Missile data, medical records found on discarded hard disks

A third (34 per cent) of discarded hard disk drives still contain confidential data, according to a new study which unearthed copies of hospital records and sensitive military information on eBayed kit.

The study, sponsored by BT and Sims Lifecycle Services and run by the computer science labs at University of Glamorgan in Wales, Edith Cowan University in Australia and Longwood University in the US, also found network data and security logs from the German Embassy in Paris on one purchased drive.

Researchers bought 300 drives from eBay, other auction sites, second-hand stalls and car boot sales.

A disk bought on eBay contained details of test launch routines for the THAAD (Terminal High Altitude Area Defence) ground to air missile defence system. The same disk also held information belonging to the system’s manufacturer, Lockheed Martin, including blueprints of facilities and personal data on workers, including social security numbers.

Lockheed Martin denies that the disk came from it. The arm manufacturer has launched an investigation that aims to uncover just how the sensitive data might have been wound up on the disk.

Two discs bought in the UK apparently came from Lanarkshire NHS Trust, including patient medical records, images of X-rays and staff letters. Lanarkshire NHS Trust runs the Monklands and Hairmyres hospitals.

In Australia, the exercise turned up a disk from a nursing home that contained pictures of actual patients and their wound photos, along with patient details.

A hard disk from a US bank contained account numbers and details of plans for a $50bn currency exchange through Spain. Details of business transactions between the bank and organisations in Venezuela, Tunisia and Nigeria were also included.

Correspondence between a member of the Federal Reserve Board and the unnamed banks revealed that one of the deals was already under scrutiny by the European Central Bank, and that federal investigators were also taking an interest.

Yet another disk contained business plans about a well known UK-based fashion company. The same disk contained customer details and discount codes. Finally still yet another disk contained corporate design plans from a major motor manufacturing company. You get the idea.

The University of Glamorgan has now been running the survey for five years, in which time the volume of drives containing sensitive data has fallen from a half to little over a third. But the actual volume of data potentially exposed has increased markedly, alongside the potential sensitivity of that data.

"If military secrets are thrown away then anything can be," Jon Godfrey of Sims Recycling Solutions, which provide secure data destruction services, told El Reg. "Organisations spend millions on data security products such as firewalls to protect data but fail to think about discarded data.

"Residual data can still be accessed years after the equipment has been discarded and in the wrong hands could have not only financial consequences but potential implications for national security. It is essential that organisations destroy data via a professional and secure data destruction system or through physical destruction, before passing the equipment for secondary use."

The data destruction problem extends beyond computer hard disks to a growing diversity of devices, such as mobile phones, MP3 players, SatNavs, printers and even set top boxes. Each can hold a "snapshot of our lives" containing data that is finding its way to China, Africa and Eastern Europe. For example, second-hand BlackBerries containing data are on sale for a premium in Nigerian street markets. ®