity theft percolating, there is even greater pressure on the part of Back Thru the Future’s clients to ensure that their hard drive and information storage devices are properly destroyed.

Bill Breckenridge, president of Data Security Technologies of Glen Allen, Pa., a company that provides physical and electronic equipment to destroy data on hard drives, agrees that the most authoritative way to dispose of hard drives is through shredding them. Further, he recommends shredding them down to a nominal 1-inch size.

However, Breckenridge also finds that overwriting is not without its advantages. "If you do a hard drive wipe, make sure you have an auditable method," he cautions.

As for overwriting the hard drives, Breckenridge says between three and seven wipes is an ideal number.

Also, with the proper hard drive wiping, Breckenridge adds, "The ultimate result is that a recycler can recoup higher returns." And, with the ability to remotely perform the hard drive wiping process over multiple units at once, Breckenridge says it is a much more efficient process.

While the protection of information is the most important issue for many companies, the reality, according to Ingenthron, is that shredding is a good marketing investment for many clients. "It assures them that their data is safe, even if the risk that anyone would ever plug it in is next to zero," he says. "There are less expensive shredders for this marketing use, which don’t actually add value by mixing plastics, steel, copper and aluminum in little pieces. You gain clients and lose material value. If you have a large enough volume, more modern shredders will keep the aluminum, copper and steel separate." Ingenthron adds, "But in either system, you lose the asset value—a single stick of RAM can be worth $20 sold in an online auction"

While shredding appears to be the most effective way to handle hard drives, Rick Simon with Asset Recovery Services N.E., Auburn, Mass., says that in the nine years his company has been involved in the IT business, more than 90 percent of his customers have opted for a multiple wiping method to overwrite the data on their hard drives.

Some of the exceptions, he says, are health care providers, which, in light of HIPAA (Health Insurance Portability and Accountability Act) concerns, are more likely to have a shredding program in place.

The biggest advantage to the wiping method is that a company would be able to reuse the computer after the process is complete. Simon does specify that the wiping software the company uses complies with Department of Defense requirements.

However, Breckenridge, who markets products for software wiping as well as shredders, says the products he markets through Data Security Technologies provide users with auditable information on each hard drive wiped, which is essentially equivalent to a certificate of destruction that some companies provide to document the shredding of material.

Clients can also specify the number of wipes to be performed on each hard drive.

The choice between wiping a hard drive and shredding it comes down to what the customer hopes to achieve. For companies that view completely destroying the information as the most relevant issue, shredding eliminates uncertainty about data accessibility. Companies who pursue this route say rendering the information inaccessible is of the utmost importance.

For those who are looking for a physical solution, there are various means of destruction. eDR Solutions, Greenville, S.C., was recently recognized with an award during the TechnoSecurity conference for its Hard Disk Crusher, which can destroy a hard drive in 10 seconds.

Charles Smith, president of eDR Solutions, says that while a degausser isn’t guaranteed to work with newer computer systems, and software wiping methods could take a considerable amount of time, the crusher can process several hundred hard drives in an eight hour shift.

With the number of options available, secure destruction professionals can look to the National Association of Information Destruction (NAID) for more direction. The association includes specifications on physical hard drive destruction in its AAA certification program.