Missile data, medical records found on discarded hard disks
Study finds all manner of stuff on eBay
A third (34 per cent) of discarded hard disk drives still contain confidential data, according to a new study which unearthed copies of hospital records and sensitive military information on eBayed kit.
The study, sponsored by BT and Sims Lifecycle Services and run by the computer science labs at University of Glamorgan in Wales, Edith Cowan University in Australia and Longwood University in the US, also found network data and security logs from the German Embassy in Paris on one purchased drive.
Researchers bought 300 drives from eBay, other auction sites, second-hand stalls and car boot sales.
A disk bought on eBay contained details of test launch routines for the THAAD (Terminal High Altitude Area Defence) ground to air missile defence system. The same disk also held information belonging to the system’s manufacturer, Lockheed Martin, including blueprints of facilities and personal data on workers, including social security numbers.
Lockheed Martin denies that the disk came from it. The arm manufacturer has launched an investigation that aims to uncover just how the sensitive data might have been wound up on the disk.
Two discs bought in the UK apparently came from Lanarkshire NHS Trust, including patient medical records, images of X-rays and staff letters. Lanarkshire NHS Trust runs the Monklands and Hairmyres hospitals.
In Australia, the exercise turned up a disk from a nursing home that contained pictures of actual patients and their wound photos, along with patient details.
A hard disk from a US bank contained account numbers and details of plans for a $50bn currency exchange through Spain. Details of business transactions between the bank and organisations in Venezuela, Tunisia and Nigeria were also included.
Correspondence between a member of the Federal Reserve Board and the unnamed banks revealed that one of the deals was already under scrutiny by the European Central Bank, and that federal investigators were also taking an interest.
Yet another disk contained business plans about a well known UK-based fashion company. The same disk contained customer details and discount codes. Finally still yet another disk contained corporate design plans from a major motor manufacturing company. You get the idea.
The University of Glamorgan has now been running the survey for five years, in which time the volume of drives containing sensitive data has fallen from a half to little over a third. But the actual volume of data potentially exposed has increased markedly, alongside the potential sensitivity of that data.
"If military secrets are thrown away then anything can be," Jon Godfrey of Sims Recycling Solutions, which provide secure data destruction services, told El Reg. "Organisations spend millions on data security products such as firewalls to protect data but fail to think about discarded data.
"Residual data can still be accessed years after the equipment has been discarded and in the wrong hands could have not only financial consequences but potential implications for national security. It is essential that organisations destroy data via a professional and secure data destruction system or through physical destruction, before passing the equipment for secondary use."
The data destruction problem extends beyond computer hard disks to a growing diversity of devices, such as mobile phones, MP3 players, SatNavs, printers and even set top boxes. Each can hold a "snapshot of our lives" containing data that is finding its way to China, Africa and Eastern Europe. For example, second-hand BlackBerries containing data are on sale for a premium in Nigerian street markets. ®
Not A New Problem
I remember buying cone shaped bags of deep fried and salted shrimp made from 12x14 inch sheets of computer printout paper from street vendors on 'The Hill' in Seoul. After a closer look at the paper we discovered the paper came from the trash of the personnel shop on post and contained Names, SSNs, and other identity information, etc. We thought it was pretty funny at the time, then decided to stuff a few empties in the suggestion box on base with the SSN of a high ranking individuals highlighted. It took them a while but eventually you couldn't find any of those bags on the hill a year later.
I also remember throwing out the computer printout listing of the entire membership in AUSA while on a brief stint as their janitor, pre-dumpster diving days. When I needed a replacement hard drive; I purchased a used hard drive to replace my crashed drive in my AST laptop. It turned out the drive previously belonged to a Marine Officer from Quantico, before I wiped the disk and reformatted. By the way it doesn't matter how many times you overwrite a disc some forensic lab somewhere will be able to extract each layer of data from the beginning format, unless you remove the magnetic material completely (sanding, ammonia, melting, etc.) the data there forever.
Information owners (that means you) need to take responsibility for its disposition; personally or regulatory via agency, get hot, ask them and demand the correct answer. Only those needing to know, need to know.
Love Gus – getting of my soap box now.
wipe the disk first...
Then physically destroy it.
I think the policy is called "belts & bracers" so you wont get caught with your pants down
I built a little smelter to destroy/reform my old hard drives as I'm a terrorist/activist. I briefly thought about offering this as a paid service before I considered what sort of customers I'd attract.