Data security tips for computer recycling

By Kim Holmes, E-Scrap News

At this year's E-Scrap 2006: The North American Electronics Recycling Conference, a number of research projects presented at the conference revealed the growing prevalence of hard drive reuse rather than shredding. Three surveys of different types of processors indicated that as few as one-quarter of e-scrap processors offer shredding services. While almost all e-scrap processors offer some form of hard drive destruction, unless explicitly instructed to destroy hard drives by the customer, processors are first assessing the reusability of hard drives and other components for remarketing, which calls into question the issue of information security.

Specifically, a survey of processors asked questions about the recyclability of old computers found that 58 percent of processors offered shredding services. In a separate survey of processors in North America that number was 46 percent and a survey of processors operating in the statewide California e-scrap recovery program suggested that number was as low as 25 percent. All of these surveys were conducted by E-Scrap News (Portland, Oregon). Likewise, processors in non-regulated markets in North America reported computer and component resale constitute on average 36.7 percent of their sales. And finally, a sizable percentage (81 percent) of refurbishers and reuse organizations that were surveyed by CompuMentor (San Francisco) and E-Scrap News predict that opportunities in the reuse market will continue to grow.

So what does this information mean for the average consumer generating e-scrap that is being sent to processors for recycling? In short, it means when relatively new equipment is sent for recycling, most likely it is first being assessed for reusability. And, unless one explicitly requests hard drives, which often contain sensitive personal or corporate information, be destroyed, the drives may be reused.

Some processors are now taking steps to protect their customer's information by overwriting the data on hard drives, which make information nearly impossible to retrieve, before remarketing them. Not all processors, however, automatically do this for free. It is important that generators of e-scrap check with the processor to see which steps, if any, are being taken to protect sensitive information.

Many reuse organizations, such as Goodwill, put the onus of removing information on the person donating the equipment. For example, the following statement is provided on Goodwill's Web site which offers instructions for donating equipment: “To protect your privacy, Goodwill recommends that donors remove all data from a computer hard drive before donating a computer, with the exception of the operating system. A donor is responsible for all confidential data that may be stored on the donated computer(s) or on any other storage devices donated. The donor bears sole responsibility for removing or securing such data, or for transferring it to a medium under your continuing control.”

Software to facilitate in purging data is available for free from Microsoft's Web site and other freeware software pages. Other programs which will wipe hard drives clean to Department of Defense standards are available for purchase.

Needless to say, not considering protecting critical data can be costly. A number of studies and recent reports confirm the ease of retrieving personal information from remarketed IT equipment.

Most recently E-Scrap News reported this past September that hard drives containing personal information of Britons are turning up in Nigeria, according to the BBC's news program The Real Story . The used computer equipment is making its way to developing nations at an alarming rate and are being trafficked through e-scrap brokers and processors. And while many who drop off their personal computers for recycling believe processors are taking steps to protect personal data, a test conducted by the Real Story proves otherwise.

The news program purchased 17 hard drives from Nigeria at about $19 (US$) a piece and turned them over to a computer forensic expert. Home addresses, bank account numbers, emails – some with highly confidential information -- and other personal information was extracted from the drives.

In 2005, staff of Blancco (Joensuu, Finland), a leading provider of data erasure software, purchased 10 used computer systems from a local computer store. Cade Gorman, manager of the U.S. sales market for the firm, reported on the findings for E-Scrap News last year (“ What about my data?” , E-Scrap News ,October 2005 ) . He wrote, “The computers, most of which were three to five years old, contained all of their former owners' data. One computer had been a law firm's file server and contained privileged client-attorney information. Another computer had a database used by a community organization that provided mental health services. Other disks contained numerous personal files.”

The ease of retrieving data from used equipment, coupled with the fact that processors currently rely heavily on hand demanufacturing to recover drives and other components for resale, means that data security must always be considered as a top asset management priority when replacing equipment at any level, whether it be a personal computer or business acquisition.

If you are a corporation recycling equipment:

Ask processors if they offer data-wiping services. Some processors provide this service for free while others may charge a small fee per hard drive.
Consider asking for hard drives containing the most sensitive information to be destroyed. Check with the corporate insurance policy managers to see if there are requirements on how confidential information is to be handled.
Ask for DOD-approved overwriting software to be used on any hard drive that may be recovered for reuse.
If you are recycling a personal home computer:

Follow the above recommendation if you are working directly with a processor.
If dropping equipment off at a collection event, ask the coordinator if any provisions are being made for data security before you bring your equipment. If not, take the task of data erasure upon yourself.
When donating a computer for reuse, always assume the responsibility of removing personal information.
Taking the extra time and expense to ensure data security when recycling computers will more than pay for itself in the end.

E-Scrap News is the premier monthly news source the electronics recycling industry has come to rely on. E-Scrap News brings readers the latest developments in collections, processing, product stewardship, technology, markets, reuse and legislation, making it the most comprehensive industry resource available. To obtain your free sample, call us at (503) 233-1305 or send us an email at This e-mail address is being protected from spambots. You need JavaScript enabled to view it .