Defense-contract discs sold in African market for $40
Northrop Grumman and Pentagon data dumped
Regcast training : Hyper-V 3.0, VM high availability and disaster recovery
Dumped hard drives with US defense data have turned up for open sale in a West African market.
A team of Canadian journalism students bought a hard drive containing information on multi-million dollar contracts between military contractor Northrop Grumman and the Pentagon for just $40 in a market near Accra, Ghana. The exercise was part of shooting a documentary on e-waste by Vancouver journalism students, researching what happens to the West's discarded and donated electronics.
"You'd think a security contractor that constantly deals with very secret proprietary information would probably want to wipe their drives," Blake Sifton, one of the three graduate journalism students told CBC. The team bought seven hard drives at a market in the port of Tema, a major point of entry for electronic waste from Europe and North America into Africa.
Northrop Grumman is reported to be investigating how an unencrypted hard drive containing sensitive data on the firm ended up on an African market, in violation of its established kit disposal procedures.
"Based on the documents we were shown, we believe this hard drive may have been stolen after one of our asset-disposal vendors took possession of the unit," Northrop Grumman told CBC.
A documentary of the students' research, Ghana: Digital Dumping Ground, aired in the PBS program Frontline/World on Tuesday. The disposal of electronic waste is controlled by European and US regulations but spare - often broken - kit often finds its way to Africa and other regions of the developing world where it is dumped. Cannibalized parts end up on markets while the rest of the kit is piled together and burned.
Sifton recalled seeing seven fires spewing "black, sticky, acrid smoke" at one Ghanian dump. "The ground is just scorched absolutely everywhere. Everywhere you walk, there's shards of plastic and metal and glass protruding from the ground."
The fires are used to extract scrap metal, valued at just 50 cents a kilogram, which locals use to scratch out a meager existence. It's the effect on the local environment and people of the West's throw-away culture around electronic kit - rather than the information security element, which is well understood - that Sifton and his colleagues are trying to highlight.
Sifton added that he did visit universities in Ghana supplied with computers donated from the West that would have otherwise been unaffordable. ®
COMMENTS
Fail to read often?
The information is about the contracts ... agreed. Most contracts I've seen contain sensitive information like (RFQ - Request for Quotes) for a financial reference along with the necessary engineering prints and processes required for a company to analyze during their bidding procedures.
Why attempt to wipe the disk at all? For security, just scrap the disk, cut and shred it for recycling. The technology will be old and obsolete soon enough.
@Clint and John: Fail to read often?
It said the information was about the contracts, not the classified material itself. Information about the contracts is rarely classified secret or better by the government. From the context of the article, it isn't even clear that it is government sensitive (aka 'For Governmental Use Only'), not company sensitive. As such it needn't be encrypted or require clearance.
AC 25-06-09 20:25 is closet to what ought to happen here. To be really secure the company has to wipe the disks before they leave the premises. That being said, there are reputable companies that are engaged solely in the secure destruction of classified hard drives. The gear to degauss then shred hard drives is pretty expensive. It is more efficient for most companies to contract to them for the certified destruction of classified materials. But such companies themselves ought to be secure against the kind of theft NG is alleging is the cause of the drive being available.
Still it is an Epic Fail by NG, becauase ultimately, they are responsible for the safety of the data, and that responsibility is non-transferable.
well
"I wonder why [the waste disposal] bit was never picked up by article on here ...."
Because there can be no disagreement that the waste disposal situation is a complete shitshow and it's (hopefully) not something that needs any debate?
IT infrastructure monitoring strategies
Agentless Backup is Not a Myth
Top 10 SIEM implementer’s checklist
Steps to Take Before Choosing a Business Continuity Partner
Requirements Checklist for Choosing a Cloud Backup and Recovery Service Provider
